diff --git a/custom/static-plugins/Composer/src/Resources/app/admin/src/CanvasSection.vue b/custom/static-plugins/Composer/src/Resources/app/admin/src/CanvasSection.vue
index 9c058de1..0d5cb4d5 100644
--- a/custom/static-plugins/Composer/src/Resources/app/admin/src/CanvasSection.vue
+++ b/custom/static-plugins/Composer/src/Resources/app/admin/src/CanvasSection.vue
@@ -1,6 +1,8 @@
 <script setup lang="ts">
 import { computed } from 'vue'
 import type { LayoutBlock, LayoutSection } from './layout-document'
+import type { SectionLayout } from './preview-assets'
+import { regionsOf } from './section-layouts'
 
 /**
  * Eine Sektion des Canvas mit ihren Blöcken.
@@ -25,6 +27,8 @@ const props = defineProps<{
   sectionIndex: number
   /** Registrierte Blöcke nach id. Ein Block, dessen Plugin nicht geladen ist, fehlt hier. */
   components: Record<string, unknown>
+  /** Die Sektionslayouts des Themes — sie sagen, welche Regionen es gibt. */
+  layouts: readonly SectionLayout[]
   /** Der ausgewählte Block, sofern er in dieser Sektion liegt. */
   selectedBlockIndex: number | null
 }>()
@@ -37,20 +41,26 @@ interface PlacedBlock {
   index: number
 }
 
+/**
+ * Alle Regionen des Layouts, auch die leeren.
+ *
+ * Eine leere Region muss sichtbar sein, sonst gibt es keinen Ort, an den man etwas ziehen
+ * könnte — und eine zweispaltige Sektion mit einer leeren Spalte sähe aus wie eine einspaltige.
+ */
 const regions = computed(() => {
-  const grouped = new Map<string, PlacedBlock[]>()
+  const placed = new Map<string, PlacedBlock[]>()
   props.section.blocks.forEach((block, index) => {
-    const list = grouped.get(block.region) ?? []
+    const list = placed.get(block.region) ?? []
     list.push({ block, index })
-    grouped.set(block.region, list)
+    placed.set(block.region, list)
   })
 
-  return [...grouped.entries()]
-    .sort(([a], [b]) => a.localeCompare(b))
-    .map(([region, placed]) => ({
-      region,
-      blocks: [...placed].sort((a, b) => a.block.position - b.block.position),
-    }))
+  return regionsOf(props.section, props.layouts).map((region) => ({
+    ...region,
+    blocks: [...(placed.get(region.regionKey) ?? [])].sort(
+      (a, b) => a.block.position - b.block.position,
+    ),
+  }))
 })
 
 /**
@@ -77,8 +87,14 @@ function propsFor(block: LayoutBlock): Record<string, unknown> {
     :data-cal-spacing="section.spacing"
     :data-cal-surface="section.surfaceRole"
   >
-    <div v-for="group in regions" :key="group.region" class="cal-region" :data-cal-region="group.region">
-      <template v-for="placed in group.blocks" :key="placed.index">
+    <div
+      v-for="region in regions"
+      :key="region.regionKey"
+      class="cal-region"
+      :data-cal-region="region.regionKey"
+      :data-cal-editor-undeclared="region.declared ? undefined : 'true'"
+    >
+      <template v-for="placed in region.blocks" :key="placed.index">
         <component
           :is="components[placed.block.blockId]"
           v-if="components[placed.block.blockId]"
@@ -104,6 +120,16 @@ function propsFor(block: LayoutBlock): Record<string, unknown> {
           {{ placed.block.blockId }}
         </div>
       </template>
+
+      <p v-if="region.blocks.length === 0" class="cal-canvas__region-empty">{{ region.label }}</p>
+      <!--
+        Eine Region, die das Layout nicht (mehr) deklariert. Ihre Blöcke stehen weiter im
+        Dokument und kommen zurück, sobald das Theme die Region wieder mitbringt — sie zu
+        verstecken hieße, Inhalt zu verstecken.
+      -->
+      <p v-else-if="!region.declared" class="cal-canvas__region-orphan">
+        Region „{{ region.regionKey }}" gibt es in diesem Layout nicht.
+      </p>
     </div>
   </div>
 </template>
diff --git a/custom/static-plugins/Composer/src/Resources/app/admin/src/ComposerAdminPage.spec.ts b/custom/static-plugins/Composer/src/Resources/app/admin/src/ComposerAdminPage.spec.ts
index da4f458a..04ebd7fa 100644
--- a/custom/static-plugins/Composer/src/Resources/app/admin/src/ComposerAdminPage.spec.ts
+++ b/custom/static-plugins/Composer/src/Resources/app/admin/src/ComposerAdminPage.spec.ts
@@ -17,10 +17,13 @@ vi.mock('@callora/surface', () => ({
 }))
 
 const fetchSurfaceStyles = vi.fn(async () => '.cal-header { color: red }')
-const fetchThemeTokens = vi.fn(async () => ({ 'color-primary': '#123456' }))
+const fetchTheme = vi.fn(async () => ({
+  valuesByKey: { 'color-primary': '#123456' },
+  sectionLayouts: [],
+}))
 vi.mock('./preview-assets', () => ({
   fetchSurfaceStyles: (...args: unknown[]) => fetchSurfaceStyles(...args),
-  fetchThemeTokens: (...args: unknown[]) => fetchThemeTokens(...args),
+  fetchTheme: (...args: unknown[]) => fetchTheme(...args),
 }))
 
 function draftResponse(surfaceKey: string | null) {
@@ -115,7 +118,7 @@ describe('ComposerAdminPage', () => {
     const wrapper = await loadLayout('kiosk')
 
     expect(fetchSurfaceStyles).toHaveBeenCalledWith(['/plugin-assets/voip/app/workspace/main.css'])
-    expect(fetchThemeTokens).toHaveBeenCalledWith('acme')
+    expect(fetchTheme).toHaveBeenCalledWith('acme')
     const canvas = wrapper.findComponent({ name: 'ComposerCanvas' })
     expect(canvas.props('surfaceCss')).toContain('--cal-color-fg')
     expect(canvas.props('surfaceCss')).toContain('.cal-header { color: red }')
diff --git a/custom/static-plugins/Composer/src/Resources/app/admin/src/ComposerAdminPage.vue b/custom/static-plugins/Composer/src/Resources/app/admin/src/ComposerAdminPage.vue
index afe021dd..a1d145a8 100644
--- a/custom/static-plugins/Composer/src/Resources/app/admin/src/ComposerAdminPage.vue
+++ b/custom/static-plugins/Composer/src/Resources/app/admin/src/ComposerAdminPage.vue
@@ -9,14 +9,17 @@ import {
 } from '@callora/surface'
 import ComposerCanvas from './ComposerCanvas.vue'
 import BlockInspector from './BlockInspector.vue'
-import { fetchSurfaceStyles, fetchThemeTokens } from './preview-assets'
+import { fetchSurfaceStyles, fetchTheme, type SectionLayout } from './preview-assets'
+import { sectionsWithUnknownLayout, themeDeclaresLayouts } from './section-layouts'
 import { collectTokenRoles } from './token-roles'
 import {
+  addSection,
   blockAt,
   clearBlockBinding,
   emptyDocument,
   readDocument,
   setBlockBinding,
+  setSectionLayout,
   type BlockAddress,
   type LayoutDocument,
 } from './layout-document'
@@ -48,6 +51,7 @@ const document = ref<LayoutDocument>(emptyDocument())
 const changedAtUtc = ref<string | null>(null)
 const surfaceCss = ref('')
 const tokens = ref<Record<string, string>>({})
+const sectionLayouts = ref<SectionLayout[]>([])
 const bundleFailures = ref<PluginLoadResult[]>([])
 const selected = ref<BlockAddress | null>(null)
 const editing = ref(true)
@@ -132,12 +136,39 @@ async function loadPreview(loaded: LoadedLayout): Promise<void> {
 
   bundleFailures.value = bundles.results.filter((result) => result.status === 'error')
 
-  const [css, themeValues] = await Promise.all([
+  const [css, theme] = await Promise.all([
     fetchSurfaceStyles(bundles.styles),
-    fetchThemeTokens(loaded.workspaceKey),
+    fetchTheme(loaded.workspaceKey),
   ])
   surfaceCss.value = css
-  tokens.value = themeValues
+  tokens.value = theme.valuesByKey
+  sectionLayouts.value = theme.sectionLayouts
+}
+
+/**
+ * Sektionen, deren Layout dieses Theme nicht kennt (§7.8).
+ *
+ * Serverseitig fallen sie beim Rendern auf `single` zurück. Hier zu zeigen, WELCHE es trifft,
+ * ist der Unterschied zwischen „meine Seite sieht anders aus" und „diese Sektionen hängen an
+ * einem Layout, das das neue Theme nicht mitbringt".
+ */
+const strandedSections = computed(() =>
+  sectionsWithUnknownLayout(document.value, sectionLayouts.value),
+)
+
+/** Ob das Theme überhaupt Layouts anbietet — ohne sie lässt sich keine Sektion anlegen. */
+const hasLayouts = computed(() => themeDeclaresLayouts(sectionLayouts.value))
+
+function appendSection(layoutKey: string): void {
+  document.value = addSection(document.value, layoutKey)
+}
+
+function changeSectionLayout(sectionIndex: number, layoutKey: string): void {
+  // Die Blöcke bleiben, wo sie sind. Sie umzuhängen wäre die scheinbar hilfreiche Variante und
+  // die, die Arbeit vernichtet: Wer ein Layout ausprobiert und zurückwechselt, fände seine
+  // Seitenspalte im Hauptbereich wieder.
+  document.value = setSectionLayout(document.value, sectionIndex, layoutKey)
+  selected.value = null
 }
 
 function changeBinding(control: string, binding: Binding<unknown>): void {
@@ -264,11 +295,72 @@ function draftUrl(key: string): string {
         <span class="composer__status">{{ saving ? 'Wird gespeichert …' : '' }}</span>
       </div>
 
+      <!--
+        Die Layouts kommen aus dem Theme, nicht aus dem Editor (§7.1). Angeboten wird
+        ausschließlich, was das Theme stylen kann — so bleibt die Token-Achse die
+        Design-Autorität, und es steht kein Layout-Name im Core.
+      -->
+      <div class="composer__sections">
+        <label for="composer-new-section">Sektion hinzufügen</label>
+        <select
+          id="composer-new-section"
+          :disabled="!hasLayouts"
+          @change="appendSection(($event.target as HTMLSelectElement).value)"
+        >
+          <option value="">Layout wählen …</option>
+          <option v-for="layout in sectionLayouts" :key="layout.layoutKey" :value="layout.layoutKey">
+            {{ layout.label }}
+          </option>
+        </select>
+        <!--
+          Kein Layout heißt nicht „Editor kaputt", sondern „dieses Theme bringt keine mit". Ohne
+          diesen Satz sucht jemand den Fehler im Editor.
+        -->
+        <!--
+          Der Server liefert immer mindestens die Basis-Layouts. Leer heißt hier also: Das
+          Theme war nicht erreichbar — nicht „dieses Theme kann keine".
+        -->
+        <p v-if="!hasLayouts" class="composer__status">
+          Die Sektionslayouts konnten nicht geladen werden.
+        </p>
+      </div>
+
+      <p v-if="strandedSections.length > 0" class="composer__hint" role="status">
+        {{ strandedSections.length }} Sektion(en) benutzen ein Layout, das dieses Theme nicht
+        kennt ({{ [...new Set(strandedSections.map((entry) => entry.section.layout))].join(', ') }}).
+        Sie werden einspaltig ausgeliefert; der Inhalt bleibt vollständig.
+      </p>
+
+      <ul v-if="document.sections.length > 0" class="composer__section-list">
+        <li v-for="(section, index) in document.sections" :key="index">
+          <label :for="`composer-section-${index}`">Sektion {{ index + 1 }}</label>
+          <select
+            :id="`composer-section-${index}`"
+            :value="section.layout"
+            @change="changeSectionLayout(index, ($event.target as HTMLSelectElement).value)"
+          >
+            <!--
+              Das aktuelle Layout steht auch dann in der Liste, wenn das Theme es nicht kennt.
+              Sonst zeigte die Auswahl etwas anderes an, als im Dokument steht, und der nächste
+              Klick irgendwohin änderte still das Layout.
+            -->
+            <option v-if="!sectionLayouts.some((l) => l.layoutKey === section.layout)"
+                    :value="section.layout">
+              {{ section.layout }} (unbekannt)
+            </option>
+            <option v-for="layout in sectionLayouts" :key="layout.layoutKey" :value="layout.layoutKey">
+              {{ layout.label }}
+            </option>
+          </select>
+        </li>
+      </ul>
+
       <div class="composer__workspace">
         <ComposerCanvas
           :document="document"
           :surface-css="canvasCss"
           :tokens="tokens"
+          :layouts="sectionLayouts"
           :selected="selected"
           :editing="editing"
           @select="selected = $event"
diff --git a/custom/static-plugins/Composer/src/Resources/app/admin/src/ComposerCanvas.vue b/custom/static-plugins/Composer/src/Resources/app/admin/src/ComposerCanvas.vue
index 396ca28f..975bb522 100644
--- a/custom/static-plugins/Composer/src/Resources/app/admin/src/ComposerCanvas.vue
+++ b/custom/static-plugins/Composer/src/Resources/app/admin/src/ComposerCanvas.vue
@@ -2,6 +2,7 @@
 import { computed, onMounted, watch } from 'vue'
 import CanvasSection from './CanvasSection.vue'
 import type { BlockAddress, LayoutDocument } from './layout-document'
+import type { SectionLayout } from './preview-assets'
 import {
   applyScopedSurfaceStyles,
   CANVAS_SCOPE,
@@ -23,6 +24,8 @@ const props = defineProps<{
   surfaceCss?: string
   /** Die Token des Themes, wie der Server sie rendern würde. */
   tokens?: Readonly<Record<string, string>>
+  /** Die Sektionslayouts des Themes — sie sagen, welche Regionen eine Sektion hat. */
+  layouts?: readonly SectionLayout[]
   /** Der ausgewählte Block. */
   selected?: BlockAddress | null
   /**
@@ -81,6 +84,7 @@ watch(() => [props.surfaceCss, props.tokens], applyStyles, { deep: true })
       :section="entry.section"
       :section-index="entry.index"
       :components="components"
+      :layouts="layouts ?? []"
       :selected-block-index="selectedIndexIn(entry.index)"
       @select="emit('select', { sectionIndex: entry.index, blockIndex: $event })"
     />
diff --git a/custom/static-plugins/Composer/src/Resources/app/admin/src/ComposerEditing.spec.ts b/custom/static-plugins/Composer/src/Resources/app/admin/src/ComposerEditing.spec.ts
index b82b3f97..d705674d 100644
--- a/custom/static-plugins/Composer/src/Resources/app/admin/src/ComposerEditing.spec.ts
+++ b/custom/static-plugins/Composer/src/Resources/app/admin/src/ComposerEditing.spec.ts
@@ -13,9 +13,30 @@ vi.mock('@callora/surface', () => ({
   surfaceBaseTokens: ':root { --cal-color-fg: #111; --cal-color-bg: #fff; --cal-space-4: 1rem }',
 }))
 
+// Inline statt über eine äußere Konstante: Die Factory läuft beim ersten Import des gemockten
+// Moduls, also bevor die Konstanten dieser Datei ausgewertet sind.
 vi.mock('./preview-assets', () => ({
   fetchSurfaceStyles: async () => '',
-  fetchThemeTokens: async () => ({}),
+  fetchTheme: async () => ({
+    valuesByKey: {},
+    sectionLayouts: [
+      {
+        layoutKey: 'single',
+        label: 'Eine Spalte',
+        regions: [{ regionKey: 'main', label: 'Inhalt' }],
+        sortOrder: 10,
+      },
+      {
+        layoutKey: 'two-2-1',
+        label: 'Zwei Spalten',
+        regions: [
+          { regionKey: 'main', label: 'Inhalt' },
+          { regionKey: 'aside', label: 'Seitenspalte' },
+        ],
+        sortOrder: 20,
+      },
+    ],
+  }),
 }))
 
 const HERO = {
@@ -204,6 +225,102 @@ describe('Blöcke auswählen und einstellen', () => {
   })
 })
 
+describe('Sektionslayouts aus dem Theme', () => {
+  it('bietet ausschließlich an, was das Theme deklariert', async () => {
+    // Der Guardrail aus §7.7: Sektionslayouts kommen aus dem Theme, nicht aus dem Editor. So
+    // bleibt die Token-Achse die Design-Autorität, und es steht kein Layout-Name im Core.
+    const wrapper = await openEditor()
+
+    const offered = wrapper
+      .find('#composer-new-section')
+      .findAll('option')
+      .map((option) => option.attributes('value'))
+
+    expect(offered).toEqual(['', 'single', 'two-2-1'])
+  })
+
+  it('legt eine Sektion mit dem gewählten Layout an und speichert sie', async () => {
+    const wrapper = await openEditor()
+
+    await wrapper.find('#composer-new-section').setValue('two-2-1')
+    await settleAutosave()
+
+    const body = savedBody(saves().length - 1)
+    expect(body.document.sections).toHaveLength(2)
+    expect(body.document.sections[1]).toMatchObject({ layout: 'two-2-1', position: 1, blocks: [] })
+  })
+
+  it('zeigt jede Region des Layouts, auch die leere', async () => {
+    // Ohne die leere Region gäbe es keinen Ort, an den sich etwas ziehen ließe — und eine
+    // zweispaltige Sektion mit leerer Spalte sähe aus wie eine einspaltige.
+    const wrapper = await openEditor()
+    await wrapper.find('#composer-new-section').setValue('two-2-1')
+
+    const regions = wrapper.findAll('[data-cal-region]').map((el) => el.attributes('data-cal-region'))
+
+    expect(regions).toContain('main')
+    expect(regions).toContain('aside')
+  })
+
+  it('behält beim Layout-Wechsel die Blöcke, wo sie sind', async () => {
+    // Der Block liegt in `aside`, und `single` hat diese Region nicht. Ihn nach `main`
+    // umzuhängen wäre die scheinbar hilfreiche Variante und die, die Arbeit vernichtet: Wer
+    // zurückwechselt, fände seine Seitenspalte im Hauptbereich wieder.
+    DOCUMENT.sections[0].layout = 'two-2-1'
+    DOCUMENT.sections[0].blocks[0].region = 'aside'
+    try {
+      const wrapper = await openEditor()
+
+      await wrapper.find('#composer-section-0').setValue('single')
+      await settleAutosave()
+
+      const body = savedBody(saves().length - 1)
+      expect(body.document.sections[0].layout).toBe('single')
+      expect(body.document.sections[0].blocks[0].region).toBe('aside')
+    } finally {
+      DOCUMENT.sections[0].layout = 'single'
+      DOCUMENT.sections[0].blocks[0].region = 'main'
+    }
+  })
+})
+
+describe('Wenn das Theme ein Layout nicht mehr kennt', () => {
+  it('nennt die gestrandeten Sektionen, statt sie nur anders aussehen zu lassen', async () => {
+    // Serverseitig fallen sie beim Rendern auf `single` zurück. Hier zu zeigen, WELCHE es
+    // trifft, ist der Unterschied zwischen „meine Seite sieht anders aus" und „diese Sektion
+    // hängt an einem Layout, das das neue Theme nicht mitbringt".
+    DOCUMENT.sections[0].layout = 'drei-spalten'
+    try {
+      const wrapper = await openEditor()
+
+      expect(wrapper.text()).toContain('drei-spalten')
+      expect(wrapper.text()).toContain('einspaltig ausgeliefert')
+    } finally {
+      DOCUMENT.sections[0].layout = 'single'
+    }
+  })
+
+  it('lässt das unbekannte Layout in der Auswahl stehen', async () => {
+    // Sonst zeigte die Auswahl etwas anderes an, als im Dokument steht, und der nächste Klick
+    // irgendwohin änderte still das Layout.
+    DOCUMENT.sections[0].layout = 'drei-spalten'
+    try {
+      const wrapper = await openEditor()
+
+      const options = wrapper
+        .find('#composer-section-0')
+        .findAll('option')
+        .map((option) => option.attributes('value'))
+
+      expect(options).toContain('drei-spalten')
+      expect((wrapper.find('#composer-section-0').element as HTMLSelectElement).value)
+        .toBe('drei-spalten')
+    } finally {
+      DOCUMENT.sections[0].layout = 'single'
+    }
+  })
+})
+
 describe('Der Klick-Konflikt', () => {
   it('steht im Editier-Modus auf abfangen und schaltet um', async () => {
     // Der Umschalter ändert, wie ein Block auf Zeigereingaben reagiert — die CSS-Regel hängt
diff --git a/custom/static-plugins/Composer/src/Resources/app/admin/src/composer.css b/custom/static-plugins/Composer/src/Resources/app/admin/src/composer.css
index 3c85213d..f4d614e6 100644
--- a/custom/static-plugins/Composer/src/Resources/app/admin/src/composer.css
+++ b/custom/static-plugins/Composer/src/Resources/app/admin/src/composer.css
@@ -53,6 +53,50 @@
   opacity: 0.6;
 }
 
+/*
+ * Eine leere Region ist im Editor sichtbar und auf der Fläche nicht. Sie IST der Ort, an den
+ * sich etwas ziehen lässt — ohne Umriss gäbe es nichts zu treffen, und eine zweispaltige
+ * Sektion mit leerer Spalte sähe aus wie eine einspaltige.
+ */
+.cal-canvas__region-empty {
+  margin: 0;
+  padding: 1.5rem;
+  border: 1px dashed color-mix(in srgb, currentColor 25%, transparent);
+  border-radius: 0.375rem;
+  text-align: center;
+  font-size: 0.8125rem;
+  opacity: 0.5;
+}
+
+.cal-canvas__region-orphan {
+  margin: 0.5rem 0 0;
+  font-size: 0.75rem;
+  opacity: 0.7;
+}
+
+.cal-canvas [data-cal-editor-undeclared='true'] {
+  outline: 1px dotted color-mix(in srgb, currentColor 35%, transparent);
+  outline-offset: 4px;
+}
+
+.composer__sections,
+.composer__section-list {
+  display: flex;
+  gap: 0.75rem;
+  align-items: center;
+  flex-wrap: wrap;
+  margin-block: 0.75rem;
+  padding: 0;
+  list-style: none;
+}
+
+.composer__section-list li {
+  display: flex;
+  gap: 0.375rem;
+  align-items: center;
+  font-size: 0.8125rem;
+}
+
 /* ── Die Editor-Oberfläche um den Canvas herum ─────────────────────────────── */
 
 .composer__workspace {
diff --git a/custom/static-plugins/Composer/src/Resources/app/admin/src/layout-document.spec.ts b/custom/static-plugins/Composer/src/Resources/app/admin/src/layout-document.spec.ts
index 72d043ac..57abe3c7 100644
--- a/custom/static-plugins/Composer/src/Resources/app/admin/src/layout-document.spec.ts
+++ b/custom/static-plugins/Composer/src/Resources/app/admin/src/layout-document.spec.ts
@@ -1,9 +1,11 @@
 import { describe, expect, it } from 'vitest'
 import {
+  addSection,
   blockAt,
   clearBlockBinding,
   readDocument,
   setBlockBinding,
+  setSectionLayout,
   type LayoutDocument,
 } from './layout-document'
 
@@ -113,6 +115,57 @@ describe('clearBlockBinding', () => {
   })
 })
 
+describe('addSection', () => {
+  it('vergibt die Position fortlaufend, nicht aus der Länge', () => {
+    // Ein Dokument mit Lücken oder doppelten Positionen — etwa aus einem Rückrollen — bekäme
+    // sonst eine Sektion, die VOR einer bestehenden landet.
+    const before: LayoutDocument = {
+      sections: [
+        { layout: 'single', position: 0, blocks: [] },
+        { layout: 'single', position: 7, blocks: [] },
+      ],
+    }
+
+    const after = addSection(before, 'two-2-1')
+
+    expect(after.sections[2].position).toBe(8)
+    expect(after.sections[2].layout).toBe('two-2-1')
+  })
+
+  it('fängt bei einem leeren Dokument bei 0 an', () => {
+    expect(addSection({ sections: [] }, 'single').sections[0].position).toBe(0)
+  })
+})
+
+describe('setSectionLayout', () => {
+  it('lässt die Blöcke, wo sie sind — auch die in Regionen, die es nun nicht gibt', () => {
+    // Sie umzuhängen wäre die scheinbar hilfreiche Variante und die, die Arbeit vernichtet:
+    // Wer ein Layout ausprobiert und zurückwechselt, fände seine Seitenspalte im Hauptbereich
+    // wieder, ohne dass irgendetwas das rückgängig machen könnte.
+    const before: LayoutDocument = {
+      sections: [
+        {
+          layout: 'two-2-1',
+          position: 0,
+          blocks: [{ blockId: 'demo.rand', region: 'aside', position: 0 }],
+        },
+      ],
+    }
+
+    const after = setSectionLayout(before, 0, 'single')
+
+    expect(after.sections[0].layout).toBe('single')
+    expect(after.sections[0].blocks[0].region).toBe('aside')
+  })
+
+  it('tut nichts bei gleichem Layout oder unbekannter Sektion', () => {
+    const before: LayoutDocument = { sections: [{ layout: 'single', position: 0, blocks: [] }] }
+
+    expect(setSectionLayout(before, 0, 'single')).toBe(before)
+    expect(setSectionLayout(before, 5, 'two-2-1')).toBe(before)
+  })
+})
+
 describe('blockAt', () => {
   it('findet den Block und verträgt eine leere Auswahl', () => {
     const document = documentWith()
diff --git a/custom/static-plugins/Composer/src/Resources/app/admin/src/layout-document.ts b/custom/static-plugins/Composer/src/Resources/app/admin/src/layout-document.ts
index af470c91..d2ef62ca 100644
--- a/custom/static-plugins/Composer/src/Resources/app/admin/src/layout-document.ts
+++ b/custom/static-plugins/Composer/src/Resources/app/admin/src/layout-document.ts
@@ -68,6 +68,48 @@ export function readDocument(raw: unknown): LayoutDocument {
   }
 }
 
+/**
+ * Hängt eine Sektion mit diesem Layout hinten an.
+ *
+ * `position` wird fortlaufend vergeben statt aus der Länge abgeleitet: Ein Dokument mit Lücken
+ * oder doppelten Positionen (etwa aus einem Rückrollen) bekäme sonst eine Sektion, die vor
+ * einer bestehenden landet.
+ */
+export function addSection(document: LayoutDocument, layout: string): LayoutDocument {
+  const highest = document.sections.reduce(
+    (max, section) => Math.max(max, section.position ?? 0),
+    -1,
+  )
+
+  return {
+    sections: [...document.sections, { layout, position: highest + 1, blocks: [] }],
+  }
+}
+
+/**
+ * Ändert das Layout einer Sektion. Die Blöcke bleiben, wo sie sind — auch die in Regionen, die
+ * das neue Layout nicht hat.
+ *
+ * Sie umzuhängen wäre die scheinbar hilfreiche Variante und die, die Arbeit vernichtet: Wer ein
+ * Layout nur ausprobiert und zurückwechselt, fände seine Seitenspalte im Hauptbereich wieder,
+ * ohne dass irgendetwas das rückgängig machen könnte. So bleibt der Wechsel umkehrbar, und der
+ * Canvas zeigt die heimatlosen Blöcke sichtbar an.
+ */
+export function setSectionLayout(
+  document: LayoutDocument,
+  sectionIndex: number,
+  layout: string,
+): LayoutDocument {
+  const section = document.sections[sectionIndex]
+  if (!section || section.layout === layout) {
+    return document
+  }
+
+  const sections = [...document.sections]
+  sections[sectionIndex] = { ...section, layout }
+  return { sections }
+}
+
 /** Der Block an dieser Stelle, oder undefined. */
 export function blockAt(
   document: LayoutDocument,
diff --git a/custom/static-plugins/Composer/src/Resources/app/admin/src/preview-assets.spec.ts b/custom/static-plugins/Composer/src/Resources/app/admin/src/preview-assets.spec.ts
index 72ae4049..e1554445 100644
--- a/custom/static-plugins/Composer/src/Resources/app/admin/src/preview-assets.spec.ts
+++ b/custom/static-plugins/Composer/src/Resources/app/admin/src/preview-assets.spec.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it, vi } from 'vitest'
-import { fetchSurfaceStyles, fetchThemeTokens } from './preview-assets'
+import { fetchSurfaceStyles, fetchTheme } from './preview-assets'
 
 describe('fetchSurfaceStyles', () => {
   it('verkettet in Kettenreihenfolge, damit die spätere Regel gewinnt — wie auf der Fläche', async () => {
@@ -33,21 +33,21 @@ describe('fetchSurfaceStyles', () => {
   })
 })
 
-describe('fetchThemeTokens', () => {
+describe('fetchTheme', () => {
   it('fragt den öffentlichen Endpunkt der Fläche, nicht einen admin-eigenen', async () => {
     // Ein zweiter Weg zu denselben Werten wäre ein zweiter Weg, auf dem sie auseinanderlaufen.
     const fetchJson = vi.fn(async () => ({ valuesByKey: { 'color-primary': '#123456' } }))
 
-    const tokens = await fetchThemeTokens('acme', fetchJson)
+    const theme = await fetchTheme('acme', fetchJson)
 
     expect(fetchJson).toHaveBeenCalledWith('/workspace/public/theme?workspaceKey=acme')
-    expect(tokens).toEqual({ 'color-primary': '#123456' })
+    expect(theme.valuesByKey).toEqual({ 'color-primary': '#123456' })
   })
 
   it('kodiert den Workspace-Schlüssel', async () => {
     const fetchJson = vi.fn(async () => ({}))
 
-    await fetchThemeTokens('a b/c', fetchJson)
+    await fetchTheme('a b/c', fetchJson)
 
     expect(fetchJson).toHaveBeenCalledWith('/workspace/public/theme?workspaceKey=a%20b%2Fc')
   })
@@ -55,11 +55,11 @@ describe('fetchThemeTokens', () => {
   it('rendert mit den Standardwerten weiter, wenn das Theme nicht erreichbar ist', async () => {
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
 
-    const tokens = await fetchThemeTokens('acme', vi.fn(async () => {
+    const theme = await fetchTheme('acme', vi.fn(async () => {
       throw new Error('offline')
     }))
 
-    expect(tokens).toEqual({})
+    expect(theme).toEqual({ valuesByKey: {}, sectionLayouts: [] })
     warn.mockRestore()
   })
 })
diff --git a/custom/static-plugins/Composer/src/Resources/app/admin/src/preview-assets.ts b/custom/static-plugins/Composer/src/Resources/app/admin/src/preview-assets.ts
index d55e0186..de6642c3 100644
--- a/custom/static-plugins/Composer/src/Resources/app/admin/src/preview-assets.ts
+++ b/custom/static-plugins/Composer/src/Resources/app/admin/src/preview-assets.ts
@@ -39,28 +39,57 @@ export async function fetchSurfaceStyles(
   return sheets.filter((sheet) => sheet.length > 0).join('\n')
 }
 
+/** Eine Region eines Sektionslayouts — ein Platz, an den ein Block darf. */
+export interface SectionLayoutRegion {
+  regionKey: string
+  label: string
+}
+
+/** Ein Sektionslayout, wie das Theme es deklariert. */
+export interface SectionLayout {
+  layoutKey: string
+  label: string
+  regions: SectionLayoutRegion[]
+  sortOrder: number
+}
+
+/** Was der Editor vom Theme braucht. */
+export interface ThemeForEditor {
+  /** Die Token-Werte, die der Server einer Fläche gibt. */
+  valuesByKey: Record<string, string>
+  /**
+   * Die Sektionslayouts, die dieses Theme kann. Der Editor bietet ausschließlich sie an —
+   * so bleibt die Token-Achse die Design-Autorität, und es steht kein Layout-Name im Core.
+   */
+  sectionLayouts: SectionLayout[]
+}
+
 /**
- * Die Theme-Werte des Workspace, so wie der Server sie einer Fläche gibt.
+ * Das Theme des Workspace, so wie der Server es einer Fläche gibt.
  *
  * Der Endpunkt ist derselbe öffentliche, den die Fläche selbst abfragt — nicht ein
  * admin-eigener. Ein zweiter Weg zu denselben Werten wäre ein zweiter Weg, auf dem sie
  * auseinanderlaufen können, und genau das soll der Canvas nicht.
  */
-export async function fetchThemeTokens(
+export async function fetchTheme(
   workspaceKey: string,
   fetchJson: FetchJson = defaultFetchJson,
-): Promise<Record<string, string>> {
+): Promise<ThemeForEditor> {
   try {
     const theme = (await fetchJson(
       `/workspace/public/theme?workspaceKey=${encodeURIComponent(workspaceKey)}`,
-    )) as { valuesByKey?: Record<string, string> } | null
+    )) as Partial<ThemeForEditor> | null
 
-    return theme?.valuesByKey ?? {}
+    return {
+      valuesByKey: theme?.valuesByKey ?? {},
+      sectionLayouts: Array.isArray(theme?.sectionLayouts) ? theme.sectionLayouts : [],
+    }
   } catch (error) {
-    // Ohne Tokens rendert der Canvas mit den Standardwerten der Fläche. Das ist eine
-    // schlechtere Vorschau, aber eine, die funktioniert.
-    console.warn('[composer] Theme-Werte konnten nicht geladen werden.', error)
-    return {}
+    // Ohne Theme rendert der Canvas mit den Standardwerten der Fläche und bietet keine
+    // Layouts an. Eine schlechtere Vorschau, aber eine, die funktioniert — und eine leere
+    // Layout-Auswahl ist ehrlicher als eine erfundene.
+    console.warn('[composer] Theme konnte nicht geladen werden.', error)
+    return { valuesByKey: {}, sectionLayouts: [] }
   }
 }
 
diff --git a/custom/static-plugins/Composer/src/Resources/app/admin/src/section-layouts.spec.ts b/custom/static-plugins/Composer/src/Resources/app/admin/src/section-layouts.spec.ts
new file mode 100644
index 00000000..2bdb7940
--- /dev/null
+++ b/custom/static-plugins/Composer/src/Resources/app/admin/src/section-layouts.spec.ts
@@ -0,0 +1,106 @@
+import { describe, expect, it } from 'vitest'
+import type { SectionLayout } from './preview-assets'
+import type { LayoutDocument } from './layout-document'
+import { regionsOf, sectionsWithUnknownLayout, themeDeclaresLayouts } from './section-layouts'
+
+const LAYOUTS: SectionLayout[] = [
+  {
+    layoutKey: 'single',
+    label: 'Eine Spalte',
+    regions: [{ regionKey: 'main', label: 'Inhalt' }],
+    sortOrder: 10,
+  },
+  {
+    layoutKey: 'two-2-1',
+    label: 'Zwei Spalten',
+    regions: [
+      { regionKey: 'main', label: 'Inhalt' },
+      { regionKey: 'aside', label: 'Seitenspalte' },
+    ],
+    sortOrder: 20,
+  },
+]
+
+function documentWith(layout: string, regions: string[] = []): LayoutDocument {
+  return {
+    sections: [
+      {
+        layout,
+        position: 0,
+        blocks: regions.map((region, index) => ({
+          blockId: `demo.${region}`,
+          region,
+          position: index,
+        })),
+      },
+    ],
+  }
+}
+
+describe('regionsOf', () => {
+  it('gibt alle Regionen des Layouts, auch die leeren', () => {
+    // Eine leere Region muss sichtbar sein, sonst gibt es keinen Ort, an den man etwas ziehen
+    // könnte — und eine zweispaltige Sektion mit leerer Spalte sähe aus wie eine einspaltige.
+    const [section] = documentWith('two-2-1', ['main']).sections
+
+    expect(regionsOf(section, LAYOUTS).map((region) => region.regionKey)).toEqual(['main', 'aside'])
+  })
+
+  it('behält die Reihenfolge des Themes', () => {
+    const [section] = documentWith('two-2-1').sections
+
+    // Alphabetisch stünde "aside" vor "main" — die Seitenspalte vor dem Inhalt, neben dem sie
+    // sitzt.
+    expect(regionsOf(section, LAYOUTS)[0].regionKey).toBe('main')
+  })
+
+  it('hängt Blöcke aus einer nicht deklarierten Region hinten an, statt sie zu verstecken', () => {
+    // Ihre Blöcke stehen weiter im Dokument und kommen zurück, sobald das Theme die Region
+    // wieder mitbringt. Wegzulassen hieße, Inhalt zu verstecken, den es noch gibt.
+    const [section] = documentWith('single', ['main', 'footer']).sections
+
+    const regions = regionsOf(section, LAYOUTS)
+
+    expect(regions.map((region) => region.regionKey)).toEqual(['main', 'footer'])
+    expect(regions.map((region) => region.declared)).toEqual([true, false])
+  })
+
+  it('zeigt bei unbekanntem Layout die benutzten Regionen', () => {
+    // Das Theme kennt das Layout nicht, also gibt es keine deklarierten Regionen. Nichts zu
+    // zeigen hieße, die Sektion sähe leer aus, obwohl Blöcke darin stehen.
+    const [section] = documentWith('erfunden', ['main']).sections
+
+    expect(regionsOf(section, LAYOUTS).map((region) => region.regionKey)).toEqual(['main'])
+  })
+})
+
+describe('sectionsWithUnknownLayout', () => {
+  it('findet die Sektionen, die nach einem Theme-Wechsel gestrandet sind', () => {
+    const document: LayoutDocument = {
+      sections: [
+        { layout: 'single', position: 0, blocks: [] },
+        { layout: 'drei-spalten', position: 1, blocks: [] },
+      ],
+    }
+
+    const stranded = sectionsWithUnknownLayout(document, LAYOUTS)
+
+    expect(stranded.map((entry) => entry.index)).toEqual([1])
+  })
+
+  it('warnt zu keiner Sektion, wenn das Theme gar keine Layouts deklariert', () => {
+    // Zwei Fälle sehen gleich aus und sind es nicht: „kennt dieses Layout nicht mehr" ist eine
+    // Ablehnung, „deklariert überhaupt keine" ist keine Aussage. Hier zu warnen wäre eine
+    // Warnung aus einem Nicht-Ereignis.
+    const document = documentWith('was-auch-immer')
+
+    expect(sectionsWithUnknownLayout(document, [])).toEqual([])
+  })
+})
+
+describe('themeDeclaresLayouts', () => {
+  it('unterscheidet ein Theme mit Layouts von einem ohne', () => {
+    expect(themeDeclaresLayouts(LAYOUTS)).toBe(true)
+    expect(themeDeclaresLayouts([])).toBe(false)
+  })
+})
diff --git a/custom/static-plugins/Composer/src/Resources/app/admin/src/section-layouts.ts b/custom/static-plugins/Composer/src/Resources/app/admin/src/section-layouts.ts
new file mode 100644
index 00000000..97c53e5f
--- /dev/null
+++ b/custom/static-plugins/Composer/src/Resources/app/admin/src/section-layouts.ts
@@ -0,0 +1,85 @@
+import type { SectionLayout } from './preview-assets'
+import type { LayoutDocument, LayoutSection } from './layout-document'
+
+/**
+ * Wie der Editor mit den Sektionslayouts des Themes umgeht.
+ *
+ * Die Regeln stehen hier als reine Funktionen, weil sie dieselben sind, die der Server beim
+ * Rendern anwendet (§7.8). Wären sie in einer Komponente vergraben, gäbe es zwei Fassungen
+ * derselben Entscheidung — und die zweite fiele erst auf der veröffentlichten Seite auf.
+ */
+
+/** Worauf eine Sektion zurückfällt, deren Layout das Theme nicht mehr kennt. */
+export const FALLBACK_LAYOUT = 'single'
+
+/** Das Layout mit diesem Schlüssel, oder undefined. */
+export function findLayout(
+  layouts: readonly SectionLayout[],
+  layoutKey: string,
+): SectionLayout | undefined {
+  return layouts.find((layout) => layout.layoutKey === layoutKey)
+}
+
+/**
+ * Ob das Theme zu Layouts überhaupt etwas sagt.
+ *
+ * Zwei Fälle sehen sonst gleich aus und sind es nicht: Ein Theme, das `two-2-1` NICHT MEHR
+ * kennt, hat es abgelehnt. Ein Theme, das gar keine Layouts deklariert, sagt zu keinem etwas —
+ * dann jede Sektion als verwaist zu markieren, wäre eine Warnung aus einem Nicht-Ereignis.
+ */
+export function themeDeclaresLayouts(layouts: readonly SectionLayout[]): boolean {
+  return layouts.length > 0
+}
+
+/**
+ * Sektionen, deren Layout dieses Theme nicht kennt — was der Editor warnend anzeigt.
+ *
+ * Serverseitig fallen sie beim Rendern auf `single` zurück; hier sichtbar zu machen, WELCHE es
+ * trifft, ist der Unterschied zwischen „meine Seite sieht anders aus" und „diese drei Sektionen
+ * hängen an einem Layout, das das neue Theme nicht mitbringt".
+ */
+export function sectionsWithUnknownLayout(
+  document: LayoutDocument,
+  layouts: readonly SectionLayout[],
+): { index: number; section: LayoutSection }[] {
+  if (!themeDeclaresLayouts(layouts)) {
+    return []
+  }
+
+  return document.sections
+    .map((section, index) => ({ index, section }))
+    .filter(({ section }) => !findLayout(layouts, section.layout))
+}
+
+/**
+ * Die Regionen, die eine Sektion anbietet — alle des Layouts, auch die leeren.
+ *
+ * Eine leere Region muss sichtbar sein, sonst gibt es keinen Ort, an den man etwas ziehen
+ * könnte: Der Canvas zeigte bisher nur Regionen, in denen schon ein Block lag, und eine
+ * zweispaltige Sektion mit einer leeren Spalte sah aus wie eine einspaltige.
+ *
+ * Blöcke in einer Region, die es im Layout nicht (mehr) gibt, kommen HINTEN dazu. Sie
+ * wegzulassen hieße, Inhalt zu verstecken, den das Dokument noch trägt — und der zurückkommt,
+ * sobald das Theme die Region wieder mitbringt.
+ */
+export function regionsOf(
+  section: LayoutSection,
+  layouts: readonly SectionLayout[],
+): { regionKey: string; label: string; declared: boolean }[] {
+  const layout = findLayout(layouts, section.layout)
+  const declared = (layout?.regions ?? []).map((region) => ({
+    regionKey: region.regionKey,
+    label: region.label,
+    declared: true,
+  }))
+
+  const declaredKeys = new Set(declared.map((region) => region.regionKey))
+  const orphaned = [...new Set(section.blocks.map((block) => block.region))]
+    .filter((regionKey) => !declaredKeys.has(regionKey))
+    .sort()
+    .map((regionKey) => ({ regionKey, label: regionKey, declared: false }))
+
+  // Kennt das Theme das Layout gar nicht, gibt es keine deklarierten Regionen — dann sind die
+  // benutzten alles, was es gibt, und der Canvas zeigt sie in der Reihenfolge des Dokuments.
+  return [...declared, ...orphaned]
+}
diff --git a/docs-site/guides/surface/themes-and-tokens.md b/docs-site/guides/surface/themes-and-tokens.md
index 5200a3eb..b677efc2 100644
--- a/docs-site/guides/surface/themes-and-tokens.md
+++ b/docs-site/guides/surface/themes-and-tokens.md
@@ -128,6 +128,91 @@ does not itself name a `--cal-*` variable. You bind a setting value to a `--cal-
 yourself — see *Consuming tokens* below.
 :::
 
+## Section layouts
+
+A **section layout** is the grid a section uses — `single`, `two-2-1`, `sidebar-left` — and the
+**regions** inside it are where blocks go. The editor offers exactly what the theme allows, so
+nobody can compose a grid nothing can style.
+
+### What the base surface brings
+
+The runtime ships a base set (`single`, `two-1-1`, `two-2-1`, `sidebar-left`, `three-1-1-1`),
+styled in the same `tokens.scss` that carries the neutral `--cal-*` values. They are the base,
+not the canon: a fresh installation has something to compose with, and a theme replaces or
+extends them.
+
+Without them the composition renderer would emit `data-cal-layout` that nothing listens to, and
+the editor would offer no choice — which looks like a bug rather than a missing theme.
+
+### Declaring your own
+
+A theme declares which layouts it can render, and which regions exist inside them:
+
+```json
+{
+  "sectionLayouts": [
+    { "key": "single", "label": "One column", "regions": ["main"] },
+    {
+      "key": "two-2-1",
+      "label": "Two columns (2:1)",
+      "regions": [
+        { "key": "main", "label": "Content" },
+        { "key": "aside", "label": "Sidebar" }
+      ]
+    }
+  ]
+}
+```
+
+A region may be written as a plain string or as `{ key, label }`. The **declared order is the
+reading order** — sorting them would put a sidebar before the content it sits next to.
+
+The layout key is what the composition renderer writes into `data-cal-layout`, and the region
+key into `data-cal-region`. Your CSS selects on those:
+
+```css
+.cal-section[data-cal-layout='two-2-1'] {
+  display: grid;
+  grid-template-columns: 2fr 1fr;
+  gap: var(--cal-space-4);
+}
+```
+
+### Inheritance
+
+**Your layouts are added to the base ones**, and one with the same key replaces the base
+version entirely (never merges with it — a `two-2-1` carrying the base's regions while your CSS
+expects two others would put blocks in regions that do not exist).
+
+Adding is the safe direction: the base stylesheet is always loaded, so the base layouts work
+under your theme too, and a theme that only wants to contribute `sidebar-right` need not repeat
+the whole palette.
+
+To stand alone with your own grid system:
+
+```json
+{ "inheritSectionLayouts": false, "sectionLayouts": [ … ] }
+```
+
+Then everything your layouts need is yours to provide. A theme that declares no layouts of its
+own inherits regardless — there would otherwise be nothing left to compose with.
+
+::: info Layouts live in the theme, not in the core
+This is what keeps the token axis the design authority: nobody can compose a grid the theme
+cannot style, and no layout names end up in Callora's contracts. Bring a layout nobody
+anticipated and the editor offers it without a change to the platform.
+:::
+
+::: warning Dropping a layout does not break a page
+If a theme stops declaring a layout — usually because somebody switched themes — sections still
+naming it fall back to `single` when rendered. The blocks all stay; the section just becomes one
+readable column instead of a grid nothing styles. The editor names the affected sections so the
+change is visible rather than mysterious.
+
+A theme that declares **no** layouts at all says nothing about any of them, and nothing falls
+back. That is deliberately different from a theme that dropped one.
+:::
+
 ## Reading a workspace's tokens
 
 The resolved values are exposed anonymously at
diff --git a/src/Core/Application/Extensions/IWorkspaceSectionLayoutStore.cs b/src/Core/Application/Extensions/IWorkspaceSectionLayoutStore.cs
new file mode 100644
index 00000000..45321c66
--- /dev/null
+++ b/src/Core/Application/Extensions/IWorkspaceSectionLayoutStore.cs
@@ -0,0 +1,38 @@
+namespace Callora.Core.Application.Extensions;
+
+/// <summary>
+/// Persistence for the section layouts a theme plugin declares.
+/// <para>
+/// Definitions only — there is nothing an operator chooses here. Which layout a section uses is
+/// part of the layout document, not a stored setting, so this store has no value side and no
+/// workspace/surface cascade.
+/// </para>
+/// </summary>
+public interface IWorkspaceSectionLayoutStore
+{
+    /// <summary>
+    /// What one theme version declared: its own layouts in declared order, and whether it
+    /// inherits the base theme's. A theme with no layouts of its own inherits.
+    /// </summary>
+    Task<ThemeSectionLayouts> ListAsync(
+        string pluginId,
+        string version,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Replaces this plugin version's layouts with what its <c>theme.json</c> now declares.
+    /// <para>
+    /// Replace rather than merge: a layout the theme dropped must disappear, or the editor would
+    /// keep offering a grid nothing can style. Documents that still name it are not touched —
+    /// they fall back at render time (§7.8) and become whole again if the theme brings it back.
+    /// </para>
+    /// </summary>
+    Task ReplaceForPluginAsync(
+        string pluginId,
+        string version,
+        IReadOnlyList<SectionLayoutDefinition> layouts,
+        bool inheritsBase,
+        CancellationToken cancellationToken = default);
+
+    Task ClearForPluginAsync(string pluginId, CancellationToken cancellationToken = default);
+}
diff --git a/src/Core/Application/Extensions/SectionLayoutDefinition.cs b/src/Core/Application/Extensions/SectionLayoutDefinition.cs
new file mode 100644
index 00000000..2403409d
--- /dev/null
+++ b/src/Core/Application/Extensions/SectionLayoutDefinition.cs
@@ -0,0 +1,27 @@
+namespace Callora.Core.Application.Extensions;
+
+/// <summary>
+/// One section layout a theme offers, and the regions it contains.
+/// <para>
+/// Section layouts come from the theme, not from the core. A theme declares in
+/// <c>theme.json</c> which layouts it can render (<c>single</c>, <c>two-2-1</c>,
+/// <c>sidebar-left</c>, …) and which regions exist inside them; the editor offers exactly that
+/// and nothing else. Two things follow. The token axis stays the design authority — nobody
+/// composes a layout the theme cannot style. And no layout names end up in the core, so a theme
+/// can bring a grid nobody anticipated without a change here.
+/// </para>
+/// </summary>
+/// <param name="LayoutKey">
+/// What the renderer writes into <c>data-cal-layout</c>, and what the theme's CSS selects on.
+/// </param>
+/// <param name="Label">What the editor shows.</param>
+/// <param name="Regions">
+/// Where blocks may go. Ordered as declared: the theme's order is the reading order, and an
+/// alphabetical one would put a sidebar before the content it sits next to.
+/// </param>
+/// <param name="SortOrder">Ascending order in the editor's layout picker.</param>
+public sealed record SectionLayoutDefinition(
+    string LayoutKey,
+    string Label,
+    IReadOnlyList<SectionLayoutRegion> Regions,
+    int SortOrder = 100);
diff --git a/src/Core/Application/Extensions/SectionLayoutRegion.cs b/src/Core/Application/Extensions/SectionLayoutRegion.cs
new file mode 100644
index 00000000..fa8ef45b
--- /dev/null
+++ b/src/Core/Application/Extensions/SectionLayoutRegion.cs
@@ -0,0 +1,6 @@
+namespace Callora.Core.Application.Extensions;
+
+/// <summary>A region inside a section layout — one slot a block can sit in.</summary>
+/// <param name="RegionKey">What the renderer writes into <c>data-cal-region</c>.</param>
+/// <param name="Label">What the editor shows.</param>
+public sealed record SectionLayoutRegion(string RegionKey, string Label);
diff --git a/src/Core/Application/Extensions/SurfaceBaseSectionLayouts.cs b/src/Core/Application/Extensions/SurfaceBaseSectionLayouts.cs
new file mode 100644
index 00000000..4e3bd99e
--- /dev/null
+++ b/src/Core/Application/Extensions/SurfaceBaseSectionLayouts.cs
@@ -0,0 +1,76 @@
+namespace Callora.Core.Application.Extensions;
+
+/// <summary>
+/// Die Sektionslayouts, die das Basis-Surface-Theme mitbringt — und was ein Plugin-Theme davon
+/// erbt.
+/// <para>
+/// Sektionslayouts gehören dem Theme (§7.1); das bleibt so. Die Basis ist ein Theme wie jedes
+/// andere, nur eben das, das immer da ist — dieselbe Rolle, die <c>tokens.scss</c> für Farben
+/// und Abstände spielt. Ohne sie hätte eine frische Installation nichts, womit sich etwas
+/// komponieren ließe: Der Renderer gäbe <c>data-cal-layout</c> aus, der Editor böte keine Wahl,
+/// und beides sähe nach einem Fehler aus statt nach einem fehlenden Theme.
+/// </para>
+/// <para>
+/// <b>Ein Plugin-Theme erbt sie standardmäßig und ergänzt die eigenen.</b> Das ist die sichere
+/// Richtung: Das Basis-Stylesheet der Runtime ist immer geladen, also funktionieren die
+/// Basis-Layouts auch unter einem fremden Theme, und ein Theme, das nur <c>sidebar-right</c>
+/// beisteuern will, muss nicht die ganze Palette wiederholen. Wer stattdessen ein eigenes
+/// Rastersystem durchsetzen will, setzt <c>inheritSectionLayouts</c> auf <c>false</c> und steht
+/// dann allein für alles gerade, was seine Layouts brauchen.
+/// </para>
+/// <para>
+/// Die Liste steht hier und nicht im TypeScript-Paket, obwohl das CSS dort liegt: Der
+/// Kompositions-Renderer muss dieselbe Vererbung kennen wie der Editor, und zwei Listen wären
+/// zwei Wahrheiten. <c>SurfaceBaseSectionLayoutsTests</c> hält diese gegen
+/// <c>tokens.scss</c> — ein deklariertes Layout ohne Regel wäre ein Angebot, das nichts tut.
+/// </para>
+/// </summary>
+public static class SurfaceBaseSectionLayouts
+{
+    /// <summary>Was die Basis anbietet, in Anzeigereihenfolge.</summary>
+    public static IReadOnlyList<SectionLayoutDefinition> All { get; } =
+    [
+        new("single", "Eine Spalte", [new("main", "Inhalt")], 10),
+        new("two-1-1", "Zwei gleiche Spalten",
+            [new("main", "Links"), new("secondary", "Rechts")], 20),
+        new("two-2-1", "Zwei Spalten (2:1)",
+            [new("main", "Inhalt"), new("aside", "Seitenspalte")], 30),
+        // Die Seitenspalte steht ZUERST — die deklarierte Reihenfolge ist die Lesereihenfolge,
+        // und im Raster liegt sie links.
+        new("sidebar-left", "Seitenspalte links",
+            [new("aside", "Seitenspalte"), new("main", "Inhalt")], 40),
+        new("three-1-1-1", "Drei gleiche Spalten",
+            [new("main", "Links"), new("secondary", "Mitte"), new("tertiary", "Rechts")], 50),
+    ];
+
+    /// <summary>
+    /// Was ein Theme insgesamt anbietet: die Basis plus seine eigenen, oder nur seine eigenen.
+    /// <para>
+    /// Ein Layout des Themes verdrängt das gleichnamige der Basis vollständig. Zusammenzuführen
+    /// wäre der Weg, auf dem ein Theme ein `two-2-1` mit den Regionen der Basis bekäme, obwohl
+    /// sein CSS zwei andere kennt — und die Blöcke lägen dann in Regionen, die es nicht gibt.
+    /// </para>
+    /// </summary>
+    public static IReadOnlyList<SectionLayoutDefinition> Compose(
+        IReadOnlyList<SectionLayoutDefinition> themeLayouts,
+        bool inherit)
+    {
+        ArgumentNullException.ThrowIfNull(themeLayouts);
+
+        if (!inherit)
+        {
+            return themeLayouts;
+        }
+
+        var own = themeLayouts
+            .Select(layout => layout.LayoutKey)
+            .ToHashSet(StringComparer.Ordinal);
+
+        return All
+            .Where(layout => !own.Contains(layout.LayoutKey))
+            .Concat(themeLayouts)
+            .OrderBy(layout => layout.SortOrder)
+            .ThenBy(layout => layout.LayoutKey, StringComparer.Ordinal)
+            .ToArray();
+    }
+}
diff --git a/src/Core/Application/Extensions/ThemeSectionLayouts.cs b/src/Core/Application/Extensions/ThemeSectionLayouts.cs
new file mode 100644
index 00000000..f95e5cab
--- /dev/null
+++ b/src/Core/Application/Extensions/ThemeSectionLayouts.cs
@@ -0,0 +1,14 @@
+namespace Callora.Core.Application.Extensions;
+
+/// <summary>
+/// Was ein Theme selbst zu Sektionslayouts erklärt hat — noch ohne die Basis.
+/// </summary>
+/// <param name="Layouts">Die eigenen Layouts, in deklarierter Reihenfolge.</param>
+/// <param name="InheritsBase">
+/// Ob die Layouts des Basis-Themes dazukommen. Standard ist ja, und das ist die sichere
+/// Richtung: Das Basis-Stylesheet der Runtime ist immer geladen, also funktionieren die
+/// Basis-Layouts auch unter einem fremden Theme.
+/// </param>
+public sealed record ThemeSectionLayouts(
+    IReadOnlyList<SectionLayoutDefinition> Layouts,
+    bool InheritsBase);
diff --git a/src/Core/Application/Extensions/WorkspacePublicTheme.cs b/src/Core/Application/Extensions/WorkspacePublicTheme.cs
index 7e172f67..7ddc1f5e 100644
--- a/src/Core/Application/Extensions/WorkspacePublicTheme.cs
+++ b/src/Core/Application/Extensions/WorkspacePublicTheme.cs
@@ -5,7 +5,13 @@ namespace Callora.Core.Application.Extensions;
 /// plugin and its effective setting values (defaults merged with workspace
 /// overrides), normalized to plain strings for CSS consumption.
 /// </summary>
+/// <param name="SectionLayouts">
+/// The section layouts this theme offers, with their regions. Part of the public theme because
+/// they are structure the theme owns, and both consumers need them: the editor to offer them,
+/// the composition renderer to notice a layout the theme no longer knows (§7.8).
+/// </param>
 public sealed record WorkspacePublicTheme(
     string ThemePluginId,
     string ThemeVersion,
-    IReadOnlyDictionary<string, string> ValuesByKey);
+    IReadOnlyDictionary<string, string> ValuesByKey,
+    IReadOnlyList<SectionLayoutDefinition> SectionLayouts);
diff --git a/src/Core/Application/Extensions/WorkspacePublicThemeResolver.cs b/src/Core/Application/Extensions/WorkspacePublicThemeResolver.cs
index 437ca5bd..cccb169d 100644
--- a/src/Core/Application/Extensions/WorkspacePublicThemeResolver.cs
+++ b/src/Core/Application/Extensions/WorkspacePublicThemeResolver.cs
@@ -22,7 +22,8 @@ namespace Callora.Core.Application.Extensions;
 public sealed class WorkspacePublicThemeResolver(
     IWorkspaceManagementStore workspaceStore,
     IWorkspaceSurfaceStore surfaceStore,
-    IWorkspaceThemeSettingsStore settingsStore)
+    IWorkspaceThemeSettingsStore settingsStore,
+    IWorkspaceSectionLayoutStore sectionLayoutStore)
 {
     /// <summary>
     /// The workspace-level theme, without any surface override. Used where no
@@ -112,7 +113,15 @@ public sealed class WorkspacePublicThemeResolver(
             }
         }
 
-        return new WorkspacePublicTheme(themePluginId, themeVersion, valuesByKey);
+        // Die Basis plus das, was dieses Theme beisteuert. Ein Theme, das nur
+        // `sidebar-right` ergänzen will, muss die ganze Palette nicht wiederholen; eines, das
+        // ein eigenes Rastersystem durchsetzt, setzt `inheritSectionLayouts` auf false.
+        var declared = await sectionLayoutStore
+            .ListAsync(themePluginId, themeVersion, cancellationToken)
+            .ConfigureAwait(false);
+        var sectionLayouts = SurfaceBaseSectionLayouts.Compose(declared.Layouts, declared.InheritsBase);
+
+        return new WorkspacePublicTheme(themePluginId, themeVersion, valuesByKey, sectionLayouts);
     }
 
     private static string? FirstSet(string? preferred, string? fallback)
diff --git a/src/Core/Domain/Extensions/WorkspaceSectionLayoutDefinition.cs b/src/Core/Domain/Extensions/WorkspaceSectionLayoutDefinition.cs
new file mode 100644
index 00000000..c132ad1a
--- /dev/null
+++ b/src/Core/Domain/Extensions/WorkspaceSectionLayoutDefinition.cs
@@ -0,0 +1,51 @@
+namespace Callora.Core.Domain.Extensions;
+
+/// <summary>
+/// A section layout a theme plugin declared, as stored.
+/// <para>
+/// Persisted for the same reason the theme's setting definitions are: the admin has to show what
+/// a theme offers, and the renderer has to know whether a stored layout still exists, without
+/// re-reading the plugin's <c>theme.json</c> off disk on every request.
+/// </para>
+/// </summary>
+public sealed class WorkspaceSectionLayoutDefinition
+{
+    public Guid Id { get; set; }
+
+    public string LayoutKey { get; set; } = string.Empty;
+
+    public string PluginId { get; set; } = string.Empty;
+
+    public string Version { get; set; } = string.Empty;
+
+    public string Label { get; set; } = string.Empty;
+
+    /// <summary>
+    /// The regions, as a JSON array of <c>{ "key": …, "label": … }</c>.
+    /// <para>
+    /// One column rather than a second table: regions are never asked for without their layout,
+    /// and nothing queries across them. A table would buy a join and an ordering column for a
+    /// list that is read whole or not at all.
+    /// </para>
+    /// </summary>
+    public string RegionsJson { get; set; } = "[]";
+
+    public int SortOrder { get; set; }
+
+    /// <summary>
+    /// Ob dieses Theme die Basis-Layouts erbt.
+    /// <para>
+    /// Eine Eigenschaft des Themes, hier auf jeder Zeile — die Tabelle ist ein Abbild des
+    /// Manifests, keine normalisierte Domäne, und eine zweite Tabelle für einen Schalter wäre
+    /// mehr Aufwand als der Schaden der Wiederholung. Gelesen wird sie aus der ersten Zeile;
+    /// ein Theme ohne eigene Layouts hat keine und erbt, was die richtige Degradation ist.
+    /// </para>
+    /// </summary>
+    public bool InheritsBase { get; set; } = true;
+
+    public bool IsActive { get; set; }
+
+    public DateTimeOffset CreatedAtUtc { get; set; }
+
+    public DateTimeOffset UpdatedAtUtc { get; set; }
+}
diff --git a/src/Core/Infrastructure/Extensions/SectionLayoutManifestReader.cs b/src/Core/Infrastructure/Extensions/SectionLayoutManifestReader.cs
new file mode 100644
index 00000000..6d298014
--- /dev/null
+++ b/src/Core/Infrastructure/Extensions/SectionLayoutManifestReader.cs
@@ -0,0 +1,160 @@
+using Callora.Core.Application.Extensions;
+using System.Text.Json;
+
+namespace Callora.Core.Infrastructure.Extensions;
+
+/// <summary>
+/// Reads the section layouts out of a <c>theme.json</c>.
+/// <para>
+/// A pure parser: it takes the parsed document and returns what it found. Nothing here touches
+/// disk or database, so every rule below — what makes a layout valid, what a missing label falls
+/// back to, which malformed entry is skipped rather than fatal — can be stated as a test against
+/// a JSON string.
+/// </para>
+/// <para>
+/// <b>Skipping beats throwing.</b> A theme with one malformed layout still offers its others; a
+/// parser that gave up would leave the editor with no layouts at all, which looks exactly like a
+/// theme that declares none, and nobody would know where to look.
+/// </para>
+/// </summary>
+public static class SectionLayoutManifestReader
+{
+    /// <summary>
+    /// Whether this manifest inherits the base theme's section layouts.
+    /// <para>
+    /// Default true, and that is the safe direction: the runtime's base stylesheet is always
+    /// loaded, so the base layouts work under a foreign theme too, and a theme that only wants
+    /// to add <c>sidebar-right</c> need not repeat the whole palette. Setting it false means
+    /// standing alone for everything the theme's own layouts need.
+    /// </para>
+    /// </summary>
+    public static bool ParseInheritsBase(JsonElement root)
+    {
+        if (root.ValueKind != JsonValueKind.Object)
+        {
+            return true;
+        }
+
+        return root.TryGetProperty("inheritSectionLayouts", out var found) &&
+               found.ValueKind is JsonValueKind.True or JsonValueKind.False
+            ? found.GetBoolean()
+            : true;
+    }
+
+    /// <summary>
+    /// The declared layouts, in file order. Empty when the manifest declares none — which is a
+    /// valid state: a theme that only styles tokens has no layouts to offer, and inherits the
+    /// base ones.
+    /// </summary>
+    public static IReadOnlyList<SectionLayoutDefinition> Parse(JsonElement root)
+    {
+        if (root.ValueKind != JsonValueKind.Object)
+        {
+            return [];
+        }
+
+        if (!TryGetArray(root, "sectionLayouts", out var container) &&
+            !TryGetArray(root, "layouts", out container))
+        {
+            return [];
+        }
+
+        var layouts = new List<SectionLayoutDefinition>();
+        var order = 0;
+        foreach (var item in container.EnumerateArray())
+        {
+            if (item.ValueKind != JsonValueKind.Object)
+            {
+                continue;
+            }
+
+            var layoutKey = FirstNonEmpty(TryGetString(item, "key"), TryGetString(item, "layoutKey"));
+            if (string.IsNullOrWhiteSpace(layoutKey))
+            {
+                // Ohne Schlüssel gibt es nichts, worauf das Theme-CSS zielen könnte, und nichts,
+                // was in ein Dokument geschrieben werden dürfte.
+                continue;
+            }
+
+            layouts.Add(new SectionLayoutDefinition(
+                layoutKey.Trim(),
+                FirstNonEmpty(TryGetString(item, "label"), TryGetString(item, "name"), layoutKey).Trim(),
+                ParseRegions(item),
+                TryGetInt32(item, "sortOrder") ?? TryGetInt32(item, "order") ?? (order += 10)));
+        }
+
+        return layouts;
+    }
+
+    /// <summary>
+    /// The regions of one layout, in declared order — the theme's order is the reading order.
+    /// Sorting them would put a sidebar before the content it sits next to.
+    /// </summary>
+    private static IReadOnlyList<SectionLayoutRegion> ParseRegions(JsonElement layout)
+    {
+        if (!TryGetArray(layout, "regions", out var container))
+        {
+            return [];
+        }
+
+        var regions = new List<SectionLayoutRegion>();
+        foreach (var item in container.EnumerateArray())
+        {
+            // Eine Region darf auch nur ihr Schlüssel sein: `"regions": ["main", "aside"]` ist
+            // die Form, in der ein Theme-Autor sie zuerst hinschreibt.
+            if (item.ValueKind == JsonValueKind.String)
+            {
+                var shorthand = item.GetString();
+                if (!string.IsNullOrWhiteSpace(shorthand))
+                {
+                    regions.Add(new SectionLayoutRegion(shorthand.Trim(), shorthand.Trim()));
+                }
+
+                continue;
+            }
+
+            if (item.ValueKind != JsonValueKind.Object)
+            {
+                continue;
+            }
+
+            var regionKey = FirstNonEmpty(TryGetString(item, "key"), TryGetString(item, "regionKey"));
+            if (string.IsNullOrWhiteSpace(regionKey))
+            {
+                continue;
+            }
+
+            regions.Add(new SectionLayoutRegion(
+                regionKey.Trim(),
+                FirstNonEmpty(TryGetString(item, "label"), TryGetString(item, "name"), regionKey).Trim()));
+        }
+
+        return regions;
+    }
+
+    private static bool TryGetArray(JsonElement element, string name, out JsonElement array)
+    {
+        if (element.TryGetProperty(name, out var found) && found.ValueKind == JsonValueKind.Array)
+        {
+            array = found;
+            return true;
+        }
+
+        array = default;
+        return false;
+    }
+
+    private static string? TryGetString(JsonElement element, string name) =>
+        element.TryGetProperty(name, out var found) && found.ValueKind == JsonValueKind.String
+            ? found.GetString()
+            : null;
+
+    private static int? TryGetInt32(JsonElement element, string name) =>
+        element.TryGetProperty(name, out var found) && found.ValueKind == JsonValueKind.Number &&
+        found.TryGetInt32(out var value)
+            ? value
+            : null;
+
+    private static string FirstNonEmpty(params string?[] candidates) =>
+        candidates.FirstOrDefault(candidate => !string.IsNullOrWhiteSpace(candidate)) ?? string.Empty;
+}
diff --git a/src/Core/Infrastructure/Extensions/ThemeJsonWorkspaceTemplateSyncService.cs b/src/Core/Infrastructure/Extensions/ThemeJsonWorkspaceTemplateSyncService.cs
index b5a36959..7d195ed5 100644
--- a/src/Core/Infrastructure/Extensions/ThemeJsonWorkspaceTemplateSyncService.cs
+++ b/src/Core/Infrastructure/Extensions/ThemeJsonWorkspaceTemplateSyncService.cs
@@ -7,6 +7,7 @@ namespace Callora.Core.Infrastructure.Extensions;
 public sealed class ThemeJsonWorkspaceTemplateSyncService(
     IWorkspaceTemplateRegistryStore store,
     IWorkspaceThemeSettingsStore settingsStore,
+    IWorkspaceSectionLayoutStore sectionLayoutStore,
     ILogger<ThemeJsonWorkspaceTemplateSyncService> logger) : IThemeJsonWorkspaceTemplateSyncService
 {
     public async Task SyncFromAssemblyAsync(
@@ -23,11 +24,13 @@ public async Task SyncFromAssemblyAsync(
         if (!readResult.ShouldReplaceDefinitions)
         {
             await SyncThemeSettingsFromThemeJsonAsync(pluginId, version, assemblyPath, cancellationToken).ConfigureAwait(false);
+            await SyncSectionLayoutsFromThemeJsonAsync(pluginId, version, assemblyPath, cancellationToken).ConfigureAwait(false);
             return;
         }
 
         await store.ReplaceDefinitionsForPluginAsync(pluginId, version, readResult.Definitions, cancellationToken).ConfigureAwait(false);
         await SyncThemeSettingsFromThemeJsonAsync(pluginId, version, assemblyPath, cancellationToken).ConfigureAwait(false);
+        await SyncSectionLayoutsFromThemeJsonAsync(pluginId, version, assemblyPath, cancellationToken).ConfigureAwait(false);
     }
 
     public Task ClearPluginDefinitionsAsync(
@@ -60,6 +63,56 @@ await store
         }
 
         await settingsStore.ClearPluginDefinitionsAsync(pluginId, cancellationToken).ConfigureAwait(false);
+        await sectionLayoutStore.ClearForPluginAsync(pluginId, cancellationToken).ConfigureAwait(false);
+    }
+
+    /// <summary>
+    /// Takes over the section layouts this theme version declares.
+    /// <para>
+    /// Always replaces, including with an empty list. A theme that dropped its layouts must stop
+    /// offering them — leaving the old ones in place would let the editor compose a grid nothing
+    /// can style, and the mistake would only surface on the published page.
+    /// </para>
+    /// </summary>
+    private async Task SyncSectionLayoutsFromThemeJsonAsync(
+        string pluginId,
+        string version,
+        string assemblyPath,
+        CancellationToken cancellationToken)
+    {
+        var themeJsonPath = ResolveThemeJsonPath(assemblyPath);
+        if (themeJsonPath is null || !File.Exists(themeJsonPath))
+        {
+            return;
+        }
+
+        IReadOnlyList<SectionLayoutDefinition> layouts;
+        bool inheritsBase;
+        try
+        {
+            var json = await File.ReadAllTextAsync(themeJsonPath, cancellationToken).ConfigureAwait(false);
+            using var document = JsonDocument.Parse(json);
+            layouts = SectionLayoutManifestReader.Parse(document.RootElement);
+            inheritsBase = SectionLayoutManifestReader.ParseInheritsBase(document.RootElement);
+        }
+        catch (JsonException ex)
+        {
+            // Die anderen Zweige haben dieselbe Datei schon gelesen und dasselbe gemeldet; hier
+            // nichts zu tun ist richtiger, als die vorhandenen Layouts wegen eines Tippfehlers
+            // in einem ganz anderen Abschnitt zu löschen.
+            logger.LogWarning(ex, "Invalid theme.json found at {ThemeJsonPath}.", themeJsonPath);
+            return;
+        }
+
+        await sectionLayoutStore
+            .ReplaceForPluginAsync(pluginId, version, layouts, inheritsBase, cancellationToken)
+            .ConfigureAwait(false);
+    }
+
+    private static string? ResolveThemeJsonPath(string assemblyPath)
+    {
+        var directory = Path.GetDirectoryName(Path.GetFullPath(assemblyPath));
+        return string.IsNullOrWhiteSpace(directory) ? null : Path.Combine(directory, "theme.json");
     }
 
     private async Task SyncThemeSettingsFromThemeJsonAsync(
diff --git a/src/Core/Infrastructure/Persistence/BackendPersistenceServiceCollectionExtensions.cs b/src/Core/Infrastructure/Persistence/BackendPersistenceServiceCollectionExtensions.cs
index e30772a0..f784c82f 100644
--- a/src/Core/Infrastructure/Persistence/BackendPersistenceServiceCollectionExtensions.cs
+++ b/src/Core/Infrastructure/Persistence/BackendPersistenceServiceCollectionExtensions.cs
@@ -58,6 +58,7 @@ public static IServiceCollection AddBackendPersistence(
             ScopedWorkspaceSurfaceProvisioner>();
         services.AddScoped<IWorkspaceTemplateRegistryStore, EfWorkspaceTemplateRegistryStore>();
         services.AddScoped<IWorkspaceThemeSettingsStore, EfWorkspaceThemeSettingsStore>();
+        services.AddScoped<IWorkspaceSectionLayoutStore, EfWorkspaceSectionLayoutStore>();
         services.AddScoped<IPasswordHasher<BackendUser>, PasswordHasher<BackendUser>>();
 
         services.AddScoped<IHostAuditStore, DatabaseHostAuditStore>();
diff --git a/src/Core/Infrastructure/Persistence/Configurations/WorkspaceSectionLayoutDefinitionEntityTypeConfiguration.cs b/src/Core/Infrastructure/Persistence/Configurations/WorkspaceSectionLayoutDefinitionEntityTypeConfiguration.cs
new file mode 100644
index 00000000..21de386e
--- /dev/null
+++ b/src/Core/Infrastructure/Persistence/Configurations/WorkspaceSectionLayoutDefinitionEntityTypeConfiguration.cs
@@ -0,0 +1,29 @@
+using Callora.Core.Domain.Extensions;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata.Builders;
+
+namespace Callora.Core.Infrastructure.Persistence.Configurations;
+
+public sealed class WorkspaceSectionLayoutDefinitionEntityTypeConfiguration
+    : IEntityTypeConfiguration<WorkspaceSectionLayoutDefinition>
+{
+    public void Configure(EntityTypeBuilder<WorkspaceSectionLayoutDefinition> builder)
+    {
+        builder.ToTable("workspace_section_layout_definitions");
+        builder.HasKey(x => x.Id);
+        builder.HasIndex(x => new { x.LayoutKey, x.PluginId, x.Version }).IsUnique();
+        builder.HasIndex(x => new { x.PluginId, x.Version, x.IsActive });
+
+        builder.Property(x => x.Id).HasColumnName("id");
+        builder.Property(x => x.LayoutKey).HasColumnName("layout_key").HasMaxLength(180).IsRequired();
+        builder.Property(x => x.PluginId).HasColumnName("plugin_id").HasMaxLength(200).IsRequired();
+        builder.Property(x => x.Version).HasColumnName("version").HasMaxLength(80).IsRequired();
+        builder.Property(x => x.Label).HasColumnName("label").HasMaxLength(300).IsRequired();
+        builder.Property(x => x.RegionsJson).HasColumnName("regions_json").IsRequired();
+        builder.Property(x => x.SortOrder).HasColumnName("sort_order").IsRequired();
+        builder.Property(x => x.InheritsBase).HasColumnName("inherits_base").IsRequired();
+        builder.Property(x => x.IsActive).HasColumnName("is_active").IsRequired();
+        builder.Property(x => x.CreatedAtUtc).HasColumnName("created_at_utc").IsRequired();
+        builder.Property(x => x.UpdatedAtUtc).HasColumnName("updated_at_utc").IsRequired();
+    }
+}
diff --git a/src/Core/Infrastructure/Persistence/EfWorkspaceSectionLayoutStore.cs b/src/Core/Infrastructure/Persistence/EfWorkspaceSectionLayoutStore.cs
new file mode 100644
index 00000000..e53314d0
--- /dev/null
+++ b/src/Core/Infrastructure/Persistence/EfWorkspaceSectionLayoutStore.cs
@@ -0,0 +1,123 @@
+using Callora.Core.Application.Extensions;
+using Callora.Core.Domain.Extensions;
+using Microsoft.EntityFrameworkCore;
+using System.Text.Json;
+
+namespace Callora.Core.Infrastructure.Persistence;
+
+public sealed class EfWorkspaceSectionLayoutStore(HostPersistenceDbContext dbContext)
+    : IWorkspaceSectionLayoutStore
+{
+    private static readonly JsonSerializerOptions Json = new(JsonSerializerDefaults.Web);
+
+    public async Task<ThemeSectionLayouts> ListAsync(
+        string pluginId,
+        string version,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(pluginId);
+        ArgumentException.ThrowIfNullOrWhiteSpace(version);
+
+        var normalizedPluginId = pluginId.Trim();
+        var normalizedVersion = version.Trim();
+
+        var rows = await dbContext.WorkspaceSectionLayoutDefinitions
+            .AsNoTracking()
+            .Where(x => x.PluginId == normalizedPluginId && x.Version == normalizedVersion && x.IsActive)
+            .OrderBy(x => x.SortOrder)
+            .ThenBy(x => x.LayoutKey)
+            .ToArrayAsync(cancellationToken)
+            .ConfigureAwait(false);
+
+        // Ein Theme ohne eigene Layouts hat keine Zeile — und erbt.
+        return new ThemeSectionLayouts(
+            rows.Select(Read).ToArray(),
+            rows.Length == 0 || rows[0].InheritsBase);
+    }
+
+    public async Task ReplaceForPluginAsync(
+        string pluginId,
+        string version,
+        IReadOnlyList<SectionLayoutDefinition> layouts,
+        bool inheritsBase,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(pluginId);
+        ArgumentException.ThrowIfNullOrWhiteSpace(version);
+        ArgumentNullException.ThrowIfNull(layouts);
+
+        var normalizedPluginId = pluginId.Trim();
+        var normalizedVersion = version.Trim();
+        var nowUtc = DateTimeOffset.UtcNow;
+
+        await using var transaction = await dbContext.Database
+            .BeginTransactionAsync(cancellationToken)
+            .ConfigureAwait(false);
+
+        await dbContext.WorkspaceSectionLayoutDefinitions
+            .Where(x => x.PluginId == normalizedPluginId && x.Version == normalizedVersion)
+            .ExecuteDeleteAsync(cancellationToken)
+            .ConfigureAwait(false);
+
+        var entities = layouts
+            .Where(layout => !string.IsNullOrWhiteSpace(layout.LayoutKey))
+            .Select(layout => new WorkspaceSectionLayoutDefinition
+            {
+                Id = Guid.NewGuid(),
+                LayoutKey = layout.LayoutKey.Trim(),
+                PluginId = normalizedPluginId,
+                Version = normalizedVersion,
+                Label = string.IsNullOrWhiteSpace(layout.Label) ? layout.LayoutKey.Trim() : layout.Label.Trim(),
+                RegionsJson = JsonSerializer.Serialize(layout.Regions, Json),
+                SortOrder = layout.SortOrder,
+                InheritsBase = inheritsBase,
+                IsActive = true,
+                CreatedAtUtc = nowUtc,
+                UpdatedAtUtc = nowUtc
+            })
+            .ToArray();
+
+        if (entities.Length > 0)
+        {
+            await dbContext.WorkspaceSectionLayoutDefinitions
+                .AddRangeAsync(entities, cancellationToken)
+                .ConfigureAwait(false);
+        }
+
+        await dbContext.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
+        await transaction.CommitAsync(cancellationToken).ConfigureAwait(false);
+    }
+
+    public async Task ClearForPluginAsync(string pluginId, CancellationToken cancellationToken = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(pluginId);
+
+        var normalizedPluginId = pluginId.Trim();
+        await dbContext.WorkspaceSectionLayoutDefinitions
+            .Where(x => x.PluginId == normalizedPluginId)
+            .ExecuteDeleteAsync(cancellationToken)
+            .ConfigureAwait(false);
+    }
+
+    private static SectionLayoutDefinition Read(WorkspaceSectionLayoutDefinition row)
+    {
+        // Ein Layout mit unlesbaren Regionen wird zu einem Layout OHNE Regionen, nicht zu einem
+        // Fehler: Der Editor bietet es dann als leer an, statt dass die ganze Liste ausfällt und
+        // niemand mehr irgendein Layout wählen kann.
+        SectionLayoutRegion[]? regions = null;
+        try
+        {
+            regions = JsonSerializer.Deserialize<SectionLayoutRegion[]>(row.RegionsJson, Json);
+        }
+        catch (JsonException)
+        {
+            regions = null;
+        }
+
+        return new SectionLayoutDefinition(
+            row.LayoutKey,
+            row.Label,
+            regions ?? [],
+            row.SortOrder);
+    }
+}
diff --git a/src/Core/Infrastructure/Persistence/HostPersistenceDbContext.cs b/src/Core/Infrastructure/Persistence/HostPersistenceDbContext.cs
index 26376d7c..2d4dcbf9 100644
--- a/src/Core/Infrastructure/Persistence/HostPersistenceDbContext.cs
+++ b/src/Core/Infrastructure/Persistence/HostPersistenceDbContext.cs
@@ -58,6 +58,9 @@ public sealed class HostPersistenceDbContext(
     public DbSet<Callora.Core.Domain.Extensions.WorkspaceThemeSettingValue> WorkspaceThemeSettingValues =>
         Set<Callora.Core.Domain.Extensions.WorkspaceThemeSettingValue>();
 
+    public DbSet<Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition> WorkspaceSectionLayoutDefinitions =>
+        Set<Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition>();
+
     public DbSet<Callora.Core.Domain.Configuration.SystemConfigDefinition> SystemConfigDefinitions =>
         Set<Callora.Core.Domain.Configuration.SystemConfigDefinition>();
 
diff --git a/src/Core/Infrastructure/Persistence/Migrations/20260807105859_AddWorkspaceSectionLayoutDefinitions.Designer.cs b/src/Core/Infrastructure/Persistence/Migrations/20260807105859_AddWorkspaceSectionLayoutDefinitions.Designer.cs
new file mode 100644
index 00000000..26de5ac8
--- /dev/null
+++ b/src/Core/Infrastructure/Persistence/Migrations/20260807105859_AddWorkspaceSectionLayoutDefinitions.Designer.cs
@@ -0,0 +1,1873 @@
+// <auto-generated />
+using System;
+using Callora.Core.Infrastructure.Persistence;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+
+#nullable disable
+
+namespace Callora.Core.Infrastructure.Persistence.Migrations;
+
+[DbContext(typeof(HostPersistenceDbContext))]
+[Migration("20260807105859_AddWorkspaceSectionLayoutDefinitions")]
+partial class AddWorkspaceSectionLayoutDefinitions
+{
+    /// <inheritdoc />
+    protected override void BuildTargetModel(ModelBuilder modelBuilder)
+    {
+#pragma warning disable 612, 618
+        modelBuilder
+            .HasAnnotation("ProductVersion", "10.0.9")
+            .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+        NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+        modelBuilder.Entity("Callora.Core.Domain.Audit.PluginAuditLog", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<string>("Action")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.Property<bool>("IsSuccess")
+                    .HasColumnType("boolean");
+
+                b.Property<string>("Message")
+                    .HasMaxLength(2000)
+                    .HasColumnType("character varying(2000)");
+
+                b.Property<string>("MetadataJson")
+                    .HasColumnType("TEXT");
+
+                b.Property<DateTimeOffset>("OccurredAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("PluginId")
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.Property<string>("RequestedBy")
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.HasKey("Id");
+
+                b.HasIndex("OccurredAtUtc");
+
+                b.HasIndex("PluginId");
+
+                b.ToTable("plugin_audit_logs", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Configuration.SystemConfigDefinition", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<string>("ConfigKey")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.Property<DateTimeOffset>("CreatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("DefaultValueJson")
+                    .HasColumnType("text");
+
+                b.Property<string>("Description")
+                    .HasMaxLength(1000)
+                    .HasColumnType("character varying(1000)");
+
+                b.Property<string>("FieldType")
+                    .IsRequired()
+                    .HasMaxLength(40)
+                    .HasColumnType("character varying(40)");
+
+                b.Property<string>("GroupName")
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.Property<bool>("IsActive")
+                    .HasColumnType("boolean");
+
+                b.Property<string>("Label")
+                    .IsRequired()
+                    .HasMaxLength(240)
+                    .HasColumnType("character varying(240)");
+
+                b.Property<string>("OptionsJson")
+                    .HasColumnType("text");
+
+                b.Property<string>("PluginId")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.Property<int>("SortOrder")
+                    .HasColumnType("integer");
+
+                b.Property<DateTimeOffset>("UpdatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("Version")
+                    .IsRequired()
+                    .HasMaxLength(60)
+                    .HasColumnType("character varying(60)");
+
+                b.HasKey("Id");
+
+                b.HasIndex("PluginId", "ConfigKey")
+                    .IsUnique();
+
+                b.ToTable("system_config_definitions", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Configuration.SystemConfigValue", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<string>("ConfigKey")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.Property<string>("PluginId")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.Property<string>("Scope")
+                    .IsRequired()
+                    .HasMaxLength(20)
+                    .HasColumnType("character varying(20)");
+
+                b.Property<string>("ScopeKey")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.Property<DateTimeOffset>("UpdatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("ValueJson")
+                    .IsRequired()
+                    .HasColumnType("text");
+
+                b.HasKey("Id");
+
+                b.HasIndex("PluginId", "ConfigKey", "Scope", "ScopeKey")
+                    .IsUnique();
+
+                b.ToTable("system_config_values", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.CustomFields.CustomFieldDefinition", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<DateTimeOffset>("CreatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("EntityName")
+                    .IsRequired()
+                    .HasMaxLength(60)
+                    .HasColumnType("character varying(60)");
+
+                b.Property<string>("FieldKey")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.Property<string>("FieldType")
+                    .IsRequired()
+                    .HasMaxLength(40)
+                    .HasColumnType("character varying(40)");
+
+                b.Property<bool>("IsActive")
+                    .HasColumnType("boolean");
+
+                b.Property<string>("Label")
+                    .IsRequired()
+                    .HasMaxLength(240)
+                    .HasColumnType("character varying(240)");
+
+                b.Property<string>("PluginId")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.Property<int>("SortOrder")
+                    .HasColumnType("integer");
+
+                b.Property<string>("Version")
+                    .IsRequired()
+                    .HasMaxLength(60)
+                    .HasColumnType("character varying(60)");
+
+                b.HasKey("Id");
+
+                b.HasIndex("EntityName", "FieldKey")
+                    .IsUnique();
+
+                b.ToTable("custom_field_definitions", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.CustomFields.CustomFieldValue", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<string>("EntityId")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.Property<string>("EntityName")
+                    .IsRequired()
+                    .HasMaxLength(60)
+                    .HasColumnType("character varying(60)");
+
+                b.Property<string>("FieldKey")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.Property<DateTimeOffset>("UpdatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("ValueJson")
+                    .IsRequired()
+                    .HasColumnType("text");
+
+                b.Property<string>("WorkspaceKey")
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.HasKey("Id");
+
+                b.HasIndex("WorkspaceKey");
+
+                b.HasIndex("EntityName", "EntityId", "FieldKey")
+                    .IsUnique();
+
+                b.ToTable("custom_field_values", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Entitlements.MarketplaceEntitlementEventRecord", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<string>("Action")
+                    .IsRequired()
+                    .HasMaxLength(50)
+                    .HasColumnType("character varying(50)");
+
+                b.Property<string>("EventId")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.Property<string>("PluginId")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.Property<DateTimeOffset>("ProcessedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("TenantKey")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.Property<string>("WorkspaceKey")
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.HasKey("Id");
+
+                b.HasIndex("EventId")
+                    .IsUnique();
+
+                b.ToTable("marketplace_entitlement_events", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Entitlements.PluginEntitlement", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<DateTimeOffset>("CreatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<bool>("IsEntitled")
+                    .HasColumnType("boolean");
+
+                b.Property<string>("PluginId")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.Property<string>("Source")
+                    .IsRequired()
+                    .HasMaxLength(60)
+                    .HasColumnType("character varying(60)");
+
+                b.Property<string>("TenantKey")
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.Property<DateTimeOffset>("UpdatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("WorkspaceKey")
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.HasKey("Id");
+
+                b.HasIndex("PluginId", "TenantKey", "WorkspaceKey")
+                    .IsUnique();
+
+                b.ToTable("plugin_entitlements", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid")
+                    .HasColumnName("id");
+
+                b.Property<DateTimeOffset>("CreatedAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("created_at_utc");
+
+                b.Property<bool>("InheritsBase")
+                    .HasColumnType("boolean")
+                    .HasColumnName("inherits_base");
+
+                b.Property<bool>("IsActive")
+                    .HasColumnType("boolean")
+                    .HasColumnName("is_active");
+
+                b.Property<string>("Label")
+                    .IsRequired()
+                    .HasMaxLength(300)
+                    .HasColumnType("character varying(300)")
+                    .HasColumnName("label");
+
+                b.Property<string>("LayoutKey")
+                    .IsRequired()
+                    .HasMaxLength(180)
+                    .HasColumnType("character varying(180)")
+                    .HasColumnName("layout_key");
+
+                b.Property<string>("PluginId")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("plugin_id");
+
+                b.Property<string>("RegionsJson")
+                    .IsRequired()
+                    .HasColumnType("text")
+                    .HasColumnName("regions_json");
+
+                b.Property<int>("SortOrder")
+                    .HasColumnType("integer")
+                    .HasColumnName("sort_order");
+
+                b.Property<DateTimeOffset>("UpdatedAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("updated_at_utc");
+
+                b.Property<string>("Version")
+                    .IsRequired()
+                    .HasMaxLength(80)
+                    .HasColumnType("character varying(80)")
+                    .HasColumnName("version");
+
+                b.HasKey("Id");
+
+                b.HasIndex("LayoutKey", "PluginId", "Version")
+                    .IsUnique();
+
+                b.HasIndex("PluginId", "Version", "IsActive");
+
+                b.ToTable("workspace_section_layout_definitions", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Extensions.WorkspaceTemplateDefinition", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid")
+                    .HasColumnName("id");
+
+                b.Property<DateTimeOffset>("CreatedAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("created_at_utc");
+
+                b.Property<string>("DisplayName")
+                    .IsRequired()
+                    .HasMaxLength(300)
+                    .HasColumnType("character varying(300)")
+                    .HasColumnName("display_name");
+
+                b.Property<bool>("IsActive")
+                    .HasColumnType("boolean")
+                    .HasColumnName("is_active");
+
+                b.Property<string>("ParentTemplateKey")
+                    .HasMaxLength(180)
+                    .HasColumnType("character varying(180)")
+                    .HasColumnName("parent_template_key");
+
+                b.Property<string>("PluginId")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("plugin_id");
+
+                b.Property<int>("Priority")
+                    .HasColumnType("integer")
+                    .HasColumnName("priority");
+
+                b.Property<string>("Scope")
+                    .IsRequired()
+                    .HasMaxLength(40)
+                    .HasColumnType("character varying(40)")
+                    .HasColumnName("scope");
+
+                b.Property<string>("Surface")
+                    .IsRequired()
+                    .HasMaxLength(40)
+                    .HasColumnType("character varying(40)")
+                    .HasColumnName("surface");
+
+                b.Property<string>("TemplateKey")
+                    .IsRequired()
+                    .HasMaxLength(180)
+                    .HasColumnType("character varying(180)")
+                    .HasColumnName("template_key");
+
+                b.Property<string>("TemplatePath")
+                    .IsRequired()
+                    .HasMaxLength(1000)
+                    .HasColumnType("character varying(1000)")
+                    .HasColumnName("template_path");
+
+                b.Property<DateTimeOffset>("UpdatedAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("updated_at_utc");
+
+                b.Property<string>("Version")
+                    .IsRequired()
+                    .HasMaxLength(80)
+                    .HasColumnType("character varying(80)")
+                    .HasColumnName("version");
+
+                b.HasKey("Id");
+
+                b.HasIndex("TemplateKey");
+
+                b.HasIndex("Surface", "IsActive");
+
+                b.HasIndex("TemplateKey", "Surface", "PluginId", "Version")
+                    .IsUnique();
+
+                b.ToTable("workspace_template_definitions", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Extensions.WorkspaceThemeSettingDefinition", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid")
+                    .HasColumnName("id");
+
+                b.Property<DateTimeOffset>("CreatedAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("created_at_utc");
+
+                b.Property<string>("DefaultValueJson")
+                    .HasColumnType("text")
+                    .HasColumnName("default_value_json");
+
+                b.Property<string>("Description")
+                    .HasMaxLength(2000)
+                    .HasColumnType("character varying(2000)")
+                    .HasColumnName("description");
+
+                b.Property<string>("FieldType")
+                    .IsRequired()
+                    .HasMaxLength(80)
+                    .HasColumnType("character varying(80)")
+                    .HasColumnName("field_type");
+
+                b.Property<string>("GroupName")
+                    .HasMaxLength(180)
+                    .HasColumnType("character varying(180)")
+                    .HasColumnName("group_name");
+
+                b.Property<bool>("IsActive")
+                    .HasColumnType("boolean")
+                    .HasColumnName("is_active");
+
+                b.Property<bool>("IsRequired")
+                    .HasColumnType("boolean")
+                    .HasColumnName("is_required");
+
+                b.Property<string>("Label")
+                    .IsRequired()
+                    .HasMaxLength(300)
+                    .HasColumnType("character varying(300)")
+                    .HasColumnName("label");
+
+                b.Property<string>("OptionsJson")
+                    .HasColumnType("text")
+                    .HasColumnName("options_json");
+
+                b.Property<string>("PluginId")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("plugin_id");
+
+                b.Property<string>("SettingKey")
+                    .IsRequired()
+                    .HasMaxLength(180)
+                    .HasColumnType("character varying(180)")
+                    .HasColumnName("setting_key");
+
+                b.Property<int>("SortOrder")
+                    .HasColumnType("integer")
+                    .HasColumnName("sort_order");
+
+                b.Property<DateTimeOffset>("UpdatedAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("updated_at_utc");
+
+                b.Property<string>("Version")
+                    .IsRequired()
+                    .HasMaxLength(80)
+                    .HasColumnType("character varying(80)")
+                    .HasColumnName("version");
+
+                b.HasKey("Id");
+
+                b.HasIndex("PluginId", "Version", "IsActive");
+
+                b.HasIndex("SettingKey", "PluginId", "Version")
+                    .IsUnique();
+
+                b.ToTable("workspace_theme_setting_definitions", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Extensions.WorkspaceThemeSettingValue", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid")
+                    .HasColumnName("id");
+
+                b.Property<string>("PluginId")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("plugin_id");
+
+                b.Property<string>("SettingKey")
+                    .IsRequired()
+                    .HasMaxLength(180)
+                    .HasColumnType("character varying(180)")
+                    .HasColumnName("setting_key");
+
+                b.Property<string>("SurfaceKey")
+                    .IsRequired()
+                    .ValueGeneratedOnAdd()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)")
+                    .HasDefaultValue("")
+                    .HasColumnName("surface_key");
+
+                b.Property<DateTimeOffset>("UpdatedAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("updated_at_utc");
+
+                b.Property<string>("ValueJson")
+                    .IsRequired()
+                    .HasColumnType("text")
+                    .HasColumnName("value_json");
+
+                b.Property<string>("WorkspaceKey")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)")
+                    .HasColumnName("workspace_key");
+
+                b.HasKey("Id");
+
+                b.HasIndex("PluginId", "SettingKey");
+
+                b.HasIndex("WorkspaceKey", "SurfaceKey", "PluginId", "SettingKey")
+                    .IsUnique();
+
+                b.ToTable("workspace_theme_setting_values", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Flows.FlowDefinition", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<string>("ActionsJson")
+                    .IsRequired()
+                    .HasColumnType("text");
+
+                b.Property<string>("ConditionsJson")
+                    .HasColumnType("text");
+
+                b.Property<DateTimeOffset>("CreatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<bool>("IsActive")
+                    .HasColumnType("boolean");
+
+                b.Property<string>("Name")
+                    .IsRequired()
+                    .HasMaxLength(240)
+                    .HasColumnType("character varying(240)");
+
+                b.Property<int>("Priority")
+                    .HasColumnType("integer");
+
+                b.Property<string>("TriggerEvent")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.Property<DateTimeOffset>("UpdatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("WorkspaceKey")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.HasKey("Id");
+
+                b.HasIndex("WorkspaceKey", "TriggerEvent", "IsActive");
+
+                b.ToTable("flows", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Integrations.IntegrationCredential", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<DateTimeOffset>("CreatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("CreatedBy")
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.Property<bool>("IsActive")
+                    .HasColumnType("boolean");
+
+                b.Property<string>("KeyHash")
+                    .IsRequired()
+                    .HasMaxLength(64)
+                    .HasColumnType("character varying(64)");
+
+                b.Property<string>("KeyPrefix")
+                    .IsRequired()
+                    .HasMaxLength(32)
+                    .HasColumnType("character varying(32)");
+
+                b.Property<string>("Name")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.Property<DateTimeOffset?>("RevokedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("RoleName")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.Property<string>("Scope")
+                    .IsRequired()
+                    .HasMaxLength(40)
+                    .HasColumnType("character varying(40)");
+
+                b.Property<string>("WorkspaceKey")
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.HasKey("Id");
+
+                b.HasIndex("KeyHash")
+                    .IsUnique();
+
+                b.HasIndex("Name")
+                    .IsUnique();
+
+                b.ToTable("integration_credentials", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Jobs.BackgroundJob", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<int>("AttemptCount")
+                    .HasColumnType("integer");
+
+                b.Property<DateTimeOffset?>("CompletedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<DateTimeOffset>("CreatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("JobType")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.Property<string>("LastError")
+                    .HasMaxLength(4000)
+                    .HasColumnType("character varying(4000)");
+
+                b.Property<DateTimeOffset?>("LeaseExpiresAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<Guid>("LeaseToken")
+                    .IsConcurrencyToken()
+                    .HasColumnType("uuid");
+
+                b.Property<int>("MaxAttempts")
+                    .HasColumnType("integer");
+
+                b.Property<string>("PayloadJson")
+                    .IsRequired()
+                    .HasColumnType("jsonb");
+
+                b.Property<DateTimeOffset>("ScheduledAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<DateTimeOffset?>("StartedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<int>("Status")
+                    .HasColumnType("integer");
+
+                b.Property<string>("WorkspaceKey")
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.HasKey("Id");
+
+                b.HasIndex("JobType");
+
+                b.HasIndex("Status", "LeaseExpiresAtUtc");
+
+                b.HasIndex("Status", "ScheduledAtUtc");
+
+                b.ToTable("background_jobs", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Media.MediaItem", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<string>("ContentType")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.Property<DateTimeOffset>("CreatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("CreatedBy")
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.Property<string>("FileName")
+                    .IsRequired()
+                    .HasMaxLength(400)
+                    .HasColumnType("character varying(400)");
+
+                b.Property<string>("Folder")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.Property<long>("SizeBytes")
+                    .HasColumnType("bigint");
+
+                b.Property<string>("WorkspaceKey")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.HasKey("Id");
+
+                b.HasIndex("WorkspaceKey", "Folder");
+
+                b.ToTable("media_items", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Notifications.NotificationEntry", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<DateTimeOffset>("CreatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<bool>("IsRead")
+                    .HasColumnType("boolean");
+
+                b.Property<string>("Level")
+                    .IsRequired()
+                    .HasMaxLength(20)
+                    .HasColumnType("character varying(20)");
+
+                b.Property<string>("Message")
+                    .IsRequired()
+                    .HasMaxLength(4000)
+                    .HasColumnType("character varying(4000)");
+
+                b.Property<string>("Title")
+                    .IsRequired()
+                    .HasMaxLength(240)
+                    .HasColumnType("character varying(240)");
+
+                b.Property<string>("WorkspaceKey")
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.HasKey("Id");
+
+                b.HasIndex("WorkspaceKey", "IsRead", "CreatedAtUtc");
+
+                b.ToTable("notifications", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Plugins.PluginDataDocument", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<string>("Collection")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.Property<DateTimeOffset>("CreatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("EntryKey")
+                    .IsRequired()
+                    .HasMaxLength(400)
+                    .HasColumnType("character varying(400)");
+
+                b.Property<string>("JsonDocument")
+                    .IsRequired()
+                    .HasColumnType("jsonb");
+
+                b.Property<string>("PluginId")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.Property<DateTimeOffset>("UpdatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("WorkspaceKey")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.HasKey("Id");
+
+                b.HasIndex("PluginId", "WorkspaceKey", "Collection", "EntryKey")
+                    .IsUnique();
+
+                b.ToTable("plugin_data_documents", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Plugins.PluginInstallation", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<string>("AssemblyPath")
+                    .IsRequired()
+                    .HasMaxLength(2048)
+                    .HasColumnType("character varying(2048)");
+
+                b.Property<string>("ConditionalCapabilities")
+                    .HasMaxLength(2000)
+                    .HasColumnType("character varying(2000)");
+
+                b.Property<string>("DisplayName")
+                    .IsRequired()
+                    .HasMaxLength(300)
+                    .HasColumnType("character varying(300)");
+
+                b.Property<string>("EntryTypeName")
+                    .HasMaxLength(800)
+                    .HasColumnType("character varying(800)");
+
+                b.Property<DateTimeOffset>("InstalledAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("PluginId")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.Property<string>("ProvidedCapabilities")
+                    .HasMaxLength(2000)
+                    .HasColumnType("character varying(2000)");
+
+                b.Property<string>("RequiredCapabilities")
+                    .HasMaxLength(2000)
+                    .HasColumnType("character varying(2000)");
+
+                b.Property<int>("State")
+                    .HasColumnType("integer");
+
+                b.Property<DateTimeOffset>("UpdatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.HasKey("Id");
+
+                b.HasIndex("PluginId")
+                    .IsUnique();
+
+                b.ToTable("plugin_installations", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Plugins.PluginMigrationRecord", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<DateTimeOffset>("AppliedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("Description")
+                    .IsRequired()
+                    .HasMaxLength(500)
+                    .HasColumnType("character varying(500)");
+
+                b.Property<string>("PluginId")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.Property<int>("Version")
+                    .HasColumnType("integer");
+
+                b.HasKey("Id");
+
+                b.HasIndex("PluginId", "Version")
+                    .IsUnique();
+
+                b.ToTable("plugin_migrations", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Plugins.SessionResumeTicketRecord", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<DateTimeOffset>("ExpiresAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("expires_at_utc");
+
+                b.Property<DateTimeOffset>("IssuedAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("issued_at_utc");
+
+                b.Property<string>("Payload")
+                    .IsRequired()
+                    .HasColumnType("text")
+                    .HasColumnName("payload");
+
+                b.Property<string>("PluginId")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("plugin_id");
+
+                b.Property<string>("SessionKind")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)")
+                    .HasColumnName("session_kind");
+
+                b.Property<string>("TokenHash")
+                    .IsRequired()
+                    .HasMaxLength(64)
+                    .HasColumnType("character varying(64)")
+                    .HasColumnName("token_hash");
+
+                b.Property<string>("WorkspaceKey")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)")
+                    .HasColumnName("workspace_key");
+
+                b.HasKey("Id");
+
+                b.HasIndex("ExpiresAtUtc");
+
+                b.HasIndex("TokenHash")
+                    .IsUnique();
+
+                b.ToTable("session_resume_tickets", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Plugins.WorkspacePluginActivation", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<DateTimeOffset>("CreatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<bool>("IsActive")
+                    .HasColumnType("boolean");
+
+                b.Property<string>("PluginId")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.Property<string>("TenantKey")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.Property<DateTimeOffset>("UpdatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("WorkspaceKey")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.HasKey("Id");
+
+                b.HasIndex("PluginId");
+
+                b.HasIndex("TenantKey", "PluginId");
+
+                b.HasIndex("TenantKey", "WorkspaceKey", "PluginId")
+                    .IsUnique();
+
+                b.ToTable("workspace_plugin_activations", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Security.BackendRbacRole", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<DateTimeOffset>("CreatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<bool>("IsSystem")
+                    .HasColumnType("boolean");
+
+                b.Property<string>("Name")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.Property<DateTimeOffset>("UpdatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.HasKey("Id");
+
+                b.HasIndex("Name")
+                    .IsUnique();
+
+                b.ToTable("backend_rbac_roles", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Security.BackendRbacRoleGrant", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<string>("PermissionKey")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.Property<Guid>("RoleId")
+                    .HasColumnType("uuid");
+
+                b.HasKey("Id");
+
+                b.HasIndex("RoleId", "PermissionKey")
+                    .IsUnique();
+
+                b.ToTable("backend_rbac_role_permissions", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Security.BackendRbacUserRole", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<DateTimeOffset>("AssignedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<Guid>("RoleId")
+                    .HasColumnType("uuid");
+
+                b.Property<Guid>("UserId")
+                    .HasColumnType("uuid");
+
+                b.HasKey("Id");
+
+                b.HasIndex("RoleId");
+
+                b.HasIndex("UserId")
+                    .IsUnique();
+
+                b.ToTable("backend_rbac_user_roles", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Security.BackendRevokedSession", b =>
+            {
+                b.Property<string>("TokenId")
+                    .HasMaxLength(128)
+                    .HasColumnType("character varying(128)");
+
+                b.Property<DateTimeOffset>("ExpiresAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<DateTimeOffset>("RevokedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("Subject")
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.HasKey("TokenId");
+
+                b.HasIndex("ExpiresAtUtc");
+
+                b.ToTable("backend_revoked_sessions", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Security.BackendUser", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<DateTimeOffset>("CreatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("DisplayName")
+                    .HasMaxLength(300)
+                    .HasColumnType("character varying(300)");
+
+                b.Property<string>("Email")
+                    .HasMaxLength(320)
+                    .HasColumnType("character varying(320)");
+
+                b.Property<string>("ExternalId")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)");
+
+                b.Property<int>("FailedAccessCount")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("integer")
+                    .HasDefaultValue(0);
+
+                b.Property<bool>("IsDisabled")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("boolean")
+                    .HasDefaultValue(false);
+
+                b.Property<DateTimeOffset?>("LockoutEndsAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("PasswordHash")
+                    .HasMaxLength(1024)
+                    .HasColumnType("character varying(1024)");
+
+                b.Property<string>("PasswordHashAlgorithm")
+                    .HasMaxLength(100)
+                    .HasColumnType("character varying(100)");
+
+                b.Property<string>("SecurityStamp")
+                    .IsRequired()
+                    .ValueGeneratedOnAdd()
+                    .HasMaxLength(64)
+                    .HasColumnType("character varying(64)")
+                    .HasDefaultValue("");
+
+                b.Property<DateTimeOffset>("UpdatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.HasKey("Id");
+
+                b.HasIndex("Email")
+                    .IsUnique();
+
+                b.HasIndex("ExternalId")
+                    .IsUnique();
+
+                b.ToTable("backend_users", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Surfaces.SurfaceHandoffTicketRecord", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<DateTimeOffset>("AuthenticatedAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("authenticated_at_utc");
+
+                b.Property<string>("AuthenticationMethod")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("authentication_method");
+
+                b.Property<string>("ClaimsJson")
+                    .IsRequired()
+                    .HasColumnType("text")
+                    .HasColumnName("claims_json");
+
+                b.Property<string>("DisplayName")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("display_name");
+
+                b.Property<DateTimeOffset>("ExpiresAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("expires_at_utc");
+
+                b.Property<DateTimeOffset>("IdentityExpiresAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("identity_expires_at_utc");
+
+                b.Property<DateTimeOffset>("IssuedAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("issued_at_utc");
+
+                b.Property<string>("Issuer")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("issuer");
+
+                b.Property<string>("SourceSurfaceKey")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)")
+                    .HasColumnName("source_surface_key");
+
+                b.Property<string>("SubjectId")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("subject_id");
+
+                b.Property<string>("TargetAudience")
+                    .IsRequired()
+                    .HasMaxLength(500)
+                    .HasColumnType("character varying(500)")
+                    .HasColumnName("target_audience");
+
+                b.Property<string>("TargetSurfaceKey")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)")
+                    .HasColumnName("target_surface_key");
+
+                b.Property<string>("TenantKey")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)")
+                    .HasColumnName("tenant_key");
+
+                b.Property<string>("TokenHash")
+                    .IsRequired()
+                    .HasMaxLength(64)
+                    .HasColumnType("character varying(64)")
+                    .HasColumnName("token_hash");
+
+                b.Property<string>("WorkspaceKey")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)")
+                    .HasColumnName("workspace_key");
+
+                b.HasKey("Id");
+
+                b.HasIndex("ExpiresAtUtc");
+
+                b.HasIndex("TokenHash")
+                    .IsUnique();
+
+                b.ToTable("surface_handoff_tickets", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Surfaces.SurfaceSessionRecord", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<string>("Audience")
+                    .IsRequired()
+                    .HasMaxLength(500)
+                    .HasColumnType("character varying(500)")
+                    .HasColumnName("audience");
+
+                b.Property<DateTimeOffset>("AuthenticatedAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("authenticated_at_utc");
+
+                b.Property<string>("AuthenticationMethod")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("authentication_method");
+
+                b.Property<string>("ClaimsJson")
+                    .IsRequired()
+                    .HasColumnType("text")
+                    .HasColumnName("claims_json");
+
+                b.Property<string>("DisplayName")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("display_name");
+
+                b.Property<DateTimeOffset>("ExpiresAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("expires_at_utc");
+
+                b.Property<string>("IdentityPluginId")
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("identity_plugin_id");
+
+                b.Property<string>("IdentityVersion")
+                    .HasMaxLength(80)
+                    .HasColumnType("character varying(80)")
+                    .HasColumnName("identity_version");
+
+                b.Property<DateTimeOffset>("IssuedAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("issued_at_utc");
+
+                b.Property<string>("Issuer")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("issuer");
+
+                b.Property<DateTimeOffset>("LastSeenAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("last_seen_at_utc");
+
+                b.Property<string>("SubjectId")
+                    .IsRequired()
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("subject_id");
+
+                b.Property<string>("SurfaceKey")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)")
+                    .HasColumnName("surface_key");
+
+                b.Property<string>("TenantKey")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)")
+                    .HasColumnName("tenant_key");
+
+                b.Property<string>("WorkspaceKey")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)")
+                    .HasColumnName("workspace_key");
+
+                b.HasKey("Id");
+
+                b.HasIndex("ExpiresAtUtc");
+
+                b.HasIndex("WorkspaceKey", "SurfaceKey");
+
+                b.ToTable("surface_sessions", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Tenants.Tenant", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<DateTimeOffset>("CreatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("DisplayName")
+                    .IsRequired()
+                    .HasMaxLength(300)
+                    .HasColumnType("character varying(300)");
+
+                b.Property<bool>("IsActive")
+                    .HasColumnType("boolean");
+
+                b.Property<string>("TenantKey")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.Property<DateTimeOffset>("UpdatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.HasKey("Id");
+
+                b.HasIndex("TenantKey")
+                    .IsUnique();
+
+                b.ToTable("tenants", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Webhooks.WebhookSubscription", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<DateTimeOffset>("CreatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("EventName")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.Property<bool>("IncludeSensitiveData")
+                    .HasColumnType("boolean");
+
+                b.Property<bool>("IsActive")
+                    .HasColumnType("boolean");
+
+                b.Property<string>("Secret")
+                    .IsRequired()
+                    .HasMaxLength(400)
+                    .HasColumnType("character varying(400)");
+
+                b.Property<string>("TargetUrl")
+                    .IsRequired()
+                    .HasMaxLength(2000)
+                    .HasColumnType("character varying(2000)");
+
+                b.Property<DateTimeOffset>("UpdatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("WorkspaceKey")
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.HasKey("Id");
+
+                b.HasIndex("EventName", "IsActive");
+
+                b.ToTable("webhook_subscriptions", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Workspaces.Workspace", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<DateTimeOffset>("CreatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("DisplayName")
+                    .IsRequired()
+                    .HasMaxLength(300)
+                    .HasColumnType("character varying(300)");
+
+                b.Property<bool>("IsActive")
+                    .HasColumnType("boolean");
+
+                b.Property<Guid>("TenantId")
+                    .HasColumnType("uuid");
+
+                b.Property<DateTimeOffset?>("ThemeAssignedAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("theme_assigned_at_utc");
+
+                b.Property<string>("ThemeAssignedBy")
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("theme_assigned_by");
+
+                b.Property<string>("ThemePluginId")
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("theme_plugin_id");
+
+                b.Property<string>("ThemeVersion")
+                    .HasMaxLength(80)
+                    .HasColumnType("character varying(80)")
+                    .HasColumnName("theme_version");
+
+                b.Property<DateTimeOffset>("UpdatedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("WorkspaceKey")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.Property<string>("WorkspaceType")
+                    .IsRequired()
+                    .HasMaxLength(100)
+                    .HasColumnType("character varying(100)");
+
+                b.HasKey("Id");
+
+                b.HasIndex("TenantId");
+
+                b.HasIndex("WorkspaceKey")
+                    .IsUnique();
+
+                b.ToTable("workspaces", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Workspaces.WorkspaceMembership", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<DateTimeOffset>("AssignedAtUtc")
+                    .HasColumnType("timestamp with time zone");
+
+                b.Property<string>("Role")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)");
+
+                b.Property<Guid>("UserId")
+                    .HasColumnType("uuid");
+
+                b.Property<Guid>("WorkspaceId")
+                    .HasColumnType("uuid");
+
+                b.HasKey("Id");
+
+                b.HasIndex("UserId");
+
+                b.HasIndex("WorkspaceId", "UserId")
+                    .IsUnique();
+
+                b.ToTable("workspace_memberships", (string)null);
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Workspaces.WorkspaceSurface", b =>
+            {
+                b.Property<Guid>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("uuid");
+
+                b.Property<string>("AccessMode")
+                    .IsRequired()
+                    .HasMaxLength(40)
+                    .HasColumnType("character varying(40)")
+                    .HasColumnName("access_mode");
+
+                b.Property<DateTimeOffset>("CreatedAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("created_at_utc");
+
+                b.Property<string>("DisplayName")
+                    .IsRequired()
+                    .HasMaxLength(300)
+                    .HasColumnType("character varying(300)")
+                    .HasColumnName("display_name");
+
+                b.Property<DateTimeOffset?>("IdentityAssignedAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("identity_assigned_at_utc");
+
+                b.Property<string>("IdentityAssignedBy")
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("identity_assigned_by");
+
+                b.Property<string>("IdentityPluginId")
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("identity_plugin_id");
+
+                b.Property<string>("IdentityVersion")
+                    .HasMaxLength(80)
+                    .HasColumnType("character varying(80)")
+                    .HasColumnName("identity_version");
+
+                b.Property<bool>("IsActive")
+                    .HasColumnType("boolean")
+                    .HasColumnName("is_active");
+
+                b.Property<string>("Locale")
+                    .HasMaxLength(40)
+                    .HasColumnType("character varying(40)")
+                    .HasColumnName("locale");
+
+                b.Property<string>("PublicBaseUrl")
+                    .HasMaxLength(2048)
+                    .HasColumnType("character varying(2048)")
+                    .HasColumnName("public_base_url");
+
+                b.Property<string>("PublicHost")
+                    .HasMaxLength(500)
+                    .HasColumnType("character varying(500)")
+                    .HasColumnName("public_host");
+
+                b.Property<string>("PublicPathPrefix")
+                    .IsRequired()
+                    .HasMaxLength(500)
+                    .HasColumnType("character varying(500)")
+                    .HasColumnName("public_path_prefix");
+
+                b.Property<string>("SurfaceKey")
+                    .IsRequired()
+                    .HasMaxLength(120)
+                    .HasColumnType("character varying(120)")
+                    .HasColumnName("surface_key");
+
+                b.Property<string>("SurfaceType")
+                    .IsRequired()
+                    .HasMaxLength(100)
+                    .HasColumnType("character varying(100)")
+                    .HasColumnName("surface_type");
+
+                b.Property<string>("TemplatePluginId")
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("template_plugin_id");
+
+                b.Property<string>("TemplateVersion")
+                    .HasMaxLength(80)
+                    .HasColumnType("character varying(80)")
+                    .HasColumnName("template_version");
+
+                b.Property<DateTimeOffset?>("ThemeAssignedAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("theme_assigned_at_utc");
+
+                b.Property<string>("ThemeAssignedBy")
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("theme_assigned_by");
+
+                b.Property<string>("ThemePluginId")
+                    .HasMaxLength(200)
+                    .HasColumnType("character varying(200)")
+                    .HasColumnName("theme_plugin_id");
+
+                b.Property<string>("ThemeVersion")
+                    .HasMaxLength(80)
+                    .HasColumnType("character varying(80)")
+                    .HasColumnName("theme_version");
+
+                b.Property<DateTimeOffset>("UpdatedAtUtc")
+                    .HasColumnType("timestamp with time zone")
+                    .HasColumnName("updated_at_utc");
+
+                b.Property<Guid>("WorkspaceId")
+                    .HasColumnType("uuid")
+                    .HasColumnName("workspace_id");
+
+                b.HasKey("Id");
+
+                b.HasIndex("PublicHost");
+
+                b.HasIndex("WorkspaceId", "SurfaceKey")
+                    .IsUnique();
+
+                b.ToTable("workspace_surfaces", (string)null);
+            });
+
+        modelBuilder.Entity("Microsoft.AspNetCore.DataProtection.EntityFrameworkCore.DataProtectionKey", b =>
+            {
+                b.Property<int>("Id")
+                    .ValueGeneratedOnAdd()
+                    .HasColumnType("integer");
+
+                NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
+
+                b.Property<string>("FriendlyName")
+                    .HasColumnType("text");
+
+                b.Property<string>("Xml")
+                    .HasColumnType("text");
+
+                b.HasKey("Id");
+
+                b.ToTable("DataProtectionKeys");
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Security.BackendRbacRoleGrant", b =>
+            {
+                b.HasOne("Callora.Core.Domain.Security.BackendRbacRole", "Role")
+                    .WithMany("Permissions")
+                    .HasForeignKey("RoleId")
+                    .OnDelete(DeleteBehavior.Cascade)
+                    .IsRequired();
+
+                b.Navigation("Role");
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Security.BackendRbacUserRole", b =>
+            {
+                b.HasOne("Callora.Core.Domain.Security.BackendRbacRole", "Role")
+                    .WithMany("UserAssignments")
+                    .HasForeignKey("RoleId")
+                    .OnDelete(DeleteBehavior.Restrict)
+                    .IsRequired();
+
+                b.HasOne("Callora.Core.Domain.Security.BackendUser", "User")
+                    .WithMany("RoleAssignments")
+                    .HasForeignKey("UserId")
+                    .OnDelete(DeleteBehavior.Cascade)
+                    .IsRequired();
+
+                b.Navigation("Role");
+
+                b.Navigation("User");
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Workspaces.Workspace", b =>
+            {
+                b.HasOne("Callora.Core.Domain.Tenants.Tenant", "Tenant")
+                    .WithMany("Workspaces")
+                    .HasForeignKey("TenantId")
+                    .OnDelete(DeleteBehavior.Restrict)
+                    .IsRequired();
+
+                b.Navigation("Tenant");
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Workspaces.WorkspaceMembership", b =>
+            {
+                b.HasOne("Callora.Core.Domain.Security.BackendUser", "User")
+                    .WithMany("WorkspaceMemberships")
+                    .HasForeignKey("UserId")
+                    .OnDelete(DeleteBehavior.Cascade)
+                    .IsRequired();
+
+                b.HasOne("Callora.Core.Domain.Workspaces.Workspace", "Workspace")
+                    .WithMany("Memberships")
+                    .HasForeignKey("WorkspaceId")
+                    .OnDelete(DeleteBehavior.Cascade)
+                    .IsRequired();
+
+                b.Navigation("User");
+
+                b.Navigation("Workspace");
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Workspaces.WorkspaceSurface", b =>
+            {
+                b.HasOne("Callora.Core.Domain.Workspaces.Workspace", "Workspace")
+                    .WithMany("Surfaces")
+                    .HasForeignKey("WorkspaceId")
+                    .OnDelete(DeleteBehavior.Cascade)
+                    .IsRequired();
+
+                b.Navigation("Workspace");
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Security.BackendRbacRole", b =>
+            {
+                b.Navigation("Permissions");
+
+                b.Navigation("UserAssignments");
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Security.BackendUser", b =>
+            {
+                b.Navigation("RoleAssignments");
+
+                b.Navigation("WorkspaceMemberships");
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Tenants.Tenant", b =>
+            {
+                b.Navigation("Workspaces");
+            });
+
+        modelBuilder.Entity("Callora.Core.Domain.Workspaces.Workspace", b =>
+            {
+                b.Navigation("Memberships");
+
+                b.Navigation("Surfaces");
+            });
+#pragma warning restore 612, 618
+    }
+}
diff --git a/src/Core/Infrastructure/Persistence/Migrations/20260807105859_AddWorkspaceSectionLayoutDefinitions.cs b/src/Core/Infrastructure/Persistence/Migrations/20260807105859_AddWorkspaceSectionLayoutDefinitions.cs
new file mode 100644
index 00000000..65661d0f
--- /dev/null
+++ b/src/Core/Infrastructure/Persistence/Migrations/20260807105859_AddWorkspaceSectionLayoutDefinitions.cs
@@ -0,0 +1,28 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Callora.Core.Infrastructure.Persistence.Migrations;
+
+/// <inheritdoc />
+public partial class AddWorkspaceSectionLayoutDefinitions : Migration
+{
+    /// <inheritdoc />
+    protected override void Up(MigrationBuilder migrationBuilder)
+    {
+        migrationBuilder.AddColumn<bool>(
+            name: "inherits_base",
+            table: "workspace_section_layout_definitions",
+            type: "boolean",
+            nullable: false,
+            defaultValue: false);
+    }
+
+    /// <inheritdoc />
+    protected override void Down(MigrationBuilder migrationBuilder)
+    {
+        migrationBuilder.DropColumn(
+            name: "inherits_base",
+            table: "workspace_section_layout_definitions");
+    }
+}
diff --git a/src/Core/Infrastructure/Persistence/Migrations/HostPersistenceDbContextModelSnapshot.cs b/src/Core/Infrastructure/Persistence/Migrations/HostPersistenceDbContextModelSnapshot.cs
index c1dd0a10..a95c1320 100644
--- a/src/Core/Infrastructure/Persistence/Migrations/HostPersistenceDbContextModelSnapshot.cs
+++ b/src/Core/Infrastructure/Persistence/Migrations/HostPersistenceDbContextModelSnapshot.cs
@@ -346,6 +346,72 @@ protected override void BuildModel(ModelBuilder modelBuilder)
                     b.ToTable("plugin_entitlements", (string)null);
                 });
 
+            modelBuilder.Entity("Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<DateTimeOffset>("CreatedAtUtc")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at_utc");
+
+                    b.Property<bool>("InheritsBase")
+                        .HasColumnType("boolean")
+                        .HasColumnName("inherits_base");
+
+                    b.Property<bool>("IsActive")
+                        .HasColumnType("boolean")
+                        .HasColumnName("is_active");
+
+                    b.Property<string>("Label")
+                        .IsRequired()
+                        .HasMaxLength(300)
+                        .HasColumnType("character varying(300)")
+                        .HasColumnName("label");
+
+                    b.Property<string>("LayoutKey")
+                        .IsRequired()
+                        .HasMaxLength(180)
+                        .HasColumnType("character varying(180)")
+                        .HasColumnName("layout_key");
+
+                    b.Property<string>("PluginId")
+                        .IsRequired()
+                        .HasMaxLength(200)
+                        .HasColumnType("character varying(200)")
+                        .HasColumnName("plugin_id");
+
+                    b.Property<string>("RegionsJson")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("regions_json");
+
+                    b.Property<int>("SortOrder")
+                        .HasColumnType("integer")
+                        .HasColumnName("sort_order");
+
+                    b.Property<DateTimeOffset>("UpdatedAtUtc")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("updated_at_utc");
+
+                    b.Property<string>("Version")
+                        .IsRequired()
+                        .HasMaxLength(80)
+                        .HasColumnType("character varying(80)")
+                        .HasColumnName("version");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("LayoutKey", "PluginId", "Version")
+                        .IsUnique();
+
+                    b.HasIndex("PluginId", "Version", "IsActive");
+
+                    b.ToTable("workspace_section_layout_definitions", (string)null);
+                });
+
             modelBuilder.Entity("Callora.Core.Domain.Extensions.WorkspaceTemplateDefinition", b =>
                 {
                     b.Property<Guid>("Id")
diff --git a/src/Core/PublicAPI.Unshipped.txt b/src/Core/PublicAPI.Unshipped.txt
index 7a67908c..22780cbe 100644
--- a/src/Core/PublicAPI.Unshipped.txt
+++ b/src/Core/PublicAPI.Unshipped.txt
@@ -484,6 +484,10 @@ Callora.Core.Application.Extensions.IPluginExtensionRegistrationStore.UpsertAsyn
 Callora.Core.Application.Extensions.IThemeJsonWorkspaceTemplateSyncService
 Callora.Core.Application.Extensions.IThemeJsonWorkspaceTemplateSyncService.ClearPluginDefinitionsAsync(string! pluginId, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
 Callora.Core.Application.Extensions.IThemeJsonWorkspaceTemplateSyncService.SyncFromAssemblyAsync(string! pluginId, string! version, string! assemblyPath, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+Callora.Core.Application.Extensions.IWorkspaceSectionLayoutStore
+Callora.Core.Application.Extensions.IWorkspaceSectionLayoutStore.ClearForPluginAsync(string! pluginId, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+Callora.Core.Application.Extensions.IWorkspaceSectionLayoutStore.ListAsync(string! pluginId, string! version, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task<Callora.Core.Application.Extensions.ThemeSectionLayouts!>!
+Callora.Core.Application.Extensions.IWorkspaceSectionLayoutStore.ReplaceForPluginAsync(string! pluginId, string! version, System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.SectionLayoutDefinition!>! layouts, bool inheritsBase, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
 Callora.Core.Application.Extensions.IWorkspaceTemplateRegistryStore
 Callora.Core.Application.Extensions.IWorkspaceTemplateRegistryStore.ListDefinitionsAsync(string? surface = null, bool? isActive = null, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task<System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.WorkspaceTemplateDefinitionSnapshot!>!>!
 Callora.Core.Application.Extensions.IWorkspaceTemplateRegistryStore.ReplaceDefinitionsForPluginAsync(string! pluginId, string! version, System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.WorkspaceTemplateDefinitionInput!>! definitions, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task<System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.WorkspaceTemplateDefinitionSnapshot!>!>!
@@ -512,6 +516,29 @@ Callora.Core.Application.Extensions.PluginExtensionRegistrationSnapshot.Extensio
 Callora.Core.Application.Extensions.PluginExtensionRegistrationSnapshot.PluginExtensionRegistrationSnapshot(string! PluginId, System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Plugins.PluginPackageExtensionRegistration!>! ExtensionRegistrations, System.Collections.Generic.IReadOnlyList<string!>! Capabilities) -> void
 Callora.Core.Application.Extensions.PluginExtensionRegistrationSnapshot.PluginId.get -> string!
 Callora.Core.Application.Extensions.PluginExtensionRegistrationSnapshot.PluginId.init -> void
+Callora.Core.Application.Extensions.SectionLayoutDefinition
+Callora.Core.Application.Extensions.SectionLayoutDefinition.<Clone>$() -> Callora.Core.Application.Extensions.SectionLayoutDefinition!
+Callora.Core.Application.Extensions.SectionLayoutDefinition.Deconstruct(out string! LayoutKey, out string! Label, out System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.SectionLayoutRegion!>! Regions, out int SortOrder) -> void
+Callora.Core.Application.Extensions.SectionLayoutDefinition.Equals(Callora.Core.Application.Extensions.SectionLayoutDefinition? other) -> bool
+Callora.Core.Application.Extensions.SectionLayoutDefinition.Label.get -> string!
+Callora.Core.Application.Extensions.SectionLayoutDefinition.Label.init -> void
+Callora.Core.Application.Extensions.SectionLayoutDefinition.LayoutKey.get -> string!
+Callora.Core.Application.Extensions.SectionLayoutDefinition.LayoutKey.init -> void
+Callora.Core.Application.Extensions.SectionLayoutDefinition.Regions.get -> System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.SectionLayoutRegion!>!
+Callora.Core.Application.Extensions.SectionLayoutDefinition.Regions.init -> void
+Callora.Core.Application.Extensions.SectionLayoutDefinition.SectionLayoutDefinition(string! LayoutKey, string! Label, System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.SectionLayoutRegion!>! Regions, int SortOrder = 100) -> void
+Callora.Core.Application.Extensions.SectionLayoutDefinition.SortOrder.get -> int
+Callora.Core.Application.Extensions.SectionLayoutDefinition.SortOrder.init -> void
+Callora.Core.Application.Extensions.SectionLayoutRegion
+Callora.Core.Application.Extensions.SectionLayoutRegion.<Clone>$() -> Callora.Core.Application.Extensions.SectionLayoutRegion!
+Callora.Core.Application.Extensions.SectionLayoutRegion.Deconstruct(out string! RegionKey, out string! Label) -> void
+Callora.Core.Application.Extensions.SectionLayoutRegion.Equals(Callora.Core.Application.Extensions.SectionLayoutRegion? other) -> bool
+Callora.Core.Application.Extensions.SectionLayoutRegion.Label.get -> string!
+Callora.Core.Application.Extensions.SectionLayoutRegion.Label.init -> void
+Callora.Core.Application.Extensions.SectionLayoutRegion.RegionKey.get -> string!
+Callora.Core.Application.Extensions.SectionLayoutRegion.RegionKey.init -> void
+Callora.Core.Application.Extensions.SectionLayoutRegion.SectionLayoutRegion(string! RegionKey, string! Label) -> void
+Callora.Core.Application.Extensions.SurfaceBaseSectionLayouts
 Callora.Core.Application.Extensions.SurfaceThemeAssignment
 Callora.Core.Application.Extensions.SurfaceThemeAssignment.<Clone>$() -> Callora.Core.Application.Extensions.SurfaceThemeAssignment!
 Callora.Core.Application.Extensions.SurfaceThemeAssignment.Deconstruct(out string! WorkspaceKey, out string! SurfaceKey, out string? ThemePluginId, out string? ThemeVersion, out bool InheritedFromWorkspace) -> void
@@ -587,21 +614,32 @@ Callora.Core.Application.Extensions.SurfaceThemeStatus.Ok = 0 -> Callora.Core.Ap
 Callora.Core.Application.Extensions.SurfaceThemeStatus.SurfaceNotFound = 2 -> Callora.Core.Application.Extensions.SurfaceThemeStatus
 Callora.Core.Application.Extensions.SurfaceThemeStatus.ThemeNotFound = 3 -> Callora.Core.Application.Extensions.SurfaceThemeStatus
 Callora.Core.Application.Extensions.SurfaceThemeStatus.WorkspaceNotFound = 1 -> Callora.Core.Application.Extensions.SurfaceThemeStatus
+Callora.Core.Application.Extensions.ThemeSectionLayouts
+Callora.Core.Application.Extensions.ThemeSectionLayouts.<Clone>$() -> Callora.Core.Application.Extensions.ThemeSectionLayouts!
+Callora.Core.Application.Extensions.ThemeSectionLayouts.Deconstruct(out System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.SectionLayoutDefinition!>! Layouts, out bool InheritsBase) -> void
+Callora.Core.Application.Extensions.ThemeSectionLayouts.Equals(Callora.Core.Application.Extensions.ThemeSectionLayouts? other) -> bool
+Callora.Core.Application.Extensions.ThemeSectionLayouts.InheritsBase.get -> bool
+Callora.Core.Application.Extensions.ThemeSectionLayouts.InheritsBase.init -> void
+Callora.Core.Application.Extensions.ThemeSectionLayouts.Layouts.get -> System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.SectionLayoutDefinition!>!
+Callora.Core.Application.Extensions.ThemeSectionLayouts.Layouts.init -> void
+Callora.Core.Application.Extensions.ThemeSectionLayouts.ThemeSectionLayouts(System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.SectionLayoutDefinition!>! Layouts, bool InheritsBase) -> void
 Callora.Core.Application.Extensions.WorkspacePublicTheme
 Callora.Core.Application.Extensions.WorkspacePublicTheme.<Clone>$() -> Callora.Core.Application.Extensions.WorkspacePublicTheme!
-Callora.Core.Application.Extensions.WorkspacePublicTheme.Deconstruct(out string! ThemePluginId, out string! ThemeVersion, out System.Collections.Generic.IReadOnlyDictionary<string!, string!>! ValuesByKey) -> void
+Callora.Core.Application.Extensions.WorkspacePublicTheme.Deconstruct(out string! ThemePluginId, out string! ThemeVersion, out System.Collections.Generic.IReadOnlyDictionary<string!, string!>! ValuesByKey, out System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.SectionLayoutDefinition!>! SectionLayouts) -> void
 Callora.Core.Application.Extensions.WorkspacePublicTheme.Equals(Callora.Core.Application.Extensions.WorkspacePublicTheme? other) -> bool
+Callora.Core.Application.Extensions.WorkspacePublicTheme.SectionLayouts.get -> System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.SectionLayoutDefinition!>!
+Callora.Core.Application.Extensions.WorkspacePublicTheme.SectionLayouts.init -> void
 Callora.Core.Application.Extensions.WorkspacePublicTheme.ThemePluginId.get -> string!
 Callora.Core.Application.Extensions.WorkspacePublicTheme.ThemePluginId.init -> void
 Callora.Core.Application.Extensions.WorkspacePublicTheme.ThemeVersion.get -> string!
 Callora.Core.Application.Extensions.WorkspacePublicTheme.ThemeVersion.init -> void
 Callora.Core.Application.Extensions.WorkspacePublicTheme.ValuesByKey.get -> System.Collections.Generic.IReadOnlyDictionary<string!, string!>!
 Callora.Core.Application.Extensions.WorkspacePublicTheme.ValuesByKey.init -> void
-Callora.Core.Application.Extensions.WorkspacePublicTheme.WorkspacePublicTheme(string! ThemePluginId, string! ThemeVersion, System.Collections.Generic.IReadOnlyDictionary<string!, string!>! ValuesByKey) -> void
+Callora.Core.Application.Extensions.WorkspacePublicTheme.WorkspacePublicTheme(string! ThemePluginId, string! ThemeVersion, System.Collections.Generic.IReadOnlyDictionary<string!, string!>! ValuesByKey, System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.SectionLayoutDefinition!>! SectionLayouts) -> void
 Callora.Core.Application.Extensions.WorkspacePublicThemeResolver
 Callora.Core.Application.Extensions.WorkspacePublicThemeResolver.ResolveAsync(string! workspaceKey, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task<Callora.Core.Application.Extensions.WorkspacePublicTheme?>!
 Callora.Core.Application.Extensions.WorkspacePublicThemeResolver.ResolveForSurfaceAsync(string! workspaceKey, string? surfaceKey, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task<Callora.Core.Application.Extensions.WorkspacePublicTheme?>!
-Callora.Core.Application.Extensions.WorkspacePublicThemeResolver.WorkspacePublicThemeResolver(Callora.Core.Application.Workspaces.IWorkspaceManagementStore! workspaceStore, Callora.Core.Application.Workspaces.IWorkspaceSurfaceStore! surfaceStore, Callora.Core.Application.Extensions.IWorkspaceThemeSettingsStore! settingsStore) -> void
+Callora.Core.Application.Extensions.WorkspacePublicThemeResolver.WorkspacePublicThemeResolver(Callora.Core.Application.Workspaces.IWorkspaceManagementStore! workspaceStore, Callora.Core.Application.Workspaces.IWorkspaceSurfaceStore! surfaceStore, Callora.Core.Application.Extensions.IWorkspaceThemeSettingsStore! settingsStore, Callora.Core.Application.Extensions.IWorkspaceSectionLayoutStore! sectionLayoutStore) -> void
 Callora.Core.Application.Extensions.WorkspaceTemplateDefinitionInput
 Callora.Core.Application.Extensions.WorkspaceTemplateDefinitionInput.<Clone>$() -> Callora.Core.Application.Extensions.WorkspaceTemplateDefinitionInput!
 Callora.Core.Application.Extensions.WorkspaceTemplateDefinitionInput.Deconstruct(out string! TemplateKey, out string! Surface, out string! DisplayName, out string! TemplatePath, out string? ParentTemplateKey, out string! Scope, out bool IsActive, out int Priority) -> void
@@ -4035,6 +4073,30 @@ Callora.Core.Domain.Extensions.ExtensionSurface
 Callora.Core.Domain.Extensions.ExtensionSurface.Admin = 0 -> Callora.Core.Domain.Extensions.ExtensionSurface
 Callora.Core.Domain.Extensions.ExtensionSurface.Surface = 1 -> Callora.Core.Domain.Extensions.ExtensionSurface
 Callora.Core.Domain.Extensions.ExtensionSurfaceCodes
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.CreatedAtUtc.get -> System.DateTimeOffset
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.CreatedAtUtc.set -> void
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.Id.get -> System.Guid
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.Id.set -> void
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.InheritsBase.get -> bool
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.InheritsBase.set -> void
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.IsActive.get -> bool
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.IsActive.set -> void
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.Label.get -> string!
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.Label.set -> void
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.LayoutKey.get -> string!
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.LayoutKey.set -> void
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.PluginId.get -> string!
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.PluginId.set -> void
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.RegionsJson.get -> string!
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.RegionsJson.set -> void
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.SortOrder.get -> int
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.SortOrder.set -> void
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.UpdatedAtUtc.get -> System.DateTimeOffset
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.UpdatedAtUtc.set -> void
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.Version.get -> string!
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.Version.set -> void
+Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition.WorkspaceSectionLayoutDefinition() -> void
 Callora.Core.Domain.Extensions.WorkspaceTemplateDefinition
 Callora.Core.Domain.Extensions.WorkspaceTemplateDefinition.CreatedAtUtc.get -> System.DateTimeOffset
 Callora.Core.Domain.Extensions.WorkspaceTemplateDefinition.CreatedAtUtc.set -> void
@@ -4667,6 +4729,7 @@ Callora.Core.Infrastructure.Extensions.InMemoryWorkspaceTemplateRegistryStore.Li
 Callora.Core.Infrastructure.Extensions.InMemoryWorkspaceTemplateRegistryStore.ReplaceDefinitionsForPluginAsync(string! pluginId, string! version, System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.WorkspaceTemplateDefinitionInput!>! definitions, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task<System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.WorkspaceTemplateDefinitionSnapshot!>!>!
 Callora.Core.Infrastructure.Extensions.InMemoryWorkspaceTemplateRegistryStore.SetDefinitionActivationAsync(string! templateKey, string! pluginId, string! version, bool isActive, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task<bool>!
 Callora.Core.Infrastructure.Extensions.InMemoryWorkspaceTemplateRegistryStore.UpsertDefinitionAsync(string! templateKey, string! surface, string! pluginId, string! version, string! displayName, string! templatePath, string? parentTemplateKey, string! scope, bool isActive, int priority, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task<Callora.Core.Application.Extensions.WorkspaceTemplateDefinitionSnapshot!>!
+Callora.Core.Infrastructure.Extensions.SectionLayoutManifestReader
 Callora.Core.Infrastructure.Extensions.ThemeJsonDefinitionReadResult
 Callora.Core.Infrastructure.Extensions.ThemeJsonDefinitionReadResult.<Clone>$() -> Callora.Core.Infrastructure.Extensions.ThemeJsonDefinitionReadResult!
 Callora.Core.Infrastructure.Extensions.ThemeJsonDefinitionReadResult.Deconstruct(out bool ShouldReplaceDefinitions, out System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.WorkspaceTemplateDefinitionInput!>! Definitions) -> void
@@ -4688,7 +4751,7 @@ Callora.Core.Infrastructure.Extensions.ThemeJsonSettingsReadResult.ThemeJsonSett
 Callora.Core.Infrastructure.Extensions.ThemeJsonWorkspaceTemplateSyncService
 Callora.Core.Infrastructure.Extensions.ThemeJsonWorkspaceTemplateSyncService.ClearPluginDefinitionsAsync(string! pluginId, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
 Callora.Core.Infrastructure.Extensions.ThemeJsonWorkspaceTemplateSyncService.SyncFromAssemblyAsync(string! pluginId, string! version, string! assemblyPath, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
-Callora.Core.Infrastructure.Extensions.ThemeJsonWorkspaceTemplateSyncService.ThemeJsonWorkspaceTemplateSyncService(Callora.Core.Application.Extensions.IWorkspaceTemplateRegistryStore! store, Callora.Core.Application.Extensions.IWorkspaceThemeSettingsStore! settingsStore, Microsoft.Extensions.Logging.ILogger<Callora.Core.Infrastructure.Extensions.ThemeJsonWorkspaceTemplateSyncService!>! logger) -> void
+Callora.Core.Infrastructure.Extensions.ThemeJsonWorkspaceTemplateSyncService.ThemeJsonWorkspaceTemplateSyncService(Callora.Core.Application.Extensions.IWorkspaceTemplateRegistryStore! store, Callora.Core.Application.Extensions.IWorkspaceThemeSettingsStore! settingsStore, Callora.Core.Application.Extensions.IWorkspaceSectionLayoutStore! sectionLayoutStore, Microsoft.Extensions.Logging.ILogger<Callora.Core.Infrastructure.Extensions.ThemeJsonWorkspaceTemplateSyncService!>! logger) -> void
 Callora.Core.Infrastructure.Features.ConfiguredFeatureFlagService
 Callora.Core.Infrastructure.Features.ConfiguredFeatureFlagService.ConfiguredFeatureFlagService(Callora.Core.Application.Policies.BackendHostOptions! options) -> void
 Callora.Core.Infrastructure.Features.ConfiguredFeatureFlagService.GetAll() -> System.Collections.Generic.IReadOnlyDictionary<string!, bool>!
@@ -4807,6 +4870,9 @@ Callora.Core.Infrastructure.Persistence.Configurations.WorkspaceMembershipEntity
 Callora.Core.Infrastructure.Persistence.Configurations.WorkspacePluginActivationEntityTypeConfiguration
 Callora.Core.Infrastructure.Persistence.Configurations.WorkspacePluginActivationEntityTypeConfiguration.Configure(Microsoft.EntityFrameworkCore.Metadata.Builders.EntityTypeBuilder<Callora.Core.Domain.Plugins.WorkspacePluginActivation!>! builder) -> void
 Callora.Core.Infrastructure.Persistence.Configurations.WorkspacePluginActivationEntityTypeConfiguration.WorkspacePluginActivationEntityTypeConfiguration() -> void
+Callora.Core.Infrastructure.Persistence.Configurations.WorkspaceSectionLayoutDefinitionEntityTypeConfiguration
+Callora.Core.Infrastructure.Persistence.Configurations.WorkspaceSectionLayoutDefinitionEntityTypeConfiguration.Configure(Microsoft.EntityFrameworkCore.Metadata.Builders.EntityTypeBuilder<Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition!>! builder) -> void
+Callora.Core.Infrastructure.Persistence.Configurations.WorkspaceSectionLayoutDefinitionEntityTypeConfiguration.WorkspaceSectionLayoutDefinitionEntityTypeConfiguration() -> void
 Callora.Core.Infrastructure.Persistence.Configurations.WorkspaceSurfaceEntityTypeConfiguration
 Callora.Core.Infrastructure.Persistence.Configurations.WorkspaceSurfaceEntityTypeConfiguration.Configure(Microsoft.EntityFrameworkCore.Metadata.Builders.EntityTypeBuilder<Callora.Core.Domain.Workspaces.WorkspaceSurface!>! builder) -> void
 Callora.Core.Infrastructure.Persistence.Configurations.WorkspaceSurfaceEntityTypeConfiguration.WorkspaceSurfaceEntityTypeConfiguration() -> void
@@ -4994,6 +5060,11 @@ Callora.Core.Infrastructure.Persistence.EfWorkspacePluginActivationReader.ListAc
 Callora.Core.Infrastructure.Persistence.EfWorkspacePluginActivationStore
 Callora.Core.Infrastructure.Persistence.EfWorkspacePluginActivationStore.EfWorkspacePluginActivationStore(Callora.Core.Infrastructure.Persistence.HostPersistenceDbContext! dbContext) -> void
 Callora.Core.Infrastructure.Persistence.EfWorkspacePluginActivationStore.SetActiveAsync(string! pluginId, string! workspaceKey, string! tenantKey, bool isActive, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+Callora.Core.Infrastructure.Persistence.EfWorkspaceSectionLayoutStore
+Callora.Core.Infrastructure.Persistence.EfWorkspaceSectionLayoutStore.ClearForPluginAsync(string! pluginId, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+Callora.Core.Infrastructure.Persistence.EfWorkspaceSectionLayoutStore.EfWorkspaceSectionLayoutStore(Callora.Core.Infrastructure.Persistence.HostPersistenceDbContext! dbContext) -> void
+Callora.Core.Infrastructure.Persistence.EfWorkspaceSectionLayoutStore.ListAsync(string! pluginId, string! version, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task<Callora.Core.Application.Extensions.ThemeSectionLayouts!>!
+Callora.Core.Infrastructure.Persistence.EfWorkspaceSectionLayoutStore.ReplaceForPluginAsync(string! pluginId, string! version, System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.SectionLayoutDefinition!>! layouts, bool inheritsBase, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
 Callora.Core.Infrastructure.Persistence.EfWorkspaceSurfaceStore
 Callora.Core.Infrastructure.Persistence.EfWorkspaceSurfaceStore.AssignIdentityProviderAsync(string! workspaceKey, string! surfaceKey, string? pluginId, string? version, string? assignedBy, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task<Callora.Core.Application.Workspaces.WorkspaceSurfaceSnapshot?>!
 Callora.Core.Infrastructure.Persistence.EfWorkspaceSurfaceStore.DeleteAsync(string! workspaceKey, string! surfaceKey, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task<bool>!
@@ -5048,6 +5119,7 @@ Callora.Core.Infrastructure.Persistence.HostPersistenceDbContext.Tenants.get ->
 Callora.Core.Infrastructure.Persistence.HostPersistenceDbContext.WebhookSubscriptions.get -> Microsoft.EntityFrameworkCore.DbSet<Callora.Core.Domain.Webhooks.WebhookSubscription!>!
 Callora.Core.Infrastructure.Persistence.HostPersistenceDbContext.WorkspaceMemberships.get -> Microsoft.EntityFrameworkCore.DbSet<Callora.Core.Domain.Workspaces.WorkspaceMembership!>!
 Callora.Core.Infrastructure.Persistence.HostPersistenceDbContext.WorkspacePluginActivations.get -> Microsoft.EntityFrameworkCore.DbSet<Callora.Core.Domain.Plugins.WorkspacePluginActivation!>!
+Callora.Core.Infrastructure.Persistence.HostPersistenceDbContext.WorkspaceSectionLayoutDefinitions.get -> Microsoft.EntityFrameworkCore.DbSet<Callora.Core.Domain.Extensions.WorkspaceSectionLayoutDefinition!>!
 Callora.Core.Infrastructure.Persistence.HostPersistenceDbContext.WorkspaceSurfaces.get -> Microsoft.EntityFrameworkCore.DbSet<Callora.Core.Domain.Workspaces.WorkspaceSurface!>!
 Callora.Core.Infrastructure.Persistence.HostPersistenceDbContext.WorkspaceTemplateDefinitions.get -> Microsoft.EntityFrameworkCore.DbSet<Callora.Core.Domain.Extensions.WorkspaceTemplateDefinition!>!
 Callora.Core.Infrastructure.Persistence.HostPersistenceDbContext.WorkspaceThemeSettingDefinitions.get -> Microsoft.EntityFrameworkCore.DbSet<Callora.Core.Domain.Extensions.WorkspaceThemeSettingDefinition!>!
@@ -5583,6 +5655,12 @@ override Callora.Core.Application.Events.PluginLifecycleChangedEvent.ToString()
 override Callora.Core.Application.Extensions.PluginExtensionRegistrationSnapshot.Equals(object? obj) -> bool
 override Callora.Core.Application.Extensions.PluginExtensionRegistrationSnapshot.GetHashCode() -> int
 override Callora.Core.Application.Extensions.PluginExtensionRegistrationSnapshot.ToString() -> string!
+override Callora.Core.Application.Extensions.SectionLayoutDefinition.Equals(object? obj) -> bool
+override Callora.Core.Application.Extensions.SectionLayoutDefinition.GetHashCode() -> int
+override Callora.Core.Application.Extensions.SectionLayoutDefinition.ToString() -> string!
+override Callora.Core.Application.Extensions.SectionLayoutRegion.Equals(object? obj) -> bool
+override Callora.Core.Application.Extensions.SectionLayoutRegion.GetHashCode() -> int
+override Callora.Core.Application.Extensions.SectionLayoutRegion.ToString() -> string!
 override Callora.Core.Application.Extensions.SurfaceThemeAssignment.Equals(object? obj) -> bool
 override Callora.Core.Application.Extensions.SurfaceThemeAssignment.GetHashCode() -> int
 override Callora.Core.Application.Extensions.SurfaceThemeAssignment.ToString() -> string!
@@ -5595,6 +5673,9 @@ override Callora.Core.Application.Extensions.SurfaceThemeSettings.ToString() ->
 override Callora.Core.Application.Extensions.SurfaceThemeSettingsResult.Equals(object? obj) -> bool
 override Callora.Core.Application.Extensions.SurfaceThemeSettingsResult.GetHashCode() -> int
 override Callora.Core.Application.Extensions.SurfaceThemeSettingsResult.ToString() -> string!
+override Callora.Core.Application.Extensions.ThemeSectionLayouts.Equals(object? obj) -> bool
+override Callora.Core.Application.Extensions.ThemeSectionLayouts.GetHashCode() -> int
+override Callora.Core.Application.Extensions.ThemeSectionLayouts.ToString() -> string!
 override Callora.Core.Application.Extensions.WorkspacePublicTheme.Equals(object? obj) -> bool
 override Callora.Core.Application.Extensions.WorkspacePublicTheme.GetHashCode() -> int
 override Callora.Core.Application.Extensions.WorkspacePublicTheme.ToString() -> string!
@@ -6122,6 +6203,12 @@ static Callora.Core.Application.Events.PluginLifecycleChangedEvent.operator !=(C
 static Callora.Core.Application.Events.PluginLifecycleChangedEvent.operator ==(Callora.Core.Application.Events.PluginLifecycleChangedEvent? left, Callora.Core.Application.Events.PluginLifecycleChangedEvent? right) -> bool
 static Callora.Core.Application.Extensions.PluginExtensionRegistrationSnapshot.operator !=(Callora.Core.Application.Extensions.PluginExtensionRegistrationSnapshot? left, Callora.Core.Application.Extensions.PluginExtensionRegistrationSnapshot? right) -> bool
 static Callora.Core.Application.Extensions.PluginExtensionRegistrationSnapshot.operator ==(Callora.Core.Application.Extensions.PluginExtensionRegistrationSnapshot? left, Callora.Core.Application.Extensions.PluginExtensionRegistrationSnapshot? right) -> bool
+static Callora.Core.Application.Extensions.SectionLayoutDefinition.operator !=(Callora.Core.Application.Extensions.SectionLayoutDefinition? left, Callora.Core.Application.Extensions.SectionLayoutDefinition? right) -> bool
+static Callora.Core.Application.Extensions.SectionLayoutDefinition.operator ==(Callora.Core.Application.Extensions.SectionLayoutDefinition? left, Callora.Core.Application.Extensions.SectionLayoutDefinition? right) -> bool
+static Callora.Core.Application.Extensions.SectionLayoutRegion.operator !=(Callora.Core.Application.Extensions.SectionLayoutRegion? left, Callora.Core.Application.Extensions.SectionLayoutRegion? right) -> bool
+static Callora.Core.Application.Extensions.SectionLayoutRegion.operator ==(Callora.Core.Application.Extensions.SectionLayoutRegion? left, Callora.Core.Application.Extensions.SectionLayoutRegion? right) -> bool
+static Callora.Core.Application.Extensions.SurfaceBaseSectionLayouts.All.get -> System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.SectionLayoutDefinition!>!
+static Callora.Core.Application.Extensions.SurfaceBaseSectionLayouts.Compose(System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.SectionLayoutDefinition!>! themeLayouts, bool inherit) -> System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.SectionLayoutDefinition!>!
 static Callora.Core.Application.Extensions.SurfaceThemeAssignment.operator !=(Callora.Core.Application.Extensions.SurfaceThemeAssignment? left, Callora.Core.Application.Extensions.SurfaceThemeAssignment? right) -> bool
 static Callora.Core.Application.Extensions.SurfaceThemeAssignment.operator ==(Callora.Core.Application.Extensions.SurfaceThemeAssignment? left, Callora.Core.Application.Extensions.SurfaceThemeAssignment? right) -> bool
 static Callora.Core.Application.Extensions.SurfaceThemeAssignmentResult.operator !=(Callora.Core.Application.Extensions.SurfaceThemeAssignmentResult? left, Callora.Core.Application.Extensions.SurfaceThemeAssignmentResult? right) -> bool
@@ -6130,6 +6217,8 @@ static Callora.Core.Application.Extensions.SurfaceThemeSettings.operator !=(Call
 static Callora.Core.Application.Extensions.SurfaceThemeSettings.operator ==(Callora.Core.Application.Extensions.SurfaceThemeSettings? left, Callora.Core.Application.Extensions.SurfaceThemeSettings? right) -> bool
 static Callora.Core.Application.Extensions.SurfaceThemeSettingsResult.operator !=(Callora.Core.Application.Extensions.SurfaceThemeSettingsResult? left, Callora.Core.Application.Extensions.SurfaceThemeSettingsResult? right) -> bool
 static Callora.Core.Application.Extensions.SurfaceThemeSettingsResult.operator ==(Callora.Core.Application.Extensions.SurfaceThemeSettingsResult? left, Callora.Core.Application.Extensions.SurfaceThemeSettingsResult? right) -> bool
+static Callora.Core.Application.Extensions.ThemeSectionLayouts.operator !=(Callora.Core.Application.Extensions.ThemeSectionLayouts? left, Callora.Core.Application.Extensions.ThemeSectionLayouts? right) -> bool
+static Callora.Core.Application.Extensions.ThemeSectionLayouts.operator ==(Callora.Core.Application.Extensions.ThemeSectionLayouts? left, Callora.Core.Application.Extensions.ThemeSectionLayouts? right) -> bool
 static Callora.Core.Application.Extensions.WorkspacePublicTheme.operator !=(Callora.Core.Application.Extensions.WorkspacePublicTheme? left, Callora.Core.Application.Extensions.WorkspacePublicTheme? right) -> bool
 static Callora.Core.Application.Extensions.WorkspacePublicTheme.operator ==(Callora.Core.Application.Extensions.WorkspacePublicTheme? left, Callora.Core.Application.Extensions.WorkspacePublicTheme? right) -> bool
 static Callora.Core.Application.Extensions.WorkspaceTemplateDefinitionInput.operator !=(Callora.Core.Application.Extensions.WorkspaceTemplateDefinitionInput? left, Callora.Core.Application.Extensions.WorkspaceTemplateDefinitionInput? right) -> bool
@@ -6564,6 +6653,8 @@ static Callora.Core.Infrastructure.DependencyInjection.DecoratableServiceCollect
 static Callora.Core.Infrastructure.DependencyInjection.ServiceCollectionExtensions.AddCalloraHosting(Callora.Core.Infrastructure.DependencyInjection.IHostServiceRegistry! services, System.Action<Callora.Core.Application.Options.CalloraHostingOptions!>? configure = null) -> void
 static Callora.Core.Infrastructure.Extensions.BackendExtensionPointCatalog.Build() -> System.Collections.Generic.IReadOnlyCollection<Callora.Core.Domain.Extensions.ExtensionPointDefinition!>!
 static Callora.Core.Infrastructure.Extensions.BackendExtensionPointCatalog.Version.get -> string!
+static Callora.Core.Infrastructure.Extensions.SectionLayoutManifestReader.Parse(System.Text.Json.JsonElement root) -> System.Collections.Generic.IReadOnlyList<Callora.Core.Application.Extensions.SectionLayoutDefinition!>!
+static Callora.Core.Infrastructure.Extensions.SectionLayoutManifestReader.ParseInheritsBase(System.Text.Json.JsonElement root) -> bool
 static Callora.Core.Infrastructure.Extensions.ThemeJsonDefinitionReadResult.operator !=(Callora.Core.Infrastructure.Extensions.ThemeJsonDefinitionReadResult? left, Callora.Core.Infrastructure.Extensions.ThemeJsonDefinitionReadResult? right) -> bool
 static Callora.Core.Infrastructure.Extensions.ThemeJsonDefinitionReadResult.operator ==(Callora.Core.Infrastructure.Extensions.ThemeJsonDefinitionReadResult? left, Callora.Core.Infrastructure.Extensions.ThemeJsonDefinitionReadResult? right) -> bool
 static Callora.Core.Infrastructure.Extensions.ThemeJsonSettingsReadResult.operator !=(Callora.Core.Infrastructure.Extensions.ThemeJsonSettingsReadResult? left, Callora.Core.Infrastructure.Extensions.ThemeJsonSettingsReadResult? right) -> bool
diff --git a/src/Surface.Rendering/Api/SurfaceRenderEndpoints.cs b/src/Surface.Rendering/Api/SurfaceRenderEndpoints.cs
index 1872820e..63d79522 100644
--- a/src/Surface.Rendering/Api/SurfaceRenderEndpoints.cs
+++ b/src/Surface.Rendering/Api/SurfaceRenderEndpoints.cs
@@ -135,16 +135,20 @@ private static async Task<IResult> RenderEndpointAsync(
         // overrides) become allowlisted tokens so a plugin's SSR template can bind
         // {{ tokens.<key> }} onto its --cal-* properties (ADR-015 §8).
         IReadOnlyDictionary<string, string>? effectiveTheme = null;
+        // Auch die Sektionslayouts des Themes: Der Kompositions-Renderer muss erkennen, dass ein
+        // im Dokument gespeichertes Layout nach einem Theme-Wechsel niemanden mehr hat, der es
+        // stylen kann (§7.8).
+        WorkspacePublicTheme? resolvedTheme = null;
         if (themeResolver is not null)
         {
             // Resolved for THIS surface: its own theme and values win over the
             // workspace's. Previously only the workspace values were read, so a
             // surface with its own theme rendered that theme's identity with the
             // workspace theme's values.
-            var theme = await themeResolver
+            resolvedTheme = await themeResolver
                 .ResolveForSurfaceAsync(surface.WorkspaceKey, surface.SurfaceKey, cancellationToken)
                 .ConfigureAwait(false);
-            effectiveTheme = theme?.ValuesByKey;
+            effectiveTheme = resolvedTheme?.ValuesByKey;
         }
 
         // Everything a contributor needs to tell one page from another. The prefix comes off
@@ -201,7 +205,8 @@ private static async Task<IResult> RenderEndpointAsync(
         var layouts = httpContext.RequestServices.GetService<ISurfaceLayoutSource>();
         var composition = layouts is null
             ? null
-            : await RenderCompositionAsync(layouts, surface, cancellationToken).ConfigureAwait(false);
+            : await RenderCompositionAsync(layouts, surface, resolvedTheme, cancellationToken)
+                .ConfigureAwait(false);
 
         var context = new SurfaceRenderContext(
             TenantKey: surface.TenantKey,
@@ -257,13 +262,28 @@ private static string StripPrefix(string path, string? prefix)
     private static async Task<string?> RenderCompositionAsync(
         ISurfaceLayoutSource layouts,
         WorkspaceSurfaceSnapshot surface,
+        WorkspacePublicTheme? theme,
         CancellationToken cancellationToken)
     {
         var document = await layouts
             .GetPublishedAsync(surface.WorkspaceKey, surface.SurfaceKey, cancellationToken)
             .ConfigureAwait(false);
+        if (document is null)
+        {
+            return null;
+        }
+
+        // Was gilt: die Layouts des Themes, oder — ohne zugewiesenes Theme — die des
+        // Basis-Themes. Die Liste ist nie leer, denn ein Theme ohne eigene Layouts erbt die
+        // Basis; nur ein Theme, das ausdrücklich nicht erbt, engt sie ein.
+        //
+        // Deshalb kann ein Rückfall hier nur eines heißen: Dieses Layout kennt niemand mehr, der
+        // es stylen könnte (§7.8) — und nicht „es hat nur gerade niemand etwas dazu gesagt".
+        var knownLayouts = new HashSet<string>(
+            (theme?.SectionLayouts ?? SurfaceBaseSectionLayouts.All).Select(layout => layout.LayoutKey),
+            StringComparer.Ordinal);
 
-        return document is null ? null : new SurfaceCompositionRenderer().Render(document);
+        return new SurfaceCompositionRenderer(layoutIsKnown: knownLayouts.Contains).Render(document);
     }
 
     /// <summary>
diff --git a/src/Surface.Rendering/PublicAPI.Unshipped.txt b/src/Surface.Rendering/PublicAPI.Unshipped.txt
index 3ca75ba6..03daae2f 100644
--- a/src/Surface.Rendering/PublicAPI.Unshipped.txt
+++ b/src/Surface.Rendering/PublicAPI.Unshipped.txt
@@ -45,7 +45,7 @@ Callora.Surface.Rendering.PublishedSurfaceTemplateBundles.TryReadEntryTemplate(s
 Callora.Surface.Rendering.Rendering.Composition.SurfaceBlockPropsSerializer
 Callora.Surface.Rendering.Rendering.Composition.SurfaceCompositionRenderer
 Callora.Surface.Rendering.Rendering.Composition.SurfaceCompositionRenderer.Render(Callora.Core.Application.Surfaces.Layout.SurfaceLayoutDocument! document) -> string!
-Callora.Surface.Rendering.Rendering.Composition.SurfaceCompositionRenderer.SurfaceCompositionRenderer(System.Func<string!, bool>? blockIsAvailable = null, System.Func<string!, System.Collections.Generic.IReadOnlySet<string!>?>? confidentialControls = null) -> void
+Callora.Surface.Rendering.Rendering.Composition.SurfaceCompositionRenderer.SurfaceCompositionRenderer(System.Func<string!, bool>? blockIsAvailable = null, System.Func<string!, System.Collections.Generic.IReadOnlySet<string!>?>? confidentialControls = null, System.Func<string!, bool>? layoutIsKnown = null) -> void
 Callora.Surface.Rendering.Rendering.NunjucksSurfaceRenderer
 Callora.Surface.Rendering.Rendering.NunjucksSurfaceRenderer.NunjucksSurfaceRenderer() -> void
 Callora.Surface.Rendering.Rendering.NunjucksSurfaceRenderer.NunjucksSurfaceRenderer(Callora.Surface.Rendering.ISurfaceTemplateBundleProvider! bundleProvider) -> void
@@ -104,6 +104,7 @@ Callora.Surface.Rendering.SurfaceTemplateException.SurfaceTemplateException() ->
 Callora.Surface.Rendering.SurfaceTemplateException.SurfaceTemplateException(string! message) -> void
 Callora.Surface.Rendering.SurfaceTemplateException.SurfaceTemplateException(string! message, System.Exception! innerException) -> void
 Callora.Surface.Rendering.SurfaceThemeTokens
+const Callora.Surface.Rendering.Rendering.Composition.SurfaceCompositionRenderer.FallbackLayout = "single" -> string!
 const Callora.Surface.Rendering.SurfaceCallerView.AuthenticatedState = "authenticated" -> string!
 const Callora.Surface.Rendering.SurfaceCallerView.GuestState = "guest" -> string!
 const Callora.Surface.Rendering.SurfaceThemeTokens.ThemePluginIdKey = "themePluginId" -> string!
diff --git a/src/Surface.Rendering/Rendering/Composition/SurfaceCompositionRenderer.cs b/src/Surface.Rendering/Rendering/Composition/SurfaceCompositionRenderer.cs
index 54f24648..ffcaf1a1 100644
--- a/src/Surface.Rendering/Rendering/Composition/SurfaceCompositionRenderer.cs
+++ b/src/Surface.Rendering/Rendering/Composition/SurfaceCompositionRenderer.cs
@@ -22,8 +22,17 @@ namespace Callora.Surface.Rendering.Rendering.Composition;
 /// </summary>
 public sealed class SurfaceCompositionRenderer
 {
+    /// <summary>
+    /// What a section falls back to when its theme no longer knows the declared layout. Not a
+    /// theme-declared value: a theme that dropped `single` too has nothing left to fall back to,
+    /// and the point of the fallback is that the CONTENT survives a theme change, not that it
+    /// still looks right.
+    /// </summary>
+    public const string FallbackLayout = "single";
+
     private readonly Func<string, bool> _blockIsAvailable;
     private readonly Func<string, IReadOnlySet<string>?> _confidentialControls;
+    private readonly Func<string, bool> _layoutIsKnown;
 
     /// <param name="blockIsAvailable">
     /// Whether a block id still resolves to an installed, visible block. An orphan — its plugin
@@ -31,12 +40,21 @@ public sealed class SurfaceCompositionRenderer
     /// stays intact and becomes whole again when the plugin returns.
     /// </param>
     /// <param name="confidentialControls">Controls a block declared confidential, by block id.</param>
+    /// <param name="layoutIsKnown">
+    /// Whether the active theme still declares this section layout. It stops declaring one when
+    /// somebody switches themes — and then <c>data-cal-layout="two-2-1"</c> would name a grid
+    /// nothing styles, so the section would collapse into whatever the browser does with
+    /// unstyled divs. Falling back to <see cref="FallbackLayout"/> keeps the blocks in one
+    /// readable column instead (§7.8): the page looks plainer, and nothing is lost.
+    /// </param>
     public SurfaceCompositionRenderer(
         Func<string, bool>? blockIsAvailable = null,
-        Func<string, IReadOnlySet<string>?>? confidentialControls = null)
+        Func<string, IReadOnlySet<string>?>? confidentialControls = null,
+        Func<string, bool>? layoutIsKnown = null)
     {
         _blockIsAvailable = blockIsAvailable ?? (_ => true);
         _confidentialControls = confidentialControls ?? (_ => null);
+        _layoutIsKnown = layoutIsKnown ?? (_ => true);
     }
 
     /// <summary>Renders the document. Sections and blocks come out in their declared order.</summary>
@@ -55,8 +73,13 @@ public string Render(SurfaceLayoutDocument document)
 
     private void RenderSection(StringBuilder markup, SurfaceLayoutSection section)
     {
+        // Ein Layout, das das Theme nicht mehr kennt, wird ersetzt statt ausgeliefert. Der
+        // Inhalt bleibt vollständig; er steht nur einspaltig, bis das Theme das Layout wieder
+        // mitbringt.
+        var layout = _layoutIsKnown(section.Layout) ? section.Layout : FallbackLayout;
+
         markup.Append("<div class=\"cal-section\" data-cal-layout=\"")
-            .Append(Attribute(section.Layout))
+            .Append(Attribute(layout))
             .Append('"');
 
         // Token STEPS, not values — the attribute names a step the theme resolves, so a section
diff --git a/src/Surface.Rendering/Resources/app/surface/src/styles/tokens.scss b/src/Surface.Rendering/Resources/app/surface/src/styles/tokens.scss
index 8f5a4b01..d433943f 100644
--- a/src/Surface.Rendering/Resources/app/surface/src/styles/tokens.scss
+++ b/src/Surface.Rendering/Resources/app/surface/src/styles/tokens.scss
@@ -21,3 +21,84 @@
   padding: var(--cal-space-4);
   color: var(--cal-color-muted);
 }
+
+// ── Sektionen und Regionen ───────────────────────────────────────────────────
+//
+// Der Kompositions-Renderer gibt `data-cal-layout` und `data-cal-region` aus. Ohne diese
+// Regeln wären das Attribute, auf die nichts hört: Eine zweispaltige Sektion stünde
+// einspaltig, und niemand könnte sagen, ob der Editor, der Renderer oder das Theme schuld
+// ist.
+//
+// Das ist dieselbe Rolle, die die Token darüber spielen — eine neutrale Basis, kein Design.
+// Ein Theme, das eigene Layouts mitbringt, überschreibt sie; ein Theme, das keine mitbringt,
+// bekommt trotzdem eine Fläche, die funktioniert. Die Namen hier sind DIESE Basis, nicht der
+// Kanon: Der Editor bietet an, was das Theme deklariert, und nur mangels Theme die hier.
+//
+// Alle Maße kommen aus `--cal-*`. Ein fester Pixelwert wäre genau die Freiheit, die die
+// Token-Achse dem Editor verweigert — mit dem Unterschied, dass sie niemand zurücknehmen kann.
+
+.cal-section {
+  display: grid;
+  gap: var(--cal-space-4);
+  padding-block: var(--cal-space-4);
+}
+
+.cal-region {
+  display: flex;
+  flex-direction: column;
+  gap: var(--cal-space-4);
+  // Ohne dies sprengt ein breiter Block (eine Tabelle, ein <pre>) seine Rasterspalte, statt
+  // in ihr zu scrollen — die berüchtigte Grid-Mindestbreite von `auto`.
+  min-width: 0;
+}
+
+.cal-section[data-cal-layout='single'] {
+  grid-template-columns: minmax(0, 1fr);
+}
+
+.cal-section[data-cal-layout='two-1-1'] {
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+}
+
+.cal-section[data-cal-layout='two-2-1'] {
+  grid-template-columns: minmax(0, 2fr) minmax(0, 1fr);
+}
+
+.cal-section[data-cal-layout='sidebar-left'] {
+  grid-template-columns: minmax(0, 1fr) minmax(0, 3fr);
+}
+
+.cal-section[data-cal-layout='three-1-1-1'] {
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+}
+
+// Unter der Umbruchbreite steht jedes Layout einspaltig. Die Breite ist in `em` und damit an
+// die Schriftgröße gebunden, nicht an das Gerät: Wer größer stellt, bekommt den Umbruch
+// früher — was der Grund ist, aus dem er ihn braucht.
+@media (max-width: 48em) {
+  .cal-section[data-cal-layout] {
+    grid-template-columns: minmax(0, 1fr);
+  }
+}
+
+// `spacing` und `surfaceRole` sind Stufen, keine Werte (§7.1). Der Editor wählt eine Stufe,
+// die Basis entscheidet, was sie bedeutet — deshalb steht hier ein Vielfaches des
+// Grundabstands und keine Zahl, die jemand im Editor eingegeben hat.
+.cal-section[data-cal-spacing='none'] {
+  padding-block: 0;
+  gap: 0;
+}
+
+.cal-section[data-cal-spacing='tight'] {
+  padding-block: calc(var(--cal-space-4) / 2);
+  gap: calc(var(--cal-space-4) / 2);
+}
+
+.cal-section[data-cal-spacing='loose'] {
+  padding-block: calc(var(--cal-space-4) * 3);
+  gap: calc(var(--cal-space-4) * 2);
+}
+
+.cal-section[data-cal-surface='muted'] {
+  background: color-mix(in srgb, var(--cal-color-fg) 4%, var(--cal-color-bg));
+}
diff --git a/src/Workspace/Api/WorkspacePublicEndpoints.cs b/src/Workspace/Api/WorkspacePublicEndpoints.cs
index d3fa29ea..73a58cf6 100644
--- a/src/Workspace/Api/WorkspacePublicEndpoints.cs
+++ b/src/Workspace/Api/WorkspacePublicEndpoints.cs
@@ -233,7 +233,12 @@ public static void MapWorkspacePublicEndpoints(this IEndpointRouteBuilder endpoi
                         workspaceKey = normalizedKey,
                         themePluginId = theme?.ThemePluginId,
                         themeVersion = theme?.ThemeVersion,
-                        valuesByKey = theme?.ValuesByKey ?? new Dictionary<string, string>()
+                        valuesByKey = theme?.ValuesByKey ?? new Dictionary<string, string>(),
+                        // Die Sektionslayouts gehören dem Theme (§7.1). Ohne zugewiesenes Theme
+                        // gelten die des Basis-Themes: Sonst hätte eine frische Installation
+                        // nichts, womit sich etwas komponieren ließe, und ein Editor ohne
+                        // Auswahl sähe nach einem Fehler aus statt nach einem fehlenden Theme.
+                        sectionLayouts = theme?.SectionLayouts ?? SurfaceBaseSectionLayouts.All
                     });
                 })
             .AllowAnonymous()
diff --git a/tests/Callora.Core.Tests/Api/WorkspacePublicEndpointsTests.cs b/tests/Callora.Core.Tests/Api/WorkspacePublicEndpointsTests.cs
index 9485dafe..fb699bf4 100644
--- a/tests/Callora.Core.Tests/Api/WorkspacePublicEndpointsTests.cs
+++ b/tests/Callora.Core.Tests/Api/WorkspacePublicEndpointsTests.cs
@@ -495,6 +495,8 @@ private static async Task<WebApplication> CreateAppAsync(
         builder.Services.AddSingleton<Callora.Core.Application.Extensions.IWorkspaceThemeSettingsStore>(
             new InMemoryWorkspaceThemeSettingsStore());
         builder.Services.AddScoped<Callora.Core.Application.Extensions.WorkspaceUiChainResolver>();
+        builder.Services.AddSingleton<Callora.Core.Application.Extensions.IWorkspaceSectionLayoutStore>(
+            new Callora.Core.Tests.Support.InMemoryWorkspaceSectionLayoutStore());
         builder.Services.AddScoped<Callora.Core.Application.Extensions.WorkspacePublicThemeResolver>();
         if (authenticate)
         {
diff --git a/tests/Callora.Core.Tests/Application/Extensions/WorkspacePublicThemeResolverTests.cs b/tests/Callora.Core.Tests/Application/Extensions/WorkspacePublicThemeResolverTests.cs
index e8b522f6..f79028ca 100644
--- a/tests/Callora.Core.Tests/Application/Extensions/WorkspacePublicThemeResolverTests.cs
+++ b/tests/Callora.Core.Tests/Application/Extensions/WorkspacePublicThemeResolverTests.cs
@@ -21,7 +21,7 @@ await settingsStore.ReplaceDefinitionsForPluginAsync(ThemePluginId, ThemeVersion
             new("branding.apiToken", "API-Token", "secret", null, "\"top-secret\"", false, 1, null, null, true)
         ]);
 
-        var resolver = new WorkspacePublicThemeResolver(workspaceStore, new InMemoryWorkspaceSurfaceStore(), settingsStore);
+        var resolver = new WorkspacePublicThemeResolver(workspaceStore, new InMemoryWorkspaceSurfaceStore(), settingsStore, new InMemoryWorkspaceSectionLayoutStore());
         var theme = await resolver.ResolveAsync("workspace-a");
 
         Assert.NotNull(theme);
@@ -34,7 +34,7 @@ public async Task Resolve_ReturnsNull_ForInactiveWorkspace()
     {
         var (workspaceStore, settingsStore) = await CreateStoresWithWorkspaceAsync(isActive: false);
 
-        var resolver = new WorkspacePublicThemeResolver(workspaceStore, new InMemoryWorkspaceSurfaceStore(), settingsStore);
+        var resolver = new WorkspacePublicThemeResolver(workspaceStore, new InMemoryWorkspaceSurfaceStore(), settingsStore, new InMemoryWorkspaceSectionLayoutStore());
 
         Assert.Null(await resolver.ResolveAsync("workspace-a"));
     }
@@ -45,7 +45,7 @@ public async Task Resolve_ReturnsNull_WhenTenantIsInactive()
         var (workspaceStore, settingsStore) = await CreateStoresWithWorkspaceAsync(isActive: true);
         workspaceStore.SetTenantActive("tenant-a", isActive: false);
 
-        var resolver = new WorkspacePublicThemeResolver(workspaceStore, new InMemoryWorkspaceSurfaceStore(), settingsStore);
+        var resolver = new WorkspacePublicThemeResolver(workspaceStore, new InMemoryWorkspaceSurfaceStore(), settingsStore, new InMemoryWorkspaceSectionLayoutStore());
 
         Assert.Null(await resolver.ResolveAsync("workspace-a"));
     }
@@ -66,7 +66,7 @@ await settingsStore.ReplaceValuesAsync("workspace-a", null, ThemePluginId,
         await settingsStore.ReplaceValuesAsync("workspace-a", "shop", ThemePluginId,
             new Dictionary<string, string?> { ["primary.color"] = "\"#ff0000\"" });
 
-        var resolver = new WorkspacePublicThemeResolver(workspaceStore, surfaceStore, settingsStore);
+        var resolver = new WorkspacePublicThemeResolver(workspaceStore, surfaceStore, settingsStore, new InMemoryWorkspaceSectionLayoutStore());
         var theme = await resolver.ResolveForSurfaceAsync("workspace-a", "shop");
 
         Assert.NotNull(theme);
@@ -89,7 +89,7 @@ await settingsStore.ReplaceDefinitionsForPluginAsync("other-theme", ThemeVersion
         await settingsStore.ReplaceValuesAsync("workspace-a", null, ThemePluginId,
             new Dictionary<string, string?> { ["primary.color"] = "\"#336699\"" });
 
-        var resolver = new WorkspacePublicThemeResolver(workspaceStore, surfaceStore, settingsStore);
+        var resolver = new WorkspacePublicThemeResolver(workspaceStore, surfaceStore, settingsStore, new InMemoryWorkspaceSectionLayoutStore());
         var theme = await resolver.ResolveForSurfaceAsync("workspace-a", "shop");
 
         Assert.NotNull(theme);
@@ -104,7 +104,7 @@ public async Task ResolveForSurface_FallsBackToTheWorkspace_ForAnUnknownSurface(
         await settingsStore.ReplaceDefinitionsForPluginAsync(ThemePluginId, ThemeVersion,
             [new("primary.color", "Primärfarbe", "color", null, "\"#000000\"", false, 0, null, null, true)]);
 
-        var resolver = new WorkspacePublicThemeResolver(workspaceStore, new InMemoryWorkspaceSurfaceStore(), settingsStore);
+        var resolver = new WorkspacePublicThemeResolver(workspaceStore, new InMemoryWorkspaceSurfaceStore(), settingsStore, new InMemoryWorkspaceSectionLayoutStore());
         var theme = await resolver.ResolveForSurfaceAsync("workspace-a", "does-not-exist");
 
         Assert.NotNull(theme);
diff --git a/tests/Callora.Core.Tests/Infrastructure/Extensions/SectionLayoutManifestReaderTests.cs b/tests/Callora.Core.Tests/Infrastructure/Extensions/SectionLayoutManifestReaderTests.cs
new file mode 100644
index 00000000..3471a1ea
--- /dev/null
+++ b/tests/Callora.Core.Tests/Infrastructure/Extensions/SectionLayoutManifestReaderTests.cs
@@ -0,0 +1,167 @@
+using Callora.Core.Infrastructure.Extensions;
+using System.Text.Json;
+using Xunit;
+
+namespace Callora.Core.Tests.Infrastructure.Extensions;
+
+/// <summary>
+/// Was ein Theme über seine Sektionslayouts sagen kann — und was passiert, wenn es sich vertut.
+/// <para>
+/// Der Parser überspringt Kaputtes, statt aufzugeben. Ein Theme mit einem fehlerhaften Layout
+/// bietet seine anderen weiter an; ein Parser, der abbräche, ließe den Editor ohne jedes Layout
+/// zurück — und das sieht genauso aus wie ein Theme, das keine deklariert.
+/// </para>
+/// </summary>
+public sealed class SectionLayoutManifestReaderTests
+{
+    private static IReadOnlyList<Callora.Core.Application.Extensions.SectionLayoutDefinition> Parse(string json)
+    {
+        using var document = JsonDocument.Parse(json);
+        return SectionLayoutManifestReader.Parse(document.RootElement);
+    }
+
+    [Fact]
+    public void ReadsLayoutsWithTheirRegions()
+    {
+        var layouts = Parse("""
+        {
+          "sectionLayouts": [
+            {
+              "key": "two-2-1",
+              "label": "Zwei Spalten (2:1)",
+              "regions": [
+                { "key": "main", "label": "Inhalt" },
+                { "key": "aside", "label": "Seitenspalte" }
+              ]
+            }
+          ]
+        }
+        """);
+
+        var layout = Assert.Single(layouts);
+        Assert.Equal("two-2-1", layout.LayoutKey);
+        Assert.Equal("Zwei Spalten (2:1)", layout.Label);
+        Assert.Equal(["main", "aside"], layout.Regions.Select(region => region.RegionKey));
+    }
+
+    [Fact]
+    public void KeepsTheDeclaredRegionOrder()
+    {
+        // Die Reihenfolge des Themes ist die Lesereihenfolge. Alphabetisch sortiert stünde
+        // "aside" vor "main" — die Seitenspalte vor dem Inhalt, neben dem sie sitzt.
+        var layouts = Parse("""
+        { "sectionLayouts": [ { "key": "x", "regions": ["main", "aside", "footer"] } ] }
+        """);
+
+        Assert.Equal(["main", "aside", "footer"], layouts[0].Regions.Select(region => region.RegionKey));
+    }
+
+    [Fact]
+    public void AcceptsARegionThatIsJustItsKey()
+    {
+        // Die Form, in der ein Theme-Autor Regionen zuerst hinschreibt.
+        var layouts = Parse("""{ "sectionLayouts": [ { "key": "single", "regions": ["main"] } ] }""");
+
+        var region = Assert.Single(layouts[0].Regions);
+        Assert.Equal("main", region.RegionKey);
+        Assert.Equal("main", region.Label);
+    }
+
+    [Fact]
+    public void SkipsALayoutWithoutAKeyAndKeepsTheRest()
+    {
+        // Ohne Schlüssel gibt es nichts, worauf das Theme-CSS zielen könnte.
+        var layouts = Parse("""
+        {
+          "sectionLayouts": [
+            { "label": "Namenlos" },
+            { "key": "single", "label": "Eine Spalte" }
+          ]
+        }
+        """);
+
+        Assert.Equal(["single"], layouts.Select(layout => layout.LayoutKey));
+    }
+
+    [Fact]
+    public void FallsBackToTheKeyWhenNoLabelIsGiven()
+    {
+        var layouts = Parse("""{ "sectionLayouts": [ { "key": "sidebar-left" } ] }""");
+
+        Assert.Equal("sidebar-left", layouts[0].Label);
+    }
+
+    [Fact]
+    public void AcceptsTheShorterKeyName()
+    {
+        // `layouts` statt `sectionLayouts` — dieselbe Nachsicht, die der Rest von theme.json
+        // schon zeigt.
+        var layouts = Parse("""{ "layouts": [ { "key": "single" } ] }""");
+
+        Assert.Equal(["single"], layouts.Select(layout => layout.LayoutKey));
+    }
+
+    [Fact]
+    public void ReadsNoLayoutsWhenTheManifestDeclaresNone()
+    {
+        // Ein gültiger Zustand: Ein Theme, das nur Token setzt, hat keine Layouts anzubieten.
+        Assert.Empty(Parse("""{ "settings": [] }"""));
+        Assert.Empty(Parse("""{ "sectionLayouts": "kein Array" }"""));
+        Assert.Empty(Parse("""[]"""));
+    }
+
+    [Fact]
+    public void GivesLayoutsAnAscendingOrderWhenNoneIsDeclared()
+    {
+        // Sonst stünden sie alle auf 0 und die Auswahl im Editor sortierte nach etwas anderem —
+        // meist nach dem Schlüssel, also alphabetisch, was die Absicht des Themes verwirft.
+        var layouts = Parse("""
+        { "sectionLayouts": [ { "key": "b" }, { "key": "a" }, { "key": "c" } ] }
+        """);
+
+        Assert.Equal(["b", "a", "c"], layouts.Select(layout => layout.LayoutKey));
+        Assert.True(layouts[0].SortOrder < layouts[1].SortOrder);
+        Assert.True(layouts[1].SortOrder < layouts[2].SortOrder);
+    }
+
+    // ── Was ein Theme von der Basis erbt ────────────────────────────────────
+
+    [Fact]
+    public void AManifestInheritsTheBaseLayoutsUnlessItSaysOtherwise()
+    {
+        // Die sichere Richtung: Das Basis-Stylesheet der Runtime ist immer geladen, also
+        // funktionieren die Basis-Layouts auch unter einem fremden Theme — und ein Theme, das
+        // nur eine Variante beisteuern will, muss die ganze Palette nicht wiederholen.
+        Assert.True(InheritsBase("""{ "sectionLayouts": [] }"""));
+        Assert.True(InheritsBase("""{ }"""));
+        Assert.True(InheritsBase("""{ "inheritSectionLayouts": true }"""));
+        Assert.False(InheritsBase("""{ "inheritSectionLayouts": false }"""));
+    }
+
+    [Fact]
+    public void AnUnreadableFlagMeansInherit()
+    {
+        // Ein Tippfehler im Schalter darf nicht heimlich alle Basis-Layouts abschalten: Der
+        // Editor böte dann nur noch das eine Layout des Themes an, und niemand käme darauf,
+        // dass es an einer Zeichenkette statt eines Wahrheitswerts liegt.
+        Assert.True(InheritsBase("""{ "inheritSectionLayouts": "false" }"""));
+        Assert.True(InheritsBase("""[]"""));
+    }
+
+    private static bool InheritsBase(string json)
+    {
+        using var document = JsonDocument.Parse(json);
+        return SectionLayoutManifestReader.ParseInheritsBase(document.RootElement);
+    }
+
+    [Fact]
+    public void LetsTheThemeDeclareItsOwnOrder()
+    {
+        var layouts = Parse("""
+        { "sectionLayouts": [ { "key": "b", "sortOrder": 5 }, { "key": "a", "order": 1 } ] }
+        """);
+
+        Assert.Equal(5, layouts[0].SortOrder);
+        Assert.Equal(1, layouts[1].SortOrder);
+    }
+}
diff --git a/tests/Callora.Core.Tests/Infrastructure/Extensions/ThemeJsonWorkspaceTemplateSyncServiceTests.cs b/tests/Callora.Core.Tests/Infrastructure/Extensions/ThemeJsonWorkspaceTemplateSyncServiceTests.cs
index 6fd6d413..a61fa9f6 100644
--- a/tests/Callora.Core.Tests/Infrastructure/Extensions/ThemeJsonWorkspaceTemplateSyncServiceTests.cs
+++ b/tests/Callora.Core.Tests/Infrastructure/Extensions/ThemeJsonWorkspaceTemplateSyncServiceTests.cs
@@ -11,7 +11,8 @@ public async Task SyncFromAssemblyAsync_ReplacesExistingPluginDefinitionsFromThe
     {
         var store = new InMemoryWorkspaceTemplateRegistryStore();
         var settingsStore = new InMemoryWorkspaceThemeSettingsStore();
-        var sut = new ThemeJsonWorkspaceTemplateSyncService(store, settingsStore, NullLogger<ThemeJsonWorkspaceTemplateSyncService>.Instance);
+        var layoutStore = new InMemoryWorkspaceSectionLayoutStore();
+        var sut = new ThemeJsonWorkspaceTemplateSyncService(store, settingsStore, layoutStore, NullLogger<ThemeJsonWorkspaceTemplateSyncService>.Instance);
         var pluginId = "theme-acme";
         var tempDir = Path.Combine(Path.GetTempPath(), $"callora-theme-sync-{Guid.NewGuid():N}");
         Directory.CreateDirectory(tempDir);
@@ -118,7 +119,8 @@ public async Task SyncFromAssemblyAsync_NoThemeJson_DoesNotMutateExistingDefinit
     {
         var store = new InMemoryWorkspaceTemplateRegistryStore();
         var settingsStore = new InMemoryWorkspaceThemeSettingsStore();
-        var sut = new ThemeJsonWorkspaceTemplateSyncService(store, settingsStore, NullLogger<ThemeJsonWorkspaceTemplateSyncService>.Instance);
+        var layoutStore = new InMemoryWorkspaceSectionLayoutStore();
+        var sut = new ThemeJsonWorkspaceTemplateSyncService(store, settingsStore, layoutStore, NullLogger<ThemeJsonWorkspaceTemplateSyncService>.Instance);
         var pluginId = "theme-acme";
 
         await store.UpsertDefinitionAsync(
@@ -159,7 +161,8 @@ public async Task ClearPluginDefinitionsAsync_RemovesPluginRows()
     {
         var store = new InMemoryWorkspaceTemplateRegistryStore();
         var settingsStore = new InMemoryWorkspaceThemeSettingsStore();
-        var sut = new ThemeJsonWorkspaceTemplateSyncService(store, settingsStore, NullLogger<ThemeJsonWorkspaceTemplateSyncService>.Instance);
+        var layoutStore = new InMemoryWorkspaceSectionLayoutStore();
+        var sut = new ThemeJsonWorkspaceTemplateSyncService(store, settingsStore, layoutStore, NullLogger<ThemeJsonWorkspaceTemplateSyncService>.Instance);
 
         await store.UpsertDefinitionAsync(
             templateKey: "workspace.layout",
diff --git a/tests/Callora.Core.Tests/Support/InMemoryWorkspaceSectionLayoutStore.cs b/tests/Callora.Core.Tests/Support/InMemoryWorkspaceSectionLayoutStore.cs
new file mode 100644
index 00000000..8251032d
--- /dev/null
+++ b/tests/Callora.Core.Tests/Support/InMemoryWorkspaceSectionLayoutStore.cs
@@ -0,0 +1,48 @@
+using Callora.Core.Application.Extensions;
+
+namespace Callora.Core.Tests.Support;
+
+/// <summary>
+/// Sektionslayouts im Speicher — dieselbe Ersetzungs-Semantik wie der EF-Store, ohne Datenbank.
+/// </summary>
+public sealed class InMemoryWorkspaceSectionLayoutStore : IWorkspaceSectionLayoutStore
+{
+    private readonly Dictionary<string, ThemeSectionLayouts> _byPluginVersion =
+        new(StringComparer.OrdinalIgnoreCase);
+
+    public Task<ThemeSectionLayouts> ListAsync(
+        string pluginId,
+        string version,
+        CancellationToken cancellationToken = default) =>
+        Task.FromResult(_byPluginVersion.TryGetValue(Key(pluginId, version), out var found)
+            ? found
+            : new ThemeSectionLayouts([], InheritsBase: true));
+
+    public Task ReplaceForPluginAsync(
+        string pluginId,
+        string version,
+        IReadOnlyList<SectionLayoutDefinition> layouts,
+        bool inheritsBase,
+        CancellationToken cancellationToken = default)
+    {
+        // Wie im EF-Store: Ohne eigene Layouts gibt es keine Zeile, die das Flag tragen könnte —
+        // und ohne Zeile wird geerbt.
+        _byPluginVersion[Key(pluginId, version)] =
+            new ThemeSectionLayouts(layouts, layouts.Count == 0 || inheritsBase);
+        return Task.CompletedTask;
+    }
+
+    public Task ClearForPluginAsync(string pluginId, CancellationToken cancellationToken = default)
+    {
+        foreach (var key in _byPluginVersion.Keys
+            .Where(key => key.StartsWith($"{pluginId} ", StringComparison.OrdinalIgnoreCase))
+            .ToArray())
+        {
+            _byPluginVersion.Remove(key);
+        }
+
+        return Task.CompletedTask;
+    }
+
+    private static string Key(string pluginId, string version) => $"{pluginId} {version}";
+}
diff --git a/tests/Callora.Core.Tests/Surface/SurfaceBaseSectionLayoutsTests.cs b/tests/Callora.Core.Tests/Surface/SurfaceBaseSectionLayoutsTests.cs
new file mode 100644
index 00000000..8f16f113
--- /dev/null
+++ b/tests/Callora.Core.Tests/Surface/SurfaceBaseSectionLayoutsTests.cs
@@ -0,0 +1,209 @@
+using Callora.Core.Application.Extensions;
+using System.Text.RegularExpressions;
+using Xunit;
+
+namespace Callora.Core.Tests.Surface;
+
+/// <summary>
+/// Die Basis-Sektionslayouts gegen das Stylesheet, das sie darstellt.
+/// <para>
+/// Die Deklaration steht in C# (der Renderer braucht sie), das CSS in
+/// <c>tokens.scss</c> (die Fläche lädt es). Zwei Dateien, zwei Sprachen, dieselbe Sache —
+/// und nichts zwingt sie zusammen außer diesem Test. Ein deklariertes Layout ohne Regel ist
+/// ein Angebot, das nichts tut: im Editor wählbar, auf der Seite wirkungslos. Eine Regel ohne
+/// Deklaration ist ein Raster, das niemand wählen kann. Beides fiele sonst erst auf der
+/// veröffentlichten Seite auf, und dort sieht es aus wie ein Fehler im Renderer.
+/// </para>
+/// </summary>
+public sealed class SurfaceBaseSectionLayoutsTests
+{
+    private static readonly string Css = File.ReadAllText(FindTokensScss());
+
+    /// <summary>Die Layout-Schlüssel, auf die das Stylesheet zielt.</summary>
+    private static HashSet<string> StyledLayouts() =>
+        Regex.Matches(Css, @"data-cal-layout='([^']+)'")
+            .Select(match => match.Groups[1].Value)
+            .ToHashSet(StringComparer.Ordinal);
+
+    [Fact]
+    public void TheBaseOffersSectionLayouts()
+    {
+        // Ohne sie hätte eine frische Installation nichts, womit sich etwas komponieren ließe:
+        // Der Renderer gäbe data-cal-layout aus, der Editor böte keine Wahl, und beides sähe
+        // nach einem Fehler aus statt nach einem fehlenden Theme.
+        Assert.NotEmpty(SurfaceBaseSectionLayouts.All);
+    }
+
+    [Fact]
+    public void EveryDeclaredLayoutIsStyled()
+    {
+        var styled = StyledLayouts();
+
+        var unstyled = SurfaceBaseSectionLayouts.All
+            .Select(layout => layout.LayoutKey)
+            .Where(key => !styled.Contains(key))
+            .ToArray();
+
+        Assert.Empty(unstyled);
+    }
+
+    [Fact]
+    public void EveryStyledLayoutIsDeclared()
+    {
+        var declared = SurfaceBaseSectionLayouts.All
+            .Select(layout => layout.LayoutKey)
+            .ToHashSet(StringComparer.Ordinal);
+
+        Assert.Empty(StyledLayouts().Where(key => !declared.Contains(key)).ToArray());
+    }
+
+    [Fact]
+    public void EveryLayoutHasRegionsWithDistinctKeys()
+    {
+        // Ein Layout ohne Region ist eines, in das nichts passt; zwei gleich benannte Regionen
+        // wären zwei Orte, die derselbe sind — Blöcke aus beiden landeten übereinander.
+        var broken = SurfaceBaseSectionLayouts.All
+            .Where(layout => layout.Regions.Count == 0 ||
+                             layout.Regions.Select(region => region.RegionKey).Distinct().Count() !=
+                             layout.Regions.Count)
+            .Select(layout => layout.LayoutKey)
+            .ToArray();
+
+        Assert.Empty(broken);
+    }
+
+    [Fact]
+    public void TheColumnCountMatchesTheRegionCount()
+    {
+        // Zwei Regionen und drei Spalten wäre eine leere dritte, die niemand füllen kann; drei
+        // Regionen und zwei Spalten stapelte die dritte irgendwohin. Beides sieht nach einem
+        // Renderer-Fehler aus und ist eine Unstimmigkeit zwischen diesen beiden Dateien.
+        var mismatched = new List<string>();
+
+        foreach (var layout in SurfaceBaseSectionLayouts.All)
+        {
+            var rule = Regex.Match(
+                Css,
+                $@"\[data-cal-layout='{Regex.Escape(layout.LayoutKey)}'\]\s*\{{([^}}]*)\}}");
+            Assert.True(rule.Success, $"Keine Regel für Layout '{layout.LayoutKey}'.");
+
+            var columns = Regex.Match(rule.Groups[1].Value, @"grid-template-columns:\s*([^;]+);");
+            Assert.True(columns.Success, $"Layout '{layout.LayoutKey}' setzt keine Spalten.");
+
+            var count = CountColumns(columns.Groups[1].Value);
+            if (count != layout.Regions.Count)
+            {
+                mismatched.Add($"{layout.LayoutKey}: {layout.Regions.Count} Regionen, {count} Spalten");
+            }
+        }
+
+        Assert.Empty(mismatched);
+    }
+
+    [Fact]
+    public void TheStylesheetComputesInTokensRatherThanFixedMeasures()
+    {
+        // Ein fester Pixelwert wäre genau die Freiheit, die die Token-Achse dem Editor
+        // verweigert — mit dem Unterschied, dass sie niemand zurücknehmen kann. Die
+        // Umbruchbreite ist ausgenommen: Sie steht in `em`, hängt also an der Schriftgröße und
+        // nicht am Gerät.
+        var withoutMediaQueries = Regex.Replace(Css, @"@media[^{]*\{", string.Empty);
+        var fixedLengths = Regex.Matches(withoutMediaQueries, @":[^;]*?\d+(px|pt)\b")
+            .Select(match => match.Value.Trim());
+
+        Assert.Empty(fixedLengths);
+    }
+
+    [Fact]
+    public void ARegionDoesNotBurstItsColumn()
+    {
+        // Die berüchtigte Grid-Mindestbreite von `auto`: Ohne `min-width: 0` sprengt eine
+        // Tabelle oder ein <pre> seine Rasterspalte, und das Layout kippt für die ganze Sektion.
+        Assert.Matches(@"\.cal-region\s*\{[^}]*min-width:\s*0", Css);
+    }
+
+    // ── Was ein Plugin-Theme davon erbt ──────────────────────────────────────
+
+    [Fact]
+    public void AThemeInheritsTheBaseAndAddsItsOwn()
+    {
+        // Die sichere Richtung: Das Basis-Stylesheet ist immer geladen, also funktionieren die
+        // Basis-Layouts auch unter einem fremden Theme — und ein Theme, das nur eine Variante
+        // beisteuern will, muss die ganze Palette nicht wiederholen.
+        var own = new SectionLayoutDefinition("sidebar-right", "Seitenspalte rechts",
+            [new("main", "Inhalt"), new("aside", "Seitenspalte")], 45);
+
+        var composed = SurfaceBaseSectionLayouts.Compose([own], inherit: true);
+
+        Assert.Contains(composed, layout => layout.LayoutKey == "single");
+        Assert.Contains(composed, layout => layout.LayoutKey == "sidebar-right");
+    }
+
+    [Fact]
+    public void AThemeLayoutDisplacesTheBaseOneOfTheSameName()
+    {
+        // Zusammenzuführen wäre der Weg, auf dem ein Theme ein `two-2-1` mit den Regionen der
+        // Basis bekäme, obwohl sein CSS zwei andere kennt — und die Blöcke lägen dann in
+        // Regionen, die es nicht gibt.
+        var own = new SectionLayoutDefinition("two-2-1", "Anders",
+            [new("links", "Links"), new("rechts", "Rechts")], 30);
+
+        var composed = SurfaceBaseSectionLayouts.Compose([own], inherit: true);
+
+        var replaced = Assert.Single(composed, layout => layout.LayoutKey == "two-2-1");
+        Assert.Equal(["links", "rechts"], replaced.Regions.Select(region => region.RegionKey));
+    }
+
+    [Fact]
+    public void AThemeThatDeclinesToInheritStandsAlone()
+    {
+        var own = new SectionLayoutDefinition("eigen", "Eigen", [new("main", "Inhalt")], 10);
+
+        var composed = SurfaceBaseSectionLayouts.Compose([own], inherit: false);
+
+        Assert.Equal(["eigen"], composed.Select(layout => layout.LayoutKey));
+    }
+
+    [Fact]
+    public void ComposedLayoutsComeOutInDisplayOrder()
+    {
+        var own = new SectionLayoutDefinition("dazwischen", "Dazwischen", [new("main", "Inhalt")], 25);
+
+        var composed = SurfaceBaseSectionLayouts.Compose([own], inherit: true);
+
+        Assert.Equal(
+            composed.Select(layout => layout.SortOrder).Order(),
+            composed.Select(layout => layout.SortOrder));
+    }
+
+    /// <summary>
+    /// Spalten in einer <c>grid-template-columns</c>-Angabe. Versteht die beiden Formen, die das
+    /// Stylesheet benutzt: eine Aufzählung von <c>minmax(...)</c> und <c>repeat(n, …)</c>.
+    /// </summary>
+    private static int CountColumns(string value)
+    {
+        var repeat = Regex.Match(value, @"repeat\(\s*(\d+)\s*,");
+        return repeat.Success
+            ? int.Parse(repeat.Groups[1].Value)
+            : Regex.Count(value, @"minmax\(");
+    }
+
+    private static string FindTokensScss()
+    {
+        var directory = new DirectoryInfo(AppContext.BaseDirectory);
+        while (directory is not null)
+        {
+            var candidate = Path.Combine(
+                directory.FullName,
+                "src", "Surface.Rendering", "Resources", "app", "surface", "src", "styles", "tokens.scss");
+            if (File.Exists(candidate))
+            {
+                return candidate;
+            }
+
+            directory = directory.Parent;
+        }
+
+        throw new FileNotFoundException("tokens.scss wurde im Repository nicht gefunden.");
+    }
+}
diff --git a/tests/Callora.Core.Tests/Surface/SurfaceCompositionRendererTests.cs b/tests/Callora.Core.Tests/Surface/SurfaceCompositionRendererTests.cs
index a79875d0..8cc8036c 100644
--- a/tests/Callora.Core.Tests/Surface/SurfaceCompositionRendererTests.cs
+++ b/tests/Callora.Core.Tests/Surface/SurfaceCompositionRendererTests.cs
@@ -155,6 +155,51 @@ public void BlocksAreGroupedByRegion()
         Assert.Contains("data-cal-region=\"aside\"", html, StringComparison.Ordinal);
     }
 
+    // ── Wenn das Theme das Layout nicht mehr kennt (§7.8) ───────────────────
+
+    [Fact]
+    public void ALayoutTheThemeNoLongerKnowsFallsBackWithoutLosingAnything()
+    {
+        // Nach einem Theme-Wechsel benennt `data-cal-layout="two-2-1"` ein Raster, das niemand
+        // stylt — die Sektion zerfiele in das, was der Browser mit ungestylten Divs tut. Der
+        // Rückfall stellt die Blöcke in eine lesbare Spalte: schlichter, aber vollständig.
+        var document = Document(new SurfaceLayoutSection("two-2-1", 0, [
+            Block("haupt", region: "main"),
+            Block("rand", region: "aside"),
+        ]));
+
+        var html = new SurfaceCompositionRenderer(layoutIsKnown: key => key == "single")
+            .Render(document);
+
+        Assert.Contains("data-cal-layout=\"single\"", html, StringComparison.Ordinal);
+        Assert.DoesNotContain("two-2-1", html, StringComparison.Ordinal);
+        // Beide Blöcke sind noch da — der Rückfall betrifft das Raster, nicht den Inhalt.
+        Assert.Contains("data-callora-island=\"haupt\"", html, StringComparison.Ordinal);
+        Assert.Contains("data-callora-island=\"rand\"", html, StringComparison.Ordinal);
+        Assert.Contains("data-cal-region=\"aside\"", html, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ALayoutTheThemeStillKnowsIsLeftAlone()
+    {
+        var html = new SurfaceCompositionRenderer(layoutIsKnown: _ => true)
+            .Render(Document(new SurfaceLayoutSection("two-2-1", 0, [Block("haupt")])));
+
+        Assert.Contains("data-cal-layout=\"two-2-1\"", html, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void WithoutAnOpinionAboutLayoutsNothingIsReplaced()
+    {
+        // Der Standardwert. Ein Renderer ohne Layout-Wissen darf nicht so tun, als hätte ein
+        // Theme das Layout abgelehnt — das wäre eine sichtbare Änderung aus einem
+        // Nicht-Ereignis.
+        var html = new SurfaceCompositionRenderer()
+            .Render(Document(new SurfaceLayoutSection("erfunden", 0, [Block("haupt")])));
+
+        Assert.Contains("data-cal-layout=\"erfunden\"", html, StringComparison.Ordinal);
+    }
+
     [Fact]
     public void AStoredStringCannotBreakOutOfItsAttribute()
     {
diff --git a/tests/Callora.Core.Tests/Surface/SurfaceRenderEndpointsTests.cs b/tests/Callora.Core.Tests/Surface/SurfaceRenderEndpointsTests.cs
index 0d2578a7..2ff28fca 100644
--- a/tests/Callora.Core.Tests/Surface/SurfaceRenderEndpointsTests.cs
+++ b/tests/Callora.Core.Tests/Surface/SurfaceRenderEndpointsTests.cs
@@ -119,6 +119,8 @@ public async Task Render_WithAssignedTheme_FlowsEffectiveTokensIntoContext()
             configure: services =>
             {
                 services.AddSingleton<IWorkspaceThemeSettingsStore>(settings);
+                services.AddSingleton<IWorkspaceSectionLayoutStore>(
+                    new InMemoryWorkspaceSectionLayoutStore());
                 services.AddScoped<WorkspacePublicThemeResolver>();
                 services.AddSingleton<ISurfaceRenderer>(capturingRenderer);
             });
@@ -284,6 +286,8 @@ private static async Task<WebApplication> CreateAppAsync(
         builder.Services.AddSingleton<IWorkspaceThemeSettingsStore>(
             new InMemoryWorkspaceThemeSettingsStore());
         builder.Services.AddScoped<WorkspaceUiChainResolver>();
+        builder.Services.AddSingleton<IWorkspaceSectionLayoutStore>(
+            new InMemoryWorkspaceSectionLayoutStore());
         builder.Services.AddScoped<WorkspacePublicThemeResolver>();
         builder.Services.AddCalloraSurfaceRendering();
         if (authenticate)