diff --git a/AGENTS.md b/AGENTS.md
index 1b1300b..f51843b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -62,7 +62,8 @@ js/
 │   ├── crypto.js       # NaCl Encryption
 │   ├── currency.js     # XMR/Fiat Umrechnung
 │   ├── pow-captcha.js  # Proof-of-Work Captcha (Challenge/Verify)
-│   └── btcpay.js       # BTCPay Server Integration (Invoice, Checkout, Webhook)
+│   ├── btcpay.js       # BTCPay Server Integration (Invoice, Checkout, Webhook)
+│   └── favorites.js    # Favoriten-Service (localStorage + Directus Sync)
 └── components/
     ├── app-shell.js    # Layout, registriert Routes
     ├── app-header.js   # Header (Theme-Toggle, Lang-Dropdown, Profil-Dropdown)
@@ -142,14 +143,16 @@ locales/
 5. ~~TweetNaCl self-hosted~~ ✅ In `js/vendor/`
 6. ~~Chat-Crypto fix~~ ✅ `box.before` + `secretbox`
 7. ~~Payment-Integration mit BTCpay Server~~ ✅ Proxy auf `pow.dgray.io`, Frontend-Service `btcpay.js`
-8. Reputation-System (5/15/50 Deals Stufen)
-9. Push-Benachrichtigungen für neue Nachrichten
+8. ~~Favoriten Directus Sync~~ ✅ FavoritesService mit Union-Merge bei Login
+9. ~~Expired Listings~~ ✅ Directus Flow (alle 15 Min), Status-Badges auf Cards
+10. Reputation-System (5/15/50 Deals Stufen)
+11. Push-Benachrichtigungen für neue Nachrichten
 
 ## Directus Berechtigungen (Public-Rolle)
 
 | Collection | Read | Create | Update | Hinweise |
 |------------|------|--------|--------|----------|
-| `listings` | ✓ | ✓ | - | Nur `status=published` lesen |
+| `listings` | ✓ | ✓ | ✓ | Nur `status=published` lesen, Update nur `views` (Public) |
 | `listings_files` | ✓ | ✓ | - | Junction-Table für Bilder |
 | `directus_files` | ✓ | ✓ | - | Für Assets/Bilder |
 | `categories` | ✓ | - | - | Nur `status=published` |
@@ -158,6 +161,13 @@ locales/
 | `languages` | ✓ | - | - | Für Sprachen-Liste |
 | `conversations` | ✓ | ✓ | ✓ | Filter via `participant_hash`, Update nur `status` |
 | `messages` | ✓ | ✓ | - | Filter via `conversation` ID |
+| `favorites` | ✓ | ✓ | - | User-Rolle: Filter `user = $CURRENT_USER`, Delete erlaubt |
+
+### Directus Flows
+
+| Flow | Trigger | Aktion |
+|------|---------|--------|
+| Archive Expired Listings | Schedule `*/15 * * * *` | `status → archived` wenn `expires_at < NOW` |
 
 Siehe `docs/DIRECTUS-SCHEMA.md` für vollständiges Schema.
 
diff --git a/README.md b/README.md
index 00e942c..cafa512 100644
--- a/README.md
+++ b/README.md
@@ -154,7 +154,8 @@ dgray/
 │   │   ├── crypto.js       # NaCl Encryption (box.before + secretbox)
 │   │   ├── currency.js     # XMR/Fiat Umrechnung
 │   │   ├── pow-captcha.js  # PoW Captcha (Server-first, lokaler Fallback)
-│   │   └── btcpay.js       # BTCPay Server Integration (Invoice, Checkout)
+│   │   ├── btcpay.js       # BTCPay Server Integration (Invoice, Checkout)
+│   │   └── favorites.js    # Favoriten (localStorage + Directus Sync)
 │   ├── vendor/
 │   │   ├── nacl-fast.min.js    # TweetNaCl (self-hosted)
 │   │   ├── nacl-util.min.js    # TweetNaCl Utils
@@ -213,6 +214,7 @@ dgray/
 - [x] Chat-System (E2E-verschlüsselt mit NaCl box.before + secretbox)
 - [x] Conversations/Messages Services
 - [x] Merkliste (Favoriten-Seite)
+- [x] Favoriten Directus-Sync (Union-Merge bei Login, localStorage-Fallback)
 - [x] PoW Captcha (server-seitig via pow.dgray.io, HMAC-signiert)
 - [x] TweetNaCl self-hosted (kein CDN)
 - [ ] Benachrichtigungen (Push)
@@ -223,6 +225,8 @@ dgray/
 - [x] BTCPay Server Integration (`pay.xmr.rocks`, Proxy auf `pow.dgray.io`)
 - [x] Listing-Gebühr: 1 EUR/USD/CHF/GBP (200 JPY) via Monero
 - [x] Webhook für Auto-Publish nach Blockchain-Confirmation
+- [x] Expired Listings (Directus Flow, Status-Badges auf Cards)
+- [x] Token-Refresh bei Tab-Visibility-Change
 - [ ] Wallet-Anbindung (monero-wallet-rpc)
 - [ ] MultiSig Escrow