diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index cdf296a..fb15aa8 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -97,6 +97,14 @@ jobs:
       - name: Build (mcp package — dist for the smoke imports)
         run: pnpm --filter @coreci/mcp build
 
+      # The app build is the M2 gate's missing leg (coreci-chat#10): `next
+      # build` is the only check that proves the App Router tree (root layout,
+      # route handlers, pages) compiles. The workspace packages are built
+      # above because the app resolves @coreci/db, @coreci/auth,
+      # @coreci/secrets and @coreci/mcp through their published dist/*.d.ts.
+      - name: Build (control-plane app - next build)
+        run: pnpm --filter @coreci/control-plane build
+
       - name: "[G-018,R-008] Import guard (no @coreci/llm-mock in prod source)"
         run: pnpm check:llm-mock-guard
 
@@ -130,6 +138,14 @@ jobs:
       - name: Upload coverage artifacts
         uses: actions/upload-artifact@v4
         if: always()
+        # @coreci-cpo's one-step tolerance, scoped to THIS step only
+        # (coreci-chat#1): the runner's artifact endpoint answers
+        # ECONNREFUSED from the shared pool, so the upload leg - and
+        # only the upload leg - reds the job. The postgres job runs no
+        # coverage step and its upload matches no files, so it never
+        # calls the endpoint. Every other step in both jobs still
+        # gates.
+        continue-on-error: true
         with:
           name: coverage-pglite
           path: |
diff --git a/apps/control-plane/next.config.mjs b/apps/control-plane/next.config.mjs
index 794afe5..ecf8de3 100644
--- a/apps/control-plane/next.config.mjs
+++ b/apps/control-plane/next.config.mjs
@@ -1,5 +1,22 @@
 /** @type {import('next').NextConfig} */
 const nextConfig = {
-  transpilePackages: ["@coreci/db", "@coreci/auth", "@coreci/audit", "@coreci/secrets", "@coreci/config", "@coreci/runtime", "@coreci/byom"],
+  transpilePackages: ["@coreci/db", "@coreci/auth", "@coreci/secrets", "@coreci/config", "@coreci/runtime", "@coreci/byom"],
+  // The app follows the repo-wide ESM import convention - a "./x.js" specifier
+  // for a "./x.ts" source - like every package in this repo. TypeScript
+  // resolves that convention (moduleResolution: bundler); the bundler does
+  // not, so `next build` failed with "Module not found: Can't resolve
+  // '../../../../lib/db.js'". resolve.extensionAlias maps a ".js" request to
+  // the ".ts"/".tsx" source behind it, so the bundler honours the same
+  // convention the type-checker and the packages already do - one
+  // resolver-level change, no import churn.
+  webpack: (config) => {
+    config.resolve.extensionAlias = {
+      ...config.resolve.extensionAlias,
+      ".js": [".ts", ".tsx", ".js"],
+      ".mjs": [".mts", ".mjs"],
+      ".cjs": [".cts", ".cjs"],
+    };
+    return config;
+  },
 };
-export default nextConfig;
\ No newline at end of file
+export default nextConfig;