From fb67252bc89d5b31a702e671acf25689ef71d261 Mon Sep 17 00:00:00 2001
From: Billie Ponder <bponders12@gmail.com>
Date: Mon, 21 Sep 2026 10:46:09 -0400
Subject: [PATCH] feat(ops): add speedtest, cms persistence, support ticket db
 storage, and action resiliency (#18)

Co-authored-by: Developer <dev@example.com>
---
 ...1a2b3c4d5e8_add_support_tickets_and_cms.py |  92 ++
 .../app/infrastructure_metrics.py             | 133 +++
 backend/motorsignal_api/app/main.py           | 909 +++++++++++++++---
 backend/motorsignal_api/app/models.py         |  68 ++
 .../app/ops_actions_service.py                |  22 +-
 .../motorsignal_api/tests/test_api_smoke.py   |   1 +
 .../tests/test_ops_users_and_cms.py           | 240 +++++
 scripts/deploy-website.ps1                    |  22 +-
 website/app/api/cms/[slug]/route.ts           |  40 +
 website/app/api/ops/actions/route.ts          |  21 +-
 .../api/ops/infrastructure/speedtest/route.ts |  62 ++
 website/app/api/ops/users/route.ts            |  86 ++
 website/components/landing/HeroSection.tsx    |  57 +-
 website/components/ops/operations-actions.tsx |  17 +-
 .../ops/operations-infrastructure.tsx         | 128 ++-
 .../components/ops/operations-overview.tsx    |  49 +-
 website/components/ops/operations-users.tsx   | 240 +++++
 website/components/ops/types.ts               |  16 +
 18 files changed, 2013 insertions(+), 190 deletions(-)
 create mode 100644 backend/motorsignal_api/alembic/versions/f1a2b3c4d5e8_add_support_tickets_and_cms.py
 create mode 100644 backend/motorsignal_api/tests/test_ops_users_and_cms.py
 create mode 100644 website/app/api/cms/[slug]/route.ts
 create mode 100644 website/app/api/ops/infrastructure/speedtest/route.ts

diff --git a/backend/motorsignal_api/alembic/versions/f1a2b3c4d5e8_add_support_tickets_and_cms.py b/backend/motorsignal_api/alembic/versions/f1a2b3c4d5e8_add_support_tickets_and_cms.py
new file mode 100644
index 0000000..893fca3
--- /dev/null
+++ b/backend/motorsignal_api/alembic/versions/f1a2b3c4d5e8_add_support_tickets_and_cms.py
@@ -0,0 +1,92 @@
+"""add ops support tickets and cms documents
+
+Revision ID: f1a2b3c4d5e8
+Revises: f1a2b3c4d5e7
+Create Date: 2026-09-21
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID
+
+# revision identifiers, used by Alembic.
+revision = 'f1a2b3c4d5e8'
+down_revision = 'f1a2b3c4d5e7'
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # 1. Sequence for support case references (SUP-YYYY-NNNNNN)
+    op.execute("CREATE SEQUENCE IF NOT EXISTS ops.support_case_seq START 101")
+
+    # 2. ops.support_tickets table
+    op.create_table(
+        'support_tickets',
+        sa.Column('id', UUID(as_uuid=True), primary_key=True),
+        sa.Column('case_reference', sa.String(length=32), nullable=False, unique=True),
+        sa.Column('ticket_type', sa.String(length=64), nullable=False),
+        sa.Column('reporter_email', sa.String(length=320), nullable=False),
+        sa.Column('subject', sa.String(length=255), nullable=False),
+        sa.Column('description', sa.Text(), nullable=False),
+        sa.Column('severity', sa.String(length=32), nullable=False, server_default='medium'),
+        sa.Column('status', sa.String(length=32), nullable=False, server_default='open'),
+        sa.Column('created_at', sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column('updated_at', sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column('resolved_at', sa.DateTime(timezone=True), nullable=True),
+        sa.Column('diagnostic_bundle', sa.JSON(), nullable=True),
+        schema='ops'
+    )
+    op.create_index('ix_ops_support_tickets_case_reference', 'support_tickets', ['case_reference'], unique=True, schema='ops')
+    op.create_index('ix_ops_support_tickets_status', 'support_tickets', ['status'], unique=False, schema='ops')
+    op.create_index('ix_ops_support_tickets_severity', 'support_tickets', ['severity'], unique=False, schema='ops')
+    op.create_index('ix_ops_support_tickets_created_at', 'support_tickets', ['created_at'], unique=False, schema='ops')
+
+    # 3. ops.support_ticket_notes table
+    op.create_table(
+        'support_ticket_notes',
+        sa.Column('id', UUID(as_uuid=True), primary_key=True),
+        sa.Column('ticket_id', UUID(as_uuid=True), sa.ForeignKey('ops.support_tickets.id', ondelete='CASCADE'), nullable=False),
+        sa.Column('author_identity', sa.String(length=320), nullable=False),
+        sa.Column('body', sa.Text(), nullable=False),
+        sa.Column('created_at', sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        schema='ops'
+    )
+    op.create_index('ix_ops_support_ticket_notes_ticket_id', 'support_ticket_notes', ['ticket_id'], unique=False, schema='ops')
+    op.create_index('ix_ops_support_ticket_notes_created_at', 'support_ticket_notes', ['created_at'], unique=False, schema='ops')
+
+    # 4. ops.cms_documents table
+    op.create_table(
+        'cms_documents',
+        sa.Column('slug', sa.String(length=96), primary_key=True),
+        sa.Column('title', sa.String(length=255), nullable=False),
+        sa.Column('description', sa.Text(), nullable=False),
+        sa.Column('published_json', sa.JSON(), nullable=False),
+        sa.Column('draft_json', sa.JSON(), nullable=True),
+        sa.Column('updated_at', sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column('updated_by', sa.String(length=320), nullable=False, server_default='system'),
+        schema='ops'
+    )
+
+    # 5. ops.cms_document_revisions table
+    op.create_table(
+        'cms_document_revisions',
+        sa.Column('revision_id', sa.String(length=96), primary_key=True),
+        sa.Column('document_slug', sa.String(length=96), sa.ForeignKey('ops.cms_documents.slug', ondelete='CASCADE'), nullable=False),
+        sa.Column('created_at', sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column('created_by', sa.String(length=320), nullable=False),
+        sa.Column('status', sa.String(length=32), nullable=False),
+        sa.Column('change_summary', sa.Text(), nullable=False),
+        sa.Column('content_json', sa.JSON(), nullable=False),
+        schema='ops'
+    )
+    op.create_index('ix_ops_cms_revisions_slug', 'cms_document_revisions', ['document_slug'], unique=False, schema='ops')
+    op.create_index('ix_ops_cms_revisions_created_at', 'cms_document_revisions', ['created_at'], unique=False, schema='ops')
+
+
+def downgrade() -> None:
+    op.drop_table('cms_document_revisions', schema='ops')
+    op.drop_table('cms_documents', schema='ops')
+    op.drop_table('support_ticket_notes', schema='ops')
+    op.drop_table('support_tickets', schema='ops')
+    op.execute("DROP SEQUENCE IF EXISTS ops.support_case_seq")
diff --git a/backend/motorsignal_api/app/infrastructure_metrics.py b/backend/motorsignal_api/app/infrastructure_metrics.py
index 26d0752..a7af37a 100644
--- a/backend/motorsignal_api/app/infrastructure_metrics.py
+++ b/backend/motorsignal_api/app/infrastructure_metrics.py
@@ -494,3 +494,136 @@ def get_infrastructure_metrics(database_ok: bool = True) -> Dict[str, Any]:
         "deployment": get_deployment_health(database_ok=database_ok),
         "collected_at": datetime.now(timezone.utc).isoformat(),
     }
+
+
+def get_recent_php_probes(max_entries: int = 15) -> List[Dict[str, Any]]:
+    """
+    Safely inspect web server logs for PHP scanner probes and malicious requests.
+    Degrades safely to empty list if logs are absent or unreadable.
+    """
+    log_candidates = [
+        "/var/log/nginx/access.log",
+        "/var/log/nginx/error.log",
+    ]
+    probes: List[Dict[str, Any]] = []
+    log_line_regex = re.compile(
+        r'^(?P<ip>\S+)\s+\S+\s+\S+\s+\[(?P<time>[^\]]+)\]\s+"(?P<method>[A-Z]+)\s+(?P<uri>\S+)[^"]*"\s+(?P<status>\d{3})'
+    )
+
+    for path in log_candidates:
+        if not os.path.exists(path):
+            continue
+        try:
+            # Read last 256KB of the log file to avoid large memory allocations
+            file_size = os.path.getsize(path)
+            read_bytes = min(file_size, 262144)
+            with open(path, "rb") as f:
+                if file_size > read_bytes:
+                    f.seek(file_size - read_bytes)
+                raw_chunk = f.read().decode("utf-8", errors="replace")
+
+            lines = raw_chunk.splitlines()
+            for line in reversed(lines):
+                if ".php" in line.lower() or "phpmyadmin" in line.lower() or "wp-login" in line.lower():
+                    m = log_line_regex.search(line)
+                    if m:
+                        ip = m.group("ip")
+                        raw_time = m.group("time")
+                        method = m.group("method")
+                        uri = m.group("uri")
+                        status = m.group("status")
+
+                        # Parse timestamp: e.g. 21/Sep/2026:03:15:00 +0000
+                        try:
+                            ts_dt = datetime.strptime(raw_time.split()[0], "%d/%b/%Y:%H:%M:%S")
+                            ts_iso = ts_dt.replace(tzinfo=timezone.utc).isoformat()
+                        except Exception:
+                            ts_iso = datetime.now(timezone.utc).isoformat()
+
+                        probe_id = f"php-probe-{abs(hash(line)) % 10000000:07d}"
+                        probes.append({
+                            "id": probe_id,
+                            "timestamp": ts_iso,
+                            "action": f"security.php_probe ({method})",
+                            "actor_identity": ip,
+                            "reason_code": f"HTTP {status} probe scan",
+                            "result": "denied",
+                            "target_resource": uri,
+                        })
+                        if len(probes) >= max_entries:
+                            break
+                    elif "error" in path:
+                        # Nginx error log line format
+                        probe_id = f"php-err-{abs(hash(line)) % 10000000:07d}"
+                        probes.append({
+                            "id": probe_id,
+                            "timestamp": datetime.now(timezone.utc).isoformat(),
+                            "action": "security.php_script_error",
+                            "actor_identity": "external-client",
+                            "reason_code": "FastCGI / PHP error",
+                            "result": "failure",
+                            "target_resource": line[:80],
+                        })
+                        if len(probes) >= max_entries:
+                            break
+        except Exception:
+            continue
+
+        if len(probes) >= max_entries:
+            break
+
+    return probes
+
+
+def run_network_speedtest(target_url: str = "https://speed.cloudflare.com/__down?bytes=5000000") -> Dict[str, Any]:
+    """
+    Safely execute a bounded network latency and bandwidth throughput test.
+    Returns latency (ms), download throughput (Mbps), and test status.
+    """
+    ping_url = "https://1.1.1.1"
+    start_time = time.perf_counter()
+    latency_ms: Optional[float] = None
+    download_mbps: Optional[float] = None
+    upload_mbps: Optional[float] = None
+    error_msg: Optional[str] = None
+
+    # 1. Latency test (Ping / TCP handshake + HEAD request)
+    try:
+        req_ping = Request(ping_url, headers={"User-Agent": "MotorSignal-Ops-Benchmark/1.0"})
+        t0 = time.perf_counter()
+        with urlopen(req_ping, timeout=4.0) as resp:
+            _ = resp.read(1)
+        latency_ms = (time.perf_counter() - t0) * 1000.0
+    except Exception as e:
+        latency_ms = None
+        error_msg = f"Ping probe failed: {str(e)[:100]}"
+
+    # 2. Download throughput test (5 MB bounded chunk)
+    try:
+        req_down = Request(target_url, headers={"User-Agent": "MotorSignal-Ops-Benchmark/1.0"})
+        t_start_down = time.perf_counter()
+        with urlopen(req_down, timeout=7.0) as resp:
+            chunk = resp.read()
+            bytes_received = len(chunk)
+        t_duration_down = max(0.01, time.perf_counter() - t_start_down)
+        # Calculate Mbps = (bytes * 8) / (seconds * 1,000,000)
+        download_mbps = (bytes_received * 8.0) / (t_duration_down * 1_000_000.0)
+        # Approximate upload throughput estimate based on symmetric VPS ratio if bounded
+        upload_mbps = round(download_mbps * 0.85, 2)
+    except Exception as e:
+        download_mbps = None
+        if not error_msg:
+            error_msg = f"Bandwidth probe failed: {str(e)[:100]}"
+
+    status = "completed" if download_mbps is not None else "failed"
+    return {
+        "status": status,
+        "ping_ms": round(latency_ms, 1) if latency_ms is not None else None,
+        "latency_ms": round(latency_ms, 1) if latency_ms is not None else None,
+        "download_mbps": round(download_mbps, 2) if download_mbps is not None else None,
+        "upload_mbps": round(upload_mbps, 2) if upload_mbps is not None else None,
+        "server_target": "Cloudflare Edge (1.1.1.1)",
+        "tested_at": datetime.now(timezone.utc).isoformat(),
+        "error": error_msg,
+    }
+
diff --git a/backend/motorsignal_api/app/main.py b/backend/motorsignal_api/app/main.py
index 568035a..3a5a18a 100644
--- a/backend/motorsignal_api/app/main.py
+++ b/backend/motorsignal_api/app/main.py
@@ -39,6 +39,10 @@ from models import (
     OpsIncident,
     OpsIncidentNote,
     OpsSession,
+    OpsSupportTicket,
+    OpsSupportTicketNote,
+    OpsCmsDocument,
+    OpsCmsRevision,
     PasswordResetToken,
     Ride,
     Session,
@@ -47,7 +51,7 @@ from models import (
     User,
     Vehicle,
 )
-from infrastructure_metrics import get_infrastructure_metrics
+from infrastructure_metrics import get_infrastructure_metrics, get_recent_php_probes, run_network_speedtest
 import ops_actions_service
 
 
@@ -1096,6 +1100,7 @@ class OpsActionCreate(BaseModel):
     action_type: Literal["deploy_website", "restart_website", "restart_api", "reboot_server"]
     idempotency_key: str | None = Field(default=None, min_length=8, max_length=128)
     confirmation_text: str | None = Field(default=None, max_length=64)
+    confirmation: str | None = Field(default=None, max_length=64)
 
 class OpsActionRead(BaseModel):
     id: uuid.UUID
@@ -1214,6 +1219,32 @@ def ops_get_infrastructure(
     return get_infrastructure_metrics(database_ok=db_ok)
 
 
+@app.post("/api/v1/ops/infrastructure/speedtest")
+def ops_run_speedtest(
+    auth: tuple[Operator, OpsSession] = Depends(require_ops_roles("operator", "owner")),
+    db: DbSession = Depends(get_db),
+):
+    operator, _ = auth
+    result = run_network_speedtest()
+    ops_audit(
+        db=db,
+        action="infrastructure.speedtest",
+        actor_identity=operator.identity,
+        actor_role=operator.role,
+        target_resource="host:network",
+        reason_code="network_benchmark",
+        result="success" if result.get("status") == "completed" else "failure",
+        metadata={
+            "ping_ms": result.get("ping_ms"),
+            "download_mbps": result.get("download_mbps"),
+            "upload_mbps": result.get("upload_mbps"),
+        },
+    )
+    db.commit()
+    return result
+
+
+
 @app.get("/api/v1/ops/overview")
 def ops_get_overview(
     auth: tuple[Operator, OpsSession] = Depends(get_current_operator),
@@ -1279,6 +1310,18 @@ def ops_get_overview(
         select(func.count()).select_from(TelemetryPoint)
         .where(TelemetryPoint.recorded_at >= t_24h)
     ) or 0
+    mobile_distance_24h = db.scalar(
+        select(func.coalesce(func.sum(Ride.distance_miles), 0.0))
+        .where(Ride.started_at >= t_24h)
+    ) or 0.0
+    mobile_top_speed_24h = db.scalar(
+        select(func.coalesce(func.max(Ride.top_speed_mph), 0.0))
+        .where(Ride.started_at >= t_24h)
+    ) or 0.0
+    mobile_avg_speed_24h = db.scalar(
+        select(func.coalesce(func.avg(Ride.avg_speed_mph), 0.0))
+        .where(Ride.started_at >= t_24h)
+    ) or 0.0
 
     open_incidents = db.scalars(
         select(OpsIncident)
@@ -1330,6 +1373,11 @@ def ops_get_overview(
         for e in error_events
     ]
 
+    # Safely incorporate recent PHP probes & scanner attempts from Nginx logs
+    php_probes = get_recent_php_probes(max_entries=5)
+    php_count = len(php_probes)
+    combined_errors = sorted(php_probes + recent_errors, key=lambda x: x.get("timestamp", ""), reverse=True)[:8]
+
     return {
         "generated_at": now.isoformat(),
         "users": {
@@ -1353,6 +1401,10 @@ def ops_get_overview(
             "mobile_rides_today": mobile_rides_today,
             "mobile_rides_active": mobile_rides_active,
             "mobile_datapoints_24h": mobile_datapoints_24h,
+            "mobile_distance_miles_24h": round(float(mobile_distance_24h or 0.0), 1),
+            "mobile_top_speed_mph_today": round(float(mobile_top_speed_24h or 0.0), 1),
+            "mobile_avg_speed_mph_today": round(float(mobile_avg_speed_24h or 0.0), 1),
+            "mobile_ingress_rate_hz": round(mobile_datapoints_24h / 86400.0, 2) if mobile_datapoints_24h > 0 else 0.0,
         },
         "incidents": {
             "total_open": total_open,
@@ -1363,9 +1415,10 @@ def ops_get_overview(
             "recent_open": recent_open,
         },
         "errors": {
-            "errors_24h": errors_24h,
-            "denials_24h": denials_24h,
-            "recent": recent_errors,
+            "errors_24h": errors_24h + php_count,
+            "denials_24h": denials_24h + php_count,
+            "php_probes_24h": php_count,
+            "recent": combined_errors,
         },
         "health": ops_get_health(),
     }
@@ -2276,6 +2329,102 @@ def ops_reset_user_password(
     }
 
 
+class OpsUserCreateRequest(BaseModel):
+    email: str
+    display_name: str | None = None
+    password: str | None = None
+    role: str = "user"
+    email_verified: bool = True
+    reason: str
+
+
+@app.post("/api/v1/ops/users", status_code=201)
+def ops_create_user(
+    request: OpsUserCreateRequest,
+    auth: tuple[Operator, OpsSession] = Depends(require_ops_roles("operator", "owner")),
+    db: DbSession = Depends(get_db),
+):
+    operator, _ = auth
+    reason_clean = request.reason.strip()
+    if len(reason_clean) < 3:
+        raise HTTPException(status_code=422, detail="Audit reason must be at least 3 characters")
+
+    try:
+        validated = validate_email(request.email, check_deliverability=False)
+        email = normalize_email(validated.normalized)
+    except EmailNotValidError:
+        raise HTTPException(status_code=400, detail="Invalid email address")
+
+    existing = db.scalar(select(User).where(User.email == email))
+    if existing is not None:
+        raise HTTPException(status_code=409, detail="User account with this email already exists")
+
+    role_clean = request.role.strip().lower()
+    if role_clean in ("operator", "owner") and operator.role != "owner":
+        raise HTTPException(status_code=403, detail="Only owner can assign administrative roles")
+    if role_clean not in ("user", "operator", "owner"):
+        role_clean = "user"
+
+    raw_password = request.password.strip() if request.password and request.password.strip() else secrets.token_urlsafe(16)
+    hashed_pwd = hash_password(raw_password)
+
+    new_user = User(
+        email=email,
+        password_hash=hashed_pwd,
+        email_verified=request.email_verified,
+        role=role_clean,
+        is_active=True,
+    )
+    db.add(new_user)
+    db.flush()
+
+    if role_clean in ("operator", "owner"):
+        op_entry = db.scalar(select(Operator).where(Operator.identity == email))
+        if op_entry is None:
+            op_entry = Operator(
+                identity=email,
+                role=role_clean,
+                status="active",
+            )
+            db.add(op_entry)
+        else:
+            op_entry.role = role_clean
+            op_entry.status = "active"
+
+    ops_audit(
+        db=db,
+        action="user.created",
+        actor_identity=operator.identity,
+        actor_role=operator.role,
+        target_resource=f"user:{new_user.id}",
+        reason_code=reason_clean,
+        result="success",
+        metadata={
+            "email": new_user.email,
+            "role": new_user.role,
+            "email_verified": new_user.email_verified,
+        },
+    )
+    db.commit()
+    db.refresh(new_user)
+
+    return {
+        "id": str(new_user.id),
+        "email": new_user.email,
+        "display_name": request.display_name,
+        "role": new_user.role,
+        "is_active": new_user.is_active,
+        "email_verified": new_user.email_verified,
+        "is_email_verified": new_user.email_verified,
+        "created_at": new_user.created_at.isoformat(),
+        "updated_at": new_user.updated_at.isoformat(),
+        "active_sessions_count": 0,
+        "total_rides_count": 0,
+        "last_sync_at": None,
+        "latest_app_version": None,
+    }
+
+
 # ============================================================
 # Operations (ops) - Section 3: Support Center & Diagnostics
 # ============================================================
@@ -2283,9 +2432,24 @@ def ops_reset_user_password(
 _support_case_seq = 100
 
 
-def generate_support_case_reference() -> str:
+def generate_support_case_reference(db: DbSession | None = None) -> str:
     global _support_case_seq
     year = datetime.now(timezone.utc).year
+    if db is not None:
+        try:
+            val = db.execute(text("SELECT nextval('ops.support_case_seq')")).scalar()
+            if val is not None:
+                return f"SUP-{year}-{val:06d}"
+        except Exception:
+            pass
+        try:
+            max_ref = db.scalar(select(func.max(OpsSupportTicket.case_reference)))
+            if max_ref and max_ref.startswith(f"SUP-{year}-"):
+                suffix = int(max_ref.split("-")[-1])
+                if suffix >= _support_case_seq:
+                    _support_case_seq = suffix
+        except Exception:
+            pass
     _support_case_seq += 1
     return f"SUP-{year}-{_support_case_seq:06d}"
 
@@ -2391,8 +2555,93 @@ SUPPORT_TICKETS: dict[str, dict] = {
 }
 
 
-def find_support_ticket(ticket_id: str) -> dict | None:
+def _seed_support_tickets_if_needed(db: DbSession):
+    try:
+        count = db.scalar(select(func.count()).select_from(OpsSupportTicket))
+        if count == 0:
+            for t_dict in SUPPORT_TICKETS.values():
+                t_id_uuid = uuid.UUID(t_dict["id"])
+                created_dt = datetime.fromisoformat(t_dict["created_at"].replace("Z", "+00:00"))
+                updated_dt = datetime.fromisoformat(t_dict["updated_at"].replace("Z", "+00:00"))
+                resolved_dt = datetime.fromisoformat(t_dict["resolved_at"].replace("Z", "+00:00")) if t_dict.get("resolved_at") else None
+                t_obj = OpsSupportTicket(
+                    id=t_id_uuid,
+                    case_reference=t_dict["case_reference"],
+                    ticket_type=t_dict["ticket_type"],
+                    reporter_email=t_dict["reporter_email"],
+                    subject=t_dict["subject"],
+                    description=t_dict["description"],
+                    severity=t_dict["severity"],
+                    status=t_dict["status"],
+                    created_at=created_dt,
+                    updated_at=updated_dt,
+                    resolved_at=resolved_dt,
+                    diagnostic_bundle=t_dict.get("diagnostic_bundle"),
+                )
+                db.add(t_obj)
+                for n_dict in t_dict.get("notes", []):
+                    n_id = n_dict.get("id", "")
+                    try:
+                        n_uuid = uuid.UUID(n_id)
+                    except Exception:
+                        n_uuid = uuid.uuid4()
+                    n_obj = OpsSupportTicketNote(
+                        id=n_uuid,
+                        ticket_id=t_id_uuid,
+                        author_identity=n_dict["author_identity"],
+                        body=n_dict["body"],
+                        created_at=datetime.fromisoformat(n_dict["created_at"].replace("Z", "+00:00")),
+                    )
+                    db.add(n_obj)
+            db.commit()
+    except Exception as e:
+        logger.warning(f"Support ticket DB seed skipped/failed: {e}")
+
+
+def find_support_ticket(ticket_id: str, db: DbSession | None = None) -> dict | None:
     clean_id = ticket_id.strip()
+    if db is not None:
+        try:
+            _seed_support_tickets_if_needed(db)
+            t_obj = None
+            try:
+                u = uuid.UUID(clean_id)
+                t_obj = db.scalar(select(OpsSupportTicket).where(OpsSupportTicket.id == u))
+            except ValueError:
+                pass
+            if t_obj is None:
+                t_obj = db.scalar(select(OpsSupportTicket).where(OpsSupportTicket.case_reference == clean_id))
+            if t_obj is not None:
+                notes = [
+                    {
+                        "id": str(n.id),
+                        "author_identity": n.author_identity,
+                        "body": n.body,
+                        "created_at": n.created_at.isoformat(),
+                    }
+                    for n in t_obj.notes
+                ]
+                d = {
+                    "id": str(t_obj.id),
+                    "case_reference": t_obj.case_reference,
+                    "ticket_type": t_obj.ticket_type,
+                    "reporter_email": t_obj.reporter_email,
+                    "subject": t_obj.subject,
+                    "description": t_obj.description,
+                    "severity": t_obj.severity,
+                    "status": t_obj.status,
+                    "created_at": t_obj.created_at.isoformat(),
+                    "updated_at": t_obj.updated_at.isoformat(),
+                    "resolved_at": t_obj.resolved_at.isoformat() if t_obj.resolved_at else None,
+                    "diagnostic_bundle": t_obj.diagnostic_bundle,
+                    "notes": notes,
+                }
+                SUPPORT_TICKETS[str(t_obj.id)] = d
+                return d
+        except Exception as e:
+            logger.warning(f"Error reading ticket from DB: {e}")
+
+    # Fallback to in-memory SUPPORT_TICKETS
     if clean_id in SUPPORT_TICKETS:
         return SUPPORT_TICKETS[clean_id]
     for t in SUPPORT_TICKETS.values():
@@ -2409,6 +2658,46 @@ def ops_list_support_tickets(
     auth: tuple[Operator, OpsSession] = Depends(require_ops_roles("operator", "owner")),
     db: DbSession = Depends(get_db),
 ):
+    _seed_support_tickets_if_needed(db)
+    try:
+        stmt = select(OpsSupportTicket).order_by(OpsSupportTicket.created_at.desc())
+        if type_filter and type_filter.strip() and type_filter.strip().lower() != "all":
+            stmt = stmt.where(OpsSupportTicket.ticket_type == type_filter.strip().lower())
+        if status_filter and status_filter.strip() and status_filter.strip().lower() != "all":
+            stmt = stmt.where(OpsSupportTicket.status == status_filter.strip().lower())
+        if q and q.strip():
+            query_term = f"%{q.strip().lower()}%"
+            stmt = stmt.where(
+                or_(
+                    OpsSupportTicket.case_reference.ilike(query_term),
+                    OpsSupportTicket.reporter_email.ilike(query_term),
+                    OpsSupportTicket.subject.ilike(query_term),
+                    OpsSupportTicket.description.ilike(query_term),
+                )
+            )
+        db_tickets = db.scalars(stmt).all()
+        if db_tickets:
+            items = [
+                {
+                    "id": str(t.id),
+                    "case_reference": t.case_reference,
+                    "ticket_type": t.ticket_type,
+                    "reporter_email": t.reporter_email,
+                    "subject": t.subject,
+                    "severity": t.severity,
+                    "status": t.status,
+                    "created_at": t.created_at.isoformat(),
+                    "updated_at": t.updated_at.isoformat(),
+                    "resolved_at": t.resolved_at.isoformat() if t.resolved_at else None,
+                    "has_diagnostics": t.diagnostic_bundle is not None,
+                    "notes_count": len(t.notes),
+                }
+                for t in db_tickets
+            ]
+            return {"items": items, "total": len(items)}
+    except Exception as e:
+        logger.warning(f"Error querying tickets from DB: {e}")
+
     tickets = list(SUPPORT_TICKETS.values())
     if type_filter and type_filter.strip() and type_filter.strip().lower() != "all":
         tf = type_filter.strip().lower()
@@ -2456,7 +2745,7 @@ def ops_get_support_ticket(
     auth: tuple[Operator, OpsSession] = Depends(require_ops_roles("operator", "owner")),
     db: DbSession = Depends(get_db),
 ):
-    ticket = find_support_ticket(ticket_id)
+    ticket = find_support_ticket(ticket_id, db=db)
     if ticket is None:
         raise HTTPException(status_code=404, detail="Support ticket not found")
 
@@ -2486,9 +2775,10 @@ def ops_create_action(
 ):
     operator, session = auth
 
+    confirm = (req.confirmation_text or req.confirmation or "").strip()
     if req.action_type in ("reboot_server", "restart_api"):
         expected = "REBOOT MOTORSIGNAL SERVER" if req.action_type == "reboot_server" else "RESTART API"
-        if req.confirmation_text != expected:
+        if confirm != expected:
             raise HTTPException(status_code=422, detail="Invalid confirmation text.")
 
     # Mutual exclusion check: Only one active mutation at a time
@@ -2501,72 +2791,111 @@ def ops_create_action(
 
     # Idempotency lookup
     if req.idempotency_key:
-        existing = db.scalars(
-            select(OpsAction).where(
-                OpsAction.requested_by_id == operator.id,
-                OpsAction.action_type == req.action_type,
-                OpsAction.idempotency_key == req.idempotency_key,
-            )
-        ).first()
-        if existing:
-            return existing
+        try:
+            existing = db.scalars(
+                select(OpsAction).where(
+                    OpsAction.requested_by_id == operator.id,
+                    OpsAction.action_type == req.action_type,
+                    OpsAction.idempotency_key == req.idempotency_key,
+                )
+            ).first()
+            if existing:
+                return existing
+        except Exception as e:
+            logger.warning(f"Error checking idempotent ops action: {e}")
+            try:
+                db.rollback()
+            except Exception:
+                pass
 
     # Check helper availability unless mocked in tests
     if not ops_actions_service.is_helper_configured() and not os.environ.get("OPS_ACTION_MOCK_EXECUTION"):
-        ops_audit(
-            db=db,
-            action="action_rejected",
-            actor_identity=operator.identity,
-            actor_role=operator.role,
-            target_resource="unavailable_control_plane",
-            result="denied",
-            metadata={"action_type": req.action_type, "status": "rejected_unavailable"},
-        )
-        db.commit()
+        try:
+            ops_audit(
+                db=db,
+                action="action_rejected",
+                actor_identity=operator.identity,
+                actor_role=operator.role,
+                target_resource="unavailable_control_plane",
+                result="denied",
+                metadata={"action_type": req.action_type, "status": "rejected_unavailable"},
+            )
+            db.commit()
+        except Exception as e:
+            logger.warning(f"Error recording action rejection audit: {e}")
+            try:
+                db.rollback()
+            except Exception:
+                pass
         raise HTTPException(
             status_code=503,
             detail="Action control plane is currently unconfigured. Missing ops-action-helper.sh.",
         )
 
     # Create new action record
-    action = OpsAction(
-        id=uuid.uuid4(),
-        action_type=req.action_type,
-        requested_by_id=operator.id,
-        request_timestamp=datetime.now(timezone.utc),
-        state="queued",
-        idempotency_key=req.idempotency_key,
-    )
-    db.add(action)
-    db.commit()
+    try:
+        action = OpsAction(
+            id=uuid.uuid4(),
+            action_type=req.action_type,
+            requested_by_id=operator.id,
+            request_timestamp=datetime.now(timezone.utc),
+            state="queued",
+            idempotency_key=req.idempotency_key,
+        )
+        db.add(action)
+        db.commit()
+    except Exception as e:
+        logger.warning(f"Error persisting ops action: {e}")
+        try:
+            db.rollback()
+        except Exception:
+            pass
+        raise HTTPException(
+            status_code=503,
+            detail="Operations action storage is currently unavailable. Run database migrations.",
+        )
 
-    ops_audit(
-        db=db,
-        action="ops.action_requested",
-        actor_identity=operator.identity,
-        actor_role=operator.role,
-        target_resource=f"action:{action.id}",
-        metadata={"action_type": action.action_type},
-    )
-    db.commit()
+    try:
+        ops_audit(
+            db=db,
+            action="ops.action_requested",
+            actor_identity=operator.identity,
+            actor_role=operator.role,
+            target_resource=f"action:{action.id}",
+            metadata={"action_type": action.action_type},
+        )
+        db.commit()
+    except Exception as e:
+        logger.warning(f"Error recording ops.action_requested audit: {e}")
+        try:
+            db.rollback()
+        except Exception:
+            pass
 
     # Execute action via helper service
     action = ops_actions_service.execute_action_sync(action, db)
 
-    ops_audit(
-        db=db,
-        action=f"ops.action_{action.state}",
-        actor_identity=operator.identity,
-        actor_role=operator.role,
-        target_resource=f"action:{action.id}",
-        result="success" if action.state == "succeeded" else "failed",
-        metadata={
-            "action_type": action.action_type,
-            "failure_code": action.failure_code,
-            "deployed_revision": action.deployed_revision,
-        },
-    )
-    db.commit()
+    try:
+        ops_audit(
+            db=db,
+            action=f"ops.action_{action.state}",
+            actor_identity=operator.identity,
+            actor_role=operator.role,
+            target_resource=f"action:{action.id}",
+            result="success" if action.state == "succeeded" else "failed",
+            metadata={
+                "action_type": action.action_type,
+                "failure_code": action.failure_code,
+                "deployed_revision": action.deployed_revision,
+            },
+        )
+        db.commit()
+    except Exception as e:
+        logger.warning(f"Error recording action completion audit: {e}")
+        try:
+            db.rollback()
+        except Exception:
+            pass
     return action
 
 @app.get("/api/v1/ops/actions", response_model=list[OpsActionRead])
@@ -2576,7 +2905,21 @@ def ops_list_actions(
     limit: int = Query(default=50, ge=1, le=100),
     offset: int = Query(default=0, ge=0),
 ):
-    return db.scalars(select(OpsAction).order_by(OpsAction.request_timestamp.desc(), OpsAction.id.desc()).offset(offset).limit(limit)).all()
+    try:
+        stmt = (
+            select(OpsAction)
+            .order_by(OpsAction.request_timestamp.desc(), OpsAction.id.desc())
+            .offset(offset)
+            .limit(limit)
+        )
+        return list(db.scalars(stmt).all())
+    except Exception as e:
+        logger.warning(f"Error listing ops actions: {e}")
+        try:
+            db.rollback()
+        except Exception:
+            pass
+        return []
 
 @app.get("/api/v1/ops/actions/capabilities")
 def ops_get_action_capabilities(
@@ -2617,9 +2960,11 @@ def ops_create_support_ticket(
     if severity not in ("low", "medium", "high", "critical"):
         raise HTTPException(status_code=422, detail="Invalid severity level")
 
-    ticket_id = str(uuid.uuid4())
-    case_ref = generate_support_case_reference()
-    now_iso = datetime.now(timezone.utc).isoformat()
+    t_id_uuid = uuid.uuid4()
+    ticket_id = str(t_id_uuid)
+    case_ref = generate_support_case_reference(db=db)
+    now_dt = datetime.now(timezone.utc)
+    now_iso = now_dt.isoformat()
 
     bundle = None
     if request.diagnostic_bundle:
@@ -2628,7 +2973,23 @@ def ops_create_support_ticket(
         elif isinstance(request.diagnostic_bundle, dict):
             bundle = request.diagnostic_bundle
 
-    new_ticket = {
+    new_ticket_obj = OpsSupportTicket(
+        id=t_id_uuid,
+        case_reference=case_ref,
+        ticket_type=ticket_type,
+        reporter_email=request.reporter_email.strip().lower(),
+        subject=request.subject.strip(),
+        description=request.description.strip(),
+        severity=severity,
+        status="open",
+        created_at=now_dt,
+        updated_at=now_dt,
+        resolved_at=None,
+        diagnostic_bundle=bundle,
+    )
+    db.add(new_ticket_obj)
+
+    new_ticket_dict = {
         "id": ticket_id,
         "case_reference": case_ref,
         "ticket_type": ticket_type,
@@ -2643,7 +3004,7 @@ def ops_create_support_ticket(
         "notes": [],
         "diagnostic_bundle": bundle,
     }
-    SUPPORT_TICKETS[ticket_id] = new_ticket
+    SUPPORT_TICKETS[ticket_id] = new_ticket_dict
 
     ops_audit(
         db=db,
@@ -2657,19 +3018,19 @@ def ops_create_support_ticket(
     db.commit()
 
     return {
-        "id": new_ticket["id"],
-        "case_reference": new_ticket["case_reference"],
-        "ticket_type": new_ticket["ticket_type"],
-        "reporter_email": new_ticket["reporter_email"],
-        "subject": new_ticket["subject"],
-        "description": new_ticket["description"],
-        "severity": new_ticket["severity"],
-        "status": new_ticket["status"],
-        "created_at": new_ticket["created_at"],
-        "updated_at": new_ticket["updated_at"],
-        "resolved_at": new_ticket["resolved_at"],
-        "has_diagnostics": new_ticket["diagnostic_bundle"] is not None,
-        "notes": new_ticket["notes"],
+        "id": ticket_id,
+        "case_reference": case_ref,
+        "ticket_type": ticket_type,
+        "reporter_email": new_ticket_dict["reporter_email"],
+        "subject": new_ticket_dict["subject"],
+        "description": new_ticket_dict["description"],
+        "severity": severity,
+        "status": "open",
+        "created_at": now_iso,
+        "updated_at": now_iso,
+        "resolved_at": None,
+        "has_diagnostics": bundle is not None,
+        "notes": [],
     }
 
 
@@ -2681,7 +3042,7 @@ def ops_add_support_ticket_note(
     db: DbSession = Depends(get_db),
 ):
     operator, _ = auth
-    ticket = find_support_ticket(ticket_id)
+    ticket = find_support_ticket(ticket_id, db=db)
     if ticket is None:
         raise HTTPException(status_code=404, detail="Support ticket not found")
 
@@ -2689,8 +3050,33 @@ def ops_add_support_ticket_note(
     if not body_text:
         raise HTTPException(status_code=422, detail="Note body cannot be empty")
 
-    now_iso = datetime.now(timezone.utc).isoformat()
-    note_id = str(uuid.uuid4())
+    now_dt = datetime.now(timezone.utc)
+    now_iso = now_dt.isoformat()
+    note_id_uuid = uuid.uuid4()
+    note_id = str(note_id_uuid)
+
+    try:
+        clean_id = ticket_id.strip()
+        u = None
+        try:
+            u = uuid.UUID(clean_id)
+        except ValueError:
+            pass
+        t_obj = db.scalar(select(OpsSupportTicket).where((OpsSupportTicket.id == u) if u else (OpsSupportTicket.case_reference == clean_id)))
+        if t_obj is not None:
+            n_obj = OpsSupportTicketNote(
+                id=note_id_uuid,
+                ticket_id=t_obj.id,
+                author_identity=operator.identity,
+                body=body_text,
+                created_at=now_dt,
+            )
+            db.add(n_obj)
+            t_obj.updated_at = now_dt
+            db.flush()
+    except Exception as e:
+        logger.warning(f"Error persisting note to DB: {e}")
+
     note = {
         "id": note_id,
         "author_identity": operator.identity,
@@ -2722,14 +3108,44 @@ def ops_update_support_ticket(
     db: DbSession = Depends(get_db),
 ):
     operator, _ = auth
-    ticket = find_support_ticket(ticket_id)
+    ticket = find_support_ticket(ticket_id, db=db)
     if ticket is None:
         raise HTTPException(status_code=404, detail="Support ticket not found")
 
     if patch.status is None and patch.severity is None:
         raise HTTPException(status_code=422, detail="Must provide status or severity to update")
 
-    now_iso = datetime.now(timezone.utc).isoformat()
+    now_dt = datetime.now(timezone.utc)
+    now_iso = now_dt.isoformat()
+
+    try:
+        clean_id = ticket_id.strip()
+        u = None
+        try:
+            u = uuid.UUID(clean_id)
+        except ValueError:
+            pass
+        t_obj = db.scalar(select(OpsSupportTicket).where((OpsSupportTicket.id == u) if u else (OpsSupportTicket.case_reference == clean_id)))
+        if t_obj is not None:
+            if patch.status is not None:
+                st = patch.status.strip().lower()
+                if st not in ("open", "in_progress", "resolved", "closed"):
+                    raise HTTPException(status_code=422, detail="Invalid ticket status")
+                t_obj.status = st
+                if st in ("resolved", "closed") and not t_obj.resolved_at:
+                    t_obj.resolved_at = now_dt
+                elif st in ("open", "in_progress"):
+                    t_obj.resolved_at = None
+            if patch.severity is not None:
+                sev = patch.severity.strip().lower()
+                if sev not in ("low", "medium", "high", "critical"):
+                    raise HTTPException(status_code=422, detail="Invalid severity level")
+                t_obj.severity = sev
+            t_obj.updated_at = now_dt
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.warning(f"Error updating ticket in DB: {e}")
 
     if patch.status is not None:
         st = patch.status.strip().lower()
@@ -2787,7 +3203,7 @@ def ops_get_support_ticket_diagnostics(
     db: DbSession = Depends(get_db),
 ):
     operator, _ = auth
-    ticket = find_support_ticket(ticket_id)
+    ticket = find_support_ticket(ticket_id, db=db)
     if ticket is None:
         raise HTTPException(status_code=404, detail="Support ticket not found")
 
@@ -2831,11 +3247,11 @@ CMS_DEFAULT_DOCUMENTS: dict[str, dict] = {
         "title": "Homepage Hero",
         "description": "Main landing hero copy, value proposition headline, and primary call-to-action.",
         "published": {
-            "headline": "Precision Telemetry for Every Corner",
-            "subheadline": "Professional-grade motorcycle lean angle, 20Hz dynamics, and track analysis directly on your smartphone.",
-            "cta_text": "Download App",
-            "cta_link": "/download",
-            "badge_text": "Engineered for Riders",
+            "headline": "Know what your ride is doing.",
+            "subheadline": "MotorSignal turns every ride into clear, actionable insight: real-time lean angle, live GPS track telemetry on the road, post-session performance replay, and enterprise security for riders and clubs.",
+            "cta_text": "Create your account",
+            "cta_link": "/register",
+            "badge_text": "⚡ Next-Gen Telemetry Engine 3.0 • Real-Time CAN-Bus & GPS",
         },
         "draft": None,
         "updated_at": "2026-09-12T12:00:00Z",
@@ -2848,11 +3264,11 @@ CMS_DEFAULT_DOCUMENTS: dict[str, dict] = {
                 "status": "published",
                 "change_summary": "Initial baseline published content",
                 "content": {
-                    "headline": "Precision Telemetry for Every Corner",
-                    "subheadline": "Professional-grade motorcycle lean angle, 20Hz dynamics, and track analysis directly on your smartphone.",
-                    "cta_text": "Download App",
-                    "cta_link": "/download",
-                    "badge_text": "Engineered for Riders",
+                    "headline": "Know what your ride is doing.",
+                    "subheadline": "MotorSignal turns every ride into clear, actionable insight: real-time lean angle, live GPS track telemetry on the road, post-session performance replay, and enterprise security for riders and clubs.",
+                    "cta_text": "Create your account",
+                    "cta_link": "/register",
+                    "badge_text": "⚡ Next-Gen Telemetry Engine 3.0 • Real-Time CAN-Bus & GPS",
                 },
             }
         ],
@@ -2864,19 +3280,24 @@ CMS_DEFAULT_DOCUMENTS: dict[str, dict] = {
         "published": {
             "items": [
                 {
-                    "title": "20Hz Lean & Dynamics",
-                    "description": "Sub-50ms authoritative sensor fusion derived lean angle.",
-                    "icon": "speed",
+                    "title": "Live Cockpit & Handlebar HUD",
+                    "description": "Real-time pitch, roll, yaw, throttle position, braking pressure, and predictive apex speeds delivered at 60fps to your handlebar display or phone mount without visual drag.",
+                    "icon": "dashboard_customize",
                 },
                 {
-                    "title": "Automatic Ride Detection",
-                    "description": "Zero-touch start and stop with 3.0 MPH moving gate.",
-                    "icon": "auto_mode",
+                    "title": "Ride Intelligence & Session Replay",
+                    "description": "Multi-layer track analysis with sector split times, deceleration zones, elevation profiles, and 3D GPS satellite trace replays after every canyon run or track session.",
+                    "icon": "analytics",
                 },
                 {
-                    "title": "Track & Road Telemetry",
-                    "description": "Forensic high-rate GPS & IMU playback with corner metrics.",
-                    "icon": "timeline",
+                    "title": "Club Telemetry & Fleet Beacon",
+                    "description": "Live pack radar tracking, automatic crash detection beacon with SOS emergency dispatch, and competitive leaderboards with verified telemetry data.",
+                    "icon": "emergency",
+                },
+                {
+                    "title": "Zero-Friction Hardware & Security",
+                    "description": "Encrypted zero-knowledge ride logs, offline Bluetooth / CAN-bus hardware sync, and end-to-end authenticated APIs compatible with major manufacturers.",
+                    "icon": "memory",
                 },
             ]
         },
@@ -2893,19 +3314,24 @@ CMS_DEFAULT_DOCUMENTS: dict[str, dict] = {
                 "content": {
                     "items": [
                         {
-                            "title": "20Hz Lean & Dynamics",
-                            "description": "Sub-50ms authoritative sensor fusion derived lean angle.",
-                            "icon": "speed",
+                            "title": "Live Cockpit & Handlebar HUD",
+                            "description": "Real-time pitch, roll, yaw, throttle position, braking pressure, and predictive apex speeds delivered at 60fps to your handlebar display or phone mount without visual drag.",
+                            "icon": "dashboard_customize",
                         },
                         {
-                            "title": "Automatic Ride Detection",
-                            "description": "Zero-touch start and stop with 3.0 MPH moving gate.",
-                            "icon": "auto_mode",
+                            "title": "Ride Intelligence & Session Replay",
+                            "description": "Multi-layer track analysis with sector split times, deceleration zones, elevation profiles, and 3D GPS satellite trace replays after every canyon run or track session.",
+                            "icon": "analytics",
                         },
                         {
-                            "title": "Track & Road Telemetry",
-                            "description": "Forensic high-rate GPS & IMU playback with corner metrics.",
-                            "icon": "timeline",
+                            "title": "Club Telemetry & Fleet Beacon",
+                            "description": "Live pack radar tracking, automatic crash detection beacon with SOS emergency dispatch, and competitive leaderboards with verified telemetry data.",
+                            "icon": "emergency",
+                        },
+                        {
+                            "title": "Zero-Friction Hardware & Security",
+                            "description": "Encrypted zero-knowledge ride logs, offline Bluetooth / CAN-bus hardware sync, and end-to-end authenticated APIs compatible with major manufacturers.",
+                            "icon": "memory",
                         },
                     ]
                 },
@@ -3121,11 +3547,90 @@ CMS_DOCUMENTS: dict[str, dict] = {
 }
 
 
+def _seed_cms_documents_if_needed(db: DbSession) -> None:
+    try:
+        count = db.scalar(select(func.count()).select_from(OpsCmsDocument))
+        if count == 0:
+            now_dt = datetime.now(timezone.utc)
+            for slug, doc in CMS_DEFAULT_DOCUMENTS.items():
+                doc_obj = OpsCmsDocument(
+                    slug=slug,
+                    title=doc["title"],
+                    description=doc.get("description", ""),
+                    published_json=doc["published"],
+                    draft_json=doc.get("draft"),
+                    updated_at=now_dt,
+                    updated_by=doc.get("updated_by", "system"),
+                )
+                db.add(doc_obj)
+                for rev in doc.get("revisions", []):
+                    rev_obj = OpsCmsRevision(
+                        revision_id=rev["revision_id"],
+                        document_slug=slug,
+                        status=rev["status"],
+                        change_summary=rev["change_summary"],
+                        content_json=rev["content"],
+                        created_at=now_dt,
+                        created_by=rev.get("created_by", "system"),
+                    )
+                    db.add(rev_obj)
+            db.commit()
+    except Exception as e:
+        logger.warning(f"Error seeding CMS documents to DB: {e}")
+
+
+@app.get("/api/v1/cms/documents/{slug}")
+def get_public_cms_document(
+    slug: str,
+    db: DbSession = Depends(get_db),
+):
+    clean_slug = slug.strip()
+    _seed_cms_documents_if_needed(db)
+    try:
+        doc_record = db.scalar(select(OpsCmsDocument).where(OpsCmsDocument.slug == clean_slug))
+        if doc_record and doc_record.published_json:
+            return {
+                "slug": doc_record.slug,
+                "title": doc_record.title,
+                "published": doc_record.published_json,
+                "updated_at": doc_record.updated_at.isoformat() if doc_record.updated_at else None,
+            }
+    except Exception as e:
+        logger.warning(f"Error querying public CMS doc from DB: {e}")
+    if clean_slug in CMS_DOCUMENTS:
+        doc = CMS_DOCUMENTS[clean_slug]
+        return {
+            "slug": doc["slug"],
+            "title": doc["title"],
+            "published": doc["published"],
+            "updated_at": doc["updated_at"],
+        }
+    raise HTTPException(status_code=404, detail="Document not found")
+
+
 @app.get("/api/v1/ops/cms/documents")
 def ops_get_cms_documents(
     auth: tuple[Operator, OpsSession] = Depends(require_ops_roles("operator", "owner")),
     db: DbSession = Depends(get_db),
 ):
+    _seed_cms_documents_if_needed(db)
+    try:
+        db_docs = db.scalars(select(OpsCmsDocument).order_by(OpsCmsDocument.slug)).all()
+        if db_docs:
+            return [
+                {
+                    "slug": d.slug,
+                    "title": d.title,
+                    "description": d.description,
+                    "has_draft": d.draft_json is not None,
+                    "updated_at": d.updated_at.isoformat() if d.updated_at else datetime.now(timezone.utc).isoformat(),
+                    "updated_by": d.updated_by,
+                }
+                for d in db_docs
+            ]
+    except Exception as e:
+        logger.warning(f"Error fetching CMS documents from DB: {e}")
+
     summaries = []
     for doc in CMS_DOCUMENTS.values():
         summaries.append({
@@ -3146,6 +3651,40 @@ def ops_get_cms_document_detail(
     db: DbSession = Depends(get_db),
 ):
     clean_slug = slug.strip()
+    _seed_cms_documents_if_needed(db)
+    try:
+        doc_record = db.scalar(select(OpsCmsDocument).where(OpsCmsDocument.slug == clean_slug))
+        if doc_record:
+            rev_records = db.scalars(
+                select(OpsCmsRevision)
+                .where(OpsCmsRevision.document_slug == clean_slug)
+                .order_by(OpsCmsRevision.created_at.desc())
+            ).all()
+            revisions = [
+                {
+                    "revision_id": r.revision_id,
+                    "created_at": r.created_at.isoformat() if r.created_at else "",
+                    "created_by": r.created_by,
+                    "status": r.status,
+                    "change_summary": r.change_summary,
+                    "content": r.content_json,
+                }
+                for r in rev_records
+            ]
+            return {
+                "slug": doc_record.slug,
+                "title": doc_record.title,
+                "description": doc_record.description,
+                "published": doc_record.published_json,
+                "draft": doc_record.draft_json,
+                "has_draft": doc_record.draft_json is not None,
+                "updated_at": doc_record.updated_at.isoformat() if doc_record.updated_at else "",
+                "updated_by": doc_record.updated_by,
+                "revisions": revisions,
+            }
+    except Exception as e:
+        logger.warning(f"Error fetching CMS detail from DB: {e}")
+
     if clean_slug not in CMS_DOCUMENTS:
         raise HTTPException(status_code=404, detail="CMS document not found")
 
@@ -3172,14 +3711,53 @@ def ops_update_cms_document(
 ):
     operator, _ = auth
     clean_slug = slug.strip()
-    if clean_slug not in CMS_DOCUMENTS:
-        raise HTTPException(status_code=404, detail="CMS document not found")
+    _seed_cms_documents_if_needed(db)
+    if clean_slug not in CMS_DEFAULT_DOCUMENTS and clean_slug not in CMS_DOCUMENTS:
+        doc_record = db.scalar(select(OpsCmsDocument).where(OpsCmsDocument.slug == clean_slug))
+        if not doc_record:
+            raise HTTPException(status_code=404, detail="CMS document not found")
 
-    doc = CMS_DOCUMENTS[clean_slug]
-    now_str = datetime.now(timezone.utc).isoformat()
+    now_dt = datetime.now(timezone.utc)
+    now_str = now_dt.isoformat()
     rev_id = f"rev-{clean_slug[:8]}-{uuid.uuid4().hex[:8]}"
     summary_text = body.change_summary.strip() or ("Draft saved" if body.action == "draft" else "Published live")
 
+    try:
+        doc_record = db.scalar(select(OpsCmsDocument).where(OpsCmsDocument.slug == clean_slug))
+        if doc_record:
+            doc_record.updated_at = now_dt
+            doc_record.updated_by = operator.identity
+            if body.action == "draft":
+                doc_record.draft_json = body.content
+            elif body.action == "publish":
+                doc_record.published_json = body.content
+                doc_record.draft_json = None
+
+            rev_record = OpsCmsRevision(
+                revision_id=rev_id,
+                document_slug=clean_slug,
+                created_at=now_dt,
+                created_by=operator.identity,
+                status="draft" if body.action == "draft" else "published",
+                change_summary=summary_text,
+                content_json=body.content,
+            )
+            db.add(rev_record)
+            db.flush()
+    except Exception as e:
+        logger.warning(f"Error persisting CMS update to DB: {e}")
+
+    doc = CMS_DOCUMENTS.setdefault(clean_slug, {
+        "slug": clean_slug,
+        "title": clean_slug.replace("_", " ").title(),
+        "description": "",
+        "published": {},
+        "draft": None,
+        "updated_at": now_str,
+        "updated_by": operator.identity,
+        "revisions": [],
+    })
+
     if body.action == "draft":
         doc["draft"] = body.content
         doc["updated_at"] = now_str
@@ -3257,32 +3835,67 @@ def ops_rollback_cms_document(
 ):
     operator, _ = auth
     clean_slug = slug.strip()
-    if clean_slug not in CMS_DOCUMENTS:
-        raise HTTPException(status_code=404, detail="CMS document not found")
+    _seed_cms_documents_if_needed(db)
 
-    doc = CMS_DOCUMENTS[clean_slug]
-    target_rev = next((r for r in doc["revisions"] if r["revision_id"] == body.revision_id.strip()), None)
-    if not target_rev:
-        raise HTTPException(status_code=404, detail="Revision not found")
-
-    now_str = datetime.now(timezone.utc).isoformat()
+    now_dt = datetime.now(timezone.utc)
+    now_str = now_dt.isoformat()
     rev_id = f"rev-{clean_slug[:8]}-{uuid.uuid4().hex[:8]}"
-    restored_content = dict(target_rev["content"])
 
-    doc["published"] = restored_content
-    doc["draft"] = None
-    doc["updated_at"] = now_str
-    doc["updated_by"] = operator.identity
+    target_content = None
+    try:
+        rev_record = db.scalar(
+            select(OpsCmsRevision).where(
+                OpsCmsRevision.document_slug == clean_slug,
+                OpsCmsRevision.revision_id == body.revision_id.strip()
+            )
+        )
+        if rev_record:
+            target_content = dict(rev_record.content_json)
+            doc_record = db.scalar(select(OpsCmsDocument).where(OpsCmsDocument.slug == clean_slug))
+            if doc_record:
+                doc_record.published_json = target_content
+                doc_record.draft_json = None
+                doc_record.updated_at = now_dt
+                doc_record.updated_by = operator.identity
+                new_rev = OpsCmsRevision(
+                    revision_id=rev_id,
+                    document_slug=clean_slug,
+                    created_at=now_dt,
+                    created_by=operator.identity,
+                    status="published",
+                    change_summary=f"Rollback to {body.revision_id.strip()}: {body.reason.strip()}",
+                    content_json=target_content,
+                )
+                db.add(new_rev)
+                db.flush()
+    except Exception as e:
+        logger.warning(f"Error rolling back CMS document in DB: {e}")
 
-    rev = {
-        "revision_id": rev_id,
-        "created_at": now_str,
-        "created_by": operator.identity,
-        "status": "published",
-        "change_summary": f"Rollback to {body.revision_id.strip()}: {body.reason.strip()}",
-        "content": restored_content,
-    }
-    doc["revisions"].insert(0, rev)
+    if clean_slug not in CMS_DOCUMENTS:
+        if not target_content:
+            raise HTTPException(status_code=404, detail="CMS document not found")
+
+    doc = CMS_DOCUMENTS.get(clean_slug)
+    if doc:
+        target_rev = next((r for r in doc["revisions"] if r["revision_id"] == body.revision_id.strip()), None)
+        if not target_rev and not target_content:
+            raise HTTPException(status_code=404, detail="Revision not found")
+        restored_content = target_content or (dict(target_rev["content"]) if target_rev else {})
+
+        doc["published"] = restored_content
+        doc["draft"] = None
+        doc["updated_at"] = now_str
+        doc["updated_by"] = operator.identity
+
+        rev = {
+            "revision_id": rev_id,
+            "created_at": now_str,
+            "created_by": operator.identity,
+            "status": "published",
+            "change_summary": f"Rollback to {body.revision_id.strip()}: {body.reason.strip()}",
+            "content": restored_content,
+        }
+        doc["revisions"].insert(0, rev)
 
     ops_audit(
         db=db,
@@ -3301,13 +3914,13 @@ def ops_rollback_cms_document(
     db.commit()
 
     return {
-        "slug": doc["slug"],
-        "title": doc["title"],
-        "description": doc["description"],
-        "published": doc["published"],
-        "draft": doc["draft"],
-        "has_draft": doc["draft"] is not None,
-        "updated_at": doc["updated_at"],
-        "updated_by": doc["updated_by"],
-        "revisions": doc["revisions"],
+        "slug": doc["slug"] if doc else clean_slug,
+        "title": doc["title"] if doc else clean_slug,
+        "description": doc["description"] if doc else "",
+        "published": doc["published"] if doc else target_content,
+        "draft": doc["draft"] if doc else None,
+        "has_draft": False,
+        "updated_at": doc["updated_at"] if doc else now_str,
+        "updated_by": doc["updated_by"] if doc else operator.identity,
+        "revisions": doc["revisions"] if doc else [],
     }
diff --git a/backend/motorsignal_api/app/models.py b/backend/motorsignal_api/app/models.py
index f15eebe..ccebdbc 100644
--- a/backend/motorsignal_api/app/models.py
+++ b/backend/motorsignal_api/app/models.py
@@ -406,3 +406,71 @@ class OpsAction(Base):
     rollback_status: Mapped[str | None] = mapped_column(Text, nullable=True)
     failure_code: Mapped[str | None] = mapped_column(String(255), nullable=True)
     idempotency_key: Mapped[str | None] = mapped_column(String(255), nullable=True)
+
+
+class OpsSupportTicket(Base):
+    __tablename__ = "support_tickets"
+    __table_args__ = {"schema": "ops"}
+
+    id: Mapped[uuid.UUID] = mapped_column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
+    case_reference: Mapped[str] = mapped_column(String(32), unique=True, nullable=False, index=True)
+    ticket_type: Mapped[str] = mapped_column(String(64), nullable=False)
+    reporter_email: Mapped[str] = mapped_column(String(320), nullable=False)
+    subject: Mapped[str] = mapped_column(String(255), nullable=False)
+    description: Mapped[str] = mapped_column(Text, nullable=False)
+    severity: Mapped[str] = mapped_column(String(32), nullable=False, default="medium", index=True)
+    status: Mapped[str] = mapped_column(String(32), nullable=False, default="open", index=True)
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=datetime.utcnow, nullable=False, index=True)
+    updated_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=datetime.utcnow, onupdate=datetime.utcnow, nullable=False)
+    resolved_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+    diagnostic_bundle: Mapped[dict | None] = mapped_column(JSON, nullable=True)
+
+    notes: Mapped[list["OpsSupportTicketNote"]] = relationship(
+        back_populates="ticket", cascade="all, delete-orphan", order_by="OpsSupportTicketNote.created_at.desc()"
+    )
+
+
+class OpsSupportTicketNote(Base):
+    __tablename__ = "support_ticket_notes"
+    __table_args__ = {"schema": "ops"}
+
+    id: Mapped[uuid.UUID] = mapped_column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
+    ticket_id: Mapped[uuid.UUID] = mapped_column(ForeignKey("ops.support_tickets.id", ondelete="CASCADE"), nullable=False, index=True)
+    author_identity: Mapped[str] = mapped_column(String(320), nullable=False)
+    body: Mapped[str] = mapped_column(Text, nullable=False)
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=datetime.utcnow, nullable=False, index=True)
+
+    ticket: Mapped["OpsSupportTicket"] = relationship(back_populates="notes")
+
+
+class OpsCmsDocument(Base):
+    __tablename__ = "cms_documents"
+    __table_args__ = {"schema": "ops"}
+
+    slug: Mapped[str] = mapped_column(String(96), primary_key=True)
+    title: Mapped[str] = mapped_column(String(255), nullable=False)
+    description: Mapped[str] = mapped_column(Text, nullable=False)
+    published_json: Mapped[dict] = mapped_column(JSON, nullable=False)
+    draft_json: Mapped[dict | None] = mapped_column(JSON, nullable=True)
+    updated_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=datetime.utcnow, onupdate=datetime.utcnow, nullable=False)
+    updated_by: Mapped[str] = mapped_column(String(320), nullable=False, default="system")
+
+    revisions: Mapped[list["OpsCmsRevision"]] = relationship(
+        back_populates="document", cascade="all, delete-orphan", order_by="OpsCmsRevision.created_at.desc()"
+    )
+
+
+class OpsCmsRevision(Base):
+    __tablename__ = "cms_document_revisions"
+    __table_args__ = {"schema": "ops"}
+
+    revision_id: Mapped[str] = mapped_column(String(96), primary_key=True)
+    document_slug: Mapped[str] = mapped_column(ForeignKey("ops.cms_documents.slug", ondelete="CASCADE"), nullable=False, index=True)
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=datetime.utcnow, nullable=False, index=True)
+    created_by: Mapped[str] = mapped_column(String(320), nullable=False)
+    status: Mapped[str] = mapped_column(String(32), nullable=False)
+    change_summary: Mapped[str] = mapped_column(Text, nullable=False)
+    content_json: Mapped[dict] = mapped_column(JSON, nullable=False)
+
+    document: Mapped["OpsCmsDocument"] = relationship(back_populates="revisions")
+
diff --git a/backend/motorsignal_api/app/ops_actions_service.py b/backend/motorsignal_api/app/ops_actions_service.py
index ffaf03d..ef78bf9 100644
--- a/backend/motorsignal_api/app/ops_actions_service.py
+++ b/backend/motorsignal_api/app/ops_actions_service.py
@@ -63,13 +63,21 @@ def validate_state_transition(current_state: str, new_state: str) -> bool:
 
 
 def get_active_action(db: DbSession) -> OpsAction | None:
-    stmt = (
-        select(OpsAction)
-        .where(OpsAction.state.in_(ACTIVE_STATES))
-        .order_by(OpsAction.request_timestamp.desc())
-        .limit(1)
-    )
-    return db.scalars(stmt).first()
+    try:
+        stmt = (
+            select(OpsAction)
+            .where(OpsAction.state.in_(ACTIVE_STATES))
+            .order_by(OpsAction.request_timestamp.desc())
+            .limit(1)
+        )
+        return db.scalars(stmt).first()
+    except Exception as e:
+        logger.warning(f"Error checking active ops action: {e}")
+        try:
+            db.rollback()
+        except Exception:
+            pass
+        return None
 
 
 def sanitize_message(msg: str | None) -> str | None:
diff --git a/backend/motorsignal_api/tests/test_api_smoke.py b/backend/motorsignal_api/tests/test_api_smoke.py
index ed42f6d..e6c07fe 100644
--- a/backend/motorsignal_api/tests/test_api_smoke.py
+++ b/backend/motorsignal_api/tests/test_api_smoke.py
@@ -10,6 +10,7 @@ import psycopg
 
 import sys
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "app"))
+os.environ.setdefault("JWT_SECRET", "local-test-secret")
 from auth import hash_one_time_token  # noqa: E402
 
 
diff --git a/backend/motorsignal_api/tests/test_ops_users_and_cms.py b/backend/motorsignal_api/tests/test_ops_users_and_cms.py
new file mode 100644
index 0000000..f0785a5
--- /dev/null
+++ b/backend/motorsignal_api/tests/test_ops_users_and_cms.py
@@ -0,0 +1,240 @@
+import hashlib
+import os
+import sys
+import unittest
+import uuid
+from datetime import datetime, timedelta, timezone
+
+ROOT = os.path.dirname(os.path.dirname(__file__))
+sys.path.insert(0, os.path.join(ROOT, ".python-packages"))
+sys.path.insert(0, os.path.join(ROOT, "app"))
+
+os.environ.setdefault("JWT_SECRET", "local-test-secret")
+os.environ["FIREBASE_PROJECT_ID"] = "motoapp-d22e0"
+os.environ["DATABASE_USER"] = "test"
+os.environ["DATABASE_PASSWORD"] = "test"
+os.environ["DATABASE_NAME"] = "test"
+
+from sqlalchemy import create_engine, event, select
+from sqlalchemy.orm import Session as DbSession
+from starlette.testclient import TestClient
+
+import main
+from main import app, get_db
+from models import Base, Operator, OpsAuditEvent, OpsSession, User, OpsCmsDocument, OpsCmsRevision
+
+
+def hash_token(raw_token: str) -> str:
+    return hashlib.sha256(raw_token.encode()).hexdigest()
+
+
+class TestOpsUsersAndCms(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.db_path = os.path.join(ROOT, "tests", "test_ops_users_cms.db")
+        cls.ops_db_path = os.path.join(ROOT, "tests", "test_ops_users_cms_schema.db")
+        for p in (cls.db_path, cls.ops_db_path):
+            if os.path.exists(p):
+                try:
+                    os.remove(p)
+                except OSError:
+                    pass
+
+        cls.engine = create_engine(f"sqlite:///{cls.db_path}")
+
+        @event.listens_for(cls.engine, "connect")
+        def attach_ops(dbapi_con, con_record):
+            dbapi_con.execute(f"ATTACH DATABASE '{cls.ops_db_path}' AS ops")
+
+        Base.metadata.create_all(cls.engine)
+
+        def override_get_db():
+            db = DbSession(cls.engine)
+            try:
+                yield db
+            finally:
+                db.close()
+
+        app.dependency_overrides[get_db] = override_get_db
+        cls.client = TestClient(app, raise_server_exceptions=True)
+
+    @classmethod
+    def tearDownClass(cls):
+        app.dependency_overrides.clear()
+        cls.engine.dispose()
+        for p in (cls.db_path, cls.ops_db_path):
+            if os.path.exists(p):
+                try:
+                    os.remove(p)
+                except OSError:
+                    pass
+
+    def setUp(self):
+        with DbSession(self.engine) as db:
+            db.query(OpsAuditEvent).delete()
+            db.query(OpsSession).delete()
+            db.query(Operator).delete()
+            db.query(User).delete()
+            db.query(OpsCmsRevision).delete()
+            db.query(OpsCmsDocument).delete()
+            db.commit()
+
+            self.op_id = uuid.uuid4()
+            self.op_identity = "operator@motorsignal.internal"
+            self.op_token = "valid-operator-token-456"
+            op = Operator(
+                id=self.op_id,
+                identity=self.op_identity,
+                role="operator",
+                status="active",
+                created_at=datetime.now(timezone.utc),
+            )
+            op_session = OpsSession(
+                operator_id=self.op_id,
+                session_token_hash=hash_token(self.op_token),
+                expires_at=datetime.now(timezone.utc) + timedelta(hours=8),
+                created_at=datetime.now(timezone.utc),
+            )
+            db.add(op)
+            db.add(op_session)
+            db.commit()
+
+    def test_create_user_unauthorized(self):
+        resp = self.client.post("/api/v1/ops/users", json={"email": "newuser@test.com", "password": "password123", "reason": "Test"})
+        self.assertEqual(resp.status_code, 401)
+
+    def test_create_user_success_and_audit(self):
+        payload = {
+            "email": "newrider@motorsignal.com",
+            "display_name": "New Rider",
+            "password": "securepassword123",
+            "role": "user",
+            "email_verified": True,
+            "reason": "Customer service manual account creation",
+        }
+        resp = self.client.post(
+            "/api/v1/ops/users",
+            json=payload,
+            headers={"Authorization": f"Bearer {self.op_token}"},
+        )
+        self.assertEqual(resp.status_code, 201)
+        data = resp.json()
+        self.assertEqual(data["email"], "newrider@motorsignal.com")
+        self.assertEqual(data["display_name"], "New Rider")
+        self.assertEqual(data["is_email_verified"], True)
+        self.assertEqual(data["is_active"], True)
+
+        # Duplicate email check
+        dup_resp = self.client.post(
+            "/api/v1/ops/users",
+            json=payload,
+            headers={"Authorization": f"Bearer {self.op_token}"},
+        )
+        self.assertEqual(dup_resp.status_code, 409)
+
+        # Audit event check
+        with DbSession(self.engine) as db:
+            event = db.scalar(
+                select(OpsAuditEvent).where(
+                    OpsAuditEvent.action == "user.created",
+                    OpsAuditEvent.actor_identity == self.op_identity,
+                )
+            )
+            self.assertIsNotNone(event)
+            self.assertEqual(event.target_resource, f"user:{data['id']}")
+
+    def test_create_operator_user(self):
+        # Update operator to owner role to authorize provisioning internal operators
+        with DbSession(self.engine) as db:
+            op = db.get(Operator, self.op_id)
+            op.role = "owner"
+            db.commit()
+
+        payload = {
+            "email": "supportstaff@motorsignal.com",
+            "password": "staffpassword123",
+            "role": "operator",
+            "email_verified": True,
+            "reason": "Provisioning internal staff operator console access",
+        }
+        resp = self.client.post(
+            "/api/v1/ops/users",
+            json=payload,
+            headers={"Authorization": f"Bearer {self.op_token}"},
+        )
+        self.assertEqual(resp.status_code, 201)
+
+        with DbSession(self.engine) as db:
+            op_record = db.scalar(select(Operator).where(Operator.identity == "supportstaff@motorsignal.com"))
+            self.assertIsNotNone(op_record)
+            self.assertEqual(op_record.role, "operator")
+
+    def test_speedtest_execution(self):
+        resp = self.client.post(
+            "/api/v1/ops/infrastructure/speedtest",
+            headers={"Authorization": f"Bearer {self.op_token}"},
+        )
+        self.assertEqual(resp.status_code, 200)
+        data = resp.json()
+        self.assertEqual(data["status"], "completed")
+        self.assertGreater(data["download_mbps"], 0)
+        self.assertGreater(data["upload_mbps"], 0)
+        self.assertIn("latency_ms", data)
+        self.assertIn("tested_at", data)
+
+    def test_public_cms_endpoint(self):
+        resp = self.client.get("/api/v1/cms/documents/homepage_hero")
+        self.assertEqual(resp.status_code, 200)
+        data = resp.json()
+        self.assertEqual(data["slug"], "homepage_hero")
+        self.assertIn("published", data)
+        self.assertEqual(data["published"]["headline"], "Know what your ride is doing.")
+
+    def test_cms_draft_and_publish_flow(self):
+        # Update draft
+        draft_payload = {
+            "action": "draft",
+            "content": {
+                "headline": "Next-Gen Motorcycle Telemetry",
+                "subheadline": "Real-time precision logging.",
+                "cta_text": "Sign Up",
+                "cta_link": "/register",
+                "badge_text": "Live 3.0",
+            },
+            "change_summary": "Draft updated copy",
+        }
+        resp = self.client.put(
+            "/api/v1/ops/cms/documents/homepage_hero",
+            json=draft_payload,
+            headers={"Authorization": f"Bearer {self.op_token}"},
+        )
+        self.assertEqual(resp.status_code, 200)
+        data = resp.json()
+        self.assertEqual(data["has_draft"], True)
+        self.assertEqual(data["draft"]["headline"], "Next-Gen Motorcycle Telemetry")
+        # Public copy should still be original
+        pub_resp = self.client.get("/api/v1/cms/documents/homepage_hero")
+        self.assertEqual(pub_resp.json()["published"]["headline"], "Know what your ride is doing.")
+
+        # Publish live
+        pub_payload = {
+            "action": "publish",
+            "content": draft_payload["content"],
+            "change_summary": "Publishing live copy",
+        }
+        pub_resp2 = self.client.put(
+            "/api/v1/ops/cms/documents/homepage_hero",
+            json=pub_payload,
+            headers={"Authorization": f"Bearer {self.op_token}"},
+        )
+        self.assertEqual(pub_resp2.status_code, 200)
+        self.assertEqual(pub_resp2.json()["has_draft"], False)
+        self.assertEqual(pub_resp2.json()["published"]["headline"], "Next-Gen Motorcycle Telemetry")
+
+        # Now public endpoint returns the updated published content
+        pub_resp3 = self.client.get("/api/v1/cms/documents/homepage_hero")
+        self.assertEqual(pub_resp3.json()["published"]["headline"], "Next-Gen Motorcycle Telemetry")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/deploy-website.ps1 b/scripts/deploy-website.ps1
index 0c9b117..ada1290 100644
--- a/scripts/deploy-website.ps1
+++ b/scripts/deploy-website.ps1
@@ -29,7 +29,7 @@ if ($GitSha -notmatch '^[0-9a-f]{40}$') {
 }
 
 # Refuse dirty website inputs before assigning the HEAD revision
-$DirtyWebsite = (git -C $RepositoryRoot status --porcelain -- website).Trim()
+$DirtyWebsite = "$((git -C $RepositoryRoot status --porcelain -- website))".Trim()
 if ($DirtyWebsite) {
     Write-Error "Cannot deploy website: working tree contains uncommitted changes under website/:`n$DirtyWebsite"
     exit 1
@@ -79,6 +79,9 @@ echo "Done!"
     try {
         $env:MOTORSIGNAL_GIT_SHA = $GitSha
         npm run build
+        if (Test-Path "$PSScriptRoot\..\website\.next\standalone\server.js") {
+            Copy-Item "$PSScriptRoot\..\website\.next\standalone\server.js" "$PSScriptRoot\..\website\server.js" -Force
+        }
     } finally {
         if ($null -eq $PreviousDeploySha) {
             Remove-Item Env:MOTORSIGNAL_GIT_SHA -ErrorAction SilentlyContinue
@@ -91,7 +94,12 @@ echo "Done!"
     $TarName = "website-update-$Timestamp.tar.gz"
     $TempTar = "$PSScriptRoot\$TarName"
 
-    tar -czf "$TempTar" --exclude="cache" --exclude="dev" --exclude="standalone" -C "$RepositoryRoot\website" .next/server .next/static .next/types .next/BUILD_ID .next/*.json public package.json app components lib
+    $TarArgs = @("-czf", "$TempTar", "--exclude=cache", "--exclude=dev", "--exclude=standalone", "-C", "$RepositoryRoot\website", ".next/server", ".next/static", ".next/types", ".next/BUILD_ID", ".next/*.json", "public", "package.json", "app", "components", "lib")
+    if (Test-Path "$RepositoryRoot\website\server.js") {
+        $TarArgs += "server.js"
+    }
+    tar @TarArgs
+    Remove-Item "$RepositoryRoot\website\server.js" -Force -ErrorAction SilentlyContinue
 
     $SizeMb = [math]::Round(((Get-Item "$TempTar").Length / 1MB), 2)
     Write-Host ">>> 3. Uploading $SizeMb MB to server..." -ForegroundColor Cyan
@@ -99,22 +107,20 @@ echo "Done!"
     Remove-Item "$TempTar" -Force
 
     Write-Host ">>> 4. Activating update on server..." -ForegroundColor Cyan
-    $RemoteCmd = @"
-bash -c '
+    $BashScript = @"
 set -euo pipefail
 TAR=/tmp/$TarName
 TARGET=/opt/motorsignal/current/website
 
 echo "Extracting runtime to `$TARGET..."
-sudo tar -xzf "`$TAR" -C "`$TARGET"
+tar -xzf "`$TAR" --no-same-owner --no-same-permissions --no-overwrite-dir -C "`$TARGET"
 rm -f "`$TAR"
 
 echo "Restarting motorsignal-website service..."
 sudo systemctl restart motorsignal-website
 echo "Service restarted."
-'
-"@
-    ssh -t @SshKeyArgs "${User}@${HostIp}" $RemoteCmd
+"@.Replace("`r", "")
+    ssh @SshKeyArgs "${User}@${HostIp}" "bash -c '$BashScript'"
 }
 
 Write-Host ">>> 5. Checking deployed revision..." -ForegroundColor Green
diff --git a/website/app/api/cms/[slug]/route.ts b/website/app/api/cms/[slug]/route.ts
new file mode 100644
index 0000000..77b3dc7
--- /dev/null
+++ b/website/app/api/cms/[slug]/route.ts
@@ -0,0 +1,40 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+interface RouteContext {
+  params: Promise<{
+    slug: string;
+  }>;
+}
+
+export async function GET(request: NextRequest, context: RouteContext) {
+  const { slug } = await context.params;
+  const baseUrl = process.env.MOTORSIGNAL_API_BASE_URL ?? 'https://api.motorsignal.app';
+
+  try {
+    const response = await fetch(`${baseUrl}/api/v1/cms/documents/${encodeURIComponent(slug)}`, {
+      method: 'GET',
+      headers: {
+        accept: 'application/json',
+      },
+      next: { revalidate: 60 },
+    });
+
+    if (response.status === 404) {
+      return NextResponse.json({ detail: 'Document not found.' }, { status: 404 });
+    }
+    if (!response.ok) {
+      return NextResponse.json(
+        { detail: 'CMS content temporarily unavailable.' },
+        { status: response.status >= 500 ? response.status : 503 }
+      );
+    }
+
+    const data = await response.json();
+    return NextResponse.json(data);
+  } catch {
+    return NextResponse.json(
+      { detail: 'Unable to connect to CMS service.' },
+      { status: 503 }
+    );
+  }
+}
diff --git a/website/app/api/ops/actions/route.ts b/website/app/api/ops/actions/route.ts
index 18bf480..b721a4a 100644
--- a/website/app/api/ops/actions/route.ts
+++ b/website/app/api/ops/actions/route.ts
@@ -138,14 +138,31 @@ export async function POST(request: NextRequest) {
       );
     }
     if (response.status === 422) {
+      const errorMsg =
+        typeof data?.detail === 'string'
+          ? data.detail
+          : Array.isArray(data?.detail)
+          ? data.detail.map((d: any) => d.msg || JSON.stringify(d)).join(', ')
+          : 'Invalid action payload.';
       return NextResponse.json(
-        { detail: data?.detail ?? 'Invalid action payload.' },
+        { detail: errorMsg },
         { status: 422 }
       );
     }
     if (!response.ok) {
+      const errorDetail =
+        typeof data?.detail === 'string'
+          ? data.detail
+          : response.status === 503
+          ? 'Operations action control plane is currently unconfigured or unavailable.'
+          : response.status === 502
+          ? 'Backend API service is temporarily unreachable (502 Bad Gateway).'
+          : response.status === 504
+          ? 'Operation timed out across gateway (504 Gateway Timeout).'
+          : 'Operations platform is temporarily unavailable.';
+
       return NextResponse.json(
-        { detail: data?.detail ?? 'Operations is temporarily unavailable.' },
+        { detail: errorDetail },
         { status: response.status >= 500 ? response.status : 503 }
       );
     }
diff --git a/website/app/api/ops/infrastructure/speedtest/route.ts b/website/app/api/ops/infrastructure/speedtest/route.ts
new file mode 100644
index 0000000..77208fe
--- /dev/null
+++ b/website/app/api/ops/infrastructure/speedtest/route.ts
@@ -0,0 +1,62 @@
+import { cookies } from 'next/headers';
+import { NextRequest, NextResponse } from 'next/server';
+import { hasValidOrigin } from '../../../../../lib/request-origin';
+
+export async function POST(request: NextRequest) {
+  if (!hasValidOrigin(request)) {
+    return NextResponse.json({ detail: 'Invalid request origin.' }, { status: 403 });
+  }
+
+  const cookieStore = await cookies();
+  const isProduction = process.env.NODE_ENV === 'production' && process.env.NEXT_PUBLIC_APP_ENV === 'production';
+  const opsToken = isProduction
+    ? cookieStore.get('__Host-motorsignal_ops')?.value
+    : cookieStore.get('__Host-motorsignal_ops')?.value ??
+      cookieStore.get('motorsignal_ops')?.value;
+
+  if (!opsToken) {
+    return NextResponse.json(
+      { detail: 'Authentication required.' },
+      { status: 401 }
+    );
+  }
+
+  const baseUrl = process.env.MOTORSIGNAL_API_BASE_URL ?? 'https://api.motorsignal.app';
+  try {
+    const response = await fetch(`${baseUrl}/api/v1/ops/infrastructure/speedtest`, {
+      method: 'POST',
+      headers: {
+        authorization: `Bearer ${opsToken}`,
+        accept: 'application/json',
+      },
+      cache: 'no-store',
+    });
+
+    if (response.status === 401) {
+      return NextResponse.json(
+        { detail: 'Your Operations session has expired.' },
+        { status: 401 }
+      );
+    }
+    if (response.status === 403) {
+      return NextResponse.json(
+        { detail: 'You do not have authority to run network speedtests.' },
+        { status: 403 }
+      );
+    }
+    if (!response.ok) {
+      return NextResponse.json(
+        { detail: 'Operations speedtest service temporarily unavailable.' },
+        { status: response.status >= 500 ? response.status : 503 }
+      );
+    }
+
+    const data = await response.json();
+    return NextResponse.json(data);
+  } catch {
+    return NextResponse.json(
+      { detail: 'Unable to connect to Operations platform.' },
+      { status: 503 }
+    );
+  }
+}
diff --git a/website/app/api/ops/users/route.ts b/website/app/api/ops/users/route.ts
index 5b82673..06f01cb 100644
--- a/website/app/api/ops/users/route.ts
+++ b/website/app/api/ops/users/route.ts
@@ -1,5 +1,6 @@
 import { cookies } from 'next/headers';
 import { NextRequest, NextResponse } from 'next/server';
+import { hasValidOrigin } from '../../../../lib/request-origin';
 
 export async function GET(request: NextRequest) {
   const cookieStore = await cookies();
@@ -69,3 +70,88 @@ export async function GET(request: NextRequest) {
     );
   }
 }
+
+export async function POST(request: NextRequest) {
+  if (!hasValidOrigin(request)) {
+    return NextResponse.json({ detail: 'Invalid request origin.' }, { status: 403 });
+  }
+
+  const cookieStore = await cookies();
+  const isProduction = process.env.NODE_ENV === 'production' && process.env.NEXT_PUBLIC_APP_ENV === 'production';
+  const opsToken = isProduction
+    ? cookieStore.get('__Host-motorsignal_ops')?.value
+    : cookieStore.get('__Host-motorsignal_ops')?.value ??
+      cookieStore.get('motorsignal_ops')?.value;
+
+  if (!opsToken) {
+    return NextResponse.json(
+      { detail: 'Authentication required.' },
+      { status: 401 }
+    );
+  }
+
+  let body: unknown;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json(
+      { detail: 'Invalid request body.' },
+      { status: 422 }
+    );
+  }
+
+  const baseUrl = process.env.MOTORSIGNAL_API_BASE_URL ?? 'https://api.motorsignal.app';
+  try {
+    const response = await fetch(`${baseUrl}/api/v1/ops/users`, {
+      method: 'POST',
+      headers: {
+        authorization: `Bearer ${opsToken}`,
+        'content-type': 'application/json',
+        accept: 'application/json',
+      },
+      body: JSON.stringify(body),
+      cache: 'no-store',
+    });
+
+    if (response.status === 401) {
+      return NextResponse.json(
+        { detail: 'Your Operations session has expired.' },
+        { status: 401 }
+      );
+    }
+    if (response.status === 403) {
+      return NextResponse.json(
+        { detail: 'You do not have authority to create users.' },
+        { status: 403 }
+      );
+    }
+    if (response.status === 409) {
+      const data = await response.json().catch(() => null);
+      return NextResponse.json(
+        { detail: data?.detail ?? 'User with this email already exists.' },
+        { status: 409 }
+      );
+    }
+    if (response.status === 422) {
+      const data = await response.json().catch(() => null);
+      return NextResponse.json(
+        { detail: data?.detail ?? 'Invalid user fields.' },
+        { status: 422 }
+      );
+    }
+    if (!response.ok) {
+      return NextResponse.json(
+        { detail: 'Operations is temporarily unavailable.' },
+        { status: response.status >= 500 ? response.status : 503 }
+      );
+    }
+
+    const data = await response.json();
+    return NextResponse.json(data, { status: 201 });
+  } catch {
+    return NextResponse.json(
+      { detail: 'Unable to connect to Operations platform.' },
+      { status: 503 }
+    );
+  }
+}
diff --git a/website/components/landing/HeroSection.tsx b/website/components/landing/HeroSection.tsx
index 01172b5..93d1f49 100644
--- a/website/components/landing/HeroSection.tsx
+++ b/website/components/landing/HeroSection.tsx
@@ -1,7 +1,42 @@
-import React from 'react';
+'use client';
+
+import React, { useState, useEffect } from 'react';
 import Link from 'next/link';
 
+interface HeroContent {
+  headline: string;
+  subheadline: string;
+  cta_text: string;
+  cta_link: string;
+  badge_text: string;
+}
+
+const DEFAULT_HERO_CONTENT: HeroContent = {
+  headline: 'Know what your ride is doing.',
+  subheadline:
+    'MotorSignal turns every ride into clear, actionable insight: real-time lean angle, live GPS track telemetry on the road, post-session performance replay, and enterprise security for riders and clubs.',
+  cta_text: 'Create your account',
+  cta_link: '/register',
+  badge_text: '⚡ Next-Gen Telemetry Engine 3.0 • Real-Time CAN-Bus & GPS',
+};
+
 export default function HeroSection() {
+  const [content, setContent] = useState<HeroContent>(DEFAULT_HERO_CONTENT);
+
+  useEffect(() => {
+    fetch('/api/cms/homepage_hero')
+      .then((res) => (res.ok ? res.json() : null))
+      .then((data) => {
+        if (data?.published) {
+          setContent((prev) => ({
+            ...prev,
+            ...data.published,
+          }));
+        }
+      })
+      .catch(() => {});
+  }, []);
+
   return (
     <section className="hero-wrapper">
       <div className="hero-glow-1" />
@@ -16,23 +51,29 @@ export default function HeroSection() {
                 <span className="core" />
               </span>
               <span className="font-label-caps text-dim-cyan">
-                ⚡ Next-Gen Telemetry Engine 3.0 • Real-Time CAN-Bus &amp; GPS
+                {content.badge_text}
               </span>
             </div>
 
             <h1 className="font-display-hero hero-title">
-              Know what your <br className="hidden sm:inline" />
-              <span className="gradient-title-text">ride is doing.</span>
+              {content.headline.includes('ride is doing.') ? (
+                <>
+                  {content.headline.replace('ride is doing.', '')}
+                  <br className="hidden sm:inline" />
+                  <span className="gradient-title-text">ride is doing.</span>
+                </>
+              ) : (
+                <span className="gradient-title-text">{content.headline}</span>
+              )}
             </h1>
 
             <p className="font-body-lg hero-desc">
-              MotorSignal turns every ride into clear, actionable insight: real-time lean angle, live GPS track
-              telemetry on the road, post-session performance replay, and enterprise security for riders and clubs.
+              {content.subheadline}
             </p>
 
             <div className="hero-actions-row">
-              <Link className="btn-primary-gradient" href="/register">
-                <span>Create your account</span>
+              <Link className="btn-primary-gradient" href={content.cta_link || '/register'}>
+                <span>{content.cta_text || 'Create your account'}</span>
                 <span className="material-symbols-outlined icon-bold">arrow_forward</span>
               </Link>
               <Link className="btn-secondary-surface" href="/features">
diff --git a/website/components/ops/operations-actions.tsx b/website/components/ops/operations-actions.tsx
index dfe8f2e..3fefe00 100644
--- a/website/components/ops/operations-actions.tsx
+++ b/website/components/ops/operations-actions.tsx
@@ -212,6 +212,7 @@ export function OperationsActions({ role, onActionCompleted }: OperationsActions
         body: JSON.stringify({
           action_type: modalActionType,
           confirmation: confirmationInput.trim() || undefined,
+          confirmation_text: confirmationInput.trim() || undefined,
           idempotency_key: idempotencyKey,
         }),
       });
@@ -504,8 +505,18 @@ export function OperationsActions({ role, onActionCompleted }: OperationsActions
 
             <form onSubmit={handleSubmitAction} className="p-5 space-y-4">
               {submitError && (
-                <div className="p-3 text-xs bg-error/10 text-error border border-error/20 rounded-lg">
-                  {submitError}
+                <div className="p-3 text-xs bg-error/10 text-error border border-error/20 rounded-lg flex items-start gap-2">
+                  <span className="material-symbols-outlined text-sm shrink-0 mt-0.5">error</span>
+                  <span>{submitError}</span>
+                </div>
+              )}
+
+              {capabilities && !capabilities.helper_configured && (
+                <div className="p-3 text-xs bg-amber-500/10 text-amber-300 border border-amber-500/20 rounded-lg flex items-start gap-2">
+                  <span className="material-symbols-outlined text-sm shrink-0 mt-0.5">warning</span>
+                  <span>
+                    Action execution boundary helper (<code className="font-mono">ops-action-helper.sh</code>) is not yet configured or executable on the host server. Actions will be rejected by backend policy.
+                  </span>
                 </div>
               )}
 
@@ -543,12 +554,14 @@ export function OperationsActions({ role, onActionCompleted }: OperationsActions
                   type="submit"
                   disabled={
                     isSubmitting ||
+                    (capabilities !== null && !capabilities.helper_configured) ||
                     (Boolean(ACTION_CONFIGS[modalActionType].requiredConfirmation) &&
                       confirmationInput.trim() !==
                         ACTION_CONFIGS[modalActionType].requiredConfirmation)
                   }
                   className={`px-4 py-2 rounded-lg text-xs font-medium transition-colors flex items-center gap-1.5 ${
                     isSubmitting ||
+                    (capabilities !== null && !capabilities.helper_configured) ||
                     (Boolean(ACTION_CONFIGS[modalActionType].requiredConfirmation) &&
                       confirmationInput.trim() !==
                         ACTION_CONFIGS[modalActionType].requiredConfirmation)
diff --git a/website/components/ops/operations-infrastructure.tsx b/website/components/ops/operations-infrastructure.tsx
index 7efa722..b62e5c6 100644
--- a/website/components/ops/operations-infrastructure.tsx
+++ b/website/components/ops/operations-infrastructure.tsx
@@ -6,6 +6,7 @@ import {
   ServiceStatusValue,
   ComponentHealthStatus,
   OperationsRole,
+  InfrastructureSpeedtestResult,
 } from './types';
 import { normalizeInfrastructureResponse } from '../../lib/ops-data';
 import { OperationsActions } from './operations-actions';
@@ -20,6 +21,12 @@ export function OperationsInfrastructure({ role }: OperationsInfrastructureProps
   const [lastFetchedAt, setLastFetchedAt] = useState<string | null>(null);
   const [fetchError, setFetchError] = useState<string | null>(null);
   const [copiedSha, setCopiedSha] = useState(false);
+  const [refreshInterval, setRefreshInterval] = useState<number>(30);
+
+  // Speedtest state
+  const [isRunningSpeedtest, setIsRunningSpeedtest] = useState(false);
+  const [speedtestResult, setSpeedtestResult] = useState<InfrastructureSpeedtestResult | null>(null);
+  const [speedtestError, setSpeedtestError] = useState<string | null>(null);
 
   const isFetchingRef = useRef(false);
   const pollTimerRef = useRef<NodeJS.Timeout | null>(null);
@@ -57,7 +64,30 @@ export function OperationsInfrastructure({ role }: OperationsInfrastructureProps
     }
   }, []);
 
-  // Initial fetch and 30-second visibility-gated polling loop
+  const handleRunSpeedtest = async () => {
+    if (isRunningSpeedtest) return;
+    setIsRunningSpeedtest(true);
+    setSpeedtestError(null);
+    try {
+      const resp = await fetch('/api/ops/infrastructure/speedtest', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+      });
+      if (!resp.ok) {
+        const data = await resp.json().catch(() => null);
+        setSpeedtestError(data?.detail || 'Failed to complete speedtest');
+        return;
+      }
+      const data = (await resp.json()) as InfrastructureSpeedtestResult;
+      setSpeedtestResult(data);
+    } catch {
+      setSpeedtestError('Network error executing speedtest');
+    } finally {
+      setIsRunningSpeedtest(false);
+    }
+  };
+
+  // Initial fetch and user-selectable visibility-gated polling loop (5s, 10s, 30s)
   useEffect(() => {
     void fetchData();
 
@@ -69,11 +99,12 @@ export function OperationsInfrastructure({ role }: OperationsInfrastructureProps
 
     document.addEventListener('visibilitychange', handleVisibilityChange);
 
+    const pollIntervalMs = refreshInterval ? refreshInterval * 1000 : 30000;
     pollTimerRef.current = setInterval(() => {
       if (document.visibilityState === 'visible') {
         void fetchData();
       }
-    }, 30000);
+    }, pollIntervalMs || 30000);
 
     return () => {
       document.removeEventListener('visibilitychange', handleVisibilityChange);
@@ -81,7 +112,7 @@ export function OperationsInfrastructure({ role }: OperationsInfrastructureProps
         clearInterval(pollTimerRef.current);
       }
     };
-  }, [fetchData]);
+  }, [fetchData, refreshInterval]);
 
   const handleCopySha = (sha: string) => {
     if (!sha) return;
@@ -186,10 +217,25 @@ export function OperationsInfrastructure({ role }: OperationsInfrastructureProps
         </div>
 
         <div className="flex items-center gap-3">
-          {/* Polling indicator */}
-          <div className="flex items-center gap-1.5 text-[11px] text-on-surface-variant font-mono bg-surface-container-low px-2.5 py-1.5 rounded-lg border border-outline-variant/20">
-            <span className="w-2 h-2 rounded-full bg-emerald-400 animate-pulse" />
-            <span>Auto 30s</span>
+          {/* Selectable Auto-refresh interval (5s, 10s, 30s) */}
+          <div className="flex items-center gap-1.5 text-[11px] text-on-surface-variant font-mono bg-surface-container-low px-2 py-1 rounded-lg border border-outline-variant/20">
+            <span className="w-2 h-2 rounded-full bg-emerald-400 animate-pulse mr-0.5" />
+            <span className="text-outline">Auto:</span>
+            {[5, 10, 30].map((sec) => (
+              <button
+                key={sec}
+                type="button"
+                onClick={() => setRefreshInterval(sec)}
+                className={`px-1.5 py-0.5 rounded text-[11px] font-semibold transition-colors ${
+                  refreshInterval === sec
+                    ? 'bg-primary-container text-on-primary-container font-bold'
+                    : 'text-on-surface-variant hover:text-on-surface'
+                }`}
+                title={`Auto-refresh every ${sec} seconds`}
+              >
+                {sec}s
+              </button>
+            ))}
           </div>
 
           {/* Last refreshed */}
@@ -470,9 +516,22 @@ export function OperationsInfrastructure({ role }: OperationsInfrastructureProps
                 </p>
               </div>
             </div>
-            <span className="px-2 py-0.5 rounded text-[10px] font-mono bg-surface-container-high text-primary-fixed-dim border border-outline-variant/30">
-              Not a rate
-            </span>
+            <div className="flex items-center gap-2">
+              <span className="px-2 py-0.5 rounded text-[10px] font-mono bg-surface-container-high text-primary-fixed-dim border border-outline-variant/30">
+                Not a rate
+              </span>
+              <button
+                type="button"
+                onClick={() => void handleRunSpeedtest()}
+                disabled={isRunningSpeedtest}
+                className="flex items-center gap-1.5 px-2.5 py-1 rounded text-xs font-semibold bg-primary-container text-on-primary-container hover:opacity-90 disabled:opacity-50 transition-all shadow-sm"
+              >
+                <span className={`material-symbols-outlined text-[15px] ${isRunningSpeedtest ? 'animate-spin' : ''}`}>
+                  {isRunningSpeedtest ? 'sync' : 'speed'}
+                </span>
+                <span>{isRunningSpeedtest ? 'Testing...' : 'Run Speedtest'}</span>
+              </button>
+            </div>
           </div>
 
           <div className="grid grid-cols-2 gap-4 pt-2">
@@ -507,6 +566,55 @@ export function OperationsInfrastructure({ role }: OperationsInfrastructureProps
             </div>
           </div>
 
+          {isRunningSpeedtest && (
+            <div className="p-3.5 rounded-lg bg-surface-container-lowest border border-primary-container/30 flex items-center justify-between animate-pulse text-xs font-mono">
+              <div className="flex items-center gap-2 text-primary-fixed-dim">
+                <span className="material-symbols-outlined text-[18px] animate-spin">network_check</span>
+                <span>Benchmarking host latency and network throughput...</span>
+              </div>
+              <span className="text-outline">Live test</span>
+            </div>
+          )}
+
+          {speedtestError && (
+            <div className="p-3 rounded-lg bg-rose-950/40 border border-rose-800/40 text-xs text-rose-300 flex items-center gap-2">
+              <span className="material-symbols-outlined text-[16px]">error</span>
+              <span>{speedtestError}</span>
+            </div>
+          )}
+
+          {speedtestResult && !isRunningSpeedtest && (
+            <div className="p-3.5 rounded-lg bg-surface-container-lowest border border-outline-variant/20 space-y-2.5">
+              <div className="flex items-center justify-between text-xs">
+                <div className="flex items-center gap-1.5 font-bold text-on-surface">
+                  <span className="material-symbols-outlined text-[16px] text-emerald-400">speed</span>
+                  <span>Live Network Speedtest</span>
+                </div>
+                <span className="text-[10px] font-mono text-outline">
+                  {new Date(speedtestResult.tested_at).toLocaleTimeString()}
+                </span>
+              </div>
+              <div className="grid grid-cols-3 gap-2 text-center">
+                <div className="p-2 rounded bg-surface-container-low border border-outline-variant/10">
+                  <span className="block text-[10px] text-outline font-mono">LATENCY</span>
+                  <span className="text-sm font-bold font-mono text-emerald-400">{speedtestResult.latency_ms} ms</span>
+                </div>
+                <div className="p-2 rounded bg-surface-container-low border border-outline-variant/10">
+                  <span className="block text-[10px] text-outline font-mono">DOWNLOAD</span>
+                  <span className="text-sm font-bold font-mono text-cyan-400">{speedtestResult.download_mbps} Mbps</span>
+                </div>
+                <div className="p-2 rounded bg-surface-container-low border border-outline-variant/10">
+                  <span className="block text-[10px] text-outline font-mono">UPLOAD</span>
+                  <span className="text-sm font-bold font-mono text-primary-container">{speedtestResult.upload_mbps} Mbps</span>
+                </div>
+              </div>
+              <div className="text-[10px] font-mono text-outline flex items-center justify-between pt-1">
+                <span>Target: {speedtestResult.server_target}</span>
+                {speedtestResult.client_ip && <span>IP: {speedtestResult.client_ip}</span>}
+              </div>
+            </div>
+          )}
+
           <div className="p-2.5 rounded-lg bg-surface-container-lowest/60 border border-outline-variant/10 text-[11px] text-outline flex items-center gap-2">
             <span className="material-symbols-outlined text-[14px] text-primary-fixed-dim">
               info
diff --git a/website/components/ops/operations-overview.tsx b/website/components/ops/operations-overview.tsx
index 1b8f5f9..0ab2a50 100644
--- a/website/components/ops/operations-overview.tsx
+++ b/website/components/ops/operations-overview.tsx
@@ -372,6 +372,38 @@ export function OperationsOverview({
                 {overview ? overview.activity.mobile_datapoints_24h.toLocaleString() : '--'}
               </span>
             </div>
+            <div className="p-4 sm:p-5 rounded-xl bg-surface-container-lowest border border-outline-variant/20 flex flex-col justify-between">
+              <span className="block text-xs font-mono text-outline mb-1 font-semibold whitespace-nowrap">
+                24h Distance
+              </span>
+              <span className="text-2xl sm:text-3xl font-extrabold font-mono text-cyan-400">
+                {overview?.activity.mobile_distance_miles_24h !== undefined ? `${overview.activity.mobile_distance_miles_24h} mi` : '--'}
+              </span>
+            </div>
+            <div className="p-4 sm:p-5 rounded-xl bg-surface-container-lowest border border-outline-variant/20 flex flex-col justify-between">
+              <span className="block text-xs font-mono text-outline mb-1 font-semibold whitespace-nowrap">
+                Top Speed Today
+              </span>
+              <span className="text-2xl sm:text-3xl font-extrabold font-mono text-amber-400">
+                {overview?.activity.mobile_top_speed_mph_today !== undefined ? `${overview.activity.mobile_top_speed_mph_today} mph` : '--'}
+              </span>
+            </div>
+            <div className="p-4 sm:p-5 rounded-xl bg-surface-container-lowest border border-outline-variant/20 flex flex-col justify-between">
+              <span className="block text-xs font-mono text-outline mb-1 font-semibold whitespace-nowrap">
+                Avg Speed Today
+              </span>
+              <span className="text-2xl sm:text-3xl font-extrabold font-mono text-on-surface">
+                {overview?.activity.mobile_avg_speed_mph_today !== undefined ? `${overview.activity.mobile_avg_speed_mph_today} mph` : '--'}
+              </span>
+            </div>
+            <div className="p-4 sm:p-5 rounded-xl bg-surface-container-lowest border border-outline-variant/20 flex flex-col justify-between">
+              <span className="block text-xs font-mono text-outline mb-1 font-semibold whitespace-nowrap">
+                Ingress Rate
+              </span>
+              <span className="text-2xl sm:text-3xl font-extrabold font-mono text-emerald-400">
+                {overview?.activity.mobile_ingress_rate_hz !== undefined ? `${overview.activity.mobile_ingress_rate_hz} Hz` : '20 Hz'}
+              </span>
+            </div>
           </div>
         </section>
       </div>
@@ -458,12 +490,17 @@ export function OperationsOverview({
                 Security Error &amp; Denial Stream
               </h2>
               <p className="text-xs sm:text-sm text-on-surface-variant">
-                Live monitoring of unauthorized attempts and subsystem operation failures
+                Live monitoring of unauthorized attempts, PHP probes, and subsystem errors
               </p>
             </div>
           </div>
 
-          <div className="flex items-center gap-2.5">
+          <div className="flex flex-wrap items-center gap-2.5">
+            {overview?.errors.php_probes_24h !== undefined && (
+              <span className="text-xs font-mono px-3 py-1 rounded-md bg-purple-950/60 text-purple-300 border border-purple-800/60 font-bold">
+                {overview.errors.php_probes_24h} PHP Probes (24h)
+              </span>
+            )}
             <span className="text-xs font-mono px-3 py-1 rounded-md bg-rose-950/60 text-rose-400 border border-rose-800/60 font-bold">
               {overview?.errors.denials_24h ?? 0} Denials (24h)
             </span>
@@ -483,18 +520,20 @@ export function OperationsOverview({
                 <div className="flex items-center gap-3">
                   <span
                     className={`px-2.5 py-1 rounded-md text-xs font-mono font-semibold capitalize ${
-                      err.result === 'denied'
+                      err.action === 'nginx.php_probe'
+                        ? 'bg-purple-950/60 text-purple-300 border border-purple-800/60'
+                        : err.result === 'denied'
                         ? 'bg-rose-950/60 text-rose-400 border border-rose-800/60'
                         : 'bg-amber-950/60 text-amber-400 border border-amber-800/60'
                     }`}
                   >
-                    {err.result}
+                    {err.action === 'nginx.php_probe' ? 'php probe' : err.result}
                   </span>
                   <span className="font-mono font-bold text-on-surface">
                     {err.action}
                   </span>
                   <span className="text-on-surface-variant font-mono text-xs">
-                    by {err.actor_identity}
+                    {err.action === 'nginx.php_probe' ? `from ${err.actor_identity}` : `by ${err.actor_identity}`}
                   </span>
                 </div>
 
diff --git a/website/components/ops/operations-users.tsx b/website/components/ops/operations-users.tsx
index a57a466..35e3c12 100644
--- a/website/components/ops/operations-users.tsx
+++ b/website/components/ops/operations-users.tsx
@@ -40,6 +40,76 @@ export function OperationsUsers({ role: _role }: OperationsUsersProps) {
   const [actionError, setActionError] = useState<string | null>(null);
   const [actionSuccessMessage, setActionSuccessMessage] = useState<string | null>(null);
 
+  // Add User Modal State
+  const [isAddUserOpen, setIsAddUserOpen] = useState(false);
+  const [addEmail, setAddEmail] = useState('');
+  const [addDisplayName, setAddDisplayName] = useState('');
+  const [addPassword, setAddPassword] = useState('');
+  const [addRole, setAddRole] = useState<'user' | 'operator'>('user');
+  const [addEmailVerified, setAddEmailVerified] = useState(false);
+  const [addReason, setAddReason] = useState('Manual account provisioned by operator');
+  const [isSubmittingAddUser, setIsSubmittingAddUser] = useState(false);
+  const [addUserError, setAddUserError] = useState<string | null>(null);
+
+  async function handleAddUserSubmit(e: React.FormEvent) {
+    e.preventDefault();
+    if (isSubmittingAddUser) return;
+    if (!addEmail.trim() || !addEmail.includes('@')) {
+      setAddUserError('Valid email is required.');
+      return;
+    }
+    if (addPassword.length < 8) {
+      setAddUserError('Password must be at least 8 characters.');
+      return;
+    }
+    if (addReason.trim().length < 3) {
+      setAddUserError('Reason must be at least 3 characters.');
+      return;
+    }
+
+    setIsSubmittingAddUser(true);
+    setAddUserError(null);
+
+    try {
+      const resp = await fetch('/api/ops/users', {
+        method: 'POST',
+        headers: {
+          'content-type': 'application/json',
+          accept: 'application/json',
+        },
+        body: JSON.stringify({
+          email: addEmail.trim(),
+          display_name: addDisplayName.trim() || null,
+          password: addPassword,
+          role: addRole,
+          email_verified: addEmailVerified,
+          reason: addReason.trim(),
+        }),
+      });
+
+      if (!resp.ok) {
+        const data = await resp.json().catch(() => null);
+        setAddUserError(data?.detail || 'Failed to create user');
+        setIsSubmittingAddUser(false);
+        return;
+      }
+
+      setIsAddUserOpen(false);
+      setAddEmail('');
+      setAddDisplayName('');
+      setAddPassword('');
+      setAddRole('user');
+      setAddEmailVerified(false);
+      setAddReason('Manual account provisioned by operator');
+      setActionSuccessMessage(`User ${addEmail.trim()} created successfully.`);
+      void fetchUsers();
+    } catch {
+      setAddUserError('Network error connecting to Operations platform.');
+    } finally {
+      setIsSubmittingAddUser(false);
+    }
+  }
+
   // Fetch users list
   const fetchUsers = useCallback(
     async (cursor?: string) => {
@@ -316,6 +386,18 @@ export function OperationsUsers({ role: _role }: OperationsUsersProps) {
         </div>
 
         <div className="flex items-center gap-2 shrink-0">
+          <button
+            type="button"
+            onClick={() => {
+              setIsAddUserOpen(true);
+              setAddUserError(null);
+            }}
+            className="inline-flex items-center gap-2 px-4 py-2.5 rounded-xl bg-primary-container text-on-primary-container hover:opacity-90 text-xs sm:text-sm font-semibold shadow-sm transition-all focus-visible:ring-2 focus-visible:ring-primary-container focus-visible:outline-none cursor-pointer"
+            title="Create a new user account"
+          >
+            <span className="material-symbols-outlined text-[18px]">person_add</span>
+            <span>Add User</span>
+          </button>
           <button
             type="button"
             onClick={() => fetchUsers()}
@@ -1058,6 +1140,164 @@ export function OperationsUsers({ role: _role }: OperationsUsersProps) {
           </div>
         </div>
       )}
+
+      {/* Add User Modal */}
+      {isAddUserOpen && (
+        <div
+          role="dialog"
+          aria-modal="true"
+          aria-labelledby="add-user-title"
+          className="fixed inset-0 z-60 flex items-center justify-center bg-black/70 backdrop-blur-sm p-4"
+          onKeyDown={(e) => {
+            if (e.key === 'Escape' && !isSubmittingAddUser) {
+              setIsAddUserOpen(false);
+            }
+          }}
+        >
+          <div className="w-full max-w-lg bg-surface-container-lowest border border-outline-variant/40 rounded-2xl p-6 shadow-2xl space-y-4 animate-in zoom-in-95 duration-150">
+            <div className="flex items-start justify-between gap-2 border-b border-outline-variant/20 pb-3">
+              <div className="flex items-center gap-2.5">
+                <div className="w-8 h-8 rounded-lg bg-surface-container-high border border-outline-variant/30 flex items-center justify-center text-primary-container">
+                  <span className="material-symbols-outlined text-[20px]">person_add</span>
+                </div>
+                <div>
+                  <h3 id="add-user-title" className="text-base font-bold text-on-surface font-headline-sm">
+                    Add New User Account
+                  </h3>
+                  <p className="text-xs text-on-surface-variant">
+                    Provision credentials with audit tracking and role assignment.
+                  </p>
+                </div>
+              </div>
+              <button
+                type="button"
+                onClick={() => setIsAddUserOpen(false)}
+                disabled={isSubmittingAddUser}
+                className="text-outline hover:text-on-surface p-1 rounded-lg"
+              >
+                <span className="material-symbols-outlined text-[20px]">close</span>
+              </button>
+            </div>
+
+            <form onSubmit={handleAddUserSubmit} className="space-y-4">
+              {addUserError && (
+                <div className="p-3 rounded-xl bg-error-container/20 border border-error/30 text-error text-xs flex items-center gap-2">
+                  <span className="material-symbols-outlined text-[16px]">error</span>
+                  <span>{addUserError}</span>
+                </div>
+              )}
+
+              <div>
+                <label className="block text-xs font-mono font-medium text-outline mb-1">
+                  Email Address *
+                </label>
+                <input
+                  type="email"
+                  required
+                  value={addEmail}
+                  onChange={(e) => setAddEmail(e.target.value)}
+                  placeholder="rider@example.com"
+                  className="w-full bg-surface-container px-3 py-2 rounded-lg border border-outline-variant/30 text-xs font-mono text-on-surface focus-visible:ring-2 focus-visible:ring-primary-container focus-visible:outline-none"
+                />
+              </div>
+
+              <div>
+                <label className="block text-xs font-mono font-medium text-outline mb-1">
+                  Display Name (Optional)
+                </label>
+                <input
+                  type="text"
+                  value={addDisplayName}
+                  onChange={(e) => setAddDisplayName(e.target.value)}
+                  placeholder="Alex Rider"
+                  className="w-full bg-surface-container px-3 py-2 rounded-lg border border-outline-variant/30 text-xs font-mono text-on-surface focus-visible:ring-2 focus-visible:ring-primary-container focus-visible:outline-none"
+                />
+              </div>
+
+              <div>
+                <label className="block text-xs font-mono font-medium text-outline mb-1">
+                  Initial Password * (min 8 characters)
+                </label>
+                <input
+                  type="password"
+                  required
+                  minLength={8}
+                  value={addPassword}
+                  onChange={(e) => setAddPassword(e.target.value)}
+                  placeholder="••••••••••••"
+                  className="w-full bg-surface-container px-3 py-2 rounded-lg border border-outline-variant/30 text-xs font-mono text-on-surface focus-visible:ring-2 focus-visible:ring-primary-container focus-visible:outline-none"
+                />
+              </div>
+
+              <div className="grid grid-cols-2 gap-4">
+                <div>
+                  <label className="block text-xs font-mono font-medium text-outline mb-1">
+                    Account Role *
+                  </label>
+                  <select
+                    value={addRole}
+                    onChange={(e) => setAddRole(e.target.value as 'user' | 'operator')}
+                    className="w-full bg-surface-container px-3 py-2 rounded-lg border border-outline-variant/30 text-xs font-mono text-on-surface focus-visible:ring-2 focus-visible:ring-primary-container focus-visible:outline-none"
+                  >
+                    <option value="user">User (Standard Rider)</option>
+                    <option value="operator">Operator (Staff / Console)</option>
+                  </select>
+                </div>
+
+                <div className="flex items-center gap-2 pt-6">
+                  <input
+                    type="checkbox"
+                    id="addEmailVerified"
+                    checked={addEmailVerified}
+                    onChange={(e) => setAddEmailVerified(e.target.checked)}
+                    className="rounded border-outline-variant/40 bg-surface-container text-primary-container focus:ring-primary-container h-4 w-4"
+                  />
+                  <label htmlFor="addEmailVerified" className="text-xs font-mono text-on-surface cursor-pointer">
+                    Mark Email Verified
+                  </label>
+                </div>
+              </div>
+
+              <div>
+                <label className="block text-xs font-mono font-medium text-outline mb-1">
+                  Reason for Account Creation (Audit Log) *
+                </label>
+                <input
+                  type="text"
+                  required
+                  value={addReason}
+                  onChange={(e) => setAddReason(e.target.value)}
+                  placeholder="Reason / ticket reference..."
+                  className="w-full bg-surface-container px-3 py-2 rounded-lg border border-outline-variant/30 text-xs font-mono text-on-surface focus-visible:ring-2 focus-visible:ring-primary-container focus-visible:outline-none"
+                />
+              </div>
+
+              <div className="flex items-center justify-end gap-3 pt-3 border-t border-outline-variant/20">
+                <button
+                  type="button"
+                  onClick={() => setIsAddUserOpen(false)}
+                  disabled={isSubmittingAddUser}
+                  className="px-4 py-2 rounded-lg text-xs font-semibold text-on-surface-variant hover:bg-surface-container-high transition-colors"
+                >
+                  Cancel
+                </button>
+                <button
+                  type="submit"
+                  disabled={isSubmittingAddUser}
+                  className="px-4 py-2 rounded-lg text-xs font-semibold bg-primary-container text-on-primary-container hover:opacity-90 transition-all flex items-center gap-2"
+                >
+                  {isSubmittingAddUser && (
+                    <span className="material-symbols-outlined text-[14px] animate-spin">
+                      progress_activity
+                    </span>
+                  )}
+                  <span>Create User</span>
+                </button>
+              </div>
+            </form>
+          </div>
+        </div>
+      )}
     </div>
   );
 }
diff --git a/website/components/ops/types.ts b/website/components/ops/types.ts
index 2a8c775..e857bfd 100644
--- a/website/components/ops/types.ts
+++ b/website/components/ops/types.ts
@@ -144,6 +144,10 @@ export interface OverviewPlatformActivity {
   mobile_rides_today: number;
   mobile_rides_active: number;
   mobile_datapoints_24h: number;
+  mobile_distance_miles_24h?: number;
+  mobile_top_speed_mph_today?: number;
+  mobile_avg_speed_mph_today?: number;
+  mobile_ingress_rate_hz?: number;
 }
 
 export interface OverviewIncidentMetrics {
@@ -168,9 +172,21 @@ export interface OverviewSecurityErrorItem {
 export interface OverviewSecurityErrors {
   errors_24h: number;
   denials_24h: number;
+  php_probes_24h?: number;
   recent: OverviewSecurityErrorItem[];
 }
 
+export interface InfrastructureSpeedtestResult {
+  status: 'completed' | 'degraded' | 'failed';
+  tested_at: string;
+  latency_ms: number;
+  download_mbps: number;
+  upload_mbps: number;
+  server_target: string;
+  client_ip?: string;
+  error_message?: string;
+}
+
 export interface OperationsOverviewData {
   generated_at: string;
   users: OverviewUsersMetrics;