diff --git a/package-lock.json b/package-lock.json
index e5a9a42cd..d9efbc54a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,7 +9,7 @@
       "version": "0.1.0",
       "license": "EUPL-1.2",
       "dependencies": {
-        "@conduction/nextcloud-vue": "^2.19.0",
+        "@conduction/nextcloud-vue": "^2.21.0",
         "@nextcloud/auth": "^2.6.0",
         "@nextcloud/axios": "~2.5.2",
         "@nextcloud/capabilities": "^1.2.1",
@@ -655,9 +655,9 @@
       }
     },
     "node_modules/@conduction/nextcloud-vue": {
-      "version": "2.19.0",
-      "resolved": "https://registry.npmjs.org/@conduction/nextcloud-vue/-/nextcloud-vue-2.19.0.tgz",
-      "integrity": "sha512-gSLl4RZ7hy1e2TBuzYZLiTLBMggRYgfuxFMva59JBhb1EP93GgvEd/HpQcg+zoBL9FJPgJw9ir2OGf9Tore7og==",
+      "version": "2.21.0",
+      "resolved": "https://registry.npmjs.org/@conduction/nextcloud-vue/-/nextcloud-vue-2.21.0.tgz",
+      "integrity": "sha512-5HjI4X8k2IYxUeBdHa2OK/MnLhOFf4HxkF5dUGl42dWmYPDaPHjvawDMZcUcyP6wsP+rk0QzmPov4FGu/4Rn7Q==",
       "license": "EUPL-1.2",
       "dependencies": {
         "@ckpack/vue-color": "^1.6.0",
@@ -719,7 +719,7 @@
         "dompurify": "^3.0.0",
         "eslint": "^8.56.0 || ^9.0.0 || ^10.0.0",
         "eslint-plugin-vue": "^9.21.0 || ^10.0.0",
-        "gridstack": "^12.0.0",
+        "gridstack": "^12.0.0 || ^13.0.0",
         "marked": "^12.0.0",
         "pinia": "^2.0.0 || ^3.0.0",
         "vue": "^3.5.0",
diff --git a/package.json b/package.json
index d8d80d56a..dd8214d83 100644
--- a/package.json
+++ b/package.json
@@ -35,7 +35,7 @@
     "extends @nextcloud/browserslist-config"
   ],
   "dependencies": {
-    "@conduction/nextcloud-vue": "^2.19.0",
+    "@conduction/nextcloud-vue": "^2.21.0",
     "@nextcloud/auth": "^2.6.0",
     "@nextcloud/axios": "~2.5.2",
     "@nextcloud/capabilities": "^1.2.1",
diff --git a/src/manifest.json b/src/manifest.json
index d503d6687..4e13bf32e 100644
--- a/src/manifest.json
+++ b/src/manifest.json
@@ -1205,15 +1205,15 @@
 		{
 			"id": "Flows",
 			"route": "/flows",
-			"type": "flows",
+			"type": "index",
 			"title": "Flows",
-			"config": { "app": "decidiq" },
-			"_note": "ADR-110 Decision 4: a flow is app-specific, so the authoring surface lives here rather than behind a deep link to another app's list. Rendered by the shared CnFlowsPage page type over OpenRegister's one native flow store (ADR-065), scoped to this app."
+			"config": { "entitySource": "flows", "app": "decidiq" },
+			"_note": "ADR-110 Decision 4: a flow is app-specific, so the authoring surface lives here rather than behind a deep link to another app's list. An ordinary index over the named `flows` source (config.entitySource) rather than the deprecated `flows` page type, reading OpenRegister's one native flow store (ADR-065), scoped to this app by config.app."
 		},
 		{
 			"id": "FlowDetail",
 			"route": "/flows/:id",
-			"type": "flow-detail",
+			"type": "flow",
 			"title": "Flow",
 			"config": { "app": "decidiq" },
 			"_note": "The shared CnFlowDetail canvas over the same single engine. Controls render in the NC app sidebar so the canvas keeps full width."
diff --git a/tests/validate-manifest.js b/tests/validate-manifest.js
index 1f39ef1ba..5756a9dcc 100644
--- a/tests/validate-manifest.js
+++ b/tests/validate-manifest.js
@@ -33,9 +33,21 @@ const REPO_ROOT = path.resolve(__dirname, '..')
 
 const MANIFEST_PATH = path.join(REPO_ROOT, 'src', 'manifest.json')
 
+// THE INSTALLED SCHEMA WINS OVER THE VENDORED COPY.
+//
+// It used to be the other way round, and that ordering is a drift machine: the
+// vendored copy shadows the one the shipped runtime actually enforces, so the
+// check keeps passing against a snapshot of the rules while the rules move.
+// Measured here — the vendored copy sat at 2.25.0 and rejected `type: "flow"`,
+// which the installed package's schema (2.26.0) accepts and the runtime
+// registers. The manifest was right and the check was reading an older grammar.
+//
+// A manifest has to satisfy the schema its own dependency ships. The vendored
+// copy stays as a fallback for a tree with no node_modules — a fresh checkout,
+// a CI leg that skips install — but it no longer gets to overrule what is
+// installed.
 const SCHEMA_CANDIDATES = [
 	process.env.APP_MANIFEST_SCHEMA,
-	path.join(REPO_ROOT, 'tests', 'schemas', 'app-manifest-v2.schema.json'),
 	path.join(
 		REPO_ROOT,
 		'node_modules',
@@ -45,6 +57,7 @@ const SCHEMA_CANDIDATES = [
 		'schemas',
 		'app-manifest-v2.schema.json',
 	),
+	path.join(REPO_ROOT, 'tests', 'schemas', 'app-manifest-v2.schema.json'),
 	path.join(
 		REPO_ROOT,
 		'..',