diff --git a/CHANGELOG.md b/CHANGELOG.md
index 56303d44..cbcc2af3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,27 @@
 
 All notable changes to RustChan will be documented in this file.
 
+## RustChan 1.7.0 — 2026-10-08
+
+### Upgrade notes
+
+- Back up the complete data directory before upgrading. Native Linux updates retain the signed-package verification, pre-upgrade snapshots and full data-and-binary rollback introduced in 1.6.6; the minimum updater remains 1.6.6. Containers, macOS, Windows and custom installations continue to use their deployment tools.
+- Rust 1.99 remains the minimum supported compiler.
+
+### Improved
+
+- Improved thumbnail delivery and caching while preserving board permissions, private-media access checks and existing preview formats.
+- Refined thread controls, post actions and archive navigation, including consistent handling of locked, archived, sticky and pruned threads.
+- Refreshed Frutiger Aero and refined the other themes, with focused readability improvements for Forest and Terminal.
+- Updated Rust dependencies within the existing dependency set.
+
+### Fixed
+
+- Release settings locks explicitly when configuration operations finish, preventing duplicate process descriptors from delaying subsequent saves or restarts.
+- Hardened posting and thread lifecycle transactions, retry receipts, reply counters, retention and recoverable media publication/deletion. Posting checks current thread state and board policy before committing.
+- Hardened hostile input handling across uploads, paths, redirects, administrator authentication/settings, backups and restores.
+- Bounded expensive search, CAPTCHA and request work, strengthened rate limiting and connection handling, and expanded security and lifecycle regression coverage.
+
 ## RustChan 1.6.6 — 2026-10-03
 
 - Fixed migration of supported earlier package baselines, including 1.6.0 databases missing the two newer post-query indexes. Unknown schema drift remains rejected; upgrades preserve existing content and retain full data-and-binary rollback.
diff --git a/Cargo.lock b/Cargo.lock
index 3927f890..5d3c6172 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1192,9 +1192,9 @@ dependencies = [
 
 [[package]]
 name = "ctutils"
-version = "0.4.2"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574"
 dependencies = [
  "cmov",
 ]
@@ -1662,9 +1662,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
+checksum = "0e9c71c2167ca323c882b99918929403426e2373ea17242ff5653e0d5e1058be"
 
 [[package]]
 name = "elliptic-curve"
@@ -1846,6 +1846,12 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b97b65636e5b9ef369943878ac74335ba1c55c1cb6adbf1e2c293c624248d693"
 
+[[package]]
+name = "fearless_simd"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3296eb97d869113eaf148a6bdf01884e90b3828ad7ae2340b0f93362fc158611"
+
 [[package]]
 name = "ff"
 version = "0.13.1"
@@ -1952,9 +1958,9 @@ dependencies = [
 
 [[package]]
 name = "fs-err"
-version = "3.3.1"
+version = "3.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b91aa448ca50d7e79433bdf3ee8d99215430d2ec02ade5aefab2a073a1822e8a"
+checksum = "b5c95b673b8f6f7235229ae11c5642d81b04c2e64c1e2fb417bc0cf73ca45f29"
 dependencies = [
  "autocfg",
  "tokio",
@@ -2236,9 +2242,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.19"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
+checksum = "7d29020232d6aa3fb1daca64c1127cf662cf97f254ae16c18c05b8ab635fc118"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -2336,6 +2342,12 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f4d0e94ddd48749f06bbe4e5389fb9799a0c45bcaf00495042076ef05e3241a"
 
+[[package]]
+name = "hayro-ccitt"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2866f0d976e76497480b853d5e258dab6e4b89ecfe991124e08f15dfa8fd03ad"
+
 [[package]]
 name = "hayro-cmap"
 version = "0.1.0"
@@ -2366,12 +2378,12 @@ dependencies = [
 
 [[package]]
 name = "hayro-jbig2"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69374b3668dd45aeb3d3145cda68f2c7b4f223aaa2511e67d076f1c7d741388d"
+checksum = "000e025850f4592ddcaee85640db70704151f2bafd43b6f431aa5b6a2c6a35a9"
 dependencies = [
- "fearless_simd",
- "hayro-ccitt",
+ "fearless_simd 1.1.0",
+ "hayro-ccitt 0.4.0",
 ]
 
 [[package]]
@@ -2380,7 +2392,7 @@ version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c75ab947623ef4ccaa7acf0579edf7cbb5a73838e3839a7be73335e522f433a1"
 dependencies = [
- "fearless_simd",
+ "fearless_simd 0.4.1",
 ]
 
 [[package]]
@@ -2396,7 +2408,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0edeafd70aa2db743de8ede8637d07ec87db05efe69cde371d03f1b185fcef27"
 dependencies = [
  "flate2",
- "hayro-ccitt",
+ "hayro-ccitt 0.3.0",
  "hayro-jbig2",
  "hayro-jpeg2000",
  "memchr",
@@ -2532,9 +2544,9 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.11.1"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
+checksum = "2c3e324da4c95177d6291d4c8730197c0d1822f8a9766814a4a44fa5ab797c9c"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -2862,9 +2874,9 @@ dependencies = [
 
 [[package]]
 name = "inventory"
-version = "0.3.24"
+version = "0.3.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4f0c30c76f2f4ccee3fe55a2435f691ca00c0e4bd87abe4f4a851b1d4dac39b"
+checksum = "6928282826c822ad91bf1c9a1cb90a30ba1c26770749929b4656cd6be829cd7c"
 dependencies = [
  "rustversion",
 ]
@@ -2916,9 +2928,9 @@ checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "jiff"
-version = "0.2.37"
+version = "0.2.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ab1baf72f08796de0260609515130699b890ac25f30e610ad894bc5856cafdb"
+checksum = "b2b005715dcbeb0089a3c0dab99f2ff1cc3b2525323552703d648585d342a383"
 dependencies = [
  "defmt",
  "jiff-core",
@@ -2943,9 +2955,9 @@ dependencies = [
 
 [[package]]
 name = "jiff-static"
-version = "0.2.37"
+version = "0.2.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "378268a1116ad67ae6228701118ac9f491d78fda38a40a1f1a9e1348de6f7212"
+checksum = "2cc9817253cf7c7ee4684451bd327e88d6f3658014e54a29198625590650695c"
 dependencies = [
  "jiff-core",
  "proc-macro2",
@@ -2955,9 +2967,9 @@ dependencies = [
 
 [[package]]
 name = "jiff-tzdb"
-version = "0.1.8"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "142bd39932ad231f10513df9ab62661fead8719872150b7ad02a2df79f4e141e"
+checksum = "fa8377070c6bae868759445e5a77f66d84f0b72f3a054bfb00e6d038b8282da7"
 
 [[package]]
 name = "jiff-tzdb-platform"
@@ -4054,9 +4066,9 @@ dependencies = [
 
 [[package]]
 name = "powerfmt"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+checksum = "4a6394b9e965e73d0a289ee54f589087e2c676aedf60885baf52c76b771e4958"
 
 [[package]]
 name = "ppv-lite86"
@@ -4093,7 +4105,7 @@ version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
 dependencies = [
- "toml_edit 0.25.15+spec-1.1.0",
+ "toml_edit 0.25.16+spec-1.1.0",
 ]
 
 [[package]]
@@ -4619,7 +4631,7 @@ dependencies = [
 
 [[package]]
 name = "rustchan"
-version = "1.6.6"
+version = "1.7.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -4676,7 +4688,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tokio-util",
- "toml 1.1.6+spec-1.1.0",
+ "toml 1.1.7+spec-1.1.0",
  "tor-cell",
  "tor-hsservice",
  "tower",
@@ -5052,9 +5064,9 @@ dependencies = [
 
 [[package]]
 name = "serde_spanned"
-version = "1.1.1"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
+checksum = "4e7523beb55eece201a2356bee0bbca0d1ab466c14c07703b2e0ee6d42cb0c2c"
 dependencies = [
  "serde_core",
 ]
@@ -5325,9 +5337,9 @@ dependencies = [
 
 [[package]]
 name = "spki"
-version = "0.8.0"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d9efca8738c78ee9484207732f728b1ef517bbb1833d6fc0879ca898a522f6f"
+checksum = "7ef958a98b9d5da290cfc78946e9f3e61e1e62a18db0d92cac0b83cc161491a9"
 dependencies = [
  "base64ct",
  "der 0.8.2",
@@ -5941,14 +5953,14 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "1.1.6+spec-1.1.0"
+version = "1.1.7+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "920602543f0911ab71da12c50d59701da54c196d1a2bf5cb4b75667f137a406a"
+checksum = "7874cd34dd99040fc24e30923aa64a60a81ff3ddfe2b8129ccc84ba24949deed"
 dependencies = [
  "indexmap 2.14.2",
  "serde_core",
- "serde_spanned 1.1.1",
- "toml_datetime 1.1.1+spec-1.1.0",
+ "serde_spanned 1.1.2",
+ "toml_datetime 1.1.2+spec-1.1.0",
  "toml_parser",
  "toml_writer",
  "winnow 1.0.4",
@@ -5965,9 +5977,9 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "1.1.1+spec-1.1.0"
+version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
 dependencies = [
  "serde_core",
 ]
@@ -5988,21 +6000,21 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.25.15+spec-1.1.0"
+version = "0.25.16+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1340ea94a5856333492c9064b02c778b191dd2c853778d9609debdcdfea3a614"
+checksum = "88f38f3af8bf71841c67a990f4e2b52143b2d0a1a994c72513ff4c14977fc722"
 dependencies = [
  "indexmap 2.14.2",
- "toml_datetime 1.1.1+spec-1.1.0",
+ "toml_datetime 1.1.2+spec-1.1.0",
  "toml_parser",
  "winnow 1.0.4",
 ]
 
 [[package]]
 name = "toml_parser"
-version = "1.1.3+spec-1.1.0"
+version = "1.1.4+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
+checksum = "bed810ee007d8e7f9cf20b4774e7198142fa27186e0f805871da7f3c39eaf333"
 dependencies = [
  "winnow 1.0.4",
 ]
@@ -6015,9 +6027,9 @@ checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
 
 [[package]]
 name = "toml_writer"
-version = "1.1.2+spec-1.1.0"
+version = "1.1.3+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2"
+checksum = "06bdbd8cfc056b8d2e2e85f29b56a3bdbecb527cef81eb39e3e7b98af4652770"
 
 [[package]]
 name = "tor-async-utils"
@@ -6272,7 +6284,7 @@ dependencies = [
  "serde_ignored",
  "strum",
  "thiserror 2.0.21",
- "toml 1.1.6+spec-1.1.0",
+ "toml 1.1.7+spec-1.1.0",
  "tor-basic-utils",
  "tor-error",
  "tor-rtcompat",
@@ -7352,9 +7364,9 @@ dependencies = [
 
 [[package]]
 name = "unicase"
-version = "2.9.0"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+checksum = "357cc3acc6a036009fd6c973ed009037c732d60d0b4f6c673e9041497482a28f"
 
 [[package]]
 name = "unicode-ident"
@@ -7469,7 +7481,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3361bff7f7d82c0c496b92048db83846691f0e844cc28dee92b1c824291b55ee"
 dependencies = [
  "bytemuck",
- "fearless_simd",
+ "fearless_simd 0.4.1",
  "guillotiere",
  "hashbrown 0.17.1",
  "log",
@@ -7486,7 +7498,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19d672facaa2d697285a786cd9d44d614cd2ce54cdc022504bf339f8fff3b750"
 dependencies = [
  "bytemuck",
- "fearless_simd",
+ "fearless_simd 0.4.1",
  "guillotiere",
  "hashbrown 0.17.1",
  "log",
@@ -7544,9 +7556,9 @@ dependencies = [
 
 [[package]]
 name = "want"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+checksum = "ec4cdd0dd910afe868b7ef477227d8d538b46b3075031afee8a9f2acb0a2ed0b"
 dependencies = [
  "try-lock",
 ]
@@ -8068,7 +8080,7 @@ checksum = "105ef4642d9cb137ef83d623d0e4bf08b8adf69e9918ca904a174adb6d3d038b"
 dependencies = [
  "const-oid 0.10.2",
  "der 0.8.2",
- "spki 0.8.0",
+ "spki 0.8.1",
  "tls_codec",
 ]
 
@@ -8140,18 +8152,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.59"
+version = "0.8.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6df92bf3d9227be3d53173901ddbffac2babc27ae50f397776ffd6dc33f800cb"
+checksum = "879fb705ce98c32e41ebdb970fbe1204f8492423b314c6ab0354c3e7b5542866"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.59"
+version = "0.8.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac4f328cf2f05d084e496c3e9c3f33ed0a183656a16e1fcec4d464d8373aec82"
+checksum = "708882a28301d604fa039cc7727607a98d04c4b86dc76ec9cc683f805d709759"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -8181,9 +8193,9 @@ dependencies = [
 
 [[package]]
 name = "zeroize"
-version = "1.9.0"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879"
 dependencies = [
  "zeroize_derive",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 23fb1421..454388a4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rustchan"
-version = "1.6.6"
+version = "1.7.0"
 edition = "2021"
 # Rust 1.99 is the supported minimum for the package and build tooling.
 rust-version.workspace = true
@@ -53,7 +53,7 @@ captcha    = { version = "1.0.0", default-features = false }
 
 # Arti 0.47 permits rusqlite >=0.36,<0.41. Keep the latest application and
 # Tor directory-cache SQLite dependencies on the same bundled library.
-rusqlite    = { version = "0.40.2", features = ["bundled", "backup"] }
+rusqlite    = { version = "0.40.2", features = ["bundled", "backup", "hooks", "blob"] }
 r2d2        = "0.8.10"
 r2d2_sqlite = "0.35.0"
 time        = "0.3.55"
diff --git a/README.md b/README.md
index 72a42112..52ac3548 100644
--- a/README.md
+++ b/README.md
@@ -18,7 +18,7 @@ Conversations are organized into **boards** (topics such as photography or techn
 
 RustChan runs as a single app, with a built-in database. You do not need to set up a separate database server.
 
-**Source version:** v1.6.6. **Downloads:** [latest published release](https://github.com/csd113/RustChan/releases/latest). **Docker image:** `ghcr.io/csd113/rustchan:latest`.
+**Source version:** v1.7.0. **Downloads:** [latest published release](https://github.com/csd113/RustChan/releases/latest). **Docker image:** `ghcr.io/csd113/rustchan:latest`.
 
 ## Quick start
 
@@ -70,14 +70,14 @@ For **Docker Compose, updates, backups, or a public website**, follow the [conta
 
 Open the [latest release](https://github.com/csd113/RustChan/releases/latest), download the ZIP for your operating system, and extract it into a folder where the app can save files.
 
-ZIP names include the release version; the v1.6.6 names are shown below. Choose the matching files from the published release you download.
+ZIP names include the release version; the v1.7.0 names are shown below. Choose the matching files from the published release you download.
 
 | Your computer | Download |
 |---|---|
-| Linux, Intel or AMD 64-bit | `rustchan-cli-v1.6.6-linux-x86_64.zip` |
-| Linux, ARM64 | `rustchan-cli-v1.6.6-linux-arm64.zip` |
-| macOS, Apple silicon | `rustchan-cli-v1.6.6-macos-apple-silicon.zip` |
-| Windows, Intel or AMD 64-bit | `rustchan-cli-v1.6.6-windows-x86_64.zip` |
+| Linux, Intel or AMD 64-bit | `rustchan-cli-v1.7.0-linux-x86_64.zip` |
+| Linux, ARM64 | `rustchan-cli-v1.7.0-linux-arm64.zip` |
+| macOS, Apple silicon | `rustchan-cli-v1.7.0-macos-apple-silicon.zip` |
+| Windows, Intel or AMD 64-bit | `rustchan-cli-v1.7.0-windows-x86_64.zip` |
 
 From a terminal in the extracted folder, run:
 
diff --git a/SETUP.md b/SETUP.md
index 45015054..06baf820 100644
--- a/SETUP.md
+++ b/SETUP.md
@@ -2,7 +2,7 @@
 
 Current setup and deployment guide for Linux, macOS, and Windows.
 
-Current version: `1.6.6`.
+Current version: `1.7.0`.
 
 This guide reflects the current RustChan architecture:
 
@@ -723,3 +723,42 @@ resource limits and verification.
 ## Applying administrator configuration
 
 Live controls keep applying immediately. Other controls show their active, saved and next-start values. Saving never restarts RustChan; managed Linux and opted-in supervised containers expose **Restart RustChan** for pending settings. See [settings restarts](docs/settings-restarts.md) for the complete classification, supervisor setup, graceful shutdown and failure recovery.
+
+## Thread archives and retention
+
+Threads leave the active index when background maintenance finds more than the
+board's **Max threads** non-sticky active threads. It keeps the newest last-bump
+and thread-ID pairs; locked threads count, sticky active threads do not. New
+thread creation durably schedules maintenance, so overflow can be visible
+briefly. Startup and periodic reconciliation recover outstanding work.
+
+Replies bump until the board's bump limit is reached. Sage replies count toward
+that limit without bumping. The bump limit stops bumps; it does not immediately
+archive the thread. There is no time-based thread expiry.
+
+**Archive overflow threads** controls automatic archival, with the global
+`archive_before_prune` safety net (default `true`) also enabling it. Hard deletion
+of active overflow occurs only when both are off. Existing archives and their
+navigation remain available even when automatic archival is disabled.
+
+**Max archived threads** is a count cap (1–10,000), not permanent retention.
+Maintenance keeps the most recently bumped archived threads, breaking ties by
+ascending thread ID. Archived sticky threads are also subject to the cap;
+sticky is not an archive preservation setting. Lowering the cap permanently
+removes overflow threads. Invalid retention values are rejected rather than
+clamped; omitted retention fields preserve the saved limits.
+
+Archival keeps the same `/{board}/thread/{id}` URL and media references. Archived
+threads are read-only, including polls; users can browse their results, quoting,
+spoilers and attachments. Board search includes archived posts. Board index,
+catalog and unread history show active threads. Administrators can manually
+archive or delete a thread using the existing authenticated, CSRF-protected
+controls. There is no public unarchive/preservation control.
+
+The archive and prune transitions use one SQLite write transaction. Pruned
+media is removed only when no other database references remain, using durable,
+restart-replayable file cleanup. Failed filesystem cleanup stays queued and
+logged. Archive policy is read when maintenance executes, not from stale job
+payloads. Changing the global TOML/environment safety net requires restart;
+board settings are live. Monitor background-job failures if maintenance is
+unable to acquire the database lock or complete cleanup.
diff --git a/docs/post-actions-audit.md b/docs/post-actions-audit.md
new file mode 100644
index 00000000..50848615
--- /dev/null
+++ b/docs/post-actions-audit.md
@@ -0,0 +1,141 @@
+# Post and thread actions audit
+
+## Pipeline mapped before implementation
+
+| Entry point | Request and authorization | State and rendered outcome | Inverse/failure |
+| --- | --- | --- | --- |
+| Catalog three-dot menu | Delegated `main.js` disclosure; native POST forms; no-JS `<details>` fallback | Server supplies report OP ID, thread ID, board, CSRF, personal pin/hide labels | Outside click/Escape close; vertical positioning only; no keyboard arrow navigation |
+| Report thread / post | `POST /report`; CSRF, board-view password, ban check, post-to-board and post-to-thread checks | `db::file_report` derives target metadata from posts; unique open report per post/reporter; moderator reports table escapes text; redirect to target thread | Resolution is admin-only; target deletion cascades reports; duplicate inserts succeed without distinction in confirmation |
+| Personal Pin / Unpin | `POST /{board}/thread-preference`; CSRF, board-view access, matching active thread | `user_thread_preferences.pinned`; catalog sorts personal pins, then sticky, then bump | Explicit setters; zero/default rows removed; no effect on global sticky flag or other visitors |
+| Personal Hide / Unhide | Same preference route and access checks | `user_thread_preferences.hidden`; active catalog split; `/{board}/hidden` restores threads | Reload persists through server DB; only catalog consumes preferences; no reply-hide feature |
+| Global Sticky / Unsticky | Native `POST /admin/thread/action`; session-scoped CSRF plus trusted origin; admin session checked inside immediate transaction | `threads.sticky`; board/catalog active listing orders sticky, bump, ID; state and mod log commit together | Explicit idempotent setters; unsticky schedules retention; archive ordering deliberately ignores sticky |
+| Lock / Unlock / Archive | Same admin route and transaction | Canonical thread flags; archive also locks; prune intent persisted | No moderator board scopes exist: admin accounts have instance-wide moderation rights |
+| Edit / Delete / Ban+delete | Existing post controls, separate native POST paths with own ownership/admin checks and confirmation | Not currently inside catalog overflow; existing routes and hooks must remain | Existing self-action expiry and moderation tests cover them; no new destructive menu actions needed |
+
+Personal preference identity reuses the existing IP/Tor identity hash. Loopback/unknown peers use the visitor cookie. It is independent of administrator account identity and deliberately remains so. Cookie clearing on public-IP identities does not erase database preferences. Foreign keys cascade preferences when their target thread is deleted; valid preferences need no time-based eviction. Boolean domain triggers reject malformed stored flags.
+
+## Verified problems and implementation scope
+
+- Catalog and hidden management fetch only the first 200 active threads before filtering/sorting, making older hidden/pinned preferences inaccessible.
+- Board index ignores personal preferences, including its pagination and counts. Its summary fragment also leaves the thread container open, allowing later summaries/action wrappers to become nested; the missing closing tag is now fixed.
+- Preference access/target checks and writes are separate autocommit operations, allowing archive/delete races.
+- Form boards are lossily sanitized rather than rejected; actions use loose normalized strings.
+- Popup positioning has no horizontal clamp, remains inside clipping ancestors, and does layout work on every scroll event. Closing scans every menu.
+- A popup has no arrow/Home/End navigation and may remain open after focus moves away or history restores it.
+- Report uses lossy board sanitation and silently treats duplicate submissions as newly filed. Report POSTs have no dedicated abuse limit when browsing-only limiting is enabled.
+- Catalog ETags omit lock/media/reply metadata and hidden-management responses lack explicit personalized cache headers.
+- Admin thread moderation ignores submitted board for target validation, logs forged board text for most actions, and performs a second redirect lookup after committing.
+
+The user confirmed preserving personal Pin/Unpin and auditing global Sticky separately. Hide remains personal listing visibility; explicit thread/search/archive navigation remains available. No individual reply hiding, account preferences, thread move operation, SPA, third-party popup package, or schema redesign is introduced.
+
+
+
+## 1–2. Menu findings and polish
+
+The original menu could clip inside a card or transformed ancestor, overflow a narrow viewport horizontally, detach after layout changes, and retain stale open state through focus changes or history. It also scanned every menu when closing or repositioning. The controller now tracks one open menu, temporarily moves it to the document body, measures its width in viewport space, clamps both axes to the visual viewport, flips above when appropriate, and limits scrolling only when space requires it. Scroll/resize work is coalesced through one animation frame; one shared resize observer runs only while a menu is open to follow header, text-size, media, and page-layout changes. Closing restores its original DOM position and clears transient state.
+
+The trigger remains a click/tap disclosure. Minimum popup width remains 150px, ordinary rows retain 6px/8px padding, and touch rows retain 38px minimum height with 9px/10px padding. Border, background, radius, hover, active, focus, and open states use existing theme tokens. The trigger stays visible when keyboard focus moves into the portaled menu. A scoped text rule prevents generic theme button styling from dimming menu labels; translucent panel tokens are painted over an opaque theme base so underlying card text/media cannot show through. Index and thread pages now reuse the catalog's actions and authoritative labels. Existing per-post report/edit/delete controls and native fallback forms remain.
+
+## 3–4. Hide architecture and fixes
+
+Hide is a personal **thread listing preference**, stored in SQLite, not moderation and not localStorage. It hides the OP and its reply previews together from active board index and catalog. Direct thread links, explicit search, archives, feeds, and read-only API navigation remain available. No per-reply hiding or thread moving subsystem exists.
+
+The previous 200-thread cutoff and filtering after fetching caused inaccessible older preferences and inconsistent counts. Both active listings now filter hidden threads in SQL before pagination and aggregate only selected threads. The index count uses the same renderable-OP filter. Catalog and Hidden management read all applicable active threads. Hiding several threads, new replies, pin/sticky/lock changes, reloads, and multiple tabs remain consistent. A direct hidden thread explains the listing preference and offers Unhide. Archived threads retain valid preferences and permit clearing them from their direct page; new Pin/Hide actions are disabled and rejected. Deleting a target cascades preferences. Clearing both flags removes the default row. Existing Boolean-domain triggers remain the malformed-state boundary.
+
+## 5–6. Personal pin and moderator Sticky
+
+The user explicitly confirmed preserving personal Pin/Unpin. These actions update `user_thread_preferences.pinned` for the viewer; they never change `threads.sticky` or another viewer's preferences. Anonymous visitors can use personal pinning after normal CSRF, board-view, and target validation.
+
+Moderator-wide Sticky/Unsticky remains a separate admin operation backed by the canonical `threads.sticky` field. There are no ordinary registered-user accounts or scoped moderator roles; all administrator accounts have instance-wide moderation rights. Anonymous/non-admin requests cannot perform global moderation. Existing POST-only routes and session-scoped admin CSRF remain enforced.
+
+Active index and catalog default order is **personal pin descending, global sticky descending, bump time descending, thread ID descending**. The filter/order occurs before LIMIT/OFFSET, avoiding repeated pins across pages. Catalog alternative sorts retain pin/sticky precedence and now use thread ID as a deterministic final tie breaker. Unpin returns a thread to its global sticky/bump position. Archive order remains the existing bump-descending/ID-ascending rule; search, feeds, and APIs retain their established non-personal semantics.
+
+## 7. Report findings and improvements
+
+Report targets are validated as a complete board/thread/post tuple; stored report metadata and redirect IDs come from the actual post. Thread actions submit the OP ID, which can differ from the thread ID, and reply controls submit the reply ID. Anonymous reporting remains supported; board-view restrictions and bans still apply.
+
+Reasons remain optional, trim whitespace, and retain the existing 256-Unicode-character truncation behavior. Controls are rejected; native form parsing and a 65,536-byte route limit bound request decoding. Moderator rendering escapes reasons, including script-like text and non-Latin input. Open duplicates remain idempotent, with a distinct “matching report is already open” confirmation instead of claiming a new report. Resolution remains admin-only and permits a later new report; target deletion cascades report rows.
+
+A dedicated budget permits 20 new reports per reporter in a rolling hour, independently of browsing rate-limit settings. Budget checking and insertion share an immediate transaction; an existing duplicate is accepted without consuming another slot. Exceeding the budget returns a themed 429 and `Retry-After: 3600`. The existing reporter identity/retention model is preserved.
+
+## 8. Authorization and security
+
+Found a menu-action CSRF gap: the general public validator accepted a correctly signed token generated for a different visitor. Report and preference requests now require cookie binding when a CSRF cookie exists and reject cross-site fetch metadata and mismatched Origin/Referer. Cookie-disabled forms require same-origin evidence. The site's HTML no-referrer policy can make legitimate native POSTs send `Origin: null`; those are accepted only with a bound cookie or same-origin fetch metadata, after rejecting cross-site metadata. Regression tests exercise foreign-token relay, explicit foreign origin, missing evidence, privacy forms, raw CSRF, and admin scope separation.
+
+Boards are validated completely rather than lossily sanitized; preference actions use a closed enum; IDs must be positive. Protected-board checks and target checks occur under the same write transaction as mutations. Global moderation validates submitted board against the canonical target board before changing anything, logging, or redirecting. A missing/broken board lookup now fails closed rather than committing with a fallback board. Return paths use the existing strict internal-path validator. No menu visibility assumption is an authorization boundary.
+
+## 9. Database, queries, and cache
+
+No dependency or preference-schema redesign was needed. Existing preference composite keys, thread/OP indexes, cascade foreign keys, and Boolean-domain triggers remain. Added `idx_reports_reporter_created(reporter_hash, created_at)` through the existing idempotent startup schema initialization, including existing databases.
+
+An actual browser database's EXPLAIN QUERY PLAN shows active thread/OP indexes and the composite preference key, rather than per-thread preference queries. Personal ordering needs a temporary sort over the board's active rows; adding another global thread index cannot eliminate ordering by a different viewer's preference. The report budget uses its new covering index. Foreign-key checking returned no violations. Evidence is in `output/post-actions-query-plans.log`.
+
+Index, catalog, and thread ETags now include personal flags and relevant authoritative metadata; catalog signatures include lock, OP content/media, reply counts, and timestamps. Personalized HTML is explicitly private, with revalidation when activity tracking is disabled and no-store when enabled. Hidden management is private/no-store and varies on Cookie. There is no separate action-state cache or optimistic client state requiring rollback.
+
+## 10. Concurrency, consistency, and failures
+
+Preference validation, flag updates, and default-row cleanup commit together in an immediate transaction. Reports serialize validation, the abuse budget, and insertion. Global moderation keeps target validation, state, pruning intent where applicable, and canonical audit logging in one immediate transaction, then redirects using the board already resolved inside it.
+
+Board/thread render loads use read snapshots so counts, posts, flags, and preferences agree; catalog/Hidden reads also recheck board access in their snapshots. Simultaneous pin/hide preserves both flags; concurrent duplicate reports yield one row; deletion races leave no preference/report references. Concurrent Sticky/Unsticky matches the last committed audit record. Repeated inverse/set operations remain idempotent. Archive rejects new personal flags and contradictory lock/unlock/sticky changes while permitting inverse cleanup.
+
+Failures return existing themed 400/403/404/409/500 responses or the explicit report-budget 429. Native forms navigate to authoritative results; no optimistic disappearance or false success state is introduced. Existing DB contention/error logging, session expiry, post ownership, destructive confirmation, and durable file cleanup mechanisms remain in place.
+
+## 11. Accessibility
+
+Triggers retain “Thread actions” accessible names and add a menu relationship, expanded state, and controlled ID. Action items have menu semantics. Arrow keys, Home, and End move through enabled actions; Escape closes and restores focus; Tab closes and follows native focus order; outside focus/click closes. Report opening records the original trigger and its existing dialog returns focus there. Disabled archived actions are skipped. One-open behavior and pagehide/pageshow cleanup prevent stale disclosures. Native no-JS details/forms, keyboard submission, and existing report controls remain usable.
+
+## 12. Themes and responsive/browser findings
+
+All nine built-in themes are exercised: forest, blue-sky, deep-orbit, terminal, dorfic, chanclassic, aero, neoncubicle, and fluorogrid. Menu, report input/confirmation, and hidden-management action contrast checks require at least 4.5:1. Screenshots cover 320px and 1280px in every theme; viewport geometry covers 320, 360, 375, 390, 430, 480, 768, 1280, and 1920px, all four edges, clipping ancestors, attached media, short/long content, keyboard interactions, history, and enlarged text. Additional tests use a 900×900 image, 60 replies, first/middle/final post report targets, nested scrolling, actual thread-update insertion, removed triggers, and reduced-motion emulation. The enlarged-text checks caught and fixed initial measurement and late header-layout movement.
+
+The project's Chromium, WebKit, Firefox, mobile Firefox, mobile WebKit, Firefox no-JS, and Chromium no-JS configurations exercise native persistence/report/moderation paths, including Hide from index/catalog/thread, Back/Forward after Hide, and admin toolbar Sticky/Unsticky. JS-only geometry tests skip the two no-JS configurations intentionally; native workflows run there. Enlarged-text tests check both an already-open menu following a growing fixed header and reopening after layout settles; a Firefox repeat run passed three times. A mobile WebKit geometry/history repeat run also passed three times. Browser checks wait for the existing activity-page refresh after history restoration, then verify the authoritative state on the listing, direct thread, or Hidden management page actually restored by the browser. Screenshots and browser diagnostics are kept under ignored `output/playwright/` directories.
+
+## 13. Tests and technical debt
+
+Added Rust HTTP/database regressions in `src/handlers/board/action_tests.rs` for explicit setters, isolation, forged boards/IDs/actions/CSRF, protected boards, GET rejection, 205-thread ordering/pagination, multiple hidden targets and new replies, direct navigation, archive cleanup, constraints/cascades, duplicate and concurrent reports, Unicode bounds, oversized bodies, report budgets, token binding, and deletion races. Added admin regressions for canonical logging, repeated and concurrent Sticky/Unsticky, forged board/session/CSRF, archive safety, missing targets, and lookup rollback. Existing cache/report tests were updated to the new contracts, and a summary-fragment regression checks balanced containers. Browser tests require exactly one action owner per index thread.
+
+Added the local `tests/e2e/post-actions.spec.ts` and adapted existing local action tests for portaled menu lookup and menuitem semantics. This repository intentionally ignores Playwright tooling; those files remain local and are not force-added. Removed the verified-unused Rust catalog split/sort helper, old menu bounds helper, and all-menu closing/reposition scans. No unrelated cleanup, commits, branches, or dependency changes were made.
+
+## 14. Validation results
+
+| Command | Final result |
+| --- | --- |
+| `cargo fmt --all --check` | Passed |
+| `cargo check --workspace --all-targets --all-features` | Passed |
+| `cargo clippy --workspace --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic -D clippy::nursery -D clippy::cargo` | Passed, no lint exceptions added |
+| `RUST_TEST_THREADS=1 cargo test --workspace --all-features` | Passed: 1,395 tests in each library/binary target, 5 CLI integration tests, 1 fixture integration test, and 1 doc test; 7 existing ignores in each unit-test target |
+| `cargo test --workspace --all-features action_tests` | 10 passed in each unit-test target |
+| `cargo test --workspace --all-features server::handlers::admin::content::tests` | 15 passed in each unit-test target |
+| `cargo test --workspace --all-features server::server::assets::tests` | 4 passed in each unit-test target after the final CSS change |
+| `cargo build --workspace --all-features` | Passed |
+| Playwright action matrix described below | Passed: 43 cases, 20 intentional configuration skips; 7 browser configurations and all 9 built-in themes |
+| `git diff --check` | Passed |
+| `node --check static/main.js` | Passed |
+| `python3 tools/check_local_tooling.py` | Passed; local browser tooling remains untracked |
+
+Browser command: `RUSTCHAN_E2E_SKIP_BUILD=1 RUSTCHAN_AUDIT_OUTPUT=output/playwright/post-actions-verified npx playwright test tests/e2e/post-actions.spec.ts tests/e2e/audit-surfaces.spec.ts tests/e2e/audit-nojs-parity.spec.ts --grep 'personal pin/hide|menus follow|menu supports|all built-in themes|catalog.*(report|pin|hide)|public report|poll creation' --workers=2`.
+
+The 20 browser skips comprise 12 existing no-JS-parity test gates on other JavaScript projects, 6 JavaScript-only geometry/theme cases on the two no-JS projects, and 2 existing surface-test gates on Chromium no-JS. The new native persistence/report/moderation workflow passes in all seven configurations, including both no-JS projects.
+
+Rust logs are under `output/post-actions-*.log`; the complete serial run is `output/post-actions-tests-serial.log`. Browser results, screenshots, and HTML report are under `output/playwright/post-actions-verified/`, with the command log at `output/post-actions-browser-verified.log`. The earlier default parallel runs exposed the pre-existing shared media fault-injection race noted below; a full earlier parallel pass and isolated PDF test also passed. The final serial command runs every non-ignored test without skipping that test, and concurrency regressions still explicitly issue concurrent operations within their test bodies.
+
+## 15. Deliberately preserved boundaries and remaining limits
+
+- Personal preferences retain the existing IP/Tor identity model. Public users sharing an identity/IP can share preferences and a report budget; clearing public-IP browser cookies does not clear SQLite state. Migrating to account/browser-only identity would be a separate product change.
+- Hide remains an active-listing preference. It does not censor direct links, search, archives, feeds, API access, individual replies, or moderation records. Valid archived preferences are retained and can be cleared explicitly.
+- Report reason truncation remains compatible with existing behavior. The abuse budget counts retained report rows; resolution still counts for the hour, while deletion of target/report records can release that count. No extra historical identity ledger was introduced.
+- Existing non-menu posting/voting CSRF compatibility, account/session architecture, self-action expiration, and file cleanup were not redesigned. Menu-triggered report/preference paths are hardened and privileged actions continue using session-scoped protection.
+- Browser tests cover the project's desktop/mobile emulation and enlarged text. Physical device pinch-zoom, assistive-technology speech output, and transport outage injection were not manually exercised. Native POST errors and keyboard/focus semantics are covered.
+- Seven pre-existing Rust tests are ignored by the repository; no ignore/lint bypass was added for this work. The default parallel runner can expose an existing shared thumbnail-fault-injection race in `primary_upload_accepts_pdf_when_board_enables_pdf`; the isolated test passes. The final complete suite is also run with `RUST_TEST_THREADS=1` to avoid that unrelated fixture race without changing media code.
+
+## Files changed
+
+| Area | Files |
+| --- | --- |
+| Database | `src/db/schema.rs`, `src/db/threads.rs` |
+| Personal actions/reporting | `src/handlers/board.rs`, `src/handlers/board/access_preferences.rs`, `src/handlers/board/catalog.rs`, `src/handlers/board/pages.rs`, `src/handlers/board/create_thread.rs`, `src/handlers/board/reports.rs` |
+| Rendering and moderation | `src/handlers/render.rs`, `src/handlers/thread.rs`, `src/handlers/admin/content.rs` |
+| Templates and assets | `src/templates/board.rs`, `src/templates/thread.rs`, `static/main.js`, `static/style.css` |
+| Rust regressions | `src/handlers/board/action_tests.rs`, `src/handlers/board/tests.rs`, `src/server/server/assets.rs` |
+| Audit | `docs/post-actions-audit.md` |
+| Local ignored browser files | `tests/e2e/post-actions.spec.ts`, `tests/e2e/audit-surfaces.spec.ts`, `tests/e2e/audit-nojs-parity.spec.ts` |
diff --git a/docs/posting-lifecycle-audit.md b/docs/posting-lifecycle-audit.md
new file mode 100644
index 00000000..9f3fd45b
--- /dev/null
+++ b/docs/posting-lifecycle-audit.md
@@ -0,0 +1,418 @@
+# Posting and thread lifecycle audit
+
+Audit date: 2026-10-06. Scope: public creation/replies, owner mutations,
+moderation, quoting, ordering, retention, retry behavior, SQL/filesystem recovery,
+and browser workflows. No dependencies, commits, branches, or broad redesign were
+introduced. The starting checkout was clean.
+
+## 1. Existing architecture
+
+`POST /{board}` and `POST /{board}/thread/{id}` share the bounded multipart parser
+in `handlers/mod.rs` and the posting service in `handlers/posting.rs`. The parser
+validates CSRF, UTF-8, control/upload multiplicity and byte budgets, and owns
+temporary uploads. The posting service checks identity, bans, access, cooldown,
+CAPTCHA, text/poll rules and media policy. Expensive preparation releases its
+pooled connection. A policy callback rechecks mutable settings after acquiring
+SQLite's writer lock.
+
+`db/threads.rs` creates the thread/OP or reply in an immediate transaction. This
+bundle includes the submission receipt, counters/bump, optional poll, filesystem
+publication intent, required media work and, for new threads, durable coalesced
+retention work. Search updates use database triggers. Thread/post IDs are distinct
+global AUTOINCREMENT identifiers; an OP post ID must not be assumed to equal its
+thread ID. Replies display their post IDs rather than a separate reply sequence.
+
+Owner edit/delete routes check signed ownership grants and time windows.
+Administrator routes check session, origin and scoped CSRF. Deletions commit
+durable cleanup intents; filesystem operations happen after SQL commit and
+recheck shared-file references. Retention workers read current board settings
+under their own immediate transaction. Startup and periodic reconciliation
+recover outstanding work.
+
+Server-rendered and upload-enhanced forms share this backend. Native success is
+303 followed by GET; upload XHR success is 204 with `X-Rustchan-Redirect`. Handled
+XHR posting rejections intentionally use transport 200 with JSON `error` and
+`X-Rustchan-Error-Status`; the browser renders an error and does not navigate as
+if accepted. Some earlier validation paths return an ordinary error status.
+HTML cache signatures include posts, counts, state, media and poll changes;
+cookie-sensitive views use the existing Vary/private-cache rules.
+
+## 2. State model
+
+| Current state | Public reply | Owner edit/delete | Administrator / retention behavior |
+| --- | --- | --- | --- |
+| Active, unlocked | Allowed after current policy checks | Allowed within ownership/window rules; OP self-delete requires no replies | Lock, sticky, archive or delete |
+| Active, locked | Rejected, including sage and media-only replies | Rejected | Unlock, archive or delete; participates in active retention |
+| Active, sticky | Same as its lock state | Same as its lock state | Exempt from active thread cap; global sticky differs from personal pin |
+| Archived | Rejected independently of the lock flag | Rejected | Readable at the same URL; deletion/archive retention allowed |
+| Deleted / destructively pruned | Missing target; rejected | Missing target | Cascaded content removed; audit history and bounded retry evidence retained |
+
+Sticky and locked can coexist. Archiving normally sets both archived and locked;
+the internal unlock helper cannot make an archived thread publicly replyable.
+There is no public move or unarchive posting workflow. Personal pin/hide state
+affects presentation, not posting authorization or global retention protection.
+
+## 3. Enforced invariants
+
+- A committed creation includes one thread and one matching OP. Every reply has
+  an existing parent and matching board; foreign keys and domain triggers protect
+  ownership, and the reply API now explicitly rejects the OP flag.
+- Current parent state and mutable posting policy are checked under the same
+  SQLite write lock as insertion. Closed/missing targets cannot be bypassed by a
+  stale form or crafted request.
+- A successful receipt names one canonical operation and target. Reuse for
+  another board, actor, operation or reply target cannot create content.
+- SQL failure, including commit failure, rolls back posts, counters, bump,
+  receipts, required jobs and filesystem intents and releases the transaction.
+- Successful SQL commit is not subsequently reported as failed because auxiliary
+  spam scheduling or a redundant post read fails.
+- Stored reply counts equal persisted non-OP rows; listing media counts equal
+  their established primary-file count. Sage increments counters without bumping.
+- Deletion preserves intentionally retained audit history and prevents an old
+  accepted token from resurrecting content during receipt retention.
+- SQL and filesystem publication are not a shared transaction: durable intents
+  make publication/deletion recoverable, and media workers wait for publication.
+
+These guarantees concern authorized application operations with SQLite foreign
+keys/triggers enabled. They do not promise survival of arbitrary external database
+corruption, deleted backups, or irrecoverable storage loss.
+
+## 4. Bugs found and repaired
+
+| Finding | Repair |
+| --- | --- |
+| Cascading content deletion erased the only submission receipt, permitting the same new-thread token to create replacement content. | Historical receipt table and BEFORE DELETE triggers on posts, threads and boards. Parent triggers handle cascade ordering. |
+| A successful reply retry was rejected after lock/archive before receipt lookup. | Replay lookup precedes early parent-state validation; new submissions still use the authoritative transactional check. |
+| Receipts were not bound to operation/target; wrong-scope token collisions became database errors. | Explicit operation/target validation and typed 409 conflicts for scope reuse. |
+| A thread removed during preparation became an internal error at insertion. | Missing parent produces typed 404 and staged-media rollback. |
+| Required deferred media jobs and state were recorded after posting commit. | Persist media intent and processing state in the creation transaction. |
+| Workers could claim a media job before its staged source was published. | Claim query excludes media sources still named by upload-finalize intents. |
+| Auxiliary scheduling and a post-commit read could turn accepted posting into apparent failure. | Capture creation time before commit; warn on auxiliary scheduling/notification failures. |
+| Ban-and-delete trusted submitted identity and OP/board classification; ban, deletion and audit records could partially succeed. | Resolve and validate the stored target, then commit authorization, ban, deletion and both audit entries together. |
+| Administrator deletion could succeed without an audit record or after stale authorization. | One immediate transaction covers session, target, deletion and audit. |
+| Owner action board permissions/settings could change between preparation and mutation. | Recheck permission and edit preparation policy inside the mutation transaction. |
+| Repeated scalar multipart controls used last-value-wins behavior. | Reject repeated scalar controls; retain intentional repeated poll options and established upload-slot rules. |
+| Quotes linked overflowing/nonpositive/Unicode or embedded malformed IDs. | Require positive ASCII i64 IDs, canonical targets, valid boundaries and valid board syntax; invalid references remain escaped text. |
+
+## 5. Race conditions
+
+Write transactions define the winner: if a reply commits before a lock/delete/
+prune transaction, the later action operates on that committed state; if the
+state transition commits first, insertion sees the closed or missing parent and
+rejects. Deletion may legitimately remove an earlier successful reply. A retry
+after that deletion reports the missing canonical target without creating another
+post. Moderation authorization and audit failure now share this serialization.
+
+Preparation races with board access, media settings, CAPTCHA policy, filters,
+cooldown, bans and session loss are covered by policy revalidation. Concurrent
+identical submissions serialize receipt lookup and insertion under the writer
+lock. Losing prepared uploads are cleaned rather than published twice.
+
+## 6. Transaction-boundary changes
+
+Required audio/video job JSON, media state and response creation time moved into
+the post transaction. Administrator delete and inline ban/delete now use RAII
+immediate transactions for all required SQL work. Owner actions gained a narrow
+validation callback invoked inside their existing immediate transaction. Existing
+atomic reply counter/bump, OP/poll, FTS and durable pruning boundaries remain.
+Filesystem finalization and expensive media/body preparation stay outside the
+SQL write transaction.
+
+## 7. Thread creation
+
+Existing empty/media, board-access, size, poll and CSRF checks remain authoritative.
+No image-required board rule or separate disabled-board flag exists; password
+access and configured media permissions determine availability. Creation now
+also atomically records required media work and safely handles deleted receipts
+and wrong-operation reuse. Failed media scheduling and deferred commit failure
+leave zero new threads/posts/receipts. Prune intent remains a required part of
+public creation, so scheduling failure cannot leave permanent unhandled overflow.
+
+## 8. Replies
+
+Current board/thread ownership, lock, archive, cooldown and access are enforced
+at insertion. Missing targets now return a normal recoverable 404. A reply cannot
+be inserted with `is_op=true`. Successful retries return the original post anchor
+even if the thread later closes; deleted-target retries cannot recreate a row.
+Creation timestamps needed for ownership cookies come from the transaction.
+
+## 9. Bump and sage
+
+Existing semantics were preserved. Normal replies bump only when the current
+pre-insertion reply count is below `boards.bump_limit`; sage replies never bump.
+The checkbox accepts `1`, case-insensitive `on`, or case-insensitive `true`, not
+arbitrary name/email text. Media-only replies follow the same rule. Deletion
+reduces reply count without rewinding bump time; it can make later replies
+eligible to bump again under the established count rule. Edits and moderation
+state changes do not bump. Active ordering is sticky, bump time, ID descending;
+archive order is bump descending, ID ascending. Existing tie/pagination and
+concurrent bump-limit tests remain in the full suite.
+
+## 10. Quotes
+
+`>>id` remains a local fragment. `>>>/board/id` resolves through that board's post
+redirect and supports explicit same-board cross-thread and cross-board links;
+`>>>/board/` links its index. Search rendering scopes otherwise local links.
+Parsing now rejects invalid numeric ranges, Unicode numerals, negative/zero IDs,
+oversized board names and quote-like embedded suffixes. Leading zeros resolve to
+the canonical ID. No eager quote-target database lookup was added: missing or
+deleted targets cannot make submission fail, and protected resolver/preview
+routes retain access checks. Existing HTML escaping remains intact. Backlinks
+are derived in the browser and deduplicated/rebuilt after updates, not stored
+foreign-key records. Browser coverage checks repeated quotes, OP quoting,
+crosslink routing, malformed references, escaping and reload behavior.
+
+## 11. Lock and unlock
+
+Fresh locked replies are rejected regardless of UI, sage or attachment. Current
+state is checked again after preparation under the write lock. Unlock permits a
+previously rejected token to be retried because rejection did not consume it.
+An already accepted token is replayed rather than rejected after locking. Archive
+is checked independently, so clearing only `locked` cannot reopen an archive.
+The existing HTTP retry suite exercises lock/reject/unlock/corrected retry.
+
+## 12. Deletion
+
+Administrator and inline ban/delete actions use the actual database post, board,
+thread, OP flag and posting identity. Forged details are rejected before mutation.
+Audit insertion failure rolls back bans and content deletion. Owner actions
+retain token/window/closed-thread/OP-with-replies restrictions and now recheck
+current board permission. Database cascades remove posts, reports, polls/votes,
+personal thread preferences and live receipts; FTS triggers remove search rows.
+Moderation history remains. Shared media cleanup keeps the durable, reference-
+checked deletion pipeline. Historical receipts intentionally have no content
+foreign keys. Existing redirect routes and ban/delete reply anchors are preserved.
+
+## 13. Pruning
+
+Active `max_threads` applies to non-sticky, non-archived threads. Locked active
+threads count; sticky active threads are exempt. Overflow chooses the oldest
+bump/ID according to deterministic active ordering. Current archive policy
+selects archive versus destructive prune. `max_archived_threads` is a count cap
+and includes archived sticky threads. Both limits are validated before destructive
+maintenance. Archive retention follows archive ordering. Creation commits a
+coalesced durable job; workers/startup reconciliation converge to current caps.
+Temporary overflow during deferred maintenance is an existing deliberate behavior.
+Tests race 25 creators at cap one, verify one pending intent, then verify exact
+retention convergence; existing worker tests exercise real automatic maintenance.
+
+## 14. Limits and boundaries
+
+Body limits count Rust Unicode scalar values, not bytes or grapheme clusters:
+4096 characters; empty text requires an accepted attachment. Names are trimmed
+and truncated to 64 characters, subjects to 128. The multipart parser additionally
+limits text fields to 64 KiB, controls to 64, total payload to 512 MiB plus bounded
+framing, and validates board/global per-type upload limits. Submission tokens
+are bounded to 128 ASCII alphanumeric/underscore/hyphen characters. Existing
+boundary/UTF-8/media tests cover rejection and cleanup. Thread cap/tie tests and
+concurrent bump-limit tests verify the supported count boundaries.
+
+There is no configured hard reply cap or image-count cap in this version.
+`bump_limit` stops bumps, not replies; inventing a new 500-reply limit would change
+the product. Upload byte caps and thread/archive caps remain the applicable limits.
+
+## 15. Duplicate protection
+
+Opaque form tokens are bound to actor, board, operation and reply target.
+SQLite serializes duplicate lookup/create; no body-text deduplication was added.
+Deleted receipts retain accepted IDs for the existing seven-day receipt horizon,
+with indexed expiry cleanup on new receipt insertion. Live receipts have the
+same opportunistic expiry model. A deleted canonical target returns 404. Failed
+validation/commit leaves the token reusable for a corrected submission. Native
+PRG, XHR redirects and existing busy-button guards remain. Distinct tokens still
+allow intentionally identical content. Legacy empty-token clients remain supported
+without an idempotency guarantee.
+
+## 16. Stale forms
+
+The database wins over embedded browser state. Lock, archive, delete, changed
+board access/media/filter/CAPTCHA policy, bans, cooldown and revoked admin bypass
+are evaluated again before insertion. Owner actions recheck board permission at
+mutation. Native error recovery supplies escaped copyable drafts; XHR preserves
+the current form and renders a rejection. File selections must be made again
+after native navigation. Real browser tests submit attachment-backed forms after
+lock/archive/delete and assert saved text and zero inserted rows/filesystem intents.
+
+## 17. Counters
+
+`threads.reply_count` is stored and changes with transactional reply insert/delete.
+Board thread counts and listing `image_count` are computed. The latter is the
+legacy count of non-NULL primary `file_path`, including video/PDF/general files;
+secondary/audio-only slots do not all represent an additional image. This naming
+and display behavior were deliberately retained. New invariant checks compare
+stored reply counts to COUNT(non-OP), listing media counts to COUNT(primary file),
+and verify one OP, board ownership, foreign keys and transaction release after
+every operation. Bursts mix text and image rows and preserve sage ordering.
+
+## 18. SQLite, recovery and performance
+
+Production/test pools use file-backed WAL, foreign keys, synchronous FULL, a
+one-second busy timeout and bounded pool checkout. Immediate posting/mutation
+transactions avoid deferred write-lock upgrades. Busy errors remain retryable
+503 with `Retry-After: 1` on the native error path; XHR exposes 503 through its
+handled-error contract. A new contention test holds the writer, checks zero
+partial writes and then successfully retries the same token. Deferred-FK commit
+failure tests verify rollback and subsequent reuse. Existing archive tests cover
+process interruption, restart, overlapping workers and maintenance commit failure.
+
+EXPLAIN QUERY PLAN on an installed current test database showed primary-key index
+searches in both receipt UNION branches, the covering `idx_threads_active_order`
+for active ordering, and `idx_submission_tombstones_created` for expiry. No eager
+quote-resolution N+1 queries or application-wide posting mutex were introduced.
+The final review found full receipt scans for board/thread/post deletion. Three
+target indexes now support the preservation triggers and foreign-key cascades;
+the upgrade test also reconstructs their absence in the previous schema. Final
+plans show `SEARCH ... USING INDEX idx_post_submissions_board/thread/post` for
+all three target lookups, replacing the observed full-table scans.
+The media claim guard scans outstanding publication intents, which are normally
+short-lived; persistent storage trouble can delay jobs until reconciliation.
+The exact additive schema repair recognizes only the new receipt objects; its
+upgrade regression preserves existing live tokens and subsequent deleted history.
+
+## 19. Security and resource checks
+
+CSRF, scoped admin CSRF/origin, board password grants, signed ownership cookies,
+parameterized SQL and current-state checks remain the boundaries. Repeated scalar
+controls and malformed tokens now fail closed. Inline bans cannot select a
+different actor via hidden fields or turn a reply into OP deletion. Quotes accept
+validated IDs after escaping; malformed input stays text. Existing bounded
+multipart/framing/field parsing, UTF-8 rejection, media sniffing, canonical path
+validation, upload admission, timeouts, cooldown, CAPTCHA and filesystem reference
+checks were reviewed and retained. No new aggressive rate limit was added.
+HTTP framing is handled by the existing Axum/HTTP stack and deployment proxy;
+this pass does not claim a separate proxy request-smuggling penetration test.
+
+## 20. UX and compatibility
+
+Deleted-during-preparation requests now receive a clear missing-target error.
+Receipt reuse gives an actionable reload conflict. Accepted posts retain success
+when auxiliary background work fails. Existing inline/generic draft recovery,
+upload progress, double-submit controls, keyboard/modal behavior, mobile layout,
+form field names, element IDs, routes, CSS/JS hooks and no-JS fallbacks are retained.
+Browser validation caught and corrected a temporary ban/delete anchor regression.
+No broad visual redesign was made. XHR's established handled-error transport
+contract is tested explicitly, rather than mistaking transport 200 for acceptance.
+
+## 21. Added and expanded regression coverage
+
+New tracked suites: `src/db/threads/lifecycle_tests.rs` (10 tests) and
+`src/handlers/posting/lifecycle_tests.rs` (5 tests). Additional regressions cover
+schema upgrade, repeated scalar multipart controls, malformed quote grammar,
+moderation audit rollback and forged inline-ban targets. An old deletion fallback
+test now verifies fail-closed preservation when board lookup breaks. Obsolete
+best-effort deletion board fallback helpers/tests were removed.
+
+The existing local Playwright harness was expanded with
+`tests/e2e/posting-lifecycle.spec.ts` (three workflows) and strengthened forged-board
+archive assertions. Browser tooling is intentionally ignored and prohibited from
+tracking by `tools/check_local_tooling.py`; it was not force-added. Tracked Rust
+regressions remain available to CI. Existing posting, database, media, deletion,
+archive, authorization, FTS and cache tests also run in the complete Rust suite.
+
+## 22. Concurrency scenarios exercised
+
+- Barrier-synchronized mixed text/image sage bursts of 2, 5, 10, 25 and 64 clients:
+  every accepted ID unique, exact reply/media counts, no bump, valid parent rows.
+- Twenty-five simultaneous thread creations at cap one: durable coalesced work,
+  deterministic newest survivor after pruning, no permanent unmanaged overflow.
+- Reply against lock, archive, deletion and pruning: eight repetitions per state
+  with a barrier; only committed-before-transition or typed rejection outcomes.
+- Three fresh HTTP runtimes: eight identical thread submissions, eight identical
+  replies, eight distinct thread submissions and eight distinct replies per run;
+  exact canonical redirects, row counts and receipt counts.
+- Existing service races include cooldown contention and concurrent identical
+  uploads; existing DB races cover bump limits, moderation/archive and overlapping
+  retention workers. Preparation callbacks force stale policy/session/parent
+  windows without timing-only sleeps.
+- A fixed-seed 160-operation sequence checks invariants after lock/unlock,
+  image/text/sage reply, deletion and sticky changes, then verifies deleted search
+  state. Fault injection covers required media job failure, auxiliary spam job
+  failure, commit failure and moderation audit failure.
+
+## 23. Validation
+
+Final command results follow. The complete Rust suite includes the dedicated
+lifecycle/concurrency suites and the existing posting, database, archive,
+filesystem, authorization and recovery regressions.
+
+| Command | Result |
+| --- | --- |
+| `cargo fmt --all --check` | Passed |
+| `cargo check --workspace --all-targets --all-features` | Passed |
+| `cargo clippy --workspace --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic -D clippy::nursery -D clippy::cargo` | Passed |
+| `cargo test --workspace --all-features` | Passed: 1,413 tests per lib/binary target; 5 integration, 1 native-render fixture and 1 doctest; 2,833 executed, 14 pre-existing ignored performance/child fixtures |
+| `cargo build --locked --bin rustchan-cli` | Passed |
+| Playwright posting/thread, dedicated lifecycle, submission idempotency, archive, admin ban/delete and password-board suites; Chromium, Chromium no-JS, mobile WebKit, two workers | Passed: 46 workflows, 8 project-specific skips |
+| Final rebuilt-binary lifecycle/archive/CAPTCHA recheck; Chromium, Chromium no-JS, mobile WebKit and desktop WebKit | Passed: 24 checks, 4 CAPTCHA project skips; includes explicit no-JS CAPTCHA contexts in Chromium/WebKit |
+| `git diff --check` | Passed |
+| `python3 tools/check_local_tooling.py` | Passed |
+
+Toolchain: Rust/cargo 1.99.0, matching the repository policy. No lints or tests were
+disabled to pass validation. Browser project-specific skips distinguish no-JS
+modal coverage, mobile-only cookie coverage and engine-independent HTTP races.
+The full suite exposed one transient failure in the unrelated configuration-save
+lock regression; it passed in isolation and the final complete rerun. New index
+upgrade checks initially exposed a missing table-index repair allowlist entry;
+that migration was corrected and both legacy/current upgrade regressions pass.
+Final Rust output: `/tmp/rustchan-posting-lifecycle-rust-tests.log`.
+Final browser output: `/tmp/rustchan-posting-lifecycle-browser-final-pass.log`;
+JSON/HTML/traces: `/tmp/rustchan-posting-lifecycle-browser-final-pass/`.
+Final schema/CAPTCHA browser output:
+`/tmp/rustchan-posting-lifecycle-browser-schema-captcha.log`; artifacts use the
+same name without `.log`.
+
+Browser commands, using the existing local harness and the freshly built binary:
+
+```sh
+RUSTCHAN_E2E_SKIP_BUILD=1 RUSTCHAN_AUDIT_OUTPUT=/tmp/rustchan-posting-lifecycle-browser-final-pass npx playwright test \
+  tests/e2e/posting-thread.spec.ts tests/e2e/posting-lifecycle.spec.ts \
+  tests/e2e/submission-idempotency.spec.ts tests/e2e/archive-production.spec.ts \
+  tests/e2e/admin-ban-delete.spec.ts tests/e2e/password-boards.spec.ts \
+  --project=chromium --project=chromium-nojs --project=mobile-webkit --workers=2
+RUSTCHAN_E2E_SKIP_BUILD=1 RUSTCHAN_AUDIT_OUTPUT=/tmp/rustchan-posting-lifecycle-browser-schema-captcha npx playwright test \
+  tests/e2e/posting-lifecycle.spec.ts tests/e2e/archive-production.spec.ts tests/e2e/captcha.spec.ts \
+  --project=chromium --project=chromium-nojs --project=mobile-webkit --project=webkit --workers=2
+```
+
+## 24. Deliberately retained limitations
+
+- Retention is asynchronous and may temporarily exceed a cap; durable intents
+  and existing reconciliation converge it. Making creation synchronously delete
+  content would change established latency and retention behavior.
+- No new hard reply/image cap, board-disabled switch, moderator-scoped role,
+  thread move or public unarchive feature was invented.
+- Receipt protection is bounded to seven days with opportunistic cleanup. A
+  fresh or empty token, browser draft submitted from another independent form,
+  or a restored backup missing newer receipts is not a global exactly-once
+  guarantee. Changing identity cannot replay the original receipt and returns
+  a conflict for a still-retained token. This avoids blocking legitimate identical posts.
+- CAPTCHA challenges remain process-local and single-attempt. Simultaneous use
+  before the first commit may reject the losing attempt; retries after a stored
+  successful receipt bypass another challenge check. Multi-instance CAPTCHA
+  coordination was not added.
+- Filesystem/SQL atomicity relies on the existing durable journal and recovery.
+  Processing failure preserves accepted source media with an explicit failed
+  state; a full background queue retains its established skipped-processing
+  failure state. Auxiliary spam-job failure is logged after acceptance.
+- The additive receipt table, triggers and indexes change the exact baseline
+  schema. Older unpatched binaries may reject that schema; database rollback
+  across binary versions needs the project's existing compatible-backup process.
+- Local `>>id` scope, computed backlink behavior, legacy media-count meaning,
+  second-resolution bumps and numbered-page movement under live activity remain.
+- Concurrency evidence is from isolated local SQLite WAL runtimes and browser
+  engines, not a distributed deployment, every possible crash instruction, or
+  production load benchmark. The existing subprocess archive recovery tests are
+  included. Browser harness changes remain local by repository policy.
+
+## Files changed
+
+Tracked implementation: `src/db/posts.rs`, `src/db/schema.rs`, `src/db/threads.rs`,
+`src/handlers/admin/content.rs`, `src/handlers/admin/moderation.rs`,
+`src/handlers/mod.rs`, `src/handlers/posting.rs`, `src/handlers/thread.rs`,
+`src/utils/sanitize.rs`.
+
+New tracked regressions: `src/db/threads/lifecycle_tests.rs`,
+`src/handlers/posting/lifecycle_tests.rs`. Report: `docs/posting-lifecycle-audit.md`.
+
+Local ignored browser changes: `tests/e2e/posting-lifecycle.spec.ts`,
+`tests/e2e/archive-production.spec.ts`.
diff --git a/docs/security-attack-surface.md b/docs/security-attack-surface.md
new file mode 100644
index 00000000..ebad3242
--- /dev/null
+++ b/docs/security-attack-surface.md
@@ -0,0 +1,157 @@
+# RustChan request attack surface — 2026-10-06
+
+Inventory completed against the unmodified route composition before implementation changes. This file records existing controls and review targets; the companion audit report records final changes and results. All GET routes also accept HEAD. No RSS, external JSON posting, legacy posting, or separate upload endpoint exists. Unknown routes use the 404 fallback. Board media and public posting are shared paths; no alternate posting parser was found.
+
+## Shared boundary
+
+All main-server routes consume bounded headers (64 KiB aggregate, 32 KiB per value), reject Transfer-Encoding, pass through transport/client identity, timeout, response-header and browsing-rate middleware. Client identity is derived from ConnectInfo; forwarding headers are used only with behind_proxy and a CIDR-trusted immediate peer. Cookies are untrusted and parsed by CookieJar. Host, Origin, Referer and fetch metadata are consumed by origin/cookie handling; Range and validators are used by media/static serving; X-Requested-With selects JSON post-error responses. Before this audit there was no explicit service-level URI limit or general streaming form cap beyond Axum's 2 MiB extractor default.
+
+## Control and cost profiles
+
+| Profile | Authentication / authorization / CSRF | Parameters and bodies | Database / filesystem / CPU / memory / rate controls / output |
+|---|---|---|---|
+| Public read | Anonymous; board password and admin bypass where applicable; no mutation CSRF | Board slug, numeric IDs; page query, theme/activity cookies, ETag; empty expected body | Board/post/poll/preference reads; HTML text/attributes and generated URLs; escaped metadata, prepared body_html. Browsing budget; catalog/hidden/thread/archive materialization merits review. |
+| Search | Anonymous; board viewing permission | board; q (256 Unicode scalars after trimming), page i64; empty body | Two parameterized FTS prefix queries (12 alphanumeric terms), count plus sort and 20-result page. Browsing budget only before audit; SQL cost independent of result size. Query echo HTML/URL escaped. |
+| Posting | Board posting permission, bans, optional CAPTCHA; public CSRF; cooldown and submission-token checks at commit | board / thread id; multipart _csrf, submission_token, name, subject, body, deletion_token, sage, captcha_id/answer, file/audio_file/image_file, poll fields | Stream to RAII temporary files; 512 MiB aggregate data, 516 MiB envelope, 64 fields, 64 KiB text/unknown fields, 64 KiB preamble/part headers, 200-byte boundary; board media limits; 10-minute body deadline. One concurrent public media request. Content sniffing, hashing, decoding/transcoding, thumbnails; staged filesystem publication and short IMMEDIATE transaction; job scheduling. Post limits and escaped metadata/markup. Browsing policy legacy includes writes, reads policy excludes writes. |
+| Public form | Anonymous; board access, ownership grants or ban checks as required; CSRF for actions (menu actions also bind cookie/origin) | Form _csrf plus route-specific fields: report post/thread/board/reason; appeal reason; vote poll/option/board; edit body; delete ownership; unlock password/return_to; preference flags/return_to | Axum default 2 MiB unless route sets 64 KiB. Report reason 256 scalars; appeal 512; report limit 20/hour per identity with open-report dedup; one appeal/day; poll unique voter; transactional target validation. Cookie preferences and internal redirects. Unlock Argon2 and failure counters. |
+| CAPTCHA | Anonymous; syntactically valid board/id before audit | id 32 hex; query board ASCII identifier; empty body | PNG generation/filtering and challenge map; five-minute retention; browsing budget only; synchronous CPU and full-map expiry scan before audit. Output server-generated PNG. |
+| Media | Board view permission including media password gate | wildcard media_path; v; Range, If-* | Checked board-relative canonical containment; no arbitrary filesystem path; ServeFile streaming/ranges and MIME/nosniff; UUID media identifiers; browsing exemption; DB authorization lookup and filesystem metadata. |
+| Setup | Uninitialized setup or administrator-authorized reopen; scoped CSRF and pending setup grant | preset/site metadata/board policies/admin credentials/theme, password token, _csrf | Default form cap; configuration validators; password hashing, SQLite setup/config writes and staged settings persistence. Rendering escapes submitted metadata; no unauthenticated reopen. |
+| Admin read | Valid expiring admin session except login entry; no CSRF for reads | Dashboard filters/page/domain/search, logs after/max bytes, jobs selection, mod-log page, ip_hash; empty body | DB reads and diagnostic/filesystem/log reads, bounded log tail; private no-store; HTML escapes stored posts/reports/reasons. No distinct moderator role: admin accounts hold full privilege. Update/restart progress endpoints require session. |
+| Admin form | Admin session (login accepts anonymous scoped login CSRF) + session-scoped CSRF + same-origin policy (valid CSRF fallback where designed); sensitive account operations reauthenticate | _csrf and typed/allowlisted per-handler fields; board/thread/post IDs; config sections/actions; ban reason/filter/metadata/settings/secrets | Default form cap; config and board validators; parameterized writes/mod log, controlled filesystem/config mutations, restart/update coordinator, maintenance gate; HTML/redirect outputs escaped/encoded. Password hashing and maintenance can be expensive. |
+| Admin asset | Admin session originally checked after multipart iteration; scoped CSRF and origin | Multipart _csrf, target board and file/image/icon metadata; favicon 5 MiB body, banner 8 MiB body | Limited bytes per part, image content validation and thumbnail/storage writes; rejected-file cleanup; scalar/part-count behavior merits review. |
+| Restore | Admin session and origin checked before streaming; maintenance gate; scoped CSRF before restore mutation | Multipart archive/password/_csrf/target/options; route extractor 20 GiB, actual stream 8 GiB; archive expansion total 8 GiB; bounded manifest and entry paths/counts | RAII temp archive, archive-layout/preflight validation, SQL schema/trust validation, recomputed body_html, staged rollback/persistent recovery; password verification and disk/database replacement expensive. Timeout exemptions deserve review. |
+| Admin backup read | Admin session; GET creates downloadable artifact but does not alter board content | board; inline/attachment choice; kind/filename for saved download | Validated backup names and containment; maintenance coordination, SQLite snapshots/archive creation or streaming download; expensive, timeout-exempt where applicable; private cache. |
+
+## Complete main-router route inventory
+
+Path parameter names appear in braces. Handler structs are the authoritative per-field schema and the named cost profile supplies the remaining trust-boundary columns above.
+
+| Method | Path | Handler | Profile |
+|---|---|---|---|
+| GET | `/healthz` | `observability::healthz` | Public read |
+| GET | `/readyz` | `observability::readyz` | Public read |
+| GET | `/metrics` | `observability::metrics` | Public read |
+| GET | `/favicon.ico` | `crate::handlers::favicon::serve_favicon_ico` | Public read |
+| GET | `/favicon-16x16.png` | `crate::handlers::favicon::serve_favicon_16` | Public read |
+| GET | `/favicon-32x32.png` | `crate::handlers::favicon::serve_favicon_32` | Public read |
+| GET | `/apple-touch-icon.png` | `crate::handlers::favicon::serve_apple_touch_icon` | Public read |
+| GET | `/captcha/{id}` | `crate::handlers::captcha::serve_captcha_image` | CAPTCHA |
+| GET | `/android-chrome-192x192.png` | `crate::handlers::favicon::serve_android_chrome_192` | Public read |
+| GET | `/android-chrome-512x512.png` | `crate::handlers::favicon::serve_android_chrome_512` | Public read |
+| POST | `/nsfw/accept` | `crate::handlers::board::accept_nsfw` | Public form |
+| GET | `/theme/{theme}` | `crate::handlers::board::set_theme` | Public read |
+| POST | `/preferences` | `crate::handlers::board::set_user_preferences` | Public form |
+| GET | `/banned` | `crate::handlers::board::banned_page` | Public read |
+| GET | `/theme-css/{theme}` | `crate::handlers::board::serve_theme_css` | Public read |
+| GET | `/banner/assets/{id}` | `crate::handlers::banner::serve_banner_asset` | Public read |
+| GET | `/banner/external/{id}` | `crate::handlers::banner::external_banner_warning_page` | Public read |
+| GET | `/banner/external/{id}/continue` | `crate::handlers::banner::external_banner_continue` | Public read |
+| GET | `/setup` | `crate::handlers::setup::setup_get` | Setup |
+| POST | `/setup/review` | `crate::handlers::setup::setup_review` | Setup |
+| POST | `/setup/finish` | `crate::handlers::setup::setup_finish` | Setup |
+| GET | `/` | `crate::handlers::board::index` | Public read |
+| GET | `/{board}` | `crate::handlers::board::board_index` | Public read |
+| POST | `/{board}` | `crate::handlers::board::create_thread` | Posting |
+| GET | `/{board}/unlock` | `crate::handlers::board::board_unlock_page` | Public read |
+| POST | `/{board}/unlock` | `crate::handlers::board::unlock_board_access` | Public form |
+| GET | `/{board}/catalog` | `crate::handlers::board::catalog` | Public read |
+| GET | `/{board}/hidden` | `crate::handlers::board::hidden_threads` | Public read |
+| POST | `/{board}/thread-preference` | `crate::handlers::board::update_thread_preference` | Public form |
+| GET | `/{board}/archive` | `crate::handlers::board::board_archive` | Public read |
+| GET | `/{board}/search` | `crate::handlers::board::search` | Search |
+| GET | `/{board}/thread/{id}` | `crate::handlers::thread::view_thread` | Public read |
+| POST | `/{board}/thread/{id}` | `crate::handlers::thread::post_reply` | Posting |
+| GET | `/{board}/post/{id}/edit` | `crate::handlers::thread::edit_post_get` | Public read |
+| POST | `/{board}/post/{id}/edit` | `crate::handlers::thread::edit_post_post` | Public form |
+| GET | `/{board}/post/{id}/delete` | `crate::handlers::thread::delete_post_get` | Public read |
+| POST | `/{board}/post/{id}/delete` | `crate::handlers::thread::delete_own_post` | Public form |
+| POST | `/report` | `crate::handlers::board::file_report` | Public form |
+| POST | `/appeal` | `crate::handlers::board::submit_appeal` | Public form |
+| POST | `/vote` | `crate::handlers::thread::vote_handler` | Public form |
+| GET | `/api/post/{board}/{post_id}` | `crate::handlers::board::api_post_preview` | Public read |
+| GET | `/{board}/post/{post_id}` | `crate::handlers::board::redirect_to_post` | Public read |
+| GET | `/{board}/thread/{id}/updates` | `crate::handlers::thread::thread_updates` | Public read |
+| GET | `/boards/{*media_path}` | `crate::handlers::board::serve_board_media` | Media |
+| GET | `/admin/restart/status` | `crate::handlers::admin::restart::status` | Admin read |
+| POST | `/admin/restart` | `crate::handlers::admin::restart::restart` | Admin form |
+| GET | `/admin/updates/status` | `crate::handlers::admin::updates::status` | Admin read |
+| POST | `/admin/updates/check` | `crate::handlers::admin::updates::check` | Admin form |
+| POST | `/admin/updates/install` | `crate::handlers::admin::updates::install` | Admin form |
+| POST | `/admin/network/settings` | `crate::handlers::admin::update_network_settings` | Admin form |
+| POST | `/admin/appearance/defaults` | `crate::handlers::admin::update_visitor_defaults` | Admin form |
+| POST | `/admin/secrets/rotate` | `crate::handlers::admin::rotate_secret` | Admin form |
+| POST | `/admin/accounts/{action}` | `crate::handlers::admin::update_account` | Admin form |
+| POST | `/admin/config/{section}` | `crate::handlers::admin::update_runtime_settings` | Admin form |
+| GET | `/admin` | `crate::handlers::admin::admin_index` | Admin read |
+| POST | `/admin/login` | `crate::handlers::admin::admin_login` | Admin form |
+| POST | `/admin/logout` | `crate::handlers::admin::admin_logout` | Admin form |
+| GET | `/admin/panel` | `crate::handlers::admin::admin_panel` | Admin read |
+| GET | `/admin/site-health/jobs` | `crate::handlers::admin::admin_site_health_jobs` | Admin read |
+| POST | `/admin/site-health/jobs/dismiss` | `crate::handlers::admin::dismiss_failed_site_health_jobs` | Admin form |
+| GET | `/admin/log/live` | `crate::handlers::admin::admin_live_log` | Admin read |
+| POST | `/admin/board/create` | `crate::handlers::admin::create_board` | Admin form |
+| POST | `/admin/board/delete` | `crate::handlers::admin::delete_board` | Admin form |
+| POST | `/admin/board/settings` | `crate::handlers::admin::update_board_settings` | Admin form |
+| POST | `/admin/board/reorder` | `crate::handlers::admin::reorder_board` | Admin form |
+| POST | `/admin/site/favicon` | `crate::handlers::admin::update_site_favicon` | Admin asset |
+| POST | `/admin/board/favicon` | `crate::handlers::admin::update_board_favicon` | Admin asset |
+| POST | `/admin/board/favicon/clear` | `crate::handlers::admin::clear_board_favicon_override` | Admin form |
+| POST | `/admin/site/banner` | `crate::handlers::admin::upload_global_banner` | Admin asset |
+| POST | `/admin/home/banner` | `crate::handlers::admin::upload_home_banner` | Admin asset |
+| POST | `/admin/board/banner` | `crate::handlers::admin::upload_board_banner` | Admin asset |
+| POST | `/admin/board/banner/clear` | `crate::handlers::admin::clear_board_banner_override` | Admin form |
+| POST | `/admin/banner/update` | `crate::handlers::admin::update_banner_meta` | Admin form |
+| POST | `/admin/banner/delete` | `crate::handlers::admin::delete_banner` | Admin form |
+| POST | `/admin/banner/move` | `crate::handlers::admin::move_banner` | Admin form |
+| POST | `/admin/thread/action` | `crate::handlers::admin::thread_action` | Admin form |
+| POST | `/admin/thread/delete` | `crate::handlers::admin::admin_delete_thread` | Admin form |
+| POST | `/admin/post/delete` | `crate::handlers::admin::admin_delete_post` | Admin form |
+| POST | `/admin/ban/add` | `crate::handlers::admin::add_ban` | Admin form |
+| POST | `/admin/ban/remove` | `crate::handlers::admin::remove_ban` | Admin form |
+| POST | `/admin/report/resolve` | `crate::handlers::admin::resolve_report` | Admin form |
+| GET | `/admin/mod-log` | `crate::handlers::admin::mod_log_page` | Admin read |
+| POST | `/admin/filter/add` | `crate::handlers::admin::add_filter` | Admin form |
+| POST | `/admin/filter/remove` | `crate::handlers::admin::remove_filter` | Admin form |
+| POST | `/admin/site/settings` | `crate::handlers::admin::update_site_settings` | Admin form |
+| POST | `/admin/theme/create` | `crate::handlers::admin::create_theme` | Admin form |
+| POST | `/admin/theme/update` | `crate::handlers::admin::update_theme` | Admin form |
+| POST | `/admin/theme/delete` | `crate::handlers::admin::delete_theme` | Admin form |
+| POST | `/admin/db/check` | `crate::handlers::admin::admin_db_check` | Admin form |
+| POST | `/admin/media/settings` | `crate::handlers::admin::update_media_settings` | Admin form |
+| POST | `/admin/setup/reopen` | `crate::handlers::setup::admin_reopen_setup` | Admin form |
+| POST | `/admin/setup/close` | `crate::handlers::setup::admin_close_setup` | Admin form |
+| GET | `/admin/db/repair` | `crate::handlers::admin::admin_db_repair_status` | Admin read |
+| POST | `/admin/db/repair` | `crate::handlers::admin::admin_db_repair` | Admin form |
+| GET | `/admin/db/repair/status` | `crate::handlers::admin::admin_db_repair_status` | Admin read |
+| GET | `/admin/db/repair/progress` | `crate::handlers::admin::admin_db_repair_progress_json` | Admin read |
+| POST | `/admin/vacuum` | `crate::handlers::admin::admin_vacuum` | Admin form |
+| POST | `/admin/ip/report` | `crate::handlers::admin::admin_ip_report` | Admin form |
+| GET | `/admin/ip/{ip_hash}` | `crate::handlers::admin::admin_ip_history` | Admin read |
+| POST | `/admin/post/ban-delete` | `crate::handlers::admin::admin_ban_and_delete` | Admin form |
+| POST | `/admin/appeal/dismiss` | `crate::handlers::admin::dismiss_appeal` | Admin form |
+| POST | `/admin/appeal/accept` | `crate::handlers::admin::accept_appeal` | Admin form |
+| GET | `/admin/backup` | `crate::handlers::admin::admin_backup` | Admin backup read |
+| GET | `/admin/restore` | `inline redirect` | Admin read |
+| POST | `/admin/restore` | `crate::handlers::admin::admin_restore` | Restore |
+| GET | `/admin/board/backup/{board}` | `crate::handlers::admin::board_backup` | Admin backup read |
+| GET | `/admin/board/restore` | `inline redirect` | Admin read |
+| POST | `/admin/board/restore` | `crate::handlers::admin::board_restore` | Restore |
+| POST | `/admin/backup/create` | `crate::handlers::admin::create_full_backup` | Admin form |
+| POST | `/admin/backup/settings` | `crate::handlers::admin::update_full_backup_settings` | Admin form |
+| POST | `/admin/board/backup/create` | `crate::handlers::admin::create_board_backup` | Admin form |
+| GET | `/admin/backup/download/{kind}/{filename}` | `crate::handlers::admin::download_backup` | Admin backup read |
+| GET | `/admin/backup/progress` | `crate::handlers::admin::backup_progress_json` | Admin read |
+| POST | `/admin/backup/delete` | `crate::handlers::admin::delete_backup` | Admin form |
+| POST | `/admin/backup/restore-saved` | `crate::handlers::admin::restore_saved_full_backup` | Admin form |
+| POST | `/admin/backup/extract-board` | `crate::handlers::admin::extract_board_from_full_backup` | Admin form |
+| POST | `/admin/board/backup/restore-saved` | `crate::handlers::admin::restore_saved_board_backup` | Admin form |
+| GET | `/static/style.css` | `serve_css` | Public read |
+| GET | `/static/main.js` | `serve_main_js` | Public read |
+| GET | `/static/admin.css` | `serve_admin_css` | Public read |
+| GET | `/static/admin.js` | `serve_admin_js` | Public read |
+| GET | `/static/theme-init.js` | `serve_theme_init_js` | Public read |
+
+## Additional listener and fallbacks
+
+The HTTP-to-HTTPS listener accepts any method on `/{*path}` and builds a permanent redirect using configured public hosts/ACME domains or a loopback fallback, never an arbitrary untrusted Host. It also runs request-boundary validation. It performs no database or filesystem work. Static assets are embedded and expose no directory browsing. ACME protocol handling is managed separately by the configured TLS provider. Health/readiness/metrics expose runtime readiness/aggregate telemetry; metrics authorization policy is recorded in the final report. No third-party endpoint is within this audit scope.
diff --git a/docs/security-audit-2026-10-06.md b/docs/security-audit-2026-10-06.md
new file mode 100644
index 00000000..33dec402
--- /dev/null
+++ b/docs/security-audit-2026-10-06.md
@@ -0,0 +1,303 @@
+# RustChan hostile-input security audit — 2026-10-06
+
+Defensive source review, implementation fixes, deterministic regressions, and local HTTP/browser/load validation. Testing used an isolated data directory and a listener bound to `127.0.0.1`; no production or third-party system was targeted. No commits or branches were created. No new crate was added; `hooks` and `blob` features were enabled on the existing rusqlite dependency.
+
+## 1. Attack surface mapped
+
+[The pre-change inventory](security-attack-surface.md) maps 122 method/path entries, their shared headers, permissions, CSRF, input/body limits, database/filesystem work, output contexts, and expensive-operation profiles. It includes posting, replies, reports, appeals, search, archive/catalog, previews/polling, ownership actions, admin authentication/settings/assets/accounts/moderation, setup, backups/restores, maintenance, update/restart, media, telemetry, embedded assets, and the HTTPS redirect listener. No alternate JSON posting, RSS, legacy posting, or separate anonymous upload route was found.
+
+The final review followed shared helpers back through every caller, including both public upload routes, all five admin asset routes, full/saved/board restore paths, post previews/search/archive/admin rendering, password reauthentication, and plaintext/static TLS/ACME listener implementations.
+
+## 2. Confirmed vulnerabilities and weaknesses
+
+No CRITICAL or HIGH finding was confirmed. Severity reflects the demonstrated boundary and existing defenses, not a hypothetical worst-case chain.
+
+| ID / severity | Boundary, consequence and cause | Correction | Regression evidence |
+|---|---|---|---|
+| F1 MEDIUM | Behind a trusted appending proxy, attacker-supplied leftmost X-Forwarded-For or preferred X-Real-IP could control identity. This undermined rate limits, bans and attribution. | Walk XFF from the trusted peer toward the first untrusted hop; authoritative malformed/duplicate XFF falls back to the peer rather than another forwarding header. | Spoofed-prefix, malformed-hop, IPv6 and direct-client tests; actual direct requests with rotating XFF still hit the same posting budget. |
+| F2 MEDIUM | Markup transformations ran after hyperlink generation and could put generated tags/quotes inside URL attributes. Cached post HTML could retain the malformed markup. CSP limits script execution but does not make malformed HTML safe. | Apply formatting before generating URL attributes; escape affected cached content as bounded raw text while preserving valid cached formatting/dice rolls. | URL/markup and legacy-cache regressions; real Chromium found zero injected handlers, malicious image nodes or broken URL attributes. |
+| F3 MEDIUM | Browsing/authentication/board-password counters and CAPTCHA challenges admitted arbitrary identities without a hard retained-state ceiling. Expiration alone did not bound burst memory. | Fixed-cap atomic rate tables; fixed-size hashed production keys, amortized expiry and fail-closed saturation. CAPTCHA capacity includes generation reservations. | Exact window boundaries, 16,384-entry saturation/recovery, 64 simultaneous reservations, CAPTCHA cap and reservation cleanup. |
+| F4 MEDIUM | Concurrent failures could all pass password failure checks before expensive verification; CAPTCHA work could block an async worker. Expensive operations lacked independent admission bounds across entry points. | Reserve attempts before verification; nonqueueing two-worker password/CAPTCHA gates; move work to blocking workers and retain permits inside them. Include setup, unlock, account/secret/update reauthentication and board password creation. | Existing auth/setup/unlock tests plus gate sharing/release and cancelled-request blocking-work regression. |
+| F5 MEDIUM | Small search result pages did not bound FTS count, sorting, deep OFFSET or parallel work. Broad prefix queries could process the entire matching corpus. | Query/term/page/result/count bounds, SQLite VM/time progress budgets, two concurrent searches and independent request budget. | Real search burst, query/pagination regressions, interruption/reusable-connection test and existing FTS plan/result tests. |
+| F6 MEDIUM | Thread rendering collected every reply; catalog/hidden listings requested unlimited rows. A stored large thread amplified repeated read memory, rendering and response cost. | OP plus 200 replies per indexed cursor page; 1,000-row catalog/hidden/preference cap matching the allowed active-thread maximum. | 450-reply traversal and EXPLAIN assertion; full-router history/quote/maximum-ID tests; real no-JS traversal of 464 replies. |
+| F7 MEDIUM | Admin favicon/banner handlers read multipart fields/files before checking the session and did not share public media admission. Unauthenticated parallel bodies could impose allocation/parser cost. | Authenticate before body consumption, bound part names/counts/text/unknown fields, reject duplicates, apply envelope guard and share media admission through processing. | Full-router stalled infinite-body rejection before reads; text limit−1/limit/limit+1, duplicate-part and permit-release tests. |
+| F8 MEDIUM | Full restore materialized all post bodies from an up-to-8-GiB snapshot. Merely slicing SQLite TEXT also misses content after embedded NUL bytes. | Page 128 IDs/types at a time; incremental SQLite value reads check byte length before allocation, validate UTF-8 and enforce 4,096 Rust scalars before staged publication; board manifest bodies use the same scalar limit before filesystem work. | 300-row sanitization; 4,095/4,096/4,097 emoji/NUL boundaries, empty body, 65,536-byte NUL-prefixed body and invalid UTF-8. Board restore rejects oversize before extraction/staging/database mutation. Existing rollback/recovery tests remain. |
+| F9 MEDIUM | Application middleware only runs after an HTTP head is parsed; native listeners lacked bounded open-socket admission and header-read deadlines. | 256 sockets per listener, transport admission before handshake, 15-second handshake/head limits; HTTP/2 stream/header caps. Request admission remains held through response streaming. | Acceptor saturation/release and streamed-response regressions; actual stalled head closed after 15.003 seconds while health reads succeeded. |
+| F10 LOW | Internal return-path validation allowed controls/backslashes elsewhere in a leading-slash path, enabling browser normalization ambiguity or invalid redirect headers. | Reject controls, any backslash, protocol-relative paths and values over 8 KiB in the shared validator. | Internal/external/protocol-relative/control/encoded-query regressions; existing handler redirect tests. |
+| F11 LOW | Anonymous upload errors and restore XHR 500 responses could include tool diagnostics or filesystem/internal details. Request tracing retained complete query strings. | Generic public internal/decoder errors with classified 413/415 behavior preserved; bounded path-only tracing and bounded restore header diagnostics. | Error-classification/privacy tests and actual corrupt-upload rejection. |
+| F12 LOW | Missing login usernames skipped password verification, providing a cheap account-existence timing signal despite generic errors. | Verify a public dummy hash at current account parameters within the same rate/concurrency gate; a missing user can never yield an account ID. | Dummy matching/nonmatching password regression and parameter parity check; existing successful/failed login tests. |
+
+Additional HARDENING: 64-KiB default forms, early declared-body rejection, 8-KiB URI limit, Host ambiguity rejection, early mutation origin/fetch checks, public signed-token cookie binding, and bounded startup browsing settings. Local testing also caught reserved form routes inheriting upload body/timeout allowances; the shared classifier and full-router regression now exclude those routes. The second pass corrected maximum SQLite post-ID focus so the newest reply remains reachable without cursor overflow.
+
+## 3. Request-size protections
+
+| Input | Final bound / enforcement |
+|---|---|
+| URI | 8,192 bytes before query parsing/logging; boundary tests at 8,191/8,192/8,193. |
+| Headers | Existing 64-KiB aggregate/32-KiB value service bounds, 64-KiB native protocol bounds; duplicate Host and ambiguous transfer framing rejected. |
+| Ordinary forms | 65,536 streaming bytes; early Content-Length rejection; 65,535/65,536/65,537 full-router tests. |
+| Public posting | Existing 512-MiB aggregate payload / 516-MiB request envelope, board-specific media limits, 64 fields, 64-KiB text/unknown fields, bounded multipart headers/preamble/boundary. |
+| Admin assets | Existing favicon 5-MiB/banner 8-MiB body caps, now early header enforcement plus shared parser/admission bounds. |
+| Restore | 8-GiB actual upload/expanded archive budgets and existing staged validation; route extractor allowance cannot bypass actual streaming limits. |
+| Text | Post body 4,096 Unicode scalars, subject 128, search 256, report 256, appeal 512; usernames/passwords and config fields retain backend validators. Login password additionally bounded at 1,024 bytes before verification. |
+
+Limits are enforced in Rust, including no-JS forms. Body declarations never choose upload policy; route/method classification does. Existing media-specific and multipart limits remain authoritative inside the larger envelope.
+
+## 4. Multipart hardening
+
+The existing streaming public parser already bounds aggregate bytes, field count, duplicate upload/scalar slots, unknown-field discard, header/preamble bytes, rejection recovery, and a shared body deadline. It uses RAII temporary files and retains a bounded recoverable draft. These controls were preserved.
+
+All admin favicon/banner paths now authenticate before iteration, reject duplicate names including unknown names, bound names to 128 bytes and total parts to 64, read scalar UTF-8 incrementally within 64 KiB, discard unknown fields within existing bounds, and use the existing envelope scanner. A permit covers parsing through blocking image publication. Session authorization is checked again before mutation.
+
+Actual HTTP cases covered missing boundary, truncation, duplicate body, a 65,537-byte unknown field and invalid raw UTF-8. Existing automated cases cover split envelopes, malformed/oversized preambles/headers, quoted boundaries, duplicate file slots, zero-byte/unselected controls, board-specific exact limits and rejected-file cleanup.
+
+## 5. Rate-limiting architecture
+
+Independent fixed-window per-client budgets are charged before parsing or DB work, across all boards/threads: thread creation 6/minute; replies 30; report/appeal requests 30; searches 20; password entry points 20; CAPTCHA 20; other mutations 120. Failed requests also consume admission. GET and HEAD expensive reads both count.
+
+Each table retains at most 16,384 entries, updates counters atomically, scans expiry at most once per minute, hashes identity plus a fixed action label, and rejects new identities when full. Authentication/unlock counters retain their existing configured failure windows. CAPTCHA holds at most 4,096 challenges/reservations with its existing five-minute TTL.
+
+The configurable browsing policy, exemptions and posting cooldowns remain. Settings now validate 1–1,000,000 browsing requests and 1–86,400-second windows. Action admission uses the resolved transport/proxy/Tor identity rather than mutable visitor cookies. Existing cookie-bound posting/report identity semantics are preserved behind this independent admission boundary.
+
+## 6. Posting and flood resistance
+
+Both thread creation and reply routes share the production parser, transactional posting validation, media admission and independent action budgets. Sage and cross-board replies cannot escape the reply class. Board access, bans, CAPTCHA policy, cooldowns, bump limits, submission-token retry semantics and staged filesystem publication remain.
+
+Identical legitimate submissions remain separate posts. Local tests accepted six identical new threads, then returned four 429 responses; accepted thirty replies, including sage, then returned five 429 responses. Rejected attempts did not create posts or corrupt reply counts. Existing concurrent posting/rollback tests cover publication and SQLite contention.
+
+## 7. Report abuse
+
+The new 30/minute report/appeal request budget covers invalid and duplicate targets before body/DB work. Existing reporting retains 20 new reports/hour per reporting identity, open-report deduplication, bounded reason text/control rejection, bans and board access, authoritative board/post/thread association, and an IMMEDIATE transaction around budget and insertion. Appeals retain their existing daily window. Separate legitimate reports remain possible.
+
+Full-router tests exercised 30 invalid reports followed by 429. The mixed HTTP workload returned controlled 400/429 for invalid reports while ordinary reads succeeded. Existing duplicate/target/appeal tests passed.
+
+## 8. Search abuse
+
+Public search rejects queries above 256 scalars and pages above 500. The DB parser retains at most twelve alphanumeric terms, generates quoted AND/prefix syntax, clamps result requests to 1–100 and offsets to 0–9,999, and caps counts at 10,000. UI results at the cap show `10,000+` and request refinement.
+
+Count and result operations each have a scoped progress callback: checks every 10,000 SQLite VM instructions, interruption at 200 checks or 500 ms. This is approximately two million VM instructions per operation, not a hard subprocess wall deadline. The callback is removed before returning a pooled connection. Broad queries produce a useful 400; saturation of the two-worker gate produces retryable 503; per-client excess produces 429. No anonymous waiter queue was added.
+
+Existing FTS CROSS JOIN/index plans, board scoping, ordering, prefixes and ordinary results remain covered. Native FTS work between VM checkpoints can overshoot the cooperative wall allowance; this limitation is explicit.
+
+## 9. SQL and query safety
+
+Request-controlled values use bound parameters. Dynamic SQL reviewed consists of source-defined column lists, table/schema maintenance, fixed route options and allowlisted modes; raw search syntax and sort identifiers are not interpolated from a request. FTS input is compiled into a bounded restricted expression and passed as a parameter.
+
+Malformed numeric IDs, negatives/zero, i64 maxima, overflow and nonnumeric values produce controlled 400/404. Search pages cannot overflow multiplication into a deep query. Thread history uses an indexed post-ID cursor; its EXPLAIN regression asserts `idx_posts_thread_live` and no temporary sorting B-tree. Maximum post-ID focus is tested through the full router.
+
+## 10. XSS and output encoding
+
+Reviewed post body, subject/name, filenames, board metadata, report/moderation reasons, search echo, archives, previews, admin output, recovery drafts and errors. Shared template text/attribute escaping and restricted HTTP(S) URL generation remain. Fixed F2 at the formatting order rather than relying on CSP. The cached-HTML compatibility check runs after a cheap byte cap; only affected legacy markup falls back to bounded escaped body text. Valid cached dice results are not recomputed.
+
+The real browser rendered literal `<img ... onerror=...>`, quotes, ampersands and Unicode as text with zero injected image/handler nodes. Existing template/admin/archive tests and new URL/legacy/search-echo regressions passed. Restored HTML is regenerated from bounded raw text; imported cached HTML is not trusted.
+
+## 11. Unicode
+
+Text limits deliberately count Rust Unicode scalars, while envelopes, passwords, URI and header limits use bytes. Tests cover combining marks, ZWJ, bidi controls, variation/emoji/non-BMP content, oversized multibyte search and restore bodies, long quote/markup sequences, raw invalid UTF-8 and embedded NUL restore values. No identifier normalization was introduced: board/identifier allowlists retain their existing semantics. Grapheme counting is not used or promised.
+
+## 12. Paths and filenames
+
+Public storage uses generated controlled names, not original filenames. Existing filename sanitation/truncation, canonical containment, board-relative validation, symlink defenses, archive entry validation, backup filename checks and durable delete/publication journals remain. Media authorization is applied before serving protected board files.
+
+A real valid PNG named `../../<audit>.png` was accepted and stored at a generated safe path with sanitized metadata. Corrupt traversal-looking, Unicode and misleading-extension filenames did not create attachments. Encoded media traversal returned 400. Existing path/archive/filename tests passed. Intentional allow-any-file boards retain their existing download policy.
+
+## 13. MIME and media validation
+
+The existing posting pipeline detects actual content, validates media type against board policy, and does not use the submitted extension/MIME as authorization. Existing image controls include 40-million-pixel admission, a 256-MiB decoder allocation policy and bounded animation frames. HEIF uses coded/output pixel bounds. Audio/container readers have bounded header/packet reads; FFmpeg/tool execution has deadlines, cancellation/process-group cleanup, output-file budgets and 64-KiB diagnostic retention. Existing media regressions passed.
+
+The audit did not replace that pipeline. Shared admin/public media admission now closes an inconsistent entry point. Actual tests accepted a valid PNG and returned 415 for non-image bytes labeled `image/png` under several filename forms. The PDF policy test now verifies the content/signature of either documented PNG preview or SVG fallback; dedicated fallback tests remain.
+
+## 14. Headers and trusted proxies
+
+Forwarding trust requires both explicit behind-proxy mode and a CIDR-trusted immediate socket peer. XFF is resolved right-to-left through trusted hops; X-Real-IP is only a fallback when XFF is absent. Invalid authoritative chains fail back to the peer. Trusted X-Forwarded-Proto uses the last hop. Direct clients cannot choose their effective IP via forwarding headers. Operators must configure trusted CIDRs accurately and have proxies overwrite or correctly append their forwarding metadata, especially X-Real-IP/protocol.
+
+Host validation rejects duplicates, credentials, whitespace, percent/separator ambiguity and nonnumeric/out-of-range ports while retaining valid IPv4/IPv6 authorities. Security-sensitive HTTPS redirect hosts remain configured. Request Host is not made a canonical site configuration. Content-Length is an early rejection hint; streaming limits remain authoritative. Actual duplicate Host and TE+CL requests returned 400.
+
+## 15. Redirects
+
+Shared internal return validation accepts bounded leading-slash paths, rejects protocol-relative/external paths, controls and all backslashes, and preserves encoded data in legitimate query strings. Existing stricter path validation inherits this boundary. Callers retain their existing route-specific fallbacks.
+
+Configured external banner continuation is intentional external navigation with its existing target validation/warning flow; it is not a generic internal return-to mechanism. No arbitrary request Host was introduced into security-sensitive absolute redirects.
+
+## 16. CSRF
+
+Mutation inventory covered posting, report/appeal, polls, owner edit/delete, thread preferences, board unlock, setup, login/logout, all admin/moderation/settings/assets, maintenance, restore and update/restart. Existing admin scope/session binding, token checks, same-origin rules and cookie flags remain. Public signed form tokens must now match a present CSRF cookie; cookie-free signed forms remain supported. Explicit cross-site Origin/Referer or fetch metadata is rejected before body work; supported no-origin/null-origin flows still require handler CSRF.
+
+GET polling/previews/read pages do not mutate content. Existing theme GET changes only a presentation cookie for the no-JS flow. Authorized backup GET can create a downloadable artifact; existing admin/CSRF controls and maintenance coordination apply. This compatibility behavior was reviewed and deliberately retained.
+
+## 17. Memory exhaustion
+
+Fixed retained-state caps, bounded forms/URI/multipart fields, socket/request gates, response windows and incremental restore reads reduce attacker-driven allocation. Thread responses contain at most 201 posts. Admin asset buffering stays within its existing 5/8-MiB envelopes and one shared media permit. CAPTCHA is finite. Searches materialize bounded pages. No allocation trusts Content-Length as capacity.
+
+The local mixed test observed RSS from 40,144 to 53,152 KiB, including allocator/WAL/media caching; these are snapshots, not sampled peak measurements or a production sizing guarantee.
+
+## 18. CPU exhaustion
+
+Password, CAPTCHA and search each have two active worker permits; uploads/assets share the existing one-media-request permit. No unbounded admission waiter queue was added. Blocking closures own their permits so HTTP cancellation cannot release still-running work. Argon2 strength is unchanged; missing accounts now perform comparable password work inside the same bound. Search callbacks bound cooperative SQL work. Existing media subprocess deadlines and bounded parser controls remain.
+
+## 19. Disk and temporary files
+
+Existing RAII upload/archive temporary files, staged publication, failure cleanup, pending filesystem intent recovery, converted-output caps and post/thread deletion cleanup remain. Rejected local multipart/media requests left no temporary files. In the measured mixed fixture, the file count stayed at eleven; accepted posts/media and SQLite/WAL explain permitted disk growth.
+
+Retention and free-space checks reduce growth but do not impose a universal storage quota or hard log-retention budget. Sustained accepted traffic and operator-created backups still require disk capacity planning. No claim of complete distributed disk-DoS prevention is made.
+
+## 20. SQLite contention and resources
+
+Public media work remains outside the short posting write transaction. Account reauthentication/new hashing now precede its IMMEDIATE transaction, with session/account/hash rechecks under the lock before mutation. Setup hashes before beginning its write transaction. Login drops the pooled connection before Argon2; update reauthentication does likewise.
+
+Existing busy timeout/bounded pool checkout and retryable DbBusy responses remain; there is no new spin/retry loop. Search interruption clears pooled state. Restore staging/rollback protects the live DB from partially validated data. Local integrity checks returned `ok` and authoritative reply counts matched stored replies after posting/load; existing transaction rollback, interrupted-job and crash/recovery tests passed.
+
+## 21. Parser and algorithmic complexity
+
+Finite field/body/URI bounds precede parsers. Rust regex processing remains bounded by post length; tests exercise many quotes, repeated incomplete spoilers and combining/zero-width text. Post markup generates numeric reference links without a database read or backlink insertion for every marker; client backlink work is confined to the displayed posts. Post-preview requests authorize and load their explicit target separately. Missing in-window quote targets use canonical post redirects. New routing rewrite uses only generated numeric fragment attributes and a visible-ID set.
+
+Restore pagination is keyset based and reads each body within a strict byte bound. Rate/CAPTCHA expiry scans are amortized rather than full-map scans per hostile request. Panic review found no new request-controlled unwrap/expect/panic; existing source-literal regex invariants and OS-randomness fail-closed termination are intentional.
+
+## 22. Admin and moderator security
+
+Admin authentication/authorization, scoped CSRF, typed actions/config validators, parameterized SQL, sensitive reauthentication and escaped stored-content rendering remain. Asset handlers now authorize before data consumption and again before publication. Account transactions recheck credentials/session after expensive work. Restore treats schema, media paths, text and cached HTML as untrusted and publishes only after preflight/staging validation. Board/saved-board/extracted-board restores enforce the same post-body scalar ceiling before staging or extraction; their JSON manifests retain the existing 64-MiB aggregate bound. Update/restart controls remain authenticated and coordinated; no external update installation was performed during this audit.
+
+## 23. Errors and logging
+
+Anonymous internal/TLS/restore-XHR 500 responses and decoder failures do not disclose internal paths/tool output. Useful 413/415 classifications and recognized safe malformed-image guidance remain. Wrapped application errors preserve their typed client status, including broad-search rejection. Detailed internal failures remain in server logs.
+
+Request spans record at most 256 path characters and omit queries/cookies/tokens/bodies. Restore content-type/length diagnostics are bounded. Login username redaction remains. Existing log rotation is preserved; action budgets constrain repeated costly error paths, but there is no added universal byte quota for logs.
+
+## 24. Security headers
+
+Existing CSP, nosniff, frame protection, referrer policy, eligible-origin HSTS, media policy and private admin/session caching were reviewed and preserved. No CSP allowance was weakened and no inline script dependency was added. New action-limit responses use private/no-store and Retry-After; existing retryable 503 behavior is reused. Host/proxy changes protect the inputs to secure-cookie/HSTS decisions.
+
+## 25. Authentication abuse
+
+Pre-verification reservation closes the concurrent lockout race; retained counters and active hash work are bounded. Password sizes and stored PHC resource ceilings remain enforced. Missing users use the same current Argon2 cost class, with no possible dummy-account session. Generic errors, random sessions, expiry/revocation, logout and HttpOnly/SameSite/Secure policy remain covered by existing tests.
+
+This removes the cheap missing-user branch; it does not claim exact constant-time end-to-end HTTP behavior across DB state or legacy password parameters.
+
+## 26. Automated tests added and strengthened
+
+New assembled-router tests cover legitimate/excessive posting, separate report/search budgets, declared/streamed form and URI boundaries, malformed Host/IDs/origin/fetch metadata, Unicode search/page limits and echo escaping, unauthenticated stalled admin uploads, bounded thread history/quote destinations/max-ID focus, response-lifetime admission, admin asset field boundaries/duplicates and permit release.
+
+Helper/DB tests cover retained-state saturation/window/concurrent admission, active-work ownership under cancellation, CAPTCHA reservations, SQLite search interruption/reuse, indexed complete history traversal, malicious URL markup and legacy-cache compatibility, Unicode/quote expansion, redirect normalization controls, private upload errors, typed wrapped errors, bounded restore including NUL/invalid UTF-8, dummy authentication safety/parameter parity, capped board preference collection with individual preferences preserved, and board-restore rejection before extraction/filesystem/database mutation.
+
+Existing multipart, media, CSRF, SQL, path, transactional rollback, cleanup, backup/restore and admin regressions were retained. No tests or lints were disabled. Independent authentication test fixtures now use distinct peer identities instead of accidentally sharing new production attempt reservations. A PDF preview policy test was corrected to validate both real preview outcomes by content; fallback-specific tests were preserved.
+
+## 27. Local adversarial, browser and load testing
+
+[Machine-readable results](security-audit-evidence-2026-10-06.json) record actual HTTP, Chromium and mixed-load evidence.
+
+- Direct-mode rotating forged XFF: six controlled invalid posting responses then two 429s.
+- Actual boundary/framing cases: malformed Host 400, URI 414, declared oversized form 413, cross-site action 403, numeric overflow 400, encoded media traversal 400, unauthenticated asset upload 403, malformed multipart/UTF-8 400, oversized unknown field 413, TE+CL and duplicate Host 400.
+- Identical thread burst: six 303 / four 429; DB integrity `ok`, thirteen posts/thirteen threads at that checkpoint.
+- Eight-worker search burst: seven 200 / thirteen 503 / twenty 429 in 0.013 seconds; normal reads remained usable. 503 is nonqueueing concurrency rejection, distinct from rate rejection.
+- Partial HTTP head: connection closed after 15.003 seconds; an independent health request succeeded while it was stalled.
+- Reply burst: thirty 303 / five 429; median accepted-reply latency 3.328 ms. Corrupt image bytes labeled PNG returned four 415s; a valid PNG with a traversal-looking filename returned 303.
+- Mixed 160 requests with eight workers: eighty normal page reads all succeeded; totals 88×200, 12×503, 30×429, 30×400. Normal-read median 8.293 ms, maximum 22.204 ms; DB integrity and reply counts remained correct, no temporary files remained.
+- Chromium posted a hostile-looking benign text thread and a normal sage reply. It found zero injected handlers/malicious image nodes. With JavaScript disabled, 464 replies were reachable exactly once over pages of 201/201/65 posts including the OP; quotes and latest/older navigation worked.
+
+Multiple identities in the mixed tests were emitted by an explicitly configured local trusted proxy fixture; all sockets still went to 127.0.0.1. Direct untrusted-header rejection was tested separately. History bulk data was inserted into the isolated fixture solely for response/navigation verification. These small controlled runs are resilience/regression evidence, not maximum-throughput benchmarks.
+
+## 28. Full validation commands and results
+
+All commands passed on the final implementation using Rust 1.99.0, matching the project toolchain/MSRV.
+
+| Command | Result |
+|---|---|
+| `cargo fmt --all --check` | PASS |
+| `cargo check --workspace --all-targets --all-features` | PASS |
+| `cargo clippy --workspace --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic -D clippy::nursery -D clippy::cargo` | PASS |
+| `cargo test --workspace --all-features` | PASS |
+| `git diff --check` | PASS |
+
+The complete test command passed **1,439 tests with zero failures and seven existing ignored cases in each of the library and CLI suites**, plus five integration tests, one native-update fixture test and one doctest. The two main suites exercise the shared code separately; their totals are not independent unique tests. All new security regressions ran in these suites. Targeted restore/cursor checks also passed during implementation. No test/lint was disabled or broadly suppressed.
+
+Initial validation found an existing PDF preview fixture assuming only SVG despite the documented PNG renderer path; it now validates both outcomes by contents, while dedicated fallback tests remain. A settings-lock test failed once in the baseline and passed in subsequent complete runs without weakening the locking implementation. Earlier implementation/compiler/test-harness failures were repaired; the result table above describes the final source.
+
+## 29. Remaining known limitations
+
+- Per-client fixed windows reset on process restart. Distributed sources, Tor stream rotation and shared NAT identities affect per-client fairness/effectiveness; global work/socket/media/state bounds still apply. Saturated identity tables fail closed until expiry cleanup.
+- Search deadlines are cooperative; native FTS work between checkpoints can exceed 500 ms. Broad legitimate queries can receive a refinement error. Gate overload is retryable 503; the gate uses the existing DbBusy response contract.
+- Native Rust/media-library work is not a process sandbox and cannot universally be forcibly cancelled. Existing decoder/subprocess limits and active-work gates reduce, rather than eliminate, library/allocator/system-level risk.
+- 256 open sockets per listener is a capacity bound, not guaranteed availability against a connection-saturating attacker. Network bandwidth, OS limits and distributed traffic remain outside application-only guarantees. Real local plaintext was exercised; static TLS/ACME compile and existing tests were validated without contacting a public ACME service.
+- No universal disk quota, hard log byte retention or global lifetime report/post quota was added. Sustained admitted traffic can consume storage. Existing board/archive/media retention and backup policies remain operator controlled.
+- Catalog/hidden output and active preference collection cap at 1,000 threads. An oversized legacy/restored board can have additional rows; normal allowed active-board settings fit this cap, and direct/thread/index navigation remains available.
+- Scalar limits are not grapheme limits. Legacy malformed cached HTML uses escaped text and may lose its formatting until edited/restored. Oversized/invalid restored bodies now fail before live publication.
+- Existing optional offline performance profiles remain explicitly ignored by the ordinary suite; crash-child tests marked ignored are invoked by their parent regressions. Snapshot latency/RSS evidence does not establish production peak resource usage.
+
+## 30. Deliberately unchanged
+
+Argon2 strength, board cooldown/CAPTCHA policy, legitimate duplicate-post semantics, report deduplication policy, public route/form/element hooks, configured browsing controls, no-JS flows, upload size/product policy, MIME decoding architecture, media streaming/ranges, staged recovery, and CSP were preserved. No User-Agent blacklist, arbitrary sleep, content censorship, new crate, commit, branch, deployment or external notification was added. The unbounded thread helper remains for offline backup/test consumers; public rendering uses the bounded helper. The final adversarial pass found no alternate unprotected posting/search/asset path.
+
+## Changed files
+
+- `Cargo.toml`
+- `docs/security-attack-surface.md`
+- `docs/security-audit-2026-10-06.md`
+- `docs/security-audit-evidence-2026-10-06.json`
+- `src/captcha.rs`
+- `src/config.rs`
+- `src/db/accounts.rs`
+- `src/db/mod.rs`
+- `src/db/posts.rs`
+- `src/db/search_budget.rs`
+- `src/db/user_thread_prefs.rs`
+- `src/error.rs`
+- `src/handlers/admin/accounts.rs`
+- `src/handlers/admin/auth.rs`
+- `src/handlers/admin/backup/http.rs`
+- `src/handlers/admin/backup/restore_board.rs`
+- `src/handlers/admin/backup/restore_full.rs`
+- `src/handlers/admin/mod.rs`
+- `src/handlers/admin/settings.rs`
+- `src/handlers/admin/settings/appearance.rs`
+- `src/handlers/admin/settings/banners.rs`
+- `src/handlers/admin/settings/board.rs`
+- `src/handlers/admin/updates.rs`
+- `src/handlers/board.rs`
+- `src/handlers/board/access_preferences.rs`
+- `src/handlers/board/catalog.rs`
+- `src/handlers/board/media.rs`
+- `src/handlers/captcha.rs`
+- `src/handlers/mod.rs`
+- `src/handlers/render.rs`
+- `src/handlers/setup.rs`
+- `src/handlers/thread.rs`
+- `src/middleware/csrf.rs`
+- `src/middleware/ip.rs`
+- `src/middleware/mod.rs`
+- `src/middleware/rate_limit.rs`
+- `src/middleware/rate_table.rs`
+- `src/middleware/state.rs`
+- `src/middleware/work_gate.rs`
+- `src/server/server.rs`
+- `src/server/server/connections.rs`
+- `src/server/server/headers.rs`
+- `src/server/server/lifecycle.rs`
+- `src/server/server/router.rs`
+- `src/server/server/router/security_tests.rs`
+- `src/server/server/routes.rs`
+- `src/templates/board.rs`
+- `src/templates/thread.rs`
+- `src/test_fixtures.rs`
+- `src/utils/redirect.rs`
+- `src/utils/sanitize.rs`
+- `static/main.js`
+
+
+## Requirement/evidence cross-check
+
+| Requested phases | Evidence retained |
+|---|---|
+| 1: route inventory before edits | Pre-change 122-route attack-surface document and shared cost/control profiles. |
+| 2–3: sizes and malformed multipart | Native/router boundaries, public/admin parser controls, exact-boundary and stalled-body regressions; actual HTTP rejection results. |
+| 4–6: limiter, floods, reports | Atomic capped tables; separate action budgets; identical/sage posting and report simulations; persistent-state checks. |
+| 7–8: search and SQL | Restricted bound FTS expression, count/page/progress limits, query-plan/result regressions, malformed ID and SQL-looking search data. |
+| 9–10: output contexts and Unicode | Shared rendering review, markup ordering/cache fix, Chromium DOM assertions, text/byte boundaries, NUL and invalid UTF-8 regressions. |
+| 11–14: path/filename/MIME/media bombs | Generated storage identifiers, canonical/archive containment, actual traversal-looking uploads, existing decoder/container/subprocess structural/deadline/cleanup tests. |
+| 15–18: headers/Host/redirect/CSRF | Direct/proxy chain fixtures, wire framing tests, Host/return-path regressions, mutation inventory and scoped-token/cookie/origin tests. |
+| 19–21: expensive parsing/quotes/bots | Bounded markup/FTS/media parsing, no per-marker DB work, independent expensive-action admission and optional CAPTCHA preserved. |
+| 22–26: memory/CPU/disk/DB/responses | Finite state/work/socket/body/output bounds, restore incremental reads and board preflight, temporary cleanup, transaction/rollback/DbBusy tests, no-JS complete history traversal. |
+| 27–30: logs/panics/leaks/admin | Bounded path-only logs, private error regressions, request-reachable panic review, pre-body authorization, transactional rechecks and safe admin rendering. |
+| 31–35: state/defaults/arithmetic/headers/auth | Capped maps/CAPTCHA, startup bounds, cursor/pagination/geometry checks, preserved CSP/cookie/cache policies, password admission and dummy-account verification tests. |
+| 36–38: adversarial regression/load matrix | Deterministic helper/full-router regressions plus local wire, Chromium and 160-request mixed workload evidence. |
+| 39–41: substantive controls/performance/focused cleanup | Backend controls, retained duplicate/no-JS semantics, measured local read/reply latency, no new crate/lint waiver or unrelated architectural rewrite. |
+| Final adversarial pass | Shared/alternate entry-point review; reserved form-route, max-ID, incremental NUL read, board preference and board-restore corrections with regressions. |
diff --git a/docs/security-audit-evidence-2026-10-06.json b/docs/security-audit-evidence-2026-10-06.json
new file mode 100644
index 00000000..67917162
--- /dev/null
+++ b/docs/security-audit-evidence-2026-10-06.json
@@ -0,0 +1,260 @@
+{
+  "scope": {
+    "date": "2026-10-06",
+    "network": "Only 127.0.0.1 local test listener",
+    "data": "Isolated temporary fixture; no production data",
+    "identity_note": "Trusted proxy fixture identities used for independent mixed-load budgets; direct-mode XFF spoof test separate"
+  },
+  "direct_forwarded_spoof": {
+    "case": "direct clients cannot rotate XFF to bypass posting limits",
+    "statuses": [
+      400,
+      400,
+      400,
+      400,
+      400,
+      400,
+      429,
+      429
+    ]
+  },
+  "http": [
+    {
+      "case": "normal board",
+      "status": 200
+    },
+    {
+      "case": "bad Host",
+      "status": 400
+    },
+    {
+      "case": "huge URI",
+      "status": 414
+    },
+    {
+      "case": "oversized declared form",
+      "status": 413
+    },
+    {
+      "case": "cross-site mutation",
+      "status": 403
+    },
+    {
+      "case": "numeric overflow",
+      "status": 400
+    },
+    {
+      "case": "SQL syntax as search data",
+      "status": 200
+    },
+    {
+      "case": "encoded media traversal",
+      "status": 400
+    },
+    {
+      "case": "unauthenticated admin upload",
+      "status": 403
+    },
+    {
+      "case": "cross-site fetch metadata",
+      "status": 403
+    },
+    {
+      "case": "missing boundary",
+      "status": 400
+    },
+    {
+      "case": "truncated multipart",
+      "status": 400
+    },
+    {
+      "case": "duplicate body",
+      "status": 400
+    },
+    {
+      "case": "unknown oversized field",
+      "status": 413
+    },
+    {
+      "case": "invalid UTF8",
+      "status": 400
+    },
+    {
+      "case": "identical-post burst",
+      "statuses": {
+        "303": 6,
+        "429": 4
+      }
+    },
+    {
+      "case": "concurrent search burst",
+      "statuses": {
+        "200": 7,
+        "503": 13,
+        "429": 20
+      },
+      "elapsed_seconds": 0.013
+    },
+    {
+      "case": "TE+CL",
+      "status": 400
+    },
+    {
+      "case": "duplicate Host",
+      "status": 400
+    },
+    {
+      "case": "stalled request head",
+      "elapsed_seconds": 15.003,
+      "closed": true
+    },
+    {
+      "case": "database consistency",
+      "integrity": "ok",
+      "posts": 13,
+      "threads": 13
+    }
+  ],
+  "mixed_load": {
+    "reply_burst": {
+      "303": 30,
+      "429": 5
+    },
+    "reply_latency_median_ms": 3.328,
+    "valid_png_traversal_filename_status": 303,
+    "corrupt_image_statuses": [
+      415,
+      415,
+      415,
+      415
+    ],
+    "mixed_requests": 160,
+    "mixed_statuses": {
+      "200": 88,
+      "503": 12,
+      "429": 30,
+      "400": 30
+    },
+    "mixed_elapsed_seconds": 0.13,
+    "normal_read_median_ms": 8.293,
+    "normal_read_max_ms": 22.204,
+    "database_integrity": "ok",
+    "authoritative_reply_count": 63,
+    "resources_before": {
+      "rss_kib": 40144,
+      "file_count": 11,
+      "disk_bytes": 4590154,
+      "temporary_files": []
+    },
+    "resources_after": {
+      "rss_kib": 53152,
+      "file_count": 11,
+      "disk_bytes": 4593370,
+      "temporary_files": []
+    },
+    "resource_note": "Snapshot RSS, not a sampled peak; SQLite/WAL and accepted post/media growth included."
+  },
+  "browser_sage_reply": {
+    "url": "/audit/thread/1",
+    "posts": 2,
+    "quoteHref": "#p1",
+    "bodyText": "Browser audit\nAnonymous\nID: 2JQIV2O9\n10/06/26(Tue)09:35:22\nNo.1\n>>14\nBenign <img src=x onerror=alert(1)> \" & é 😀 https://example.invalid/safe\nreport\nAnonymous\nID: 2JQIV2O9\n10/06/26(Tue)09:45:05\nNo.14\n(You)\n>>1(OP) Normal reply é 😀 [b]bold[/b]\nreport",
+    "injectedHandlers": 0
+  },
+  "browser_no_javascript_history": {
+    "initial": {
+      "posts": 201,
+      "quoteHref": "/audit/post/77",
+      "injectedHandlers": 0
+    },
+    "javaScriptDisabled": true,
+    "historyPages": 3,
+    "historyPagePostCounts": [
+      201,
+      201,
+      65
+    ],
+    "uniqueReplies": 464,
+    "quoteFocus": true,
+    "latestNavigation": true
+  },
+  "validation": {
+    "status": "passed",
+    "rustc": "rustc 1.99.0 (b940084d7 2026-09-28)",
+    "commands": [
+      {
+        "command": "cargo fmt --all --check",
+        "exit_code": 0,
+        "elapsed_seconds": 2.081,
+        "log": "/tmp/rustchan-release-validation-0.log"
+      },
+      {
+        "command": "cargo check --workspace --all-targets --all-features",
+        "exit_code": 0,
+        "elapsed_seconds": 7.379,
+        "log": "/tmp/rustchan-release-validation-1.log"
+      },
+      {
+        "command": "cargo clippy --workspace --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic -D clippy::nursery -D clippy::cargo",
+        "exit_code": 0,
+        "elapsed_seconds": 12.071,
+        "log": "/tmp/rustchan-release-validation-2.log"
+      },
+      {
+        "command": "cargo test --workspace --all-features",
+        "exit_code": 0,
+        "elapsed_seconds": 118.838,
+        "log": "/tmp/rustchan-release-validation-3.log"
+      },
+      {
+        "command": "git diff --check",
+        "exit_code": 0,
+        "elapsed_seconds": 0.024,
+        "log": "/tmp/rustchan-release-validation-4.log"
+      }
+    ],
+    "suites": [
+      {
+        "suite": "library",
+        "passed": 1439,
+        "failed": 0,
+        "ignored": 7
+      },
+      {
+        "suite": "CLI binary",
+        "passed": 1439,
+        "failed": 0,
+        "ignored": 7
+      },
+      {
+        "suite": "integration",
+        "passed": 5,
+        "failed": 0,
+        "ignored": 0
+      },
+      {
+        "suite": "native-update fixture",
+        "passed": 1,
+        "failed": 0,
+        "ignored": 0
+      },
+      {
+        "suite": "doctest",
+        "passed": 1,
+        "failed": 0,
+        "ignored": 0
+      }
+    ],
+    "additional_targeted_checks": [
+      "maximum SQLite post-ID focus",
+      "incremental restore Unicode/NUL/invalid UTF-8/empty-body bounds",
+      "board restore rejection before filesystem/database mutation"
+    ],
+    "local_fixture_cleanup": "Named browser and test server closed; isolated data directory removed."
+  },
+  "notes": [
+    "Latencies are local fixture observations, not capacity benchmarks.",
+    "RSS measurements are snapshots, not sampled peaks.",
+    "HTTP/browser tests ran the built audit binary; later restore/authentication/metadata regressions are verified in the final full Rust suite."
+  ]
+}
diff --git a/docs/strict-lint-exceptions.tsv b/docs/strict-lint-exceptions.tsv
index aa34f802..58c2e3e8 100644
--- a/docs/strict-lint-exceptions.tsv
+++ b/docs/strict-lint-exceptions.tsv
@@ -341,7 +341,6 @@ src/workers/mod.rs	1380	expect	clippy::cognitive_complexity	source validation an
 src/workers/mod.rs	1551	expect	clippy::too_many_arguments	the finalisation boundary carries the durable job and all validated filesystem identities	fn transcode_video_finalise
 src/workers/mod.rs	1593	expect	clippy::too_many_arguments	output installation and atomic DB completion require the full validated transcode identity	fn persist_transcoded_webm
 src/workers/mod.rs	1934	expect	clippy::too_many_arguments	the finalisation boundary explicitly carries all validated paths and DB identity	fn waveform_finalise
-src/workers/mod.rs	2115	expect	clippy::cognitive_complexity	archive, prune, and filesystem finalization remain one consistency operation	fn prune_threads
 src/workers/mod.rs	2561	expect	clippy::cognitive_complexity,clippy::too_many_lines	the bounded legacy-state matrix is intentionally explicit	fn reconcile_media_job_states
 src/workers/mod.rs	3050	expect	clippy::expect_used	test database queries stop locally with fixture-specific failure context	fn file_hash_count
 src/workers/mod.rs	3227	expect	clippy::expect_used	fixture setup failures should stop this queue durability test	fn required_thread_prune_bypasses_capacity_and_survives_queue_recreation
diff --git a/docs/thread-archive-audit.md b/docs/thread-archive-audit.md
new file mode 100644
index 00000000..c5dc5de9
--- /dev/null
+++ b/docs/thread-archive-audit.md
@@ -0,0 +1,255 @@
+# Thread/archive production-readiness audit
+
+## Architecture before changes
+
+Threads remain in `threads` with an `archived` boolean; posts, polls, submission
+tokens and media references stay in place. There is no separate archive table,
+archive timestamp, time-based expiry, or public unarchive action. The internal
+unarchive helper preserves the lock until explicitly unlocked.
+
+Public thread creation commits the thread, OP, optional poll, file publication
+intent and coalesced durable `thread_prune` job in one immediate transaction.
+Replies serialize thread state, reply count and bump-limit checks under SQLite's
+write lock. Sage replies increment the count without bumping. Reaching the bump
+limit stops future bumps; it does not itself archive a thread. Deleting replies
+reduces the reply count but preserves bump time. Deleting the OP deletes its thread.
+
+`workers::prune_threads` loads current board settings and archives overflow
+non-sticky active threads by descending bump time. Sticky active threads do not
+consume `max_threads`; locked threads do. Archiving atomically sets archived and
+locked. `allow_archive || CONFIG.archive_before_prune` decides whether active
+overflow is archived or deleted. The global safety net defaults to true.
+Startup and periodic bounded reconciliation schedule any outstanding overflow;
+creation and moderation can temporarily exceed limits pending maintenance.
+
+Archive retention is a count cap, `max_archived_threads`, not a duration. All
+archived threads, including manually archived sticky threads, participate; sticky
+is not an archive preservation flag. Retention keeps most recently bumped
+content, not most recently manually archived content. Deletion cascades database
+references and commits a durable file-delete intent after checking all remaining
+references. Filesystem replay checks references again and resumes after restart.
+Archiving itself neither moves nor deletes media. Active-media pruning excludes
+archives, and the normal media reconciliation pipeline remains authoritative.
+
+`/{board}/archive` lists 20 threads per numbered page. It paginates threads before
+aggregating post/media counts. `/{board}/thread/{id}` remains the stable URL across
+archival and shares the active renderer, quoting, escaping, thumbnails and CSP.
+Thread loads check the actual board. Board-password gates apply to archive,
+thread, search and media routes. Catalog, index and unread history exclude
+archives; board FTS and admin searches include archived posts. Replies and owner
+edit/delete controls reject archived content under the write lock.
+
+Administrators can archive and delete threads using session, origin and CSRF
+checks. No moderator-scoped role or preservation/unarchive UI exists. Board
+limits are exposed through established board settings; global archive policy
+uses TOML/environment configuration. Workers validate limits before deletion.
+
+## Findings and implementation evidence
+
+| Problem and root cause | Repair | Regression coverage |
+| --- | --- | --- |
+| Equal bump timestamps had no explicit retention tie-breaker, allowing planner choice to disagree with visible ordering. | Active retention uses `bumped_at DESC, id DESC`; archive retention uses the existing archive order, `bumped_at DESC, id ASC`. | `archive_threshold_ties_sticky_locked_and_idempotency`, `live_deletion_ties_keep_the_visible_newest_threads`, `archive_pages_and_retention_share_tie_order_and_search_survives` |
+| Maintenance read policy before acquiring its write lock, then archived and pruned in separate transactions. A failed prune could leave a partially completed maintenance pass. | Read current policy, archive/live-prune, archive-cap pruning and file intents under one immediate transaction; finalize files after commit. | `archive_and_prune_worker_rolls_back_as_one_operation`, `combined_retention_failure_rolls_back_archive_transition`, existing `delayed_prune_uses_only_current_limits` and `delayed_prune_uses_current_archived_limit` |
+| Overflow recovery built an unbounded SQLite parameter list. Large restored/backlogged boards could fail maintenance. | Archive using a parameterized selection subquery; batch file collection and deletion into at most 500 IDs per statement. | `archive_recovery_handles_more_than_sqlite_parameter_limit` uses 33,000 threads. |
+| Hand-written archive/prune transactions relied on individual rollback/commit paths. | RAII transactions roll back on body or commit failure and release the write lock. | `failed_archive_commit_releases_the_lock_and_rolls_back`, `archive_busy_failure_and_restart_are_recoverable`, `process_interruption_during_archive_recovers_without_content_loss` |
+| Invalid administrator retention values were clamped to one or defaulted to 150, potentially deleting content; omitted fields reset existing caps. Direct DB callers also lacked destructive-limit validation. | Reject invalid explicit values with HTTP 400; preserve omitted caps; validate again at the archive/prune DB boundary. | `retention_settings_reject_invalid_values_and_preserve_omitted_limits`, `invalid_retention_http_settings_cannot_reduce_saved_caps`, `destructive_limits_fail_closed_at_database_boundary`; browser settings rejection assertions |
+| Existing/manual/safety-net archives became inaccessible through the archive index when `allow_archive` was false. Navigation used the same incorrect condition. | Archive access and navigation are independent of automatic overflow policy. | `archive_index_remains_accessible_when_overflow_archiving_is_disabled`; browser automatic/manual archival scenarios |
+| Archived polls still offered voting and accepted mutations, despite the thread being read-only. | Render poll results and `[archived]`; enforce `threads.archived=0` inside the vote INSERT itself. | `archived_poll_is_read_only_in_thread_and_vote_route`, extended vote membership/expiry regression, browser poll rejection assertions |
+| Manual moderation could succeed without an audit record, and archive logs used the supplied board name. Manual archive/unsticky changes lacked an immediate durable retention request. | Session authorization, state mutation, canonical archive log and retention intent commit together. | `manual_archive_rolls_back_when_audit_logging_fails`; browser anonymous/CSRF rejection and forged-board audit/redirect checks |
+| Archive counts and rows were separate snapshots; access preflight could become stale during a password change. | Revalidate board access and read board/count/page under one SQLite read snapshot. | `archived_pages_enforce_board_view_passwords` checks protected archive and stable thread URLs, forged cookies and post-password viewability; pagination regressions |
+| Archived replies were reported as merely locked because that check ran first. | Prioritize archive status during preflight and the authoritative reply write check. | Extended `reply_rechecks_thread_state_after_independent_preparation`; browser checks the precise archived error. |
+
+These changes preserve background enforcement: the active cap is authoritative
+when maintenance runs, not a synchronous cap on thread creation. Sticky active
+threads remain exempt, locked active threads remain eligible, and archived sticky
+threads remain subject to archive retention. No time-based expiry, preservation
+flag, separate archive table, or reopening interface was introduced.
+
+## Database, concurrency and recovery
+
+The only schema change replaces `idx_threads_board_sticky_bumped` with:
+
+```sql
+CREATE INDEX idx_threads_active_order
+ON threads(board_id, sticky DESC, bumped_at DESC, id DESC)
+WHERE archived = 0;
+```
+
+The existing strict schema-repair path recognizes the exact legacy index,
+installs the replacement and removes the redundant old index in its migration
+transaction. The existing upgrade regression reconstructs that legacy schema and
+verifies data survives repair. No columns, foreign keys or dependency versions
+changed. The existing archive index continues to support archive pagination and
+retention order.
+
+File-backed WAL tests race creators, replies and maintenance, and race
+stickying/locking/deleting against archival. SQLite write transactions determine
+the outcome; no application-wide mutex was added. Two overlapping worker passes
+converge to the same caps. Tests also exercise lock contention, failed DELETE
+triggers, deferred-foreign-key commit failure, reopening the database, and a
+subprocess killed after its archive UPDATE but before commit. The latter verifies
+the original active state returns intact and maintenance can safely retry.
+
+New concurrency tests are
+`overlapping_creators_and_archive_passes_preserve_every_thread`,
+`concurrent_oldest_reply_and_archive_obey_the_committed_bump`, and
+`concurrent_moderation_and_archive_are_serialized_by_sqlite`.
+`sage_bump_limit_and_deleted_replies_preserve_archive_order` verifies sage,
+bump-limit and reply-deletion behavior, including rejection of archived replies
+even if an administrator clears the lock flag.
+
+## Media, routing, search and security
+
+Archive rendering uses the existing shared post renderer. The new
+`archived_media_and_markup_use_the_same_safe_post_renderer` compares active and
+archived reply output for image, video, audio, PDF, other-file and legacy media,
+including companion audio, quotes, spoilers and hostile names/filenames.
+`archived_media_survives_and_shared_paths_are_never_pruned` verifies archival
+preserves references and retention never schedules deletion of a shared original,
+thumbnail or companion audio path.
+
+The unchanged media subsystem already tests missing-thumbnail fallback, pruned
+originals, processing failures, HTTP validators/ranges, legacy redirects,
+reference rechecks and interrupted durable cleanup. Those regressions are
+included in the full test suite. Board restore rerenders `body_html` from escaped
+raw body through the shared sanitizer; it does not trust archived HTML supplied
+by a board-backup manifest. No separate archive rendering or conversion pipeline
+was added.
+
+Stable thread URLs remain valid after archival; wrong-board, negative,
+nonexistent and pruned IDs fail through the existing route checks. Board archive
+and archived thread pages retain view-password protection. Poll voting is now
+read-only at the SQL write boundary. Administrator actions retain session,
+origin and CSRF enforcement and now fail atomically when audit logging fails.
+Archive requests remain parameterized, user display fields stay escaped, media
+delivery retains path validation, and the existing CSP is unchanged.
+
+Search still includes archives and uses the existing FTS index. Index, catalog
+and unread activity still exclude archives. Pruning removes searchable posts
+through existing cascades/triggers. No cache of archive rows was introduced;
+cookie-dependent responses retain `Vary: Cookie`.
+
+## Archive UI and administration
+
+Archive navigation is always discoverable from board/index/catalog views. Rows
+show thread number, state, reply and attachment counts, creation and last-bump
+times. The page states its actual retention cap; empty-state copy is clearer.
+Decorative thumbnails use empty alternative text and archive rows have visible
+theme-aware keyboard focus outlines. Existing routes, numbered pagination,
+element hooks, progressive enhancement and no-JS browsing are preserved.
+
+Administrator guidance now explicitly says lowering the archive cap permanently
+prunes overflow, archived sticky threads are included, and the global safety net
+can override the automatic-archive checkbox. `SETUP.md` documents creation,
+sage/bump limits, count retention, media cleanup, manual moderation, search and
+live versus restart-required policy changes. The generated TOML comment correctly
+describes in-place archival rather than a nonexistent archive table.
+
+## Performance evidence
+
+The explicit `archive_query_profile` test uses 10,000 threads and 210,000 posts,
+including 9,900 archived threads. Both index candidates receive `ANALYZE` before
+comparison. These local Rust 1.99/SQLite debug-build measurements are illustrative,
+not production latency guarantees.
+
+| Operation | Evidence |
+| --- | --- |
+| 200 active-retention selections before | 13.903 ms; `SEARCH threads USING INDEX idx_threads_archived (board_id=? AND archived=?)`, then `USE TEMP B-TREE FOR LAST TERM OF ORDER BY` |
+| 200 selections after | 6.169 ms; `SEARCH threads USING COVERING INDEX idx_threads_active_order (board_id=? AND sticky=?)`; no temporary sort, approximately 2.25× faster |
+| Archive page, offset 0 | 4.328 ms for 20 loads, approximately 0.216 ms/page |
+| Archive page, offset 5,000 | 52.855 ms for 20 loads, approximately 2.643 ms/page |
+| Archive page, offset 9,880 | 99.045 ms for 20 loads, approximately 4.952 ms/page |
+| Archived thread and posts | 0.404 ms |
+| FTS search including archives | 11.893 ms |
+| Archive plus retention deleting 950 threads/19,950 posts | 268.596 ms |
+
+Deep OFFSET cost increases, but the validated archive cap is 10,000 and this
+measured cost does not justify replacing established numbered URLs with cursors.
+The page-first aggregation remains in place. Separately, the 33,000-thread test
+proves backlog maintenance avoids the SQLite bind-parameter scaling trap.
+
+Reproduce profiling with:
+
+```sh
+RUSTCHAN_ARCHIVE_EVIDENCE=/tmp/rustchan-archive-performance.txt \
+  cargo test --locked --lib db::threads::archive_tests::archive_query_profile \
+  --all-features -- --ignored --exact
+```
+
+## Files changed
+
+- `src/db/threads.rs` and new `src/db/threads/archive_tests.rs`: transitions, deterministic pruning, batching, boundary validation and lifecycle tests.
+- `src/db/schema.rs`: partial active-order index and legacy upgrade regression.
+- `src/db/posts.rs`: atomic archived-poll vote rejection.
+- `src/workers/mod.rs`: atomic current-policy retention and worker rollback regression.
+- `src/handlers/admin/content.rs`: atomic audited moderation and retention scheduling.
+- `src/handlers/admin/settings/board.rs`: safe retention parsing and handler regressions.
+- `src/handlers/board/catalog.rs` and `src/handlers/board/tests.rs`: archive accessibility, consistent authorized snapshot and routing regressions.
+- `src/handlers/posting.rs` and `src/handlers/thread.rs`: precise archived reply/vote errors.
+- `src/templates/board.rs`, `src/templates/thread.rs`, `src/templates/admin.rs`, `static/style.css`: archive metadata, navigation, read-only polls, administrator guidance and focus styling.
+- `src/config/template.rs`, `SETUP.md`, `docs/thread-archive-audit.md`: corrected policy/operational documentation and audit evidence.
+- `docs/strict-lint-exceptions.tsv`: remove the worker complexity expectation made obsolete by the focused simplification.
+
+The new `tests/e2e/archive-production.spec.ts` stays local, as required by the
+repository's existing Playwright ignore/check policy. No browser harness,
+package manifest or tooling is force-added to Git.
+
+## Validation results
+
+Validated on macOS with `rustc 1.99.0 (b940084d7 2026-09-28)`.
+
+| Command | Result |
+| --- | --- |
+| `cargo fmt --all --check` | Passed |
+| `cargo check --locked --workspace --all-targets --all-features` | Passed |
+| `cargo clippy --workspace --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic -D clippy::nursery -D clippy::cargo` | Passed; no new lint allowances |
+| `cargo test --workspace --all-features` | Passed: 1,376 unit tests in each library/binary target, six integration tests and one doctest; zero failures. Seven tests are explicitly ignored in each unit target. The archive profiler was run separately; the interrupted child helper runs through its parent regression. |
+| `cargo test --locked --lib db::threads::archive_tests --all-features` | Passed: 14 regressions; profiler and subprocess helper intentionally ignored |
+| Explicit ignored archive profiler command above | Passed; before/after evidence recorded in this report |
+| `RUSTDOCFLAGS='-D warnings' cargo doc --locked --workspace --all-features --no-deps` | Passed |
+| `cargo deny --locked check` | Passed advisories, bans, licenses and sources; existing missing-license metadata for `captcha` and duplicate-version warnings remain. Dependencies were unchanged. |
+| `python3 tools/check_local_tooling.py` | Passed; local browser tooling remains untracked |
+| `git diff --check` | Passed |
+
+Browser validation used the existing local isolated-runtime Playwright harness:
+
+```sh
+RUSTCHAN_E2E_SKIP_BUILD=1 RUSTCHAN_AUDIT_OUTPUT=output/playwright/archive-final \
+  npx playwright test tests/e2e/archive-production.spec.ts --workers=2
+RUSTCHAN_E2E_SKIP_BUILD=1 RUSTCHAN_AUDIT_OUTPUT=output/playwright/archive-existing-final \
+  npx playwright test tests/e2e/settings.spec.ts --grep 'bump/archive|thread sage' \
+  --project=chromium --workers=2
+RUSTCHAN_E2E_SKIP_BUILD=1 RUSTCHAN_AUDIT_OUTPUT=output/playwright/archive-backlinks-final \
+  npx playwright test tests/e2e/archive-production.spec.ts --grep 'automatic archival' \
+  --workers=2
+```
+
+Results: 14/14 new scenarios across Chromium, WebKit, Firefox, mobile Firefox,
+mobile WebKit, Firefox without JS and Chromium without JS; 2/2 unchanged existing
+archive scenarios; 7/7 final automatic-archive scenarios after adding explicit
+backlink navigation. Coverage includes real image uploads, automatic archival,
+stable URLs, quotes/backlinks, media loading, search, pagination, restart, denied
+replies/votes, manual moderation authorization/CSRF/canonical audit logs and
+invalid settings. All nine built-in themes were checked at 1,280 and 390 pixels,
+with overflow/focus assertions and visual screenshot review. No existing test or
+diagnostic assertion was weakened.
+
+One earlier parallel full-suite run hit a transient lock-acquisition failure in
+the unchanged `config::admin::tests::atomic_save_validates_before_mutation_and_does_not_change_active_config`
+test. The complete default-parallelism rerun passed. This was recorded rather
+than changing unrelated configuration behavior or suppressing that test.
+
+## Remaining limitations
+
+- Creation can temporarily exceed the active cap while its durable maintenance
+  job is pending. Failure/retry/reconciliation remain operational concerns.
+- Archives are capped by count and bump order. There is no permanent/protected
+  archive mode, archive timestamp, time retention or public reopening control.
+- File removal follows the committed database transition through durable cleanup
+  and reference checks. It cannot be one atomic transaction across SQLite and
+  the filesystem; failures remain queued and logged for replay.
+- The interrupted-process regression tests SQLite recovery from process death,
+  not physical power loss or every storage failure. Invalid retention policy
+  fails closed; this audit does not invent an automatic corrupted-database repair.
+- Timing evidence is from this machine and debug fixtures. Deployments should
+  monitor maintenance backlog and SQLite contention under their own workloads.
diff --git a/docs/thumbnail-evidence/browser-baseline.json b/docs/thumbnail-evidence/browser-baseline.json
new file mode 100644
index 00000000..93baa40e
--- /dev/null
+++ b/docs/thumbnail-evidence/browser-baseline.json
@@ -0,0 +1,433 @@
+{
+  "browser": "153.0.8010.12",
+  "thumbnail_bytes": 33016,
+  "unique_thumbnail_requests_after_full_scroll": 65,
+  "samples": [
+    {
+      "posts_with_images": 0,
+      "sample": 0,
+      "state": "cold-browser-cache",
+      "thumbnail_elements": 0,
+      "loaded_elements_including_repeated_urls": 0,
+      "browser_media_response_events": 0,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 0,
+      "thumbnail_resource_entries": 0,
+      "thumbnail_resource_unique_urls": 0,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 0,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 13.5,
+      "navigation_dom_content_loaded_ms": 12.800000011920929,
+      "resource_duration_ms": []
+    },
+    {
+      "posts_with_images": 0,
+      "sample": 1,
+      "state": "warm",
+      "thumbnail_elements": 0,
+      "loaded_elements_including_repeated_urls": 0,
+      "browser_media_response_events": 0,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 0,
+      "thumbnail_resource_entries": 0,
+      "thumbnail_resource_unique_urls": 0,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 0,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 10.700000047683716,
+      "navigation_dom_content_loaded_ms": 9.600000023841858,
+      "resource_duration_ms": []
+    },
+    {
+      "posts_with_images": 0,
+      "sample": 2,
+      "state": "warm",
+      "thumbnail_elements": 0,
+      "loaded_elements_including_repeated_urls": 0,
+      "browser_media_response_events": 0,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 0,
+      "thumbnail_resource_entries": 0,
+      "thumbnail_resource_unique_urls": 0,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 0,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 13.100000023841858,
+      "navigation_dom_content_loaded_ms": 12.100000023841858,
+      "resource_duration_ms": []
+    },
+    {
+      "posts_with_images": 0,
+      "sample": 3,
+      "state": "warm",
+      "thumbnail_elements": 0,
+      "loaded_elements_including_repeated_urls": 0,
+      "browser_media_response_events": 0,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 0,
+      "thumbnail_resource_entries": 0,
+      "thumbnail_resource_unique_urls": 0,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 0,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 13.099999964237213,
+      "navigation_dom_content_loaded_ms": 12,
+      "resource_duration_ms": []
+    },
+    {
+      "posts_with_images": 0,
+      "sample": 4,
+      "state": "warm",
+      "thumbnail_elements": 0,
+      "loaded_elements_including_repeated_urls": 0,
+      "browser_media_response_events": 0,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 0,
+      "thumbnail_resource_entries": 0,
+      "thumbnail_resource_unique_urls": 0,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 0,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 13.199999988079071,
+      "navigation_dom_content_loaded_ms": 12.100000023841858,
+      "resource_duration_ms": []
+    },
+    {
+      "posts_with_images": 4,
+      "sample": 0,
+      "state": "cold-browser-cache",
+      "thumbnail_elements": 4,
+      "loaded_elements_including_repeated_urls": 4,
+      "browser_media_response_events": 4,
+      "uncached_media_responses": 4,
+      "cached_media_responses": 0,
+      "thumbnail_resource_entries": 4,
+      "thumbnail_resource_unique_urls": 4,
+      "resource_timing_transfer_bytes": 133264,
+      "resource_timing_encoded_body_bytes": 132064,
+      "cdp_encoded_transfer_bytes": 135536,
+      "navigation_load_event_end_ms": 20.899999976158142,
+      "navigation_dom_content_loaded_ms": 19.600000023841858,
+      "resource_duration_ms": [
+        4.899999976158142,
+        2.099999964237213,
+        2.299999952316284,
+        2.100000023841858
+      ]
+    },
+    {
+      "posts_with_images": 4,
+      "sample": 1,
+      "state": "warm",
+      "thumbnail_elements": 4,
+      "loaded_elements_including_repeated_urls": 4,
+      "browser_media_response_events": 4,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 4,
+      "thumbnail_resource_entries": 4,
+      "thumbnail_resource_unique_urls": 4,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 132064,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 14.900000035762787,
+      "navigation_dom_content_loaded_ms": 13.700000047683716,
+      "resource_duration_ms": [
+        0,
+        0,
+        0,
+        0
+      ]
+    },
+    {
+      "posts_with_images": 4,
+      "sample": 2,
+      "state": "warm",
+      "thumbnail_elements": 4,
+      "loaded_elements_including_repeated_urls": 4,
+      "browser_media_response_events": 4,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 4,
+      "thumbnail_resource_entries": 4,
+      "thumbnail_resource_unique_urls": 4,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 132064,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 14.899999976158142,
+      "navigation_dom_content_loaded_ms": 13.600000023841858,
+      "resource_duration_ms": [
+        0,
+        0,
+        0,
+        0
+      ]
+    },
+    {
+      "posts_with_images": 4,
+      "sample": 3,
+      "state": "warm",
+      "thumbnail_elements": 4,
+      "loaded_elements_including_repeated_urls": 4,
+      "browser_media_response_events": 4,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 4,
+      "thumbnail_resource_entries": 4,
+      "thumbnail_resource_unique_urls": 4,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 132064,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 15.800000011920929,
+      "navigation_dom_content_loaded_ms": 14.5,
+      "resource_duration_ms": [
+        0,
+        0,
+        0,
+        0
+      ]
+    },
+    {
+      "posts_with_images": 4,
+      "sample": 4,
+      "state": "warm",
+      "thumbnail_elements": 4,
+      "loaded_elements_including_repeated_urls": 4,
+      "browser_media_response_events": 4,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 4,
+      "thumbnail_resource_entries": 4,
+      "thumbnail_resource_unique_urls": 4,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 132064,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 18.80000001192093,
+      "navigation_dom_content_loaded_ms": 17.100000023841858,
+      "resource_duration_ms": [
+        0,
+        0,
+        0,
+        0
+      ]
+    },
+    {
+      "posts_with_images": 128,
+      "sample": 0,
+      "state": "cold-browser-cache",
+      "thumbnail_elements": 128,
+      "loaded_elements_including_repeated_urls": 49,
+      "browser_media_response_events": 25,
+      "uncached_media_responses": 25,
+      "cached_media_responses": 0,
+      "thumbnail_resource_entries": 25,
+      "thumbnail_resource_unique_urls": 25,
+      "resource_timing_transfer_bytes": 832900,
+      "resource_timing_encoded_body_bytes": 825400,
+      "cdp_encoded_transfer_bytes": 847100,
+      "navigation_load_event_end_ms": 52,
+      "navigation_dom_content_loaded_ms": 45.09999996423721,
+      "resource_duration_ms": [
+        5,
+        3.100000023841858,
+        5.199999988079071,
+        3.599999964237213,
+        4.899999976158142,
+        5,
+        5.099999964237213,
+        5.099999964237213,
+        6.299999952316284,
+        7.600000023841858,
+        7.400000035762787,
+        7.5,
+        7.800000011920929,
+        7,
+        7.800000011920929,
+        9.800000011920929,
+        9.800000011920929,
+        9.899999976158142,
+        9.400000035762787,
+        9.800000011920929,
+        9.600000023841858,
+        10.600000023841858,
+        11.400000035762787,
+        11.100000023841858,
+        11.300000011920929
+      ]
+    },
+    {
+      "posts_with_images": 128,
+      "sample": 1,
+      "state": "warm",
+      "thumbnail_elements": 128,
+      "loaded_elements_including_repeated_urls": 49,
+      "browser_media_response_events": 25,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 25,
+      "thumbnail_resource_entries": 25,
+      "thumbnail_resource_unique_urls": 25,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 825400,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 48.19999998807907,
+      "navigation_dom_content_loaded_ms": 41.19999998807907,
+      "resource_duration_ms": [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0
+      ]
+    },
+    {
+      "posts_with_images": 128,
+      "sample": 2,
+      "state": "warm",
+      "thumbnail_elements": 128,
+      "loaded_elements_including_repeated_urls": 49,
+      "browser_media_response_events": 25,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 25,
+      "thumbnail_resource_entries": 25,
+      "thumbnail_resource_unique_urls": 25,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 825400,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 48.39999997615814,
+      "navigation_dom_content_loaded_ms": 41.39999997615814,
+      "resource_duration_ms": [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0
+      ]
+    },
+    {
+      "posts_with_images": 128,
+      "sample": 3,
+      "state": "warm",
+      "thumbnail_elements": 128,
+      "loaded_elements_including_repeated_urls": 49,
+      "browser_media_response_events": 25,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 25,
+      "thumbnail_resource_entries": 25,
+      "thumbnail_resource_unique_urls": 25,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 825400,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 47.09999996423721,
+      "navigation_dom_content_loaded_ms": 40,
+      "resource_duration_ms": [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0
+      ]
+    },
+    {
+      "posts_with_images": 128,
+      "sample": 4,
+      "state": "warm",
+      "thumbnail_elements": 128,
+      "loaded_elements_including_repeated_urls": 49,
+      "browser_media_response_events": 25,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 25,
+      "thumbnail_resource_entries": 25,
+      "thumbnail_resource_unique_urls": 25,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 825400,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 51.19999998807907,
+      "navigation_dom_content_loaded_ms": 40.80000001192093,
+      "resource_duration_ms": [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0
+      ]
+    }
+  ],
+  "limitations": "Debug server, local loopback HTTP, synthetic 1024x768 gradient source, 250px lossless WebP preview, 128 posts share 65 unique URLs. Initial viewport measured for 500ms after load. Browser setup/CDP overhead; cold browser cache, warm server/OS cache. Resource Timing adds an estimated 300-byte header cost; CDP records transfer separately. Load-event timings are observations, not isolated proof of frontend speedup. Original loaded only after click; missing/corrupt fallback and missing-file recovery asserted. Raw output remains in local output/playwright and /tmp."
+}
diff --git a/docs/thumbnail-evidence/browser-final.json b/docs/thumbnail-evidence/browser-final.json
new file mode 100644
index 00000000..f6bcefdc
--- /dev/null
+++ b/docs/thumbnail-evidence/browser-final.json
@@ -0,0 +1,433 @@
+{
+  "browser": "153.0.8010.12",
+  "thumbnail_bytes": 33016,
+  "unique_thumbnail_requests_after_full_scroll": 65,
+  "samples": [
+    {
+      "posts_with_images": 0,
+      "sample": 0,
+      "state": "cold-browser-cache",
+      "thumbnail_elements": 0,
+      "loaded_elements_including_repeated_urls": 0,
+      "browser_media_response_events": 0,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 0,
+      "thumbnail_resource_entries": 0,
+      "thumbnail_resource_unique_urls": 0,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 0,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 13.099999964237213,
+      "navigation_dom_content_loaded_ms": 12.299999952316284,
+      "resource_duration_ms": []
+    },
+    {
+      "posts_with_images": 0,
+      "sample": 1,
+      "state": "warm",
+      "thumbnail_elements": 0,
+      "loaded_elements_including_repeated_urls": 0,
+      "browser_media_response_events": 0,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 0,
+      "thumbnail_resource_entries": 0,
+      "thumbnail_resource_unique_urls": 0,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 0,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 13.300000011920929,
+      "navigation_dom_content_loaded_ms": 12.400000035762787,
+      "resource_duration_ms": []
+    },
+    {
+      "posts_with_images": 0,
+      "sample": 2,
+      "state": "warm",
+      "thumbnail_elements": 0,
+      "loaded_elements_including_repeated_urls": 0,
+      "browser_media_response_events": 0,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 0,
+      "thumbnail_resource_entries": 0,
+      "thumbnail_resource_unique_urls": 0,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 0,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 14.199999988079071,
+      "navigation_dom_content_loaded_ms": 13.199999988079071,
+      "resource_duration_ms": []
+    },
+    {
+      "posts_with_images": 0,
+      "sample": 3,
+      "state": "warm",
+      "thumbnail_elements": 0,
+      "loaded_elements_including_repeated_urls": 0,
+      "browser_media_response_events": 0,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 0,
+      "thumbnail_resource_entries": 0,
+      "thumbnail_resource_unique_urls": 0,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 0,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 15,
+      "navigation_dom_content_loaded_ms": 14,
+      "resource_duration_ms": []
+    },
+    {
+      "posts_with_images": 0,
+      "sample": 4,
+      "state": "warm",
+      "thumbnail_elements": 0,
+      "loaded_elements_including_repeated_urls": 0,
+      "browser_media_response_events": 0,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 0,
+      "thumbnail_resource_entries": 0,
+      "thumbnail_resource_unique_urls": 0,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 0,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 12.799999952316284,
+      "navigation_dom_content_loaded_ms": 11.799999952316284,
+      "resource_duration_ms": []
+    },
+    {
+      "posts_with_images": 4,
+      "sample": 0,
+      "state": "cold-browser-cache",
+      "thumbnail_elements": 4,
+      "loaded_elements_including_repeated_urls": 4,
+      "browser_media_response_events": 4,
+      "uncached_media_responses": 4,
+      "cached_media_responses": 0,
+      "thumbnail_resource_entries": 4,
+      "thumbnail_resource_unique_urls": 4,
+      "resource_timing_transfer_bytes": 133264,
+      "resource_timing_encoded_body_bytes": 132064,
+      "cdp_encoded_transfer_bytes": 135536,
+      "navigation_load_event_end_ms": 20.399999976158142,
+      "navigation_dom_content_loaded_ms": 19.19999998807907,
+      "resource_duration_ms": [
+        5.300000011920929,
+        2.400000035762787,
+        2.900000035762787,
+        3
+      ]
+    },
+    {
+      "posts_with_images": 4,
+      "sample": 1,
+      "state": "warm",
+      "thumbnail_elements": 4,
+      "loaded_elements_including_repeated_urls": 4,
+      "browser_media_response_events": 4,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 4,
+      "thumbnail_resource_entries": 4,
+      "thumbnail_resource_unique_urls": 4,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 132064,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 10,
+      "navigation_dom_content_loaded_ms": 9.199999988079071,
+      "resource_duration_ms": [
+        0,
+        0,
+        0,
+        0
+      ]
+    },
+    {
+      "posts_with_images": 4,
+      "sample": 2,
+      "state": "warm",
+      "thumbnail_elements": 4,
+      "loaded_elements_including_repeated_urls": 4,
+      "browser_media_response_events": 4,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 4,
+      "thumbnail_resource_entries": 4,
+      "thumbnail_resource_unique_urls": 4,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 132064,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 13,
+      "navigation_dom_content_loaded_ms": 11.800000011920929,
+      "resource_duration_ms": [
+        0,
+        0,
+        0,
+        0
+      ]
+    },
+    {
+      "posts_with_images": 4,
+      "sample": 3,
+      "state": "warm",
+      "thumbnail_elements": 4,
+      "loaded_elements_including_repeated_urls": 4,
+      "browser_media_response_events": 4,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 4,
+      "thumbnail_resource_entries": 4,
+      "thumbnail_resource_unique_urls": 4,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 132064,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 9.399999976158142,
+      "navigation_dom_content_loaded_ms": 8.5,
+      "resource_duration_ms": [
+        0,
+        0,
+        0,
+        0
+      ]
+    },
+    {
+      "posts_with_images": 4,
+      "sample": 4,
+      "state": "warm",
+      "thumbnail_elements": 4,
+      "loaded_elements_including_repeated_urls": 4,
+      "browser_media_response_events": 4,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 4,
+      "thumbnail_resource_entries": 4,
+      "thumbnail_resource_unique_urls": 4,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 132064,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 9.800000011920929,
+      "navigation_dom_content_loaded_ms": 8.899999976158142,
+      "resource_duration_ms": [
+        0,
+        0,
+        0,
+        0
+      ]
+    },
+    {
+      "posts_with_images": 128,
+      "sample": 0,
+      "state": "cold-browser-cache",
+      "thumbnail_elements": 128,
+      "loaded_elements_including_repeated_urls": 49,
+      "browser_media_response_events": 25,
+      "uncached_media_responses": 25,
+      "cached_media_responses": 0,
+      "thumbnail_resource_entries": 25,
+      "thumbnail_resource_unique_urls": 25,
+      "resource_timing_transfer_bytes": 832900,
+      "resource_timing_encoded_body_bytes": 825400,
+      "cdp_encoded_transfer_bytes": 847100,
+      "navigation_load_event_end_ms": 52.80000001192093,
+      "navigation_dom_content_loaded_ms": 46.10000002384186,
+      "resource_duration_ms": [
+        4.699999988079071,
+        3.300000011920929,
+        4.699999988079071,
+        3.700000047683716,
+        5,
+        5.100000023841858,
+        5.100000023841858,
+        6.199999988079071,
+        7.399999976158142,
+        7.599999964237213,
+        7.699999988079071,
+        7.799999952316284,
+        7.799999952316284,
+        7.800000011920929,
+        9,
+        9.600000023841858,
+        10,
+        9.900000035762787,
+        10,
+        9.199999988079071,
+        11,
+        11.5,
+        11.300000011920929,
+        11.400000035762787,
+        11.5
+      ]
+    },
+    {
+      "posts_with_images": 128,
+      "sample": 1,
+      "state": "warm",
+      "thumbnail_elements": 128,
+      "loaded_elements_including_repeated_urls": 49,
+      "browser_media_response_events": 25,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 25,
+      "thumbnail_resource_entries": 25,
+      "thumbnail_resource_unique_urls": 25,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 825400,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 44.10000002384186,
+      "navigation_dom_content_loaded_ms": 37.19999998807907,
+      "resource_duration_ms": [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0
+      ]
+    },
+    {
+      "posts_with_images": 128,
+      "sample": 2,
+      "state": "warm",
+      "thumbnail_elements": 128,
+      "loaded_elements_including_repeated_urls": 49,
+      "browser_media_response_events": 25,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 25,
+      "thumbnail_resource_entries": 25,
+      "thumbnail_resource_unique_urls": 25,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 825400,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 35.89999997615814,
+      "navigation_dom_content_loaded_ms": 30,
+      "resource_duration_ms": [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0
+      ]
+    },
+    {
+      "posts_with_images": 128,
+      "sample": 3,
+      "state": "warm",
+      "thumbnail_elements": 128,
+      "loaded_elements_including_repeated_urls": 49,
+      "browser_media_response_events": 25,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 25,
+      "thumbnail_resource_entries": 25,
+      "thumbnail_resource_unique_urls": 25,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 825400,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 36.30000001192093,
+      "navigation_dom_content_loaded_ms": 30,
+      "resource_duration_ms": [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0
+      ]
+    },
+    {
+      "posts_with_images": 128,
+      "sample": 4,
+      "state": "warm",
+      "thumbnail_elements": 128,
+      "loaded_elements_including_repeated_urls": 49,
+      "browser_media_response_events": 25,
+      "uncached_media_responses": 0,
+      "cached_media_responses": 25,
+      "thumbnail_resource_entries": 25,
+      "thumbnail_resource_unique_urls": 25,
+      "resource_timing_transfer_bytes": 0,
+      "resource_timing_encoded_body_bytes": 825400,
+      "cdp_encoded_transfer_bytes": 0,
+      "navigation_load_event_end_ms": 51.39999997615814,
+      "navigation_dom_content_loaded_ms": 40.89999997615814,
+      "resource_duration_ms": [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0
+      ]
+    }
+  ],
+  "limitations": "Debug server, local loopback HTTP, synthetic 1024x768 gradient source, 250px lossless WebP preview, 128 posts share 65 unique URLs. Initial viewport measured for 500ms after load. Browser setup/CDP overhead; cold browser cache, warm server/OS cache. Resource Timing adds an estimated 300-byte header cost; CDP records transfer separately. Load-event timings are observations, not isolated proof of frontend speedup. Original loaded only after click; missing/corrupt fallback and missing-file recovery asserted. Raw output remains in local output/playwright and /tmp."
+}
diff --git a/docs/thumbnail-evidence/http-baseline.json b/docs/thumbnail-evidence/http-baseline.json
new file mode 100644
index 00000000..a8b30287
--- /dev/null
+++ b/docs/thumbnail-evidence/http-baseline.json
@@ -0,0 +1,346 @@
+{
+  "limitations": "Debug build, loopback HTTP/1.1, warm OS cache, 16 concurrent requests, current-thread runtime; middleware/browser cache excluded. DB checkouts measured; SQL count and syscall count require separate instrumentation. ps CPU cumulative; RSS sampled, not peak. Original removed before requests.",
+  "samples": [
+    {
+      "admin_cookie": false,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 33439,
+        "latency": {
+          "max_us": 27858,
+          "p50_us": 2232,
+          "p95_us": 25280
+        },
+        "process_cpu_time_and_rss_kib": "0:00.72  47952",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 25510,
+        "latency": {
+          "max_us": 5208,
+          "p50_us": 2804,
+          "p95_us": 3498
+        },
+        "process_cpu_time_and_rss_kib": "0:00.76  48064",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 32583,
+        "latency": {
+          "max_us": 6700,
+          "p50_us": 3604,
+          "p95_us": 4722
+        },
+        "process_cpu_time_and_rss_kib": "0:00.80  48432",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 28545,
+        "latency": {
+          "max_us": 6059,
+          "p50_us": 3001,
+          "p95_us": 4957
+        },
+        "process_cpu_time_and_rss_kib": "0:00.84  48544",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 30023,
+        "latency": {
+          "max_us": 6610,
+          "p50_us": 3430,
+          "p95_us": 4088
+        },
+        "process_cpu_time_and_rss_kib": "0:00.88  48656",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 27221,
+        "latency": {
+          "max_us": 5912,
+          "p50_us": 2920,
+          "p95_us": 3883
+        },
+        "process_cpu_time_and_rss_kib": "0:00.92  48656",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 31531,
+        "latency": {
+          "max_us": 6433,
+          "p50_us": 3621,
+          "p95_us": 4483
+        },
+        "process_cpu_time_and_rss_kib": "0:00.96  48656",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 27485,
+        "latency": {
+          "max_us": 6402,
+          "p50_us": 2961,
+          "p95_us": 3613
+        },
+        "process_cpu_time_and_rss_kib": "0:01.00  48784",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 30575,
+        "latency": {
+          "max_us": 6260,
+          "p50_us": 3503,
+          "p95_us": 4425
+        },
+        "process_cpu_time_and_rss_kib": "0:01.04  48800",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 25194,
+        "latency": {
+          "max_us": 5474,
+          "p50_us": 2680,
+          "p95_us": 3471
+        },
+        "process_cpu_time_and_rss_kib": "0:01.08  48800",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 29966,
+        "latency": {
+          "max_us": 6182,
+          "p50_us": 3401,
+          "p95_us": 4376
+        },
+        "process_cpu_time_and_rss_kib": "0:01.12  48800",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 25804,
+        "latency": {
+          "max_us": 5505,
+          "p50_us": 2757,
+          "p95_us": 5041
+        },
+        "process_cpu_time_and_rss_kib": "0:01.15  48800",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 28657,
+        "latency": {
+          "max_us": 6732,
+          "p50_us": 3242,
+          "p95_us": 4174
+        },
+        "process_cpu_time_and_rss_kib": "0:01.19  48832",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 25678,
+        "latency": {
+          "max_us": 5548,
+          "p50_us": 2810,
+          "p95_us": 3251
+        },
+        "process_cpu_time_and_rss_kib": "0:01.22  48832",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 31150,
+        "latency": {
+          "max_us": 4532,
+          "p50_us": 3649,
+          "p95_us": 4131
+        },
+        "process_cpu_time_and_rss_kib": "0:01.27  48832",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 26708,
+        "latency": {
+          "max_us": 5658,
+          "p50_us": 2863,
+          "p95_us": 4983
+        },
+        "process_cpu_time_and_rss_kib": "0:01.30  48832",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 29845,
+        "latency": {
+          "max_us": 6263,
+          "p50_us": 3341,
+          "p95_us": 5603
+        },
+        "process_cpu_time_and_rss_kib": "0:01.34  48960",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 25653,
+        "latency": {
+          "max_us": 5442,
+          "p50_us": 2716,
+          "p95_us": 3586
+        },
+        "process_cpu_time_and_rss_kib": "0:01.38  48976",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 31436,
+        "latency": {
+          "max_us": 4213,
+          "p50_us": 3703,
+          "p95_us": 4012
+        },
+        "process_cpu_time_and_rss_kib": "0:01.42  48976",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 27288,
+        "latency": {
+          "max_us": 5716,
+          "p50_us": 2897,
+          "p95_us": 4989
+        },
+        "process_cpu_time_and_rss_kib": "0:01.46  48976",
+        "requests": 128
+      }
+    }
+  ],
+  "thumbnail_bytes": 556
+}
\ No newline at end of file
diff --git a/docs/thumbnail-evidence/http-final-repeat.json b/docs/thumbnail-evidence/http-final-repeat.json
new file mode 100644
index 00000000..2dcfb02f
--- /dev/null
+++ b/docs/thumbnail-evidence/http-final-repeat.json
@@ -0,0 +1,346 @@
+{
+  "limitations": "Debug build, loopback HTTP/1.1, warm OS cache, 16 concurrent requests, current-thread runtime; middleware/browser cache excluded. DB checkouts measured; SQL count and syscall count require separate instrumentation. ps CPU cumulative; RSS sampled, not peak. Original removed before requests.",
+  "samples": [
+    {
+      "admin_cookie": false,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 34380,
+        "latency": {
+          "max_us": 28665,
+          "p50_us": 1811,
+          "p95_us": 17779
+        },
+        "process_cpu_time_and_rss_kib": "0:00.70  48064",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 17250,
+        "latency": {
+          "max_us": 3026,
+          "p50_us": 1807,
+          "p95_us": 2812
+        },
+        "process_cpu_time_and_rss_kib": "0:00.74  48224",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 22986,
+        "latency": {
+          "max_us": 4204,
+          "p50_us": 2517,
+          "p95_us": 3220
+        },
+        "process_cpu_time_and_rss_kib": "0:00.79  48352",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 18741,
+        "latency": {
+          "max_us": 3649,
+          "p50_us": 1953,
+          "p95_us": 3238
+        },
+        "process_cpu_time_and_rss_kib": "0:00.83  48496",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 21114,
+        "latency": {
+          "max_us": 4138,
+          "p50_us": 2277,
+          "p95_us": 3365
+        },
+        "process_cpu_time_and_rss_kib": "0:00.88  48608",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 17841,
+        "latency": {
+          "max_us": 3543,
+          "p50_us": 1845,
+          "p95_us": 2505
+        },
+        "process_cpu_time_and_rss_kib": "0:00.93  48608",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 22351,
+        "latency": {
+          "max_us": 4437,
+          "p50_us": 2493,
+          "p95_us": 3324
+        },
+        "process_cpu_time_and_rss_kib": "0:00.98  48672",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 19291,
+        "latency": {
+          "max_us": 3764,
+          "p50_us": 2001,
+          "p95_us": 3560
+        },
+        "process_cpu_time_and_rss_kib": "0:01.02  48800",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 21414,
+        "latency": {
+          "max_us": 3477,
+          "p50_us": 2478,
+          "p95_us": 2745
+        },
+        "process_cpu_time_and_rss_kib": "0:01.07  48816",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 18079,
+        "latency": {
+          "max_us": 3742,
+          "p50_us": 1869,
+          "p95_us": 3372
+        },
+        "process_cpu_time_and_rss_kib": "0:01.11  48816",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 22742,
+        "latency": {
+          "max_us": 4190,
+          "p50_us": 2655,
+          "p95_us": 3413
+        },
+        "process_cpu_time_and_rss_kib": "0:01.16  48816",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 18891,
+        "latency": {
+          "max_us": 3638,
+          "p50_us": 1987,
+          "p95_us": 3186
+        },
+        "process_cpu_time_and_rss_kib": "0:01.20  48816",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 22022,
+        "latency": {
+          "max_us": 4206,
+          "p50_us": 2505,
+          "p95_us": 3632
+        },
+        "process_cpu_time_and_rss_kib": "0:01.24  48816",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 18390,
+        "latency": {
+          "max_us": 3722,
+          "p50_us": 1890,
+          "p95_us": 3401
+        },
+        "process_cpu_time_and_rss_kib": "0:01.28  48816",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 22432,
+        "latency": {
+          "max_us": 3022,
+          "p50_us": 2606,
+          "p95_us": 2897
+        },
+        "process_cpu_time_and_rss_kib": "0:01.33  48816",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 18502,
+        "latency": {
+          "max_us": 3709,
+          "p50_us": 1924,
+          "p95_us": 3381
+        },
+        "process_cpu_time_and_rss_kib": "0:01.37  48816",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 20991,
+        "latency": {
+          "max_us": 4568,
+          "p50_us": 2301,
+          "p95_us": 3353
+        },
+        "process_cpu_time_and_rss_kib": "0:01.41  48832",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 17826,
+        "latency": {
+          "max_us": 3552,
+          "p50_us": 1839,
+          "p95_us": 2386
+        },
+        "process_cpu_time_and_rss_kib": "0:01.46  48832",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 21886,
+        "latency": {
+          "max_us": 3624,
+          "p50_us": 2505,
+          "p95_us": 2930
+        },
+        "process_cpu_time_and_rss_kib": "0:01.50  48832",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 19120,
+        "latency": {
+          "max_us": 3870,
+          "p50_us": 1983,
+          "p95_us": 3374
+        },
+        "process_cpu_time_and_rss_kib": "0:01.55  48832",
+        "requests": 128
+      }
+    }
+  ],
+  "thumbnail_bytes": 556
+}
\ No newline at end of file
diff --git a/docs/thumbnail-evidence/http-final.json b/docs/thumbnail-evidence/http-final.json
new file mode 100644
index 00000000..611f842e
--- /dev/null
+++ b/docs/thumbnail-evidence/http-final.json
@@ -0,0 +1,346 @@
+{
+  "limitations": "Debug build, loopback HTTP/1.1, warm OS cache, 16 concurrent requests, current-thread runtime; middleware/browser cache excluded. DB checkouts measured; SQL count and syscall count require separate instrumentation. ps CPU cumulative; RSS sampled, not peak. Original removed before requests.",
+  "samples": [
+    {
+      "admin_cookie": false,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 29652,
+        "latency": {
+          "max_us": 27912,
+          "p50_us": 1705,
+          "p95_us": 25540
+        },
+        "process_cpu_time_and_rss_kib": "0:00.73  47888",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 17498,
+        "latency": {
+          "max_us": 3436,
+          "p50_us": 1802,
+          "p95_us": 2880
+        },
+        "process_cpu_time_and_rss_kib": "0:00.77  47984",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 22750,
+        "latency": {
+          "max_us": 4217,
+          "p50_us": 2596,
+          "p95_us": 3475
+        },
+        "process_cpu_time_and_rss_kib": "0:00.82  48240",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 18747,
+        "latency": {
+          "max_us": 3712,
+          "p50_us": 1938,
+          "p95_us": 2577
+        },
+        "process_cpu_time_and_rss_kib": "0:00.86  48368",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 21775,
+        "latency": {
+          "max_us": 3444,
+          "p50_us": 2514,
+          "p95_us": 2940
+        },
+        "process_cpu_time_and_rss_kib": "0:00.90  48416",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 18058,
+        "latency": {
+          "max_us": 3776,
+          "p50_us": 1870,
+          "p95_us": 3274
+        },
+        "process_cpu_time_and_rss_kib": "0:00.95  48432",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 22328,
+        "latency": {
+          "max_us": 4932,
+          "p50_us": 2488,
+          "p95_us": 3292
+        },
+        "process_cpu_time_and_rss_kib": "0:00.99  48480",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 18924,
+        "latency": {
+          "max_us": 3689,
+          "p50_us": 1983,
+          "p95_us": 3355
+        },
+        "process_cpu_time_and_rss_kib": "0:01.03  48608",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 22027,
+        "latency": {
+          "max_us": 3941,
+          "p50_us": 2530,
+          "p95_us": 3217
+        },
+        "process_cpu_time_and_rss_kib": "0:01.08  48624",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 18363,
+        "latency": {
+          "max_us": 3765,
+          "p50_us": 1898,
+          "p95_us": 2403
+        },
+        "process_cpu_time_and_rss_kib": "0:01.13  48624",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 22624,
+        "latency": {
+          "max_us": 4185,
+          "p50_us": 2542,
+          "p95_us": 3624
+        },
+        "process_cpu_time_and_rss_kib": "0:01.17  48624",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 19327,
+        "latency": {
+          "max_us": 3793,
+          "p50_us": 2003,
+          "p95_us": 3194
+        },
+        "process_cpu_time_and_rss_kib": "0:01.21  48624",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 22308,
+        "latency": {
+          "max_us": 4124,
+          "p50_us": 2506,
+          "p95_us": 3108
+        },
+        "process_cpu_time_and_rss_kib": "0:01.26  48656",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 18789,
+        "latency": {
+          "max_us": 3693,
+          "p50_us": 1930,
+          "p95_us": 2603
+        },
+        "process_cpu_time_and_rss_kib": "0:01.30  48656",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 22698,
+        "latency": {
+          "max_us": 4602,
+          "p50_us": 2609,
+          "p95_us": 2880
+        },
+        "process_cpu_time_and_rss_kib": "0:01.35  48656",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 18904,
+        "latency": {
+          "max_us": 4054,
+          "p50_us": 1963,
+          "p95_us": 2493
+        },
+        "process_cpu_time_and_rss_kib": "0:01.39  48656",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 21806,
+        "latency": {
+          "max_us": 3040,
+          "p50_us": 2521,
+          "p95_us": 2851
+        },
+        "process_cpu_time_and_rss_kib": "0:01.43  48656",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": false,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 18195,
+        "latency": {
+          "max_us": 3699,
+          "p50_us": 1878,
+          "p95_us": 2438
+        },
+        "process_cpu_time_and_rss_kib": "0:01.47  48672",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": false,
+      "measurement": {
+        "body_bytes": 71168,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 22505,
+        "latency": {
+          "max_us": 4205,
+          "p50_us": 2589,
+          "p95_us": 3549
+        },
+        "process_cpu_time_and_rss_kib": "0:01.52  48672",
+        "requests": 128
+      }
+    },
+    {
+      "admin_cookie": true,
+      "conditional": true,
+      "measurement": {
+        "body_bytes": 0,
+        "concurrency": 16,
+        "database_checkouts": 128,
+        "elapsed_us": 19186,
+        "latency": {
+          "max_us": 3865,
+          "p50_us": 1996,
+          "p95_us": 2664
+        },
+        "process_cpu_time_and_rss_kib": "0:01.56  48672",
+        "requests": 128
+      }
+    }
+  ],
+  "thumbnail_bytes": 556
+}
\ No newline at end of file
diff --git a/docs/thumbnail-pipeline-audit.md b/docs/thumbnail-pipeline-audit.md
new file mode 100644
index 00000000..59c0b2ea
--- /dev/null
+++ b/docs/thumbnail-pipeline-audit.md
@@ -0,0 +1,214 @@
+# Thumbnail pipeline audit — 2026-10-04
+
+Audited from `c7e4be7` on branch `1.7.0-staging`. No dependencies, schema,
+thumbnail encoding, templates, CSS, post URLs, or production JavaScript changed.
+
+**Lifecycle and existing behavior**
+
+- Multipart uploads stream to temporary files. MIME/structure, board policy,
+  size and decoded-image limits are validated before persistence. The existing
+  `MediaUploadGate` permits one public media upload at a time, including parsing
+  and processing. Decoder validation remains mandatory even for deduplicated
+  uploads. Originals are capped at 40 million decoded pixels and decoder
+  allocations at 256 MiB.
+- `handlers::process_primary_upload` hashes the upload and consults `file_hashes`.
+  A same-board hit reuses the stored original and thumbnail when both exist;
+  missing outputs cause upload-time processing again. Empty thumbnail paths are
+  valid for generic files. No content decode is performed on thumbnail GETs.
+- `utils/files/storage.rs` stages UUID-named files, invokes
+  `MediaProcessor::process_upload`, and records the actual thumbnail output path.
+  Image conversion happens first; thumbnail generation decodes the persisted
+  result. JPEG orientation and metadata stripping retain their existing behavior.
+  Validation, conversion and thumbnailing can therefore decode a fresh image
+  separately; that work happens on upload, never on page or thumbnail delivery.
+- `media/thumbnail.rs` fits still previews into the configured square (default
+  250 × 250), preserving aspect ratio and avoiding enlargement of small images.
+  Triangle filtering and the `image` crate's lossless WebP encoding remain
+  unchanged; there is no lossy quality setting. Animated media uses a still first
+  composited frame for its preview; the original conversion preserves animation.
+  PDF first pages use Hayro; video frames use optional FFmpeg then the same Rust
+  WebP encoder. Failures can produce generated 250 × 250 SVG placeholders. Audio
+  initially uses SVG, then durable workers publish waveform PNGs. Background
+  workers are capped at four; queued job claiming/completion is transactional.
+- Upload finalization persists post/file-hash paths together with filesystem
+  recovery intent. Referenced thumbnails survive cache eviction. Ordinary
+  page loads do not regenerate previews. Generation failure can leave an original
+  without a thumbnail; pending/failed/pruned media has dedicated template states.
+- Board, catalog, archive, thread and preview/update APIs render stored paths
+  into `/boards/{board}/thumbs/{filename}` URLs. Rendering does not stat or decode
+  thumbnail files. Catalog/index/archive images are lazy with async decoding;
+  thread OPs are eager and replies lazy. CSS limits post previews to 150 px and
+  replies to 80 px (with responsive overrides). Posts store no thumbnail
+  width/height metadata, so post images have no intrinsic-size HTML hints.
+- `static/main.js` installs one load/error fallback per image; an already complete
+  image with no natural size may call `decode()` before showing the fallback.
+  There is no custom thumbnail download queue or original-image prefetch. The
+  full image's `src` is assigned from `data-src` on expansion; videos/audio use
+  `preload="none"`, PDFs use `about:blank` until opened. Native browser request
+  scheduling and caching handle concurrency and repeated URLs. Cross-board hover
+  previews also deduplicate in-flight HTML fetches and retain a per-page HTML
+  cache; pending media is refreshed through the existing post-update endpoint. No-JS links still
+  open the original. Sensitive-content/NSFW, quote-preview and media hooks remain
+  intact.
+- `/boards/{*media_path}` checks live board permissions before every origin
+  request, including conditional GETs. Path validation canonicalizes root and
+  target, checks every path component for symlinks, verifies a regular file and
+  rejects multiple hardlinks on Unix. The leaf is inspected during the component
+  walk and again after canonicalization; the file service then obtains metadata
+  from its opened file. Those checks were preserved. `ServeFile` streams only the
+  requested file in bounded chunks (default 64 KiB). It supports HEAD, byte
+  ranges, Last-Modified/If-Modified-Since and metadata-derived
+  ETag/If-None-Match; ETags do not hash/read image contents. GET/304 still opens
+  the file and reads metadata; 304 does not read a payload. WebP/PNG are not
+  HTTP-compressed again. Generated SVGs retain restrictive CSP/nosniff headers.
+- Public UUID media already had `public, max-age=31536000, immutable`.
+  View-password media uses `private, no-cache, must-revalidate`; unversioned
+  replaceable board favicons use a one-hour TTL. Revalidated private media still
+  checks access. Missing SVG waveforms redirect temporarily to their completed
+  PNGs; old MP4/MKV URLs redirect permanently to WebM siblings. Corrupt persisted
+  thumbnail bytes receive an ordinary file response and the browser displays a
+  fallback; serving never decodes or repairs them.
+
+**Findings and implemented changes**
+
+The browser baseline did not expose duplicate downloads, eager original loading,
+far-offscreen unique thumbnail floods, or unnecessary warm-cache media requests.
+The worthwhile changes were on the server request path:
+
+1. Synchronous canonicalization, per-component filesystem checks and legacy
+   sibling resolution previously ran on the async executor after DB preflight.
+   They now run in that same blocking preflight. The DB connection is released
+   before filesystem work. A rare replacement/open race also resolves its legacy
+   sibling on a blocking worker. Security checks and their syscall count remain
+   intact; the improvement is executor responsiveness and overlapping work.
+2. A public/post-password request carrying an admin cookie previously performed a
+   session SELECT despite already having view access. Session lookup now occurs
+   only when an unresolved view-password gate requires administrator access.
+   Valid board unlock cookies also avoid that extra lookup. Board access is still
+   loaded from the DB each time; no authorization cache was introduced. Public
+   cookie-bearing requests go from two application SELECTs to one (code-path
+   accounting; not a SQL trace). Pool validation SQL is separate.
+3. Media errors now carry private no-store headers. Previously an initial 404 had
+   no explicit cache policy, and a failed open after successful validation could
+   inherit the one-year immutable policy. A missing/generated-later file or a
+   temporary denial must not be retained as immutable content. This is a
+   correctness improvement established from the response path; no negative-cache
+   performance win is claimed. Successful 200/206/304 policies remain unchanged.
+4. Response metadata uses the validated file path, avoiding the earlier redundant
+   root/path construction. No large image buffers or application cache were added.
+
+**Measured evidence**
+
+The tracked ignored Rust workload runs the production handler and `ServeFile`
+through real loopback HTTP/1.1: 128 pre-generated 250 px WebP files, concurrency
+16, five batches for each visitor/admin-cookie and full/conditional combination.
+The original is deleted before requests, proving delivery is independent of
+source decoding/resizing. It measures complete-response latency, body bytes and
+DB checkouts, with cumulative CPU/end-of-batch RSS observations from `ps`.
+
+Apple M2 Pro, arm64 macOS, Rust 1.99.0, debug build, current-thread Tokio harness,
+warm filesystem/server cache. These are local workload results, not a release
+capacity claim. Moving blocking calls can have a different timing effect on a
+multi-thread production runtime or slower storage.
+
+| 128-request batch | Before median ms | After median ms | Before request p50/p95 ms | After request p50/p95 ms |
+| --- | ---: | ---: | ---: | ---: |
+| Visitor, full responses | 30.023 | 22.027 | 3.341 / 4.425 | 2.514 / 3.108 |
+| Visitor, conditional 304 | 25.653 | 18.195 | 2.804 / 3.498 | 1.878 / 2.603 |
+| Admin cookie, full responses | 31.436 | 22.624 | 3.621 / 4.376 | 2.589 / 3.475 |
+| Admin cookie, conditional 304 | 27.288 | 18.924 | 2.897 / 4.983 | 1.983 / 2.664 |
+
+An independent optimized repeat recorded 21.414, 17.841, 22.432 and 18.891 ms,
+respectively. Every full batch transferred 71,168 body bytes before and after;
+304 batches transferred zero body bytes. All origin batches checked out 128 DB
+connections. No reduction in filesystem calls, total CPU or RSS is established.
+`ps` includes client/setup/instrumentation and is not a peak-memory or isolated
+server-CPU measurement. Syscalls and SQL statements were not traced on this host.
+
+The local browser workload extends `tests/e2e/helpers.ts` and diagnostics rather
+than introducing a framework. It uploads a real 1024 × 768 gradient, then seeds
+0, 4 and 128 image-post cases. The many-post page has 65 unique thumbnails,
+including repeated URLs. CDP observes cache/response events without request
+routing (routing would disable browser cache); Resource Timing observes bytes.
+Five visits per size include a cleared browser cache followed by four warm visits.
+
+| Browser case | Before / after unique origin thumbnail responses | Before / after Resource Timing transfer bytes |
+| --- | ---: | ---: |
+| No images, cold or warm | 0 / 0 | 0 / 0 |
+| Four images, cold | 4 / 4 | 133,264 / 133,264 |
+| Four images, warm | 0 / 0 | 0 / 0 |
+| 128 posts, initial cold viewport | 25 / 25 | 832,900 / 832,900 |
+| 128 posts, warm viewport | 0 / 0 | 0 / 0 |
+| 128 posts, complete scroll | 65 / 65 total unique URLs | No duplicate URL requests |
+
+Browser WebP previews were 33,016 bytes in both runs. The initial many-post
+viewport transferred 825,400 body bytes plus Resource Timing's estimated header
+cost. Some far-offscreen repeated elements obtain natural dimensions from shared
+cached URLs; that does not represent additional network downloads. Cold load-event
+completion was 52.0 ms before and 52.8 ms after. Warm navigation timings varied,
+including the no-image control, so they do not establish a frontend speedup.
+Opening the image loaded the correct 1024 px original; missing/corrupt previews
+showed fallbacks, and a missing file created later recovered on navigation.
+
+Raw HTTP samples: [baseline](thumbnail-evidence/http-baseline.json),
+[optimized](thumbnail-evidence/http-final.json),
+[repeat](thumbnail-evidence/http-final-repeat.json). Browser aggregate/per-resource
+observations: [baseline](thumbnail-evidence/browser-baseline.json),
+[optimized](thumbnail-evidence/browser-final.json). Full browser artifacts remain
+under the repository's ignored `output/playwright/thumbnails/` directory. The new
+browser spec remains local under ignored `tests/e2e/`, following `.gitignore`'s
+existing policy; the Rust benchmark and evidence are versionable.
+
+**Validation and reproduction**
+
+```sh
+cargo fmt --all --check
+cargo clippy --workspace --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic -D clippy::nursery -D clippy::cargo
+cargo test --workspace --all-features
+cargo test --workspace --all-features -- --test-threads=1
+RUSTCHAN_THUMB_EVIDENCE=/tmp/thumbnail-http.json cargo test --locked --lib server::handlers::board::media::performance::thumbnail_http_workload -- --ignored --exact
+RUSTCHAN_E2E_SKIP_BUILD=1 RUSTCHAN_AUDIT_OUTPUT=output/playwright/thumbnails/check npx playwright test tests/e2e/thumbnail-loading.spec.ts --project=chromium --workers=1
+RUSTCHAN_E2E_SKIP_BUILD=1 npx playwright test tests/e2e/media.spec.ts tests/e2e/password-boards.spec.ts tests/e2e/phase3-media-runtime.spec.ts tests/e2e/non-video-media.spec.ts --project=chromium --project=webkit --project=chromium-nojs --workers=2
+```
+
+Build the current server with `cargo build --locked --bin rustchan-cli` before
+using `RUSTCHAN_E2E_SKIP_BUILD=1`. Browser setup also generates its native update
+fixture using the existing global setup.
+
+Formatting and strict Clippy passed. New request regressions cover ETag/date 304,
+HEAD, byte ranges, original independence, missing-file recovery/no-store,
+permission changes, unlock retirement, session revocation, and legacy redirects.
+The browser matrix passed 29 tests with 10 existing engine/capability skips;
+the many-image benchmark passed before and after. Full parallel Rust runs exposed
+shared global configuration-save locking and thumbnail-failure-injection
+interference with a PDF test. The complete serial run passed: 1,353 library
+tests, 1,353 binary tests, five CLI runtime tests, one native UI fixture test and
+one doc test (2,713 passes total; 10 intentional ignores across library/binary).
+No unrelated test or production configuration logic was modified.
+
+**Deliberately deferred**
+
+- No stronger public caching, application thumbnail cache, static-route bypass,
+  or permission cache: existing warm visits already generate zero media origin
+  work, while private media must recheck authorization.
+- No lossy codecs, smaller previews or extra responsive variants: preview quality,
+  compatibility and existing high-DPI presentation take precedence; network bytes
+  did not regress. Lossless gradient previews can be relatively large.
+- No runtime dimension probing. Intrinsic dimension metadata would require a
+  coordinated schema/upload/restore/template change; guessing square dimensions
+  would alter portrait/landscape layout. Profile layout shifts before doing that.
+- No shared decoded-image upload pipeline, new generation queue, or single-flight
+  cache: upload processing is already gated, requests never generate thumbnails,
+  and fusing validation/conversion would broaden this change into media semantics.
+- No reduction of symlink/hardlink/canonicalization checks, permanent root trust
+  cache, or alternate file-server implementation: the checks protect untrusted
+  stored paths. A descriptor-based race-hardening design is separate work.
+- Public immutable retention and cached corrupt-file repair at the same URL retain
+  their existing semantics; replacing immutable assets should use a new URL.
+
+**Files changed**
+
+- `src/handlers/board/media.rs`: delivery preflight, error cache policy and request regressions.
+- `src/handlers/board/media/performance.rs`: opt-in actual HTTP workload.
+- `docs/thumbnail-pipeline-audit.md` and `docs/thumbnail-evidence/{http-baseline,http-final,http-final-repeat,browser-baseline,browser-final}.json`: audit and measured evidence.
+- Local ignored `tests/e2e/thumbnail-loading.spec.ts`: browser workload and recovery assertions.
diff --git a/src/captcha.rs b/src/captcha.rs
index 669f9c71..b4c8d712 100644
--- a/src/captcha.rs
+++ b/src/captcha.rs
@@ -2,8 +2,9 @@ use ::captcha::{
     filters::{Dots, Grid, Noise, Wave},
     Captcha,
 };
-use dashmap::DashMap;
+use parking_lot::Mutex;
 use sha2::{Digest as _, Sha256};
+use std::collections::HashMap;
 use std::sync::LazyLock;
 use subtle::ConstantTimeEq as _;
 
@@ -22,10 +23,49 @@ const CAPTCHA_CHARSET: &[char] = &[
 ];
 
 /// In-memory, single-use challenge store keyed by challenge identifier.
-static CAPTCHA_CHALLENGES: LazyLock<DashMap<String, StoredCaptchaChallenge>> =
-    LazyLock::new(DashMap::new);
+static CAPTCHA_CHALLENGES: LazyLock<Mutex<ChallengeStore>> = LazyLock::new(Mutex::default);
+/// Hard cap includes outstanding generation reservations.
+const CAPTCHA_MAX_CHALLENGES: usize = 4096;
+
+#[derive(Default)]
+/// Bounded challenge state and amortized expiration scheduling.
+struct ChallengeStore {
+    /// Single-use challenges awaiting a response.
+    challenges: HashMap<String, StoredCaptchaChallenge>,
+    /// Slots reserved before expensive generation starts.
+    generating: usize,
+    /// Last whole-store expiry scan.
+    last_pruned: Option<i64>,
+}
+
+/// A capacity reservation reclaimed on every failed generation path.
+struct ChallengeReservation<'a> {
+    /// Store that owns the reservation.
+    store: &'a Mutex<ChallengeStore>,
+}
+
+impl Drop for ChallengeReservation<'_> {
+    fn drop(&mut self) {
+        let mut store = self.store.lock();
+        store.generating = store.generating.saturating_sub(1);
+    }
+}
+
+/// Reserve a slot atomically before PNG generation; never queue at capacity.
+fn reserve_challenge(
+    store: &Mutex<ChallengeStore>,
+    now: i64,
+) -> Result<ChallengeReservation<'_>, CaptchaImageError> {
+    let mut state = store.lock();
+    prune_store(&mut state, now);
+    if state.challenges.len().saturating_add(state.generating) >= CAPTCHA_MAX_CHALLENGES {
+        return Err(CaptchaImageError::Busy);
+    }
+    state.generating = state.generating.saturating_add(1);
+    drop(state);
+    Ok(ChallengeReservation { store })
+}
 
-#[derive(Clone)]
 /// Hashed server-side state for one outstanding CAPTCHA challenge.
 struct StoredCaptchaChallenge {
     /// Board short name that owns the challenge.
@@ -43,6 +83,8 @@ pub enum CaptchaImageError {
     InvalidRequest,
     /// The CAPTCHA backend failed to encode an image.
     GenerationFailed,
+    /// Outstanding challenges have exhausted the bounded store.
+    Busy,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -91,7 +133,7 @@ pub fn generate_captcha_image(
         return Err(CaptchaImageError::InvalidRequest);
     }
 
-    prune_expired(chrono::Utc::now().timestamp());
+    let _reservation = reserve_challenge(&CAPTCHA_CHALLENGES, chrono::Utc::now().timestamp())?;
 
     let mut captcha = Captcha::new();
     let _configured = captcha
@@ -139,7 +181,7 @@ pub fn verify_captcha(
     let now = chrono::Utc::now().timestamp();
     prune_expired(now);
 
-    let Some((_, challenge)) = CAPTCHA_CHALLENGES.remove(captcha_id) else {
+    let Some(challenge) = CAPTCHA_CHALLENGES.lock().challenges.remove(captcha_id) else {
         return Err(CaptchaValidationError::Expired);
     };
 
@@ -163,7 +205,7 @@ pub fn verify_captcha(
 /// Hash and store one challenge when its generated answer is valid.
 fn store_challenge(board_short: &str, captcha_id: &str, answer: &str, now: i64) {
     if let Some(answer_hash) = answer_hash(board_short, captcha_id, answer) {
-        let _previous_value = CAPTCHA_CHALLENGES.insert(
+        let _previous_value = CAPTCHA_CHALLENGES.lock().challenges.insert(
             captcha_id.to_owned(),
             StoredCaptchaChallenge {
                 board_short: board_short.to_owned(),
@@ -176,7 +218,21 @@ fn store_challenge(board_short: &str, captcha_id: &str, answer: &str, now: i64)
 
 /// Remove challenges whose expiration time is at or before `now`.
 fn prune_expired(now: i64) {
-    CAPTCHA_CHALLENGES.retain(|_, challenge| challenge.expires_at > now);
+    prune_store(&mut CAPTCHA_CHALLENGES.lock(), now);
+}
+
+/// Expire in one bounded scan at most once per minute, including under saturation.
+fn prune_store(store: &mut ChallengeStore, now: i64) {
+    if store
+        .last_pruned
+        .is_some_and(|last| now.saturating_sub(last) < 60)
+    {
+        return;
+    }
+    store
+        .challenges
+        .retain(|_, challenge| challenge.expires_at > now);
+    store.last_pruned = Some(now);
 }
 
 /// Compute the secret-bound answer hash for a scoped challenge.
@@ -232,7 +288,7 @@ pub mod testing {
         let Some(answer_hash) = super::answer_hash(board_short, captcha_id, answer) else {
             return;
         };
-        let _previous_value = super::CAPTCHA_CHALLENGES.insert(
+        let _previous_value = super::CAPTCHA_CHALLENGES.lock().challenges.insert(
             captcha_id.to_owned(),
             super::StoredCaptchaChallenge {
                 board_short: board_short.to_owned(),
@@ -244,7 +300,10 @@ pub mod testing {
 
     /// Return whether a challenge identifier is currently stored.
     pub fn challenge_exists_for_test(captcha_id: &str) -> bool {
-        super::CAPTCHA_CHALLENGES.contains_key(captcha_id)
+        super::CAPTCHA_CHALLENGES
+            .lock()
+            .challenges
+            .contains_key(captcha_id)
     }
 }
 
@@ -340,4 +399,20 @@ mod tests {
             Err(CaptchaValidationError::Missing)
         );
     }
+    #[test]
+    fn challenge_capacity_includes_concurrent_reservations_and_recovers_on_drop() {
+        let store = Mutex::new(ChallengeStore::default());
+        let reservations = (0..CAPTCHA_MAX_CHALLENGES)
+            .map(|_| reserve_challenge(&store, 100))
+            .collect::<Vec<_>>();
+        assert!(reservations.iter().all(Result::is_ok));
+        assert!(matches!(
+            reserve_challenge(&store, 100),
+            Err(CaptchaImageError::Busy)
+        ));
+        assert_eq!(store.lock().generating, CAPTCHA_MAX_CHALLENGES);
+        drop(reservations);
+        assert_eq!(store.lock().generating, 0);
+        assert!(reserve_challenge(&store, 100).is_ok());
+    }
 }
diff --git a/src/config.rs b/src/config.rs
index d98771c2..135efc7f 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -1570,6 +1570,13 @@ impl Config {
         const MAX_VIDEO_MIB: usize = 2048;
         const MAX_AUDIO_MIB: usize = 512;
         self.operator.validate()?;
+        if !(1..=1_000_000).contains(&self.rate_limit_gets)
+            || !(1..=86_400).contains(&self.rate_limit_window)
+        {
+            anyhow::bail!(
+                "CONFIG ERROR: browsing request allowance must be 1..=1000000 and window 1..=86400 seconds."
+            );
+        }
         // cookie_secret is hex-encoded: 64 hex chars = 32 bytes of entropy.
         if self.cookie_secret.len() < 64 {
             anyhow::bail!(
diff --git a/src/config/admin.rs b/src/config/admin.rs
index 047704c3..0fac2273 100644
--- a/src/config/admin.rs
+++ b/src/config/admin.rs
@@ -1161,11 +1161,24 @@ mod tests {
     }
 }
 
+/// Owns the settings lock until the configuration operation completes.
+pub(crate) struct SettingsLease(std::fs::File);
+
+impl Drop for SettingsLease {
+    fn drop(&mut self) {
+        // Closing only this descriptor can leave a Unix lock held by a duplicate
+        // inherited during concurrent process creation. Release it explicitly.
+        if let Err(error) = self.0.unlock() {
+            tracing::error!(%error, "failed to release settings lease");
+        }
+    }
+}
+
 /// Lock the fixed configuration resource across web saves and supervisor transactions.
 ///
 /// # Errors
 /// Rejects unsafe lock paths and concurrent saves, restarts or configuration recovery.
-pub(crate) fn settings_lease(path: &Path) -> anyhow::Result<std::fs::File> {
+pub(crate) fn settings_lease(path: &Path) -> anyhow::Result<SettingsLease> {
     let parent = path
         .parent()
         .context("settings path needs a parent")?
@@ -1219,7 +1232,7 @@ pub(crate) fn settings_lease(path: &Path) -> anyhow::Result<std::fs::File> {
     file.try_lock().context(
         "Another configuration save, update or restart is in progress. Retry after it completes.",
     )?;
-    Ok(file)
+    Ok(SettingsLease(file))
 }
 
 /// Compare effective startup controls against the running process, excluding live controls.
@@ -1363,6 +1376,20 @@ mod restart_tests {
         );
         Ok(())
     }
+    /// A retained descriptor must not extend the owning settings operation's lock.
+    #[test]
+    fn settings_lease_release_is_not_delayed_by_a_retained_descriptor() -> anyhow::Result<()> {
+        let dir = tempfile::tempdir()?;
+        let path = dir.path().join("settings.toml");
+        let lease = settings_lease(&path)?;
+        let retained_descriptor = lease.0.try_clone()?;
+        drop(lease);
+        let next_lease = settings_lease(&path)?;
+        drop(next_lease);
+        drop(retained_descriptor);
+        Ok(())
+    }
+
     /// A supervisor's lease rejects all configuration writers until it releases the resource.
     #[test]
     fn supervisor_lease_rejects_config_save_without_partial_mutation() -> anyhow::Result<()> {
diff --git a/src/config/template.rs b/src/config/template.rs
index 4bc7a92a..c3ac91ab 100644
--- a/src/config/template.rs
+++ b/src/config/template.rs
@@ -200,7 +200,8 @@ db_warn_threshold_mb = 2048
 job_queue_capacity = 1000
 
 # When true, threads that would be hard-deleted by the prune worker are instead
-# moved to the archive table, even on boards where archiving is disabled.
+# marked archived in place, even on boards where archiving is disabled.
+# The board archive count cap still applies; this does not guarantee permanent retention.
 archive_before_prune = true
 
 # Maximum total size (MiB) of all thumbnail/waveform cache files across all boards.
diff --git a/src/db/accounts.rs b/src/db/accounts.rs
index 5d12892f..95aac1aa 100644
--- a/src/db/accounts.rs
+++ b/src/db/accounts.rs
@@ -43,15 +43,26 @@ pub fn manage_account(
         "password is too long"
     );
     crate::utils::crypto::validate_password(new_password)?;
-    let tx = conn.transaction_with_behavior(rusqlite::TransactionBehavior::Immediate)?;
-    let session = super::get_session(&tx, session)?.context("administrator session expired")?;
+    let authorized = super::get_session(conn, session)?.context("administrator session expired")?;
     let actor =
-        super::get_admin_name_by_id(&tx, session.admin_id)?.context("administrator missing")?;
-    let user = super::get_admin_by_username(&tx, &actor)?.context("administrator missing")?;
+        super::get_admin_name_by_id(conn, authorized.admin_id)?.context("administrator missing")?;
+    let user = super::get_admin_by_username(conn, &actor)?.context("administrator missing")?;
     if !crate::utils::crypto::verify_password(current_password, &user.password_hash)? {
         return Ok(false);
     }
+    // Password work runs before taking SQLite's single writer lock. Recheck
+    // session and credentials under that lock to close the authorization race.
     let hash = crate::utils::crypto::hash_password(new_password)?;
+    let tx = conn.transaction_with_behavior(rusqlite::TransactionBehavior::Immediate)?;
+    let current_session =
+        super::get_session(&tx, session)?.context("administrator session expired")?;
+    let current_user =
+        super::get_admin_by_username(&tx, &actor)?.context("administrator missing")?;
+    ensure!(
+        current_session.admin_id == authorized.admin_id
+            && current_user.password_hash == user.password_hash,
+        "administrator authorization changed; retry after signing in again"
+    );
     match action {
         AccountAction::Create => {
             ensure!(
diff --git a/src/db/mod.rs b/src/db/mod.rs
index c3d16b84..d98f1489 100644
--- a/src/db/mod.rs
+++ b/src/db/mod.rs
@@ -25,6 +25,8 @@ mod pool;
 pub mod posts;
 /// Baseline schema installation, repair, and verification.
 mod schema;
+/// Scoped `SQLite` progress limits for public full-text searches.
+mod search_budget;
 /// First-run setup state and completion markers.
 pub mod setup;
 /// Built-in and custom theme persistence.
diff --git a/src/db/posts.rs b/src/db/posts.rs
index 7cd2dcdf..407ba2bc 100644
--- a/src/db/posts.rs
+++ b/src/db/posts.rs
@@ -180,6 +180,48 @@ pub fn get_posts_for_thread(conn: &rusqlite::Connection, thread_id: i64) -> Resu
     Ok(posts)
 }
 
+/// Load at most 200 replies and the opening post, with a cursor for older replies.
+/// Numeric cursors use the thread/id index, without deep OFFSET scans.
+///
+/// # Errors
+/// Returns an error if the database query fails.
+pub fn get_thread_post_window(
+    conn: &rusqlite::Connection,
+    thread_id: i64,
+    before: Option<i64>,
+) -> Result<(Vec<Post>, Option<i64>)> {
+    let mut stmt = conn.prepare_cached(&format!(
+        "SELECT {POST_SELECT_COLUMNS} FROM posts
+         WHERE thread_id = ?1 AND is_op = 0 AND id <= ?2
+         ORDER BY id DESC LIMIT 201"
+    ))?;
+    let mut posts = stmt
+        .query_map(
+            params![
+                thread_id,
+                before.map_or(i64::MAX, |id| id.saturating_sub(1))
+            ],
+            map_post,
+        )?
+        .collect::<rusqlite::Result<Vec<_>>>()?;
+    let has_older = posts.len() > 200;
+    posts.truncate(200);
+    let older_before = has_older
+        .then(|| posts.last().map(|post| post.id))
+        .flatten();
+    let op = conn
+        .prepare_cached(&format!(
+            "SELECT {POST_SELECT_COLUMNS} FROM posts WHERE thread_id = ?1 AND is_op = 1 LIMIT 1"
+        ))?
+        .query_row(params![thread_id], map_post)
+        .optional()?;
+    if let Some(op) = op {
+        posts.push(op);
+    }
+    posts.reverse();
+    Ok((posts, older_before))
+}
+
 /// Fetch posts in `thread_id` whose id is strictly greater than `since_id`.
 /// Returns them oldest-first. Used by the thread auto-update polling endpoint.
 ///
@@ -365,7 +407,10 @@ pub fn get_post_submission(
     Ok(conn
         .query_row(
             "SELECT thread_id, post_id, is_thread
-             FROM post_submissions
+             FROM (
+                 SELECT * FROM post_submissions
+                 UNION ALL SELECT * FROM post_submission_tombstones
+             )
              WHERE submission_token = ?1
                AND ip_hash = ?2
                AND board_id = ?3
@@ -399,6 +444,14 @@ pub fn record_post_submission(
         return Ok(());
     }
 
+    anyhow::ensure!(
+        !conn.query_row(
+            "SELECT EXISTS(SELECT 1 FROM post_submission_tombstones WHERE submission_token = ?1)",
+            [submission_token],
+            |row| row.get::<_, bool>(0),
+        )?,
+        "submission token was already accepted and deleted"
+    );
     conn.execute(
         "INSERT INTO post_submissions
          (submission_token, ip_hash, board_id, thread_id, post_id, is_thread)
@@ -422,6 +475,12 @@ pub fn record_post_submission(
     .context("Failed to prune expired post submission tokens")
     .map(|_affected_rows| ())?;
 
+    conn.execute(
+        "DELETE FROM post_submission_tombstones WHERE created_at < unixepoch() - 604800",
+        [],
+    )
+    .context("Failed to prune expired deleted submission receipts")
+    .map(|_affected_rows| ())?;
     Ok(())
 }
 
@@ -522,7 +581,7 @@ pub fn delete_post(
 }
 
 /// Delete a non-opening post inside the caller's transaction.
-fn delete_post_reply_in_tx(
+pub(crate) fn delete_post_reply_in_tx(
     conn: &rusqlite::Connection,
     post_id: i64,
 ) -> crate::error::Result<crate::db::DeletePathsResult> {
@@ -665,12 +724,24 @@ pub fn self_delete_post(
     post_id: i64,
     token: &str,
     delete_window_secs: i64,
+) -> crate::error::Result<(SelfDeleteOutcome, Option<crate::db::DeletePathsResult>)> {
+    self_delete_post_with_validation(conn, post_id, token, delete_window_secs, |_| Ok(()))
+}
+
+/// Recheck mutable request policy under the same write lock as deletion.
+pub(crate) fn self_delete_post_with_validation(
+    conn: &rusqlite::Connection,
+    post_id: i64,
+    token: &str,
+    delete_window_secs: i64,
+    validate: impl FnOnce(&rusqlite::Connection) -> crate::error::Result<()>,
 ) -> crate::error::Result<(SelfDeleteOutcome, Option<crate::db::DeletePathsResult>)> {
     conn.execute_batch("BEGIN IMMEDIATE")
         .context("Failed to begin self_delete_post transaction")?;
 
     let result: crate::error::Result<(SelfDeleteOutcome, Option<crate::db::DeletePathsResult>)> =
         (|| {
+            validate(conn)?;
             let row: Option<(i64, bool, String, i64, bool, bool)> = conn
                 .query_row(
                     "SELECT p.thread_id, p.is_op, p.deletion_token, p.created_at,
@@ -761,6 +832,27 @@ pub fn edit_post(
     new_body: &str,
     new_body_html: &str,
     edit_window_secs: i64,
+) -> Result<bool> {
+    edit_post_with_validation(
+        conn,
+        post_id,
+        token,
+        new_body,
+        new_body_html,
+        edit_window_secs,
+        |_| Ok(()),
+    )
+}
+
+/// Recheck mutable request policy under the same write lock as editing.
+pub(crate) fn edit_post_with_validation(
+    conn: &rusqlite::Connection,
+    post_id: i64,
+    token: &str,
+    new_body: &str,
+    new_body_html: &str,
+    edit_window_secs: i64,
+    validate: impl FnOnce(&rusqlite::Connection) -> crate::error::Result<()>,
 ) -> Result<bool> {
     let window = if edit_window_secs <= 0 {
         60
@@ -774,6 +866,7 @@ pub fn edit_post(
         .context("Failed to begin IMMEDIATE transaction for edit_post")?;
 
     let result: Result<bool> = (|| {
+        validate(conn)?;
         let row: Option<(String, i64, bool, bool)> = conn
             .query_row(
                 "SELECT p.deletion_token, p.created_at, t.locked, t.archived
@@ -858,7 +951,7 @@ fn search_terms(query: &str) -> Vec<String> {
     let mut terms = Vec::new();
     let mut current = String::new();
 
-    for ch in query.chars() {
+    for ch in query.chars().take(crate::models::SEARCH_QUERY_MAX_CHARS) {
         if ch.is_alphanumeric() {
             for lower in ch.to_lowercase() {
                 current.push(lower);
@@ -906,6 +999,8 @@ pub fn search_posts(
     offset: i64,
 ) -> Result<Vec<Post>> {
     let _timing = super::diagnostics::QueryTiming::start("search_posts");
+    let limit = limit.clamp(1, 100);
+    let offset = offset.clamp(0, 9_999);
     let Some(fts_query) = to_fts_query(query) else {
         return Ok(Vec::new());
     };
@@ -922,11 +1017,14 @@ pub fn search_posts(
          WHERE posts.board_id = ?1 AND posts_fts MATCH ?2
          ORDER BY posts.created_at DESC, posts.id DESC
          LIMIT ?3 OFFSET ?4";
-    let mut stmt = conn.prepare_cached(sql)?;
-    let posts = stmt
-        .query_map(params![board_id, fts_query, limit, offset], map_post)?
-        .collect::<rusqlite::Result<Vec<_>>>()?;
-    Ok(posts)
+    super::search_budget::with_search_budget(conn, || {
+        let mut stmt = conn.prepare_cached(sql)?;
+        let posts = stmt
+            .query_map(params![board_id, fts_query, limit, offset], map_post)?
+            .collect::<rusqlite::Result<Vec<_>>>()?;
+        Ok(posts)
+    })
+    .map_err(anyhow::Error::from)
 }
 
 /// # Errors
@@ -940,13 +1038,17 @@ pub fn count_search_results(
     let Some(fts_query) = to_fts_query(query) else {
         return Ok(0);
     };
-    Ok(conn
-        .prepare_cached(
-            "SELECT COUNT(*)
-             FROM posts_fts CROSS JOIN posts ON posts.id = posts_fts.rowid
-             WHERE posts.board_id = ?1 AND posts_fts MATCH ?2",
-        )?
-        .query_row(params![board_id, fts_query], |r| r.get(0))?)
+    super::search_budget::with_search_budget(conn, || {
+        Ok(conn
+            .prepare_cached(
+                "SELECT COUNT(*) FROM (
+                 SELECT 1 FROM posts_fts CROSS JOIN posts ON posts.id = posts_fts.rowid
+                 WHERE posts.board_id = ?1 AND posts_fts MATCH ?2 LIMIT 10000
+             )",
+            )?
+            .query_row(params![board_id, fts_query], |r| r.get(0))?)
+    })
+    .map_err(anyhow::Error::from)
 }
 
 // File deduplication
@@ -1110,7 +1212,7 @@ pub fn get_poll_for_thread(
 ///
 /// This returns false for two distinct cases:
 ///   1. The voter has already voted (UNIQUE constraint fires INSERT OR IGNORE)
-///   2. The option does not belong to the poll, or the poll has expired
+///   2. The option does not belong to the poll, or the poll has expired/archived
 ///
 /// Callers that need to distinguish these cases should call `cast_vote` and, on
 /// false, separately query whether the IP has voted on this poll. A future
@@ -1129,7 +1231,9 @@ pub fn cast_vote(
          SELECT ?1, ?2, ?3
          FROM poll_options AS po
          JOIN polls AS p ON p.id = po.poll_id
-         WHERE po.id = ?2
+         JOIN threads AS t ON t.id = p.thread_id
+         WHERE t.archived = 0
+           AND po.id = ?2
            AND po.poll_id = ?1
            AND p.expires_at > unixepoch()",
         params![poll_id, option_id, ip_hash],
@@ -1613,6 +1717,16 @@ pub fn claim_next_job(conn: &rusqlite::Connection) -> Result<Option<(i64, String
          WHERE id = (
              SELECT candidate.id FROM background_jobs AS candidate
              WHERE candidate.status = 'pending' AND candidate.attempts < ?1
+               AND (candidate.job_type NOT IN ('video_transcode', 'audio_waveform')
+                    OR NOT EXISTS (
+                        SELECT 1 FROM pending_fs_ops fs,
+                            json_each(CASE WHEN json_valid(fs.payload_json)
+                                           THEN fs.payload_json ELSE '{}' END, '$.relative_paths') artifact
+                        WHERE fs.kind = 'upload_finalize'
+                          AND artifact.value = json_extract(
+                              CASE WHEN json_valid(candidate.payload)
+                                   THEN candidate.payload ELSE '{}' END, '$.d.file_path')
+                    ))
                AND (
                    candidate.job_type != 'thread_prune'
                    OR NOT EXISTS (
@@ -2788,6 +2902,44 @@ mod tests {
         )?)
     }
 
+    #[test]
+    fn thread_windows_are_bounded_and_keep_every_reply_reachable() -> Result<()> {
+        let conn = test_conn()?;
+        let op_id = seed_search_post(&conn, "window", "opening post")?;
+        let op = get_post(&conn, op_id)?.context("opening post exists")?;
+        conn.execute(
+            "WITH RECURSIVE n(x) AS (SELECT 1 UNION ALL SELECT x+1 FROM n WHERE x<450)
+            INSERT INTO posts(thread_id,board_id,body,body_html,deletion_token,created_at)
+            SELECT ?1,?2,'reply','reply','delete',1700000000+x FROM n",
+            params![op.thread_id, op.board_id],
+        )
+        .map(|_count| ())?;
+        let mut before = None;
+        let mut seen = std::collections::HashSet::new();
+        loop {
+            let (posts, older) = super::get_thread_post_window(&conn, op.thread_id, before)?;
+            anyhow::ensure!(
+                posts.len() <= 201 && posts.first().is_some_and(|post| post.id == op_id)
+            );
+            for post in posts.iter().filter(|post| !post.is_op) {
+                anyhow::ensure!(seen.insert(post.id), "reply appeared twice across pages");
+            }
+            if older.is_none() {
+                break;
+            }
+            before = older;
+        }
+        anyhow::ensure!(seen.len() == 450);
+        let plan = conn.prepare("EXPLAIN QUERY PLAN SELECT id FROM posts WHERE thread_id=?1 AND is_op=0 AND id<?2 ORDER BY id DESC LIMIT 201")?
+            .query_map(params![op.thread_id,i64::MAX], |row| row.get::<_,String>(3))?
+            .collect::<rusqlite::Result<Vec<_>>>()?.join(" ");
+        anyhow::ensure!(
+            plan.contains("idx_posts_thread_live") && !plan.contains("TEMP B-TREE"),
+            "window must use keyset index: {plan}"
+        );
+        Ok(())
+    }
+
     #[test]
     #[expect(
         clippy::panic_in_result_fn,
@@ -4110,6 +4262,11 @@ mod tests {
             !cast_vote(&conn, expired_poll, expired_option, "late")?,
             "an expired poll should reject the vote in the write statement"
         );
+        crate::db::set_thread_archived(&conn, thread_id, true)?;
+        assert!(
+            !cast_vote(&conn, open_poll, open_option, "archived-voter")?,
+            "archival must reject votes in the same write statement"
+        );
         Ok(())
     }
 }
diff --git a/src/db/schema.rs b/src/db/schema.rs
index 99040aa0..f9b93907 100644
--- a/src/db/schema.rs
+++ b/src/db/schema.rs
@@ -272,10 +272,64 @@ const BASE_SCHEMA_SQL: &str = "
     );
 ";
 
+/// Retain bounded retry receipts after content deletion, including cascade/prune.
+/// These historical IDs intentionally have no foreign keys: deletion must not
+/// erase the evidence that a submission was already accepted.
+const SUBMISSION_TOMBSTONE_SQL: &str = "
+    CREATE TABLE IF NOT EXISTS post_submission_tombstones (
+        submission_token TEXT PRIMARY KEY,
+        ip_hash TEXT NOT NULL,
+        board_id INTEGER NOT NULL,
+        thread_id INTEGER NOT NULL,
+        post_id INTEGER NOT NULL,
+        is_thread INTEGER NOT NULL CHECK (is_thread IN (0, 1)),
+        created_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_submission_tombstones_created
+        ON post_submission_tombstones(created_at);
+    CREATE INDEX IF NOT EXISTS idx_post_submissions_board
+        ON post_submissions(board_id);
+    CREATE INDEX IF NOT EXISTS idx_post_submissions_thread
+        ON post_submissions(thread_id);
+    CREATE INDEX IF NOT EXISTS idx_post_submissions_post
+        ON post_submissions(post_id);
+    CREATE TRIGGER IF NOT EXISTS posts_submission_tombstone
+    BEFORE DELETE ON posts BEGIN
+        INSERT OR IGNORE INTO post_submission_tombstones
+        SELECT submission_token, ip_hash, board_id, thread_id, post_id, is_thread, created_at
+        FROM post_submissions WHERE post_id = OLD.id;
+    END;
+    CREATE TRIGGER IF NOT EXISTS threads_submission_tombstone
+    BEFORE DELETE ON threads BEGIN
+        INSERT OR IGNORE INTO post_submission_tombstones
+        SELECT submission_token, ip_hash, board_id, thread_id, post_id, is_thread, created_at
+        FROM post_submissions WHERE thread_id = OLD.id;
+    END;
+    CREATE TRIGGER IF NOT EXISTS boards_submission_tombstone
+    BEFORE DELETE ON boards BEGIN
+        INSERT OR IGNORE INTO post_submission_tombstones
+        SELECT submission_token, ip_hash, board_id, thread_id, post_id, is_thread, created_at
+        FROM post_submissions WHERE board_id = OLD.id;
+    END;
+";
+
+/// Exactly recognized objects added for retry receipts on existing databases.
+const SUBMISSION_TOMBSTONE_OBJECTS: [&str; 9] = [
+    "post_submission_tombstones",
+    "sqlite_autoindex_post_submission_tombstones_1",
+    "idx_submission_tombstones_created",
+    "idx_post_submissions_board",
+    "idx_post_submissions_thread",
+    "idx_post_submissions_post",
+    "posts_submission_tombstone",
+    "threads_submission_tombstone",
+    "boards_submission_tombstone",
+];
+
 /// Complete baseline secondary-index definitions.
 const INDEX_SCHEMA_SQL: &str = "
-    CREATE INDEX IF NOT EXISTS idx_threads_board_sticky_bumped
-        ON threads(board_id, sticky DESC, bumped_at DESC);
+    CREATE INDEX IF NOT EXISTS idx_threads_active_order
+        ON threads(board_id, sticky DESC, bumped_at DESC, id DESC) WHERE archived = 0;
     CREATE INDEX IF NOT EXISTS idx_posts_thread
         ON posts(thread_id, created_at ASC);
     CREATE INDEX IF NOT EXISTS idx_posts_thread_live
@@ -304,6 +358,8 @@ const INDEX_SCHEMA_SQL: &str = "
         ON background_jobs(status, priority DESC, created_at ASC);
     CREATE INDEX IF NOT EXISTS idx_reports_status
         ON reports(status, created_at DESC);
+    CREATE INDEX IF NOT EXISTS idx_reports_reporter_created
+        ON reports(reporter_hash, created_at);
     CREATE UNIQUE INDEX IF NOT EXISTS idx_reports_open_unique
         ON reports(post_id, reporter_hash)
         WHERE status = 'open';
@@ -340,7 +396,8 @@ const INDEX_SCHEMA_SQL: &str = "
 /// Obsolete theme index accepted only during the known legacy repair path.
 const LEGACY_THEME_SORT_INDEX: &str = "idx_themes_enabled_sort";
 /// Additive indexes introduced after the first package-version baseline.
-const ADDITIVE_BASELINE_INDEXES: [&str; 11] = [
+const ADDITIVE_BASELINE_INDEXES: [&str; 12] = [
+    "idx_threads_active_order",
     "idx_posts_thread_live",
     "idx_posts_board_ip_created",
     "idx_posts_file_path",
@@ -354,7 +411,11 @@ const ADDITIVE_BASELINE_INDEXES: [&str; 11] = [
     "idx_ban_appeals_ip_created",
 ];
 /// Redundant indexes removed when the additive index set is installed.
-const REDUNDANT_LEGACY_INDEXES: [&str; 2] = ["idx_file_hashes", "idx_posts_thread_id"];
+const REDUNDANT_LEGACY_INDEXES: [&str; 3] = [
+    "idx_file_hashes",
+    "idx_posts_thread_id",
+    "idx_threads_board_sticky_bumped",
+];
 /// Board columns whose historical default was zero instead of the baseline value.
 const LEGACY_BOARD_ZERO_DEFAULT_COLUMNS: [&str; 4] = [
     "allow_editing",
@@ -678,6 +739,7 @@ fn install_baseline_schema_in_transaction(conn: &rusqlite::Connection) -> Result
 /// Create every table, index, search object, and invariant in the baseline.
 fn create_baseline_schema_objects(conn: &rusqlite::Connection) -> Result<()> {
     create_base_tables(conn)?;
+    conn.execute_batch(SUBMISSION_TOMBSTONE_SQL)?;
     create_indexes(conn)?;
     ensure_posts_search_index(conn)?;
     ensure_post_invariants(conn)?;
@@ -930,7 +992,8 @@ fn can_repair_known_legacy_baseline_drift(expected: &SchemaShape, actual: &Schem
 fn schema_objects_are_legacy_repairable(expected: &SchemaShape, actual: &SchemaShape) -> bool {
     for (name, expected_object) in &expected.objects {
         let Some(actual_object) = actual.objects.get(name) else {
-            if ADDITIVE_BASELINE_INDEXES.contains(&name.as_str())
+            if SUBMISSION_TOMBSTONE_OBJECTS.contains(&name.as_str())
+                || ADDITIVE_BASELINE_INDEXES.contains(&name.as_str())
                 || (expected_object.kind == "trigger" && is_additive_domain_trigger(name))
             {
                 continue;
@@ -978,6 +1041,8 @@ fn schema_objects_are_legacy_repairable(expected: &SchemaShape, actual: &SchemaS
 /// Return whether SQL exactly describes a removed redundant index.
 fn is_redundant_legacy_index(name: &str, sql: &str) -> bool {
     let expected = match name {
+        "idx_threads_board_sticky_bumped" =>
+            "CREATE INDEX idx_threads_board_sticky_bumped ON threads(board_id, sticky DESC, bumped_at DESC)",
         "idx_file_hashes" => "CREATE INDEX idx_file_hashes ON file_hashes(sha256)",
         "idx_posts_thread_id" => "CREATE INDEX idx_posts_thread_id ON posts(thread_id)",
         _ => return false,
@@ -996,6 +1061,9 @@ fn is_legacy_theme_sort_index(sql: &str) -> bool {
 fn tables_are_legacy_repairable(expected: &SchemaShape, actual: &SchemaShape) -> bool {
     for (table, expected_table) in &expected.tables {
         let Some(actual_table) = actual.tables.get(table) else {
+            if table == "post_submission_tombstones" {
+                continue;
+            }
             return false;
         };
         let repairable = match table.as_str() {
@@ -1020,7 +1088,8 @@ fn table_is_additive_index_repairable(expected: &TableShape, actual: &TableShape
     for (name, expected_index) in &expected.indexes {
         match actual.indexes.get(name) {
             Some(actual_index) if actual_index == expected_index => {}
-            None if ADDITIVE_BASELINE_INDEXES.contains(&name.as_str()) => {}
+            None if ADDITIVE_BASELINE_INDEXES.contains(&name.as_str())
+                || SUBMISSION_TOMBSTONE_OBJECTS.contains(&name.as_str()) => {}
             Some(_) | None => return false,
         }
     }
@@ -1077,9 +1146,11 @@ fn apply_additive_schema_repairs(conn: &rusqlite::Connection) -> Result<()> {
 
 /// Install additive indexes and domain triggers while the caller owns a transaction.
 fn apply_additive_schema_repairs_in_transaction(conn: &rusqlite::Connection) -> Result<()> {
+    conn.execute_batch(SUBMISSION_TOMBSTONE_SQL)?;
     conn.execute_batch(
         "DROP INDEX IF EXISTS idx_themes_enabled_sort;
          DROP INDEX IF EXISTS idx_file_hashes;
+         DROP INDEX IF EXISTS idx_threads_board_sticky_bumped;
          DROP INDEX IF EXISTS idx_posts_thread_id;",
     )
     .context("Remove obsolete indexes failed")?;
@@ -2484,7 +2555,8 @@ mod tests {
             conn.execute_batch(&format!("DROP INDEX {index}"))?;
         }
         conn.execute_batch(
-            "CREATE INDEX idx_file_hashes ON file_hashes(sha256);
+            "CREATE INDEX idx_threads_board_sticky_bumped ON threads(board_id, sticky DESC, bumped_at DESC);
+             CREATE INDEX idx_file_hashes ON file_hashes(sha256);
              CREATE INDEX idx_posts_thread_id ON posts(thread_id);
              CREATE TABLE schema_version (version TEXT NOT NULL PRIMARY KEY);",
         )?;
@@ -3471,4 +3543,31 @@ mod tests {
         );
         Ok(())
     }
+    #[test]
+    fn submission_receipt_upgrade_preserves_live_tokens_and_deleted_history() -> Result<()> {
+        let conn = rusqlite::Connection::open_in_memory()?;
+        install_or_migrate_schema(&conn)?;
+        conn.execute_batch("INSERT INTO boards(id,short_name,name) VALUES(1,'life','Life');
+            INSERT INTO threads(id,board_id) VALUES(1,1);
+            INSERT INTO posts(id,thread_id,board_id,body,body_html,deletion_token,is_op) VALUES(1,1,1,'body','body','token',1);
+            INSERT INTO post_submissions(submission_token,ip_hash,board_id,thread_id,post_id,is_thread) VALUES('receipt','actor',1,1,1,1);
+            DROP TRIGGER posts_submission_tombstone;
+            DROP TRIGGER threads_submission_tombstone;
+            DROP TRIGGER boards_submission_tombstone;
+            DROP INDEX idx_post_submissions_board;
+            DROP INDEX idx_post_submissions_thread;
+            DROP INDEX idx_post_submissions_post;
+            DROP TABLE post_submission_tombstones;")?;
+        install_or_migrate_schema(&conn)?;
+        let receipt = crate::db::get_post_submission(&conn, "receipt", "actor", 1)?
+            .context("preserved receipt")?;
+        anyhow::ensure!(receipt.post_id == 1);
+        crate::db::delete_thread(&conn, 1).map(|_cleanup| ())?;
+        anyhow::ensure!(
+            crate::db::get_post_submission(&conn, "receipt", "actor", 1)? == Some(receipt)
+        );
+        verify_database_schema(&conn)?;
+        install_or_migrate_schema(&conn)?;
+        Ok(())
+    }
 }
diff --git a/src/db/search_budget.rs b/src/db/search_budget.rs
new file mode 100644
index 00000000..d6476bd5
--- /dev/null
+++ b/src/db/search_budget.rs
@@ -0,0 +1,74 @@
+//! Cooperative SQLite work budgets for anonymous search count/sort operations.
+
+use crate::error::{AppError, Result};
+use rusqlite::{Connection, ErrorCode};
+use std::time::{Duration, Instant};
+
+/// Progress checks are amortized over this many SQLite VM instructions.
+const CHECK_INTERVAL: i32 = 10_000;
+/// Approximate combined VM instruction budget for a count and result page.
+const MAX_CHECKS: usize = 200;
+/// Cooperative wall-clock allowance, checked at each VM progress checkpoint.
+const SEARCH_DEADLINE: Duration = Duration::from_millis(500);
+
+/// Removes the callback before a pooled connection can serve other requests.
+struct SearchBudget<'a> {
+    /// Connection whose callback belongs exclusively to the scoped search.
+    conn: &'a Connection,
+}
+
+impl Drop for SearchBudget<'_> {
+    fn drop(&mut self) {
+        if let Err(error) = self.conn.progress_handler(0, None::<fn() -> bool>) {
+            tracing::error!(%error, "could not clear SQLite search progress handler");
+        }
+    }
+}
+
+/// Run bounded search work and translate budget exhaustion into a useful client error.
+pub(super) fn with_search_budget<T>(
+    conn: &Connection,
+    work: impl FnOnce() -> Result<T>,
+) -> Result<T> {
+    let started = Instant::now();
+    let mut checks = 0usize;
+    conn.progress_handler(
+        CHECK_INTERVAL,
+        Some(move || {
+            checks = checks.saturating_add(1);
+            checks >= MAX_CHECKS || started.elapsed() >= SEARCH_DEADLINE
+        }),
+    )?;
+    let guard = SearchBudget { conn };
+    let result = work();
+    drop(guard);
+    match result {
+        Err(AppError::Internal(error)) if error.chain().any(|cause| matches!(
+            cause.downcast_ref::<rusqlite::Error>(),
+            Some(rusqlite::Error::SqliteFailure(code, _)) if code.code == ErrorCode::OperationInterrupted
+        )) => Err(AppError::BadRequest("This search is too broad. Please use more specific words.".into())),
+        other => other,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn expensive_queries_stop_and_pooled_connection_is_reusable() -> anyhow::Result<()> {
+        let conn = Connection::open_in_memory()?;
+        let result = with_search_budget(&conn, || {
+            conn.query_row("WITH RECURSIVE work(n) AS (SELECT 1 UNION ALL SELECT n+1 FROM work WHERE n<10000000) SELECT SUM(n) FROM work", [], |row| row.get::<_, i64>(0)).map_err(AppError::from)
+        });
+        anyhow::ensure!(matches!(result, Err(AppError::BadRequest(_))));
+        let value: i64 = conn.query_row("SELECT 1", [], |row| row.get(0))?;
+        anyhow::ensure!(value == 1);
+        let count: i64 = with_search_budget(&conn, || {
+            conn.query_row("SELECT 7", [], |row| row.get(0))
+                .map_err(AppError::from)
+        })?;
+        anyhow::ensure!(count == 7);
+        Ok(())
+    }
+}
diff --git a/src/db/threads.rs b/src/db/threads.rs
index 5dd525e0..41337f99 100644
--- a/src/db/threads.rs
+++ b/src/db/threads.rs
@@ -76,7 +76,7 @@ fn map_thread(row: &rusqlite::Row<'_>) -> rusqlite::Result<Thread> {
 /// Collect all file paths (`file_path`, `thumb_path`, `audio_file_path`) for every
 /// post in the given set of thread ids. Returns a flat Vec of non-null paths.
 ///
-/// Uses a single JOIN query instead of one query per thread.
+/// Uses bounded batches instead of one query per thread.
 ///
 /// Call before deleting the thread rows; cascading deletion removes the posts
 /// that supply these paths.
@@ -88,35 +88,37 @@ fn collect_thread_file_paths(
         return Ok(Vec::new());
     }
 
-    // Build WHERE thread_id IN (?, ?, ...) dynamically.
-    let placeholders: String = thread_ids
-        .iter()
-        .enumerate()
-        .map(|(i, _)| format!("?{}", i.saturating_add(1)))
-        .collect::<Vec<_>>()
-        .join(", ");
-    let sql = format!(
-        "SELECT file_path, thumb_path, audio_file_path
+    let mut paths = Vec::new();
+    for batch in thread_ids.chunks(500) {
+        // Bound parameters so restored or backlogged boards cannot exceed SQLite limits.
+        let placeholders: String = batch
+            .iter()
+            .enumerate()
+            .map(|(i, _)| format!("?{}", i.saturating_add(1)))
+            .collect::<Vec<_>>()
+            .join(", ");
+        let sql = format!(
+            "SELECT file_path, thumb_path, audio_file_path
          FROM posts WHERE thread_id IN ({placeholders})"
-    );
+        );
 
-    let mut stmt = conn.prepare(&sql)?;
-    let rows: Vec<(Option<String>, Option<String>, Option<String>)> = stmt
-        .query_map(rusqlite::params_from_iter(thread_ids), |r| {
-            Ok((r.get(0)?, r.get(1)?, r.get(2)?))
-        })?
-        .collect::<rusqlite::Result<_>>()?;
+        let mut stmt = conn.prepare(&sql)?;
+        let rows: Vec<(Option<String>, Option<String>, Option<String>)> = stmt
+            .query_map(rusqlite::params_from_iter(batch), |r| {
+                Ok((r.get(0)?, r.get(1)?, r.get(2)?))
+            })?
+            .collect::<rusqlite::Result<_>>()?;
 
-    let mut paths = Vec::new();
-    for (f, t, a) in rows {
-        if let Some(p) = f {
-            paths.push(p);
-        }
-        if let Some(p) = t {
-            paths.push(p);
-        }
-        if let Some(p) = a {
-            paths.push(p);
+        for (f, t, a) in rows {
+            if let Some(p) = f {
+                paths.push(p);
+            }
+            if let Some(p) = t {
+                paths.push(p);
+            }
+            if let Some(p) = a {
+                paths.push(p);
+            }
         }
     }
     Ok(paths)
@@ -154,19 +156,44 @@ pub fn get_threads_for_board(
 
 /// Paginate threads before computing reply aggregates; exclude missing OPs first.
 pub(super) fn thread_page_sql(archived: bool) -> String {
+    thread_listing_sql(archived, false)
+}
+
+/// Build the shared page query, applying personal visibility before pagination.
+fn thread_listing_sql(archived: bool, personalized: bool) -> String {
     // Preserve the legacy aggregate's tie order for each listing, including
     // deterministic boundaries when many replies bump in the same second.
-    let order = if archived {
+    let base_order = if archived {
         "t.bumped_at DESC, t.id ASC"
     } else {
         "t.sticky DESC, t.bumped_at DESC, t.id DESC"
     };
+    let order = if personalized && !archived {
+        format!("t.viewer_pinned DESC, {base_order}")
+    } else {
+        base_order.to_owned()
+    };
+    let page_order = if personalized && !archived {
+        format!("COALESCE(pref.pinned, 0) DESC, {base_order}")
+    } else {
+        base_order.to_owned()
+    };
+    let (columns, join, visibility) = if personalized {
+        (
+            ", COALESCE(pref.pinned, 0) AS viewer_pinned",
+            "LEFT JOIN user_thread_preferences pref ON pref.thread_id = t.id AND pref.user_hash = ?5",
+            "AND COALESCE(pref.hidden, 0) = ?6",
+        )
+    } else {
+        ("", "", "")
+    };
     format!(
         "WITH page AS MATERIALIZED (
-             SELECT t.* FROM threads t
+             SELECT t.*{columns} FROM threads t {join}
              WHERE t.board_id = ?1 AND t.archived = ?4
+               {visibility}
                AND EXISTS (SELECT 1 FROM posts op WHERE op.thread_id=t.id AND op.is_op=1)
-             ORDER BY {order} LIMIT ?2 OFFSET ?3
+             ORDER BY {page_order} LIMIT ?2 OFFSET ?3
          )
          SELECT t.id, t.board_id, t.subject, t.created_at, t.bumped_at,
                 t.locked, t.sticky, t.reply_count,
@@ -179,6 +206,52 @@ pub(super) fn thread_page_sql(archived: bool) -> String {
     )
 }
 
+/// List a visitor's visible or hidden active threads in canonical personal order.
+///
+/// Personal pins precede sticky threads, then bump time and descending thread ID.
+/// Filtering and sorting occur before LIMIT/OFFSET, so pages never repeat pins.
+///
+/// # Errors
+/// Returns an error if the indexed listing cannot be read.
+pub fn get_threads_for_viewer(
+    conn: &rusqlite::Connection,
+    board_id: i64,
+    user_hash: &str,
+    hidden: bool,
+    limit: i64,
+    offset: i64,
+) -> Result<Vec<Thread>> {
+    let sql = thread_listing_sql(false, true);
+    let mut stmt = conn.prepare_cached(&sql)?;
+    let threads = stmt
+        .query_map(
+            params![board_id, limit, offset, 0_i32, user_hash, i32::from(hidden)],
+            map_thread,
+        )?
+        .collect::<rusqlite::Result<Vec<_>>>()?;
+    Ok(threads)
+}
+
+/// Count active, renderable threads with the same visibility filter as listing.
+///
+/// # Errors
+/// Returns an error if the count cannot be read.
+pub fn count_threads_for_viewer(
+    conn: &rusqlite::Connection,
+    board_id: i64,
+    user_hash: &str,
+    hidden: bool,
+) -> Result<i64> {
+    Ok(conn.query_row(
+        "SELECT COUNT(*) FROM threads t
+         LEFT JOIN user_thread_preferences pref ON pref.thread_id = t.id AND pref.user_hash = ?2
+         WHERE t.board_id = ?1 AND t.archived = 0 AND COALESCE(pref.hidden, 0) = ?3
+           AND EXISTS (SELECT 1 FROM posts op WHERE op.thread_id = t.id AND op.is_op = 1)",
+        params![board_id, user_hash, i32::from(hidden)],
+        |row| row.get(0),
+    )?)
+}
+
 /// Execute an indexed page and its bounded per-thread aggregate probes.
 fn load_thread_page(
     conn: &rusqlite::Connection,
@@ -247,7 +320,7 @@ pub fn get_thread(conn: &rusqlite::Connection, thread_id: i64) -> Result<Option<
 /// Result of atomically deciding whether a public post submission is new.
 pub(crate) enum PostCreationOutcome<T> {
     /// The transaction created and committed a new post bundle.
-    Created(T),
+    Created(T, i64),
     /// The token already names a canonical committed post.
     Replayed(super::PostSubmissionRecord),
 }
@@ -263,6 +336,8 @@ pub(crate) struct PostFilesystemCommit<'a, F = fn(&rusqlite::Connection) -> Resu
     schedule_thread_prune: bool,
     /// Posting policy checked after token replay and while holding the write lock.
     validate: F,
+    /// Board name for media work that must persist alongside the new post.
+    media_job_board: Option<&'a str>,
 }
 
 impl<'a> PostFilesystemCommit<'a> {
@@ -289,16 +364,114 @@ impl<'a, F> PostFilesystemCommit<'a, F> {
         deduplicated_paths: &'a [&'a str],
         schedule_thread_prune: bool,
         validate: F,
+    ) -> Self {
+        Self::new_with_media_validation(
+            pending_fs_op,
+            deduplicated_paths,
+            schedule_thread_prune,
+            None,
+            validate,
+        )
+    }
+
+    /// Include required media work in the atomic creation bundle.
+    pub(crate) const fn new_with_media_validation(
+        pending_fs_op: Option<&'a crate::pending_fs::PendingFsOpInsert>,
+        deduplicated_paths: &'a [&'a str],
+        schedule_thread_prune: bool,
+        media_job_board: Option<&'a str>,
+        validate: F,
     ) -> Self {
         Self {
             pending_fs_op,
             deduplicated_paths,
             schedule_thread_prune,
             validate,
+            media_job_board,
         }
     }
 }
 
+/// Persist media intent before commit; a full queue leaves an explicit failure.
+fn persist_new_post_metadata(
+    conn: &rusqlite::Connection,
+    post: &super::NewPost,
+    post_id: i64,
+    media_board: Option<&str>,
+) -> Result<i64> {
+    if let Some(board_short) = media_board {
+        let source = post
+            .file_path
+            .as_ref()
+            .context("pending media requires a source")?;
+        let (job_type, job_tag) = match post.media_type.as_deref() {
+            Some("video") => ("video_transcode", "VideoTranscode"),
+            Some("audio") => ("audio_waveform", "AudioWaveform"),
+            _ => anyhow::bail!("pending processing requires audio or video"),
+        };
+        let capacity = crate::config::CONFIG.job_queue_capacity;
+        let full = capacity > 0 && u64::try_from(super::pending_job_count(conn)?)? >= capacity;
+        if full {
+            super::set_post_media_processing_state(
+                conn,
+                post_id,
+                Some(super::MEDIA_PROCESSING_FAILED),
+                Some("Background media queue is full; deferred processing was skipped."),
+            )?;
+        } else {
+            let payload = serde_json::json!({
+                "t": job_tag, "d": { "post_id": post_id, "file_path": source, "board_short": board_short }
+            }).to_string();
+            super::enqueue_job(conn, job_type, &payload).map(|_job_id| ())?;
+            super::set_post_media_processing_state(
+                conn,
+                post_id,
+                Some(super::MEDIA_PROCESSING_PENDING),
+                None,
+            )?;
+        }
+    }
+    Ok(conn.query_row(
+        "SELECT created_at FROM posts WHERE id = ?1",
+        [post_id],
+        |row| row.get(0),
+    )?)
+}
+
+/// Reject reuse of a receipt for another operation or reply target.
+pub(crate) fn validate_submission_target(
+    record: super::PostSubmissionRecord,
+    thread_id: Option<i64>,
+) -> Result<()> {
+    if record.is_thread != thread_id.is_none()
+        || thread_id.is_some_and(|target| target != record.thread_id)
+    {
+        return Err(crate::error::AppError::Conflict(
+            "This submission token belongs to a different posting form. Reload the page.".into(),
+        )
+        .into());
+    }
+    Ok(())
+}
+
+/// A token accepted for another actor/board must never create new content.
+fn reject_conflicting_submission(conn: &rusqlite::Connection, token: &str) -> Result<()> {
+    if !token.is_empty()
+        && conn.query_row(
+            "SELECT EXISTS(SELECT 1 FROM post_submissions WHERE submission_token=?1)
+            OR EXISTS(SELECT 1 FROM post_submission_tombstones WHERE submission_token=?1)",
+            [token],
+            |row| row.get::<_, bool>(0),
+        )?
+    {
+        return Err(crate::error::AppError::Conflict(
+            "This submission token has already been used. Reload the posting form.".into(),
+        )
+        .into());
+    }
+    Ok(())
+}
+
 /// Create a thread, its OP post, and an optional poll atomically.
 ///
 /// # Errors
@@ -321,7 +494,7 @@ pub fn create_thread_with_optional_poll(
         poll,
         PostFilesystemCommit::new(pending_fs_op, &[], false),
     )? {
-        PostCreationOutcome::Created(ids) => Ok(ids),
+        PostCreationOutcome::Created(ids, _) => Ok(ids),
         PostCreationOutcome::Replayed(existing) => Ok((existing.thread_id, existing.post_id, None)),
     }
 }
@@ -355,10 +528,12 @@ pub(crate) fn create_thread_submission(
             if let Some(existing) =
                 super::posts::get_post_submission(conn, submission_token, ip_hash, board_id)?
             {
+                validate_submission_target(existing, None)?;
                 return Ok(PostCreationOutcome::Replayed(existing));
             }
         }
 
+        reject_conflicting_submission(conn, submission_token)?;
         (filesystem.validate)(conn)?;
         validate_deduplicated_paths(conn, filesystem.deduplicated_paths)?;
 
@@ -406,7 +581,16 @@ pub(crate) fn create_thread_submission(
                 .map(|_operation_summary| ())?;
         }
 
-        Ok(PostCreationOutcome::Created((thread_id, post_id, poll_id)))
+        let created_at = persist_new_post_metadata(
+            conn,
+            &post_with_thread,
+            post_id,
+            filesystem.media_job_board,
+        )?;
+        Ok(PostCreationOutcome::Created(
+            (thread_id, post_id, poll_id),
+            created_at,
+        ))
     })();
 
     match result {
@@ -443,7 +627,7 @@ pub fn create_reply_with_thread_update(
         should_bump,
         PostFilesystemCommit::new(pending_fs_op, &[], false),
     )? {
-        PostCreationOutcome::Created(post_id) => Ok(post_id),
+        PostCreationOutcome::Created(post_id, _) => Ok(post_id),
         PostCreationOutcome::Replayed(existing) => Ok(existing.post_id),
     }
 }
@@ -468,39 +652,22 @@ pub(crate) fn create_reply_submission(
             if let Some(existing) =
                 super::posts::get_post_submission(conn, submission_token, ip_hash, post.board_id)?
             {
+                validate_submission_target(existing, Some(post.thread_id))?;
                 return Ok(PostCreationOutcome::Replayed(existing));
             }
         }
 
+        if post.is_op {
+            return Err(crate::error::AppError::BadRequest(
+                "A reply cannot be a thread starter.".into(),
+            )
+            .into());
+        }
+        reject_conflicting_submission(conn, submission_token)?;
         (filesystem.validate)(conn)?;
         validate_deduplicated_paths(conn, filesystem.deduplicated_paths)?;
 
-        let flags = conn
-            .query_row(
-                "SELECT locked, archived
-                 FROM threads
-                 WHERE id = ?1 AND board_id = ?2",
-                params![post.thread_id, post.board_id],
-                |row| {
-                    Ok((
-                        row.get::<_, i32>(0)? != 0_i32,
-                        row.get::<_, i32>(1)? != 0_i32,
-                    ))
-                },
-            )
-            .optional()?;
-        let Some((locked, archived)) = flags else {
-            anyhow::bail!(
-                "Thread id {} not found while creating reply",
-                post.thread_id
-            );
-        };
-        if locked {
-            return Err(anyhow::Error::new(ThreadClosed::Locked));
-        }
-        if archived {
-            return Err(anyhow::Error::new(ThreadClosed::Archived));
-        }
+        ensure_replyable(conn, post.board_id, post.thread_id)?;
 
         let post_id = super::posts::create_post_inner(conn, post)?;
         let updated = if should_bump {
@@ -541,7 +708,9 @@ pub(crate) fn create_reply_submission(
                 false,
             )?;
         }
-        Ok(PostCreationOutcome::Created(post_id))
+        let created_at =
+            persist_new_post_metadata(conn, post, post_id, filesystem.media_job_board)?;
+        Ok(PostCreationOutcome::Created(post_id, created_at))
     })();
 
     match result {
@@ -559,6 +728,38 @@ pub(crate) fn create_reply_submission(
     }
 }
 
+/// Authoritative current parent-state check, performed under the posting write lock.
+fn ensure_replyable(conn: &rusqlite::Connection, board_id: i64, thread_id: i64) -> Result<()> {
+    let flags = conn
+        .query_row(
+            "SELECT locked, archived
+                 FROM threads
+                 WHERE id = ?1 AND board_id = ?2",
+            params![thread_id, board_id],
+            |row| {
+                Ok((
+                    row.get::<_, i32>(0)? != 0_i32,
+                    row.get::<_, i32>(1)? != 0_i32,
+                ))
+            },
+        )
+        .optional()?;
+    let Some((locked, archived)) = flags else {
+        return Err(crate::error::AppError::NotFound(
+            "Thread not found. It may have been deleted or pruned.".into(),
+        )
+        .into());
+    };
+    if archived {
+        return Err(anyhow::Error::new(ThreadClosed::Archived));
+    }
+    if locked {
+        return Err(anyhow::Error::new(ThreadClosed::Locked));
+    }
+
+    Ok(())
+}
+
 /// Revalidate a prior dedup cache hit after the post transaction owns the write lock.
 fn validate_deduplicated_paths(conn: &rusqlite::Connection, paths: &[&str]) -> Result<()> {
     for path in paths {
@@ -710,243 +911,125 @@ pub fn delete_thread(
 }
 
 // Archive / prune
-/// Archive oldest non-sticky threads that exceed the board's `max_threads` limit.
-///
-/// Archived threads are locked and marked read-only; their content remains
-/// accessible via `/{board}/archive`. Returns the count of threads archived
-/// (no file deletion occurs).
+/// Archive overflow non-sticky active threads, keeping the newest bump/ID pairs.
 ///
-/// ID selection and the bulk update share a transaction so a concurrent bump
-/// cannot change the ordering between those operations.
-///
-/// Note: LIMIT -1 OFFSET ? is a SQLite-specific idiom for "skip the first
-/// max rows, return everything else". It is not standard SQL. The LIMIT -1
-/// means "no upper bound on the result set after the offset is applied".
+/// Archiving locks threads and preserves all posts and media references.
+/// Sticky active threads do not count against the limit; locked threads do.
 ///
 /// # Errors
-/// Returns an error if the database operation fails.
+/// Returns an error for invalid limits or a failed transaction.
 pub fn archive_old_threads(conn: &rusqlite::Connection, board_id: i64, max: i64) -> Result<usize> {
-    conn.execute_batch("BEGIN IMMEDIATE")
-        .context("Failed to begin archive_old_threads transaction")?;
-
-    let result: Result<usize> = (|| {
-        // Collect inside the transaction to prevent races with concurrent bumps.
-        let ids: Vec<i64> = {
-            let mut stmt = conn.prepare_cached(
-                "SELECT id FROM threads
-                 WHERE board_id = ?1 AND sticky = 0 AND archived = 0
-                 ORDER BY bumped_at DESC LIMIT -1 OFFSET ?2",
-            )?;
-            // Bind `collected` explicitly so `stmt` is dropped before the
-            // block ends — the MappedRows iterator borrows `stmt`, and the
-            // compiler requires the borrow to end before the binding goes out
-            // of scope at the closing `}`.
-            let collected = stmt
-                .query_map(params![board_id, max], |r| r.get(0))?
-                .collect::<rusqlite::Result<Vec<_>>>()?;
-            collected
-        };
-
-        let count = ids.len();
-        if count == 0 {
-            return Ok(0);
-        }
-
-        // Single bulk UPDATE instead of N individual statements.
-        let placeholders: String = ids
-            .iter()
-            .enumerate()
-            .map(|(i, _)| format!("?{}", i.saturating_add(1)))
-            .collect::<Vec<_>>()
-            .join(", ");
-        let sql =
-            format!("UPDATE threads SET archived = 1, locked = 1 WHERE id IN ({placeholders})");
-        conn.execute(&sql, rusqlite::params_from_iter(&ids))
-            .context("Failed to bulk archive threads")
-            .map(|_affected_rows| ())?;
-
-        Ok(count)
-    })();
+    let tx = rusqlite::Transaction::new_unchecked(conn, rusqlite::TransactionBehavior::Immediate)?;
+    let count = archive_old_threads_in_tx(&tx, board_id, max)?;
+    tx.commit()?;
+    Ok(count)
+}
 
-    match result {
-        Ok(0) => {
-            // Nothing to archive — roll back the (empty) transaction cleanly.
-            drop(conn.execute_batch("ROLLBACK"));
-            Ok(0)
-        }
-        Ok(count) => {
-            super::commit_transaction(conn, "Failed to commit archive_old_threads transaction")?;
-            Ok(count)
-        }
-        Err(e) => {
-            drop(conn.execute_batch("ROLLBACK"));
-            Err(e)
-        }
-    }
+/// Archive overflow while the caller holds the SQLite write transaction.
+pub(crate) fn archive_old_threads_in_tx(
+    conn: &rusqlite::Transaction<'_>,
+    board_id: i64,
+    max: i64,
+) -> Result<usize> {
+    validate_retention_limit(max, false)?;
+    // A subquery avoids building an unbounded parameter list for backlog recovery.
+    conn.execute(
+        "UPDATE threads SET archived = 1, locked = 1
+         WHERE id IN (
+             SELECT id FROM threads
+             WHERE board_id = ?1 AND sticky = 0 AND archived = 0
+             ORDER BY bumped_at DESC, id DESC LIMIT -1 OFFSET ?2
+         )",
+        params![board_id, max],
+    )
+    .context("Failed to archive overflow threads")
 }
 
-/// Hard-delete oldest non-sticky, non-archived threads that exceed `max_threads`.
-/// Used when a board has archiving disabled — threads are permanently removed.
+/// Hard-delete overflow non-sticky active threads when archiving is disabled.
 ///
-/// Returns the on-disk paths that are now safe to delete (i.e. no longer
-/// referenced by any remaining post after the prune). The caller is responsible
-/// for actually removing these files from disk.
-///
-/// ID selection, bulk deletion, and the final path-reference check share a
-/// transaction so a concurrent insert cannot make a returned path live again.
-/// File paths are collected with one joined query.
-///
-/// Note: LIMIT -1 OFFSET ? is a SQLite-specific idiom — see `archive_old_threads`.
+/// Returns safe file paths and a durable cleanup intent for filesystem replay.
 ///
 /// # Errors
-/// Returns an error if the database operation fails.
+/// Returns an error for invalid limits or a failed transaction.
 pub fn prune_old_threads(
     conn: &rusqlite::Connection,
     board_id: i64,
     max: i64,
 ) -> Result<crate::db::DeletePathsResult> {
-    conn.execute_batch("BEGIN IMMEDIATE")
-        .context("Failed to begin prune_old_threads transaction")?;
-
-    let result: Result<crate::db::DeletePathsResult> = (|| {
-        // Collect ids inside the transaction to prevent concurrent bumps from
-        // changing the ordering between the SELECT and the DELETE.
-        let ids: Vec<i64> = {
-            let mut stmt = conn.prepare_cached(
-                "SELECT id FROM threads
-                 WHERE board_id = ?1 AND sticky = 0 AND archived = 0
-                 ORDER BY bumped_at DESC LIMIT -1 OFFSET ?2",
-            )?;
-            let collected = stmt
-                .query_map(params![board_id, max], |r| r.get(0))?
-                .collect::<rusqlite::Result<Vec<_>>>()?;
-            collected
-        };
-
-        if ids.is_empty() {
-            return Ok(crate::db::DeletePathsResult {
-                paths: Vec::new(),
-                pending_fs_op_id: None,
-            });
-        }
-
-        // Collect all file paths in a single query BEFORE the DELETEs.
-        let candidates = collect_thread_file_paths(conn, &ids)?;
-
-        // Single bulk DELETE instead of N individual statements.
-        let placeholders: String = ids
-            .iter()
-            .enumerate()
-            .map(|(i, _)| format!("?{}", i.saturating_add(1)))
-            .collect::<Vec<_>>()
-            .join(", ");
-        let sql = format!("DELETE FROM threads WHERE id IN ({placeholders})");
-        conn.execute(&sql, rusqlite::params_from_iter(&ids))
-            .context("Failed to bulk delete pruned threads")
-            .map(|_affected_rows| ())?;
-
-        // Determine safe paths INSIDE the transaction so the check sees the
-        // post-delete state before any concurrent writer can insert new references.
-        let safe = super::paths_safe_to_delete(conn, candidates)?;
-        let pending_fs_op = super::build_delete_files_pending_op(&safe)?;
-        if let Some(op) = pending_fs_op.as_ref() {
-            super::insert_pending_fs_op(conn, op)?;
-        }
-        Ok(crate::db::DeletePathsResult {
-            paths: safe,
-            pending_fs_op_id: pending_fs_op.map(|op| op.id),
-        })
-    })();
-
-    match result {
-        Ok(result) => {
-            super::commit_transaction(conn, "Failed to commit prune_old_threads transaction")?;
-            Ok(result)
-        }
-        Err(e) => {
-            drop(conn.execute_batch("ROLLBACK"));
-            Err(e)
-        }
-    }
+    let tx = rusqlite::Transaction::new_unchecked(conn, rusqlite::TransactionBehavior::Immediate)?;
+    let result = prune_old_threads_in_tx(&tx, board_id, max, false)?;
+    tx.commit()?;
+    Ok(result)
 }
 
-/// Hard-delete oldest archived threads that exceed the archive retention cap.
+/// Hard-delete archived overflow, keeping the first entries in archive order.
 ///
-/// Returns the on-disk paths that are now safe to remove. As with live-thread
-/// pruning, the caller is responsible for deleting those files from disk.
-///
-/// The ordering uses `bumped_at DESC`, matching the archive page and ensuring
-/// we keep the most recently-active archived threads.
+/// Retention uses bump time, not time of archival. Archived sticky threads are
+/// subject to this cap too. File cleanup is durably scheduled before commit.
 ///
 /// # Errors
-/// Returns an error if the transaction cannot be opened or committed, if the
-/// candidate threads cannot be queried, or if the bulk delete/safe-path
-/// calculation fails.
+/// Returns an error for invalid limits or a failed transaction.
 pub fn prune_old_archived_threads(
     conn: &rusqlite::Connection,
     board_id: i64,
     max: i64,
 ) -> Result<crate::db::DeletePathsResult> {
-    conn.execute_batch("BEGIN IMMEDIATE")
-        .context("Failed to begin prune_old_archived_threads transaction")?;
-
-    let result: Result<crate::db::DeletePathsResult> = (|| {
-        let ids: Vec<i64> = {
-            let mut stmt = conn.prepare_cached(
-                "SELECT id FROM threads
-                 WHERE board_id = ?1 AND archived = 1
-                 ORDER BY bumped_at DESC LIMIT -1 OFFSET ?2",
-            )?;
-            let collected = stmt
-                .query_map(params![board_id, max], |r| r.get(0))?
-                .collect::<rusqlite::Result<Vec<_>>>()?;
-            collected
-        };
-
-        if ids.is_empty() {
-            return Ok(crate::db::DeletePathsResult {
-                paths: Vec::new(),
-                pending_fs_op_id: None,
-            });
-        }
-
-        let candidates = collect_thread_file_paths(conn, &ids)?;
-
-        let placeholders: String = ids
-            .iter()
-            .enumerate()
-            .map(|(i, _)| format!("?{}", i.saturating_add(1)))
-            .collect::<Vec<_>>()
-            .join(", ");
-        let sql = format!("DELETE FROM threads WHERE id IN ({placeholders})");
-        conn.execute(&sql, rusqlite::params_from_iter(&ids))
-            .context("Failed to bulk delete archived threads")
-            .map(|_affected_rows| ())?;
+    let tx = rusqlite::Transaction::new_unchecked(conn, rusqlite::TransactionBehavior::Immediate)?;
+    let result = prune_old_threads_in_tx(&tx, board_id, max, true)?;
+    tx.commit()?;
+    Ok(result)
+}
 
-        let safe = super::paths_safe_to_delete(conn, candidates)?;
-        let pending_fs_op = super::build_delete_files_pending_op(&safe)?;
-        if let Some(op) = pending_fs_op.as_ref() {
-            super::insert_pending_fs_op(conn, op)?;
-        }
-        Ok(crate::db::DeletePathsResult {
-            paths: safe,
-            pending_fs_op_id: pending_fs_op.map(|op| op.id),
-        })
-    })();
+/// Reject invalid destructive limits even when called outside the worker.
+fn validate_retention_limit(max: i64, archived: bool) -> Result<()> {
+    let upper = if archived { 10_000 } else { 1_000 };
+    anyhow::ensure!(
+        (1..=upper).contains(&max),
+        "invalid retention limit {max}; expected 1..={upper}; preserving content"
+    );
+    Ok(())
+}
 
-    match result {
-        Ok(result) => {
-            super::commit_transaction(
-                conn,
-                "Failed to commit prune_old_archived_threads transaction",
-            )?;
-            Ok(result)
-        }
-        Err(e) => {
-            drop(conn.execute_batch("ROLLBACK"));
-            Err(e)
-        }
+/// Select, delete, reference-check and journal files in the caller's transaction.
+pub(crate) fn prune_old_threads_in_tx(
+    conn: &rusqlite::Transaction<'_>,
+    board_id: i64,
+    max: i64,
+    archived: bool,
+) -> Result<crate::db::DeletePathsResult> {
+    validate_retention_limit(max, archived)?;
+    // Archive ties historically ascend by ID. Active ties descend by ID, exactly
+    // matching the board index. Never let query planner choice decide retention.
+    let sql = if archived {
+        "SELECT id FROM threads WHERE board_id = ?1 AND archived = 1
+         ORDER BY bumped_at DESC, id ASC LIMIT -1 OFFSET ?2"
+    } else {
+        "SELECT id FROM threads WHERE board_id = ?1 AND sticky = 0 AND archived = 0
+         ORDER BY bumped_at DESC, id DESC LIMIT -1 OFFSET ?2"
+    };
+    let ids = conn
+        .prepare_cached(sql)?
+        .query_map(params![board_id, max], |row| row.get::<_, i64>(0))?
+        .collect::<rusqlite::Result<Vec<_>>>()?;
+    let candidates = collect_thread_file_paths(conn, &ids)?;
+    for batch in ids.chunks(500) {
+        let placeholders = vec!["?"; batch.len()].join(", ");
+        conn.execute(
+            &format!("DELETE FROM threads WHERE id IN ({placeholders})"),
+            rusqlite::params_from_iter(batch),
+        )
+        .context("Failed to delete overflow threads")
+        .map(|_affected_rows| ())?;
     }
+    let safe = super::paths_safe_to_delete(conn, candidates)?;
+    let pending_fs_op = super::build_delete_files_pending_op(&safe)?;
+    if let Some(op) = pending_fs_op.as_ref() {
+        super::insert_pending_fs_op(conn, op)?;
+    }
+    Ok(crate::db::DeletePathsResult {
+        paths: safe,
+        pending_fs_op_id: pending_fs_op.map(|op| op.id),
+    })
 }
 
 // Archive listing
@@ -1707,3 +1790,10 @@ mod tests {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod archive_tests;
+
+#[cfg(test)]
+/// Full posting state-machine and WAL concurrency regressions.
+mod lifecycle_tests;
diff --git a/src/db/threads/archive_tests.rs b/src/db/threads/archive_tests.rs
new file mode 100644
index 00000000..687268f7
--- /dev/null
+++ b/src/db/threads/archive_tests.rs
@@ -0,0 +1,574 @@
+//! Archive lifecycle regressions using real schema, transactions and file-backed WAL.
+
+use super::*;
+use anyhow::ensure;
+use rusqlite::Connection;
+
+fn fixture(conn: &Connection) -> Result<i64> {
+    crate::db::schema::install_or_migrate_schema(conn)?;
+    crate::db::create_board(conn, "archive", "Archive", "", false)
+}
+
+fn thread(conn: &Connection, board: i64, bump: i64) -> Result<i64> {
+    let id = conn.query_row(
+        "INSERT INTO threads(board_id, subject, bumped_at) VALUES(?1, 'café <script>', ?2) RETURNING id",
+        params![board, bump], |row| row.get(0),
+    )?;
+    conn.execute(
+        "INSERT INTO posts(thread_id, board_id, body, body_html, deletion_token, is_op)
+         VALUES(?1, ?2, 'archive needle', 'archive needle', 'delete', 1)",
+        params![id, board],
+    )
+    .map(|_rows| ())?;
+    Ok(id)
+}
+
+fn ids(conn: &Connection, archived: bool) -> Result<Vec<i64>> {
+    let mut statement = conn.prepare("SELECT id FROM threads WHERE archived=?1 ORDER BY id")?;
+    let ids = statement
+        .query_map([i64::from(archived)], |row| row.get(0))?
+        .collect::<rusqlite::Result<_>>()?;
+    Ok(ids)
+}
+
+#[test]
+fn archive_threshold_ties_sticky_locked_and_idempotency() -> Result<()> {
+    let conn = Connection::open_in_memory()?;
+    let board = fixture(&conn)?;
+    let oldest = thread(&conn, board, 100)?;
+    let newer = thread(&conn, board, 100)?;
+    let newest = thread(&conn, board, 100)?;
+    let sticky = thread(&conn, board, 1)?;
+    set_thread_sticky(&conn, sticky, true)?;
+    set_thread_locked(&conn, oldest, true)?;
+    ensure!(archive_old_threads(&conn, board, 3)? == 0);
+    ensure!(archive_old_threads(&conn, board, 2)? == 1);
+    ensure!(ids(&conn, true)? == [oldest]);
+    ensure!(ids(&conn, false)? == [newer, newest, sticky]);
+    ensure!(archive_old_threads(&conn, board, 2)? == 0);
+    let state = get_thread(&conn, oldest)?.context("archived thread")?;
+    ensure!(state.archived && state.locked);
+    Ok(())
+}
+
+#[test]
+fn destructive_limits_fail_closed_at_database_boundary() -> Result<()> {
+    let conn = Connection::open_in_memory()?;
+    let board = fixture(&conn)?;
+    let _thread = thread(&conn, board, 100)?;
+    for max in [i64::MIN, -1, 0, 10_001, i64::MAX] {
+        ensure!(archive_old_threads(&conn, board, max).is_err());
+        ensure!(prune_old_threads(&conn, board, max).is_err());
+        ensure!(prune_old_archived_threads(&conn, board, max).is_err());
+        ensure!(conn.is_autocommit());
+        ensure!(ids(&conn, false)?.len() == 1);
+    }
+    Ok(())
+}
+
+#[test]
+fn archive_pages_and_retention_share_tie_order_and_search_survives() -> Result<()> {
+    let conn = Connection::open_in_memory()?;
+    let board = fixture(&conn)?;
+    let mut expected = Vec::new();
+    for _ in 0_i32..45_i32 {
+        let id = thread(&conn, board, 100)?;
+        set_thread_archived(&conn, id, true)?;
+        expected.push(id);
+    }
+    let mut paged = Vec::new();
+    for offset in [0, 20, 40] {
+        paged.extend(
+            get_archived_threads_for_board(&conn, board, 20, offset)?
+                .iter()
+                .map(|t| t.id),
+        );
+    }
+    ensure!(paged == expected);
+    ensure!(crate::db::search_posts(&conn, board, "needle", 50, 0)?.len() == 45);
+    ensure!(get_threads_for_board(&conn, board, 20, 0)?.is_empty());
+    let _deleted = prune_old_archived_threads(&conn, board, 20)?;
+    ensure!(ids(&conn, true)? == expected.get(..20).context("first archive page")?);
+    ensure!(crate::db::search_posts(&conn, board, "needle", 50, 0)?.len() == 20);
+    Ok(())
+}
+
+#[test]
+fn live_deletion_ties_keep_the_visible_newest_threads() -> Result<()> {
+    let conn = Connection::open_in_memory()?;
+    let board = fixture(&conn)?;
+    let old = thread(&conn, board, 100)?;
+    let newer = thread(&conn, board, 100)?;
+    let newest = thread(&conn, board, 100)?;
+    let _deleted = prune_old_threads(&conn, board, 2)?;
+    ensure!(ids(&conn, false)? == [newer, newest]);
+    ensure!(get_thread(&conn, old)?.is_none());
+    Ok(())
+}
+
+#[test]
+fn combined_retention_failure_rolls_back_archive_transition() -> Result<()> {
+    let conn = Connection::open_in_memory()?;
+    let board = fixture(&conn)?;
+    for _ in 0_i32..4_i32 {
+        let _thread = thread(&conn, board, 100)?;
+    }
+    conn.execute_batch(
+        "CREATE TRIGGER fail_prune BEFORE DELETE ON threads
+                        BEGIN SELECT RAISE(ABORT, 'injected archive retention failure'); END;",
+    )?;
+    {
+        let tx =
+            rusqlite::Transaction::new_unchecked(&conn, rusqlite::TransactionBehavior::Immediate)?;
+        ensure!(archive_old_threads_in_tx(&tx, board, 1)? == 3);
+        ensure!(prune_old_threads_in_tx(&tx, board, 1, true).is_err());
+    }
+    ensure!(conn.is_autocommit());
+    ensure!(ids(&conn, false)?.len() == 4 && ids(&conn, true)?.is_empty());
+    conn.execute_batch("DROP TRIGGER fail_prune")?;
+    ensure!(archive_old_threads(&conn, board, 1)? == 3);
+    Ok(())
+}
+
+#[test]
+fn archived_media_survives_and_shared_paths_are_never_pruned() -> Result<()> {
+    let conn = Connection::open_in_memory()?;
+    let board = fixture(&conn)?;
+    let first = thread(&conn, board, 1)?;
+    let second = thread(&conn, board, 2)?;
+    let live = thread(&conn, board, 3)?;
+    for id in [first, second, live] {
+        conn.execute("UPDATE posts SET file_path='archive/shared.webp', thumb_path='archive/thumbs/shared.webp', audio_file_path='archive/shared.opus' WHERE thread_id=?1", [id]).map(|_rows| ())?;
+    }
+    ensure!(archive_old_threads(&conn, board, 1)? == 2);
+    let posts = crate::db::get_posts_for_thread(&conn, first)?;
+    let post = posts.first().context("archived OP")?;
+    ensure!(post.file_path.as_deref() == Some("archive/shared.webp"));
+    ensure!(post.audio_file_path.as_deref() == Some("archive/shared.opus"));
+    let deleted = prune_old_archived_threads(&conn, board, 1)?;
+    ensure!(deleted.paths.is_empty() && deleted.pending_fs_op_id.is_none());
+    ensure!(get_thread(&conn, second)?.is_some());
+    Ok(())
+}
+
+#[test]
+fn archive_recovery_handles_more_than_sqlite_parameter_limit() -> Result<()> {
+    let conn = Connection::open_in_memory()?;
+    let board = fixture(&conn)?;
+    conn.execute(
+        "WITH RECURSIVE n(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM n WHERE x<33000)
+                  INSERT INTO threads(board_id,bumped_at) SELECT ?1,x FROM n",
+        [board],
+    )
+    .map(|_rows| ())?;
+    ensure!(archive_old_threads(&conn, board, 1)? == 32_999);
+    let _deleted = prune_old_archived_threads(&conn, board, 1)?;
+    ensure!(ids(&conn, true)?.len() == 1 && ids(&conn, false)?.len() == 1);
+    Ok(())
+}
+
+#[test]
+fn archive_busy_failure_and_restart_are_recoverable() -> Result<()> {
+    let dir = tempfile::tempdir()?;
+    let path = dir.path().join("archive.sqlite3");
+    let conn = Connection::open(&path)?;
+    conn.execute_batch(crate::db::pool::CONNECTION_PRAGMAS)?;
+    let board = fixture(&conn)?;
+    let old = thread(&conn, board, 1)?;
+    let _new = thread(&conn, board, 2)?;
+    let other = Connection::open(&path)?;
+    other.busy_timeout(std::time::Duration::from_millis(10))?;
+    {
+        let _tx =
+            rusqlite::Transaction::new_unchecked(&conn, rusqlite::TransactionBehavior::Immediate)?;
+        ensure!(archive_old_threads(&other, board, 1).is_err());
+        ensure!(other.is_autocommit());
+    }
+    ensure!(archive_old_threads(&other, board, 1)? == 1);
+    drop(other);
+    drop(conn);
+    let restarted = Connection::open(path)?;
+    ensure!(ids(&restarted, true)? == [old]);
+    ensure!(archive_old_threads(&restarted, board, 1)? == 0);
+    crate::db::verify_database_schema(&restarted)?;
+    Ok(())
+}
+
+#[test]
+fn overlapping_creators_and_archive_passes_preserve_every_thread() -> Result<()> {
+    let dir = tempfile::tempdir()?;
+    let path = dir.path().join("concurrent.sqlite3");
+    let conn = Connection::open(&path)?;
+    conn.execute_batch(crate::db::pool::CONNECTION_PRAGMAS)?;
+    let board = fixture(&conn)?;
+    let barrier = std::sync::Barrier::new(4);
+    std::thread::scope(|scope| -> Result<()> {
+        let mut handles = Vec::new();
+        for worker in 0_i32..4_i32 {
+            let path = &path;
+            let barrier = &barrier;
+            handles.push(scope.spawn(move || -> Result<()> {
+                let worker_conn = Connection::open(path)?;
+                worker_conn.execute_batch(crate::db::pool::CONNECTION_PRAGMAS)?;
+                worker_conn.busy_timeout(std::time::Duration::from_secs(5))?;
+                let _barrier = barrier.wait();
+                for _ in 0_i32..10_i32 {
+                    if worker < 2_i32 {
+                        let tx = rusqlite::Transaction::new_unchecked(
+                            &worker_conn,
+                            rusqlite::TransactionBehavior::Immediate,
+                        )?;
+                        let _thread = thread(&tx, board, 100)?;
+                        let _schedule = crate::db::persist_thread_prune_intent_in_tx(&tx, board)?;
+                        tx.commit()?;
+                    } else {
+                        let _count = archive_old_threads(&worker_conn, board, 3)?;
+                    }
+                }
+                Ok(())
+            }));
+        }
+        for handle in handles {
+            handle.join().map_err(|payload| {
+                anyhow::anyhow!(
+                    "archive worker panicked: {}",
+                    crate::media::process::panic_message(payload.as_ref())
+                )
+            })??;
+        }
+        Ok(())
+    })?;
+    let _count = archive_old_threads(&conn, board, 3)?;
+    ensure!(ids(&conn, false)?.len() == 3 && ids(&conn, true)?.len() == 17);
+    ensure!(crate::db::search_posts(&conn, board, "needle", 100, 0)?.len() == 20);
+    crate::db::verify_database_schema(&conn)?;
+    Ok(())
+}
+
+#[test]
+#[ignore = "explicit archive-heavy performance and query-plan evidence"]
+fn archive_query_profile() -> Result<()> {
+    let mut evidence = Vec::new();
+    let conn = Connection::open_in_memory()?;
+    let board = fixture(&conn)?;
+    conn.execute(
+        "WITH RECURSIVE n(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM n WHERE x<10000)
+                  INSERT INTO threads(board_id,bumped_at,archived) SELECT ?1,x/100, x>100 FROM n",
+        [board],
+    )
+    .map(|_rows| ())?;
+    conn.execute("INSERT INTO posts(thread_id,board_id,body,body_html,deletion_token,is_op) SELECT id,board_id,'needle','needle','delete',1 FROM threads", []).map(|_rows| ())?;
+    conn.execute_batch(
+        "WITH RECURSIVE n(x) AS (VALUES(1) UNION ALL SELECT x+1 FROM n WHERE x<20)
+        INSERT INTO posts(thread_id,board_id,body,body_html,deletion_token)
+        SELECT t.id,t.board_id,'reply','reply','delete' FROM threads t CROSS JOIN n;",
+    )?;
+    let query = "SELECT id FROM threads WHERE board_id=1 AND archived=0 AND sticky=0 ORDER BY bumped_at DESC,id DESC LIMIT -1 OFFSET 50";
+    for indexed in [false, true] {
+        if indexed {
+            conn.execute_batch("CREATE INDEX IF NOT EXISTS idx_threads_active_order ON threads(board_id,sticky DESC,bumped_at DESC,id DESC) WHERE archived=0; DROP INDEX IF EXISTS idx_threads_board_sticky_bumped;")?;
+        } else {
+            conn.execute_batch("DROP INDEX IF EXISTS idx_threads_active_order; CREATE INDEX IF NOT EXISTS idx_threads_board_sticky_bumped ON threads(board_id,sticky DESC,bumped_at DESC);")?;
+        }
+        conn.execute_batch("ANALYZE")?;
+        let plan = conn
+            .prepare(&format!("EXPLAIN QUERY PLAN {query}"))?
+            .query_map([], |r| r.get::<_, String>(3))?
+            .collect::<rusqlite::Result<Vec<_>>>()?;
+        let start = std::time::Instant::now();
+        for _ in 0_i32..200_i32 {
+            let result = conn
+                .prepare(query)?
+                .query_map([], |r| r.get::<_, i64>(0))?
+                .collect::<rusqlite::Result<Vec<_>>>()?;
+            ensure!(result.len() == 50);
+        }
+        evidence.push(format!(
+            "archive-heavy active retention indexed={indexed}: {:?} for 200 queries; {plan:?}",
+            start.elapsed()
+        ));
+    }
+    for offset in [0, 5000, 9880] {
+        let start = std::time::Instant::now();
+        for _ in 0_i32..20_i32 {
+            ensure!(get_archived_threads_for_board(&conn, board, 20, offset)?.len() == 20);
+        }
+        evidence.push(format!(
+            "archive page offset={offset}: {:?} for 20 loads",
+            start.elapsed()
+        ));
+    }
+    let thread_started = std::time::Instant::now();
+    let _thread = get_thread(&conn, 9999)?;
+    let _posts = crate::db::get_posts_for_thread(&conn, 9999)?;
+    evidence.push(format!(
+        "archived thread load: {:?}",
+        thread_started.elapsed()
+    ));
+    let search_started = std::time::Instant::now();
+    let _search = crate::db::search_posts(&conn, board, "needle", 20, 0)?;
+    evidence.push(format!(
+        "archive FTS search: {:?}",
+        search_started.elapsed()
+    ));
+    let maintenance_started = std::time::Instant::now();
+    let _count = archive_old_threads(&conn, board, 50)?;
+    let _deleted = prune_old_archived_threads(&conn, board, 9000)?;
+    evidence.push(format!(
+        "archive + retention of 950 threads/19950 posts: {:?}",
+        maintenance_started.elapsed()
+    ));
+    std::fs::write(
+        std::env::var("RUSTCHAN_ARCHIVE_EVIDENCE")?,
+        evidence.join("\n"),
+    )?;
+    Ok(())
+}
+
+fn reply_post(board_id: i64, thread_id: i64) -> crate::db::NewPost {
+    crate::db::NewPost {
+        thread_id,
+        board_id,
+        name: "anon".to_owned(),
+        tripcode: None,
+        subject: None,
+        body: "reply".to_owned(),
+        body_html: "reply".to_owned(),
+        ip_hash: None,
+        file_path: None,
+        file_name: None,
+        file_size: None,
+        thumb_path: None,
+        mime_type: None,
+        media_type: None,
+        audio_file_path: None,
+        audio_file_name: None,
+        audio_file_size: None,
+        audio_mime_type: None,
+        deletion_token: "delete".to_owned(),
+        is_op: false,
+    }
+}
+
+#[test]
+fn sage_bump_limit_and_deleted_replies_preserve_archive_order() -> Result<()> {
+    let conn = Connection::open_in_memory()?;
+    let board = fixture(&conn)?;
+    let old = thread(&conn, board, 100)?;
+    let recent = thread(&conn, board, 200)?;
+    conn.execute("UPDATE boards SET bump_limit=1 WHERE id=?1", [board])
+        .map(|_rows| ())?;
+    let reply = reply_post(board, old);
+    let sage_id = create_reply_with_thread_update(&conn, &reply, "sage", false, None)?;
+    let _over_limit = create_reply_with_thread_update(&conn, &reply, "after-limit", true, None)?;
+    let state = get_thread(&conn, old)?.context("sage thread")?;
+    ensure!(state.reply_count == 2 && state.bumped_at == 100);
+    let _deleted = crate::db::delete_post(&conn, sage_id)?;
+    let after_deletion = get_thread(&conn, old)?.context("thread after deletion")?;
+    ensure!(after_deletion.reply_count == 1 && after_deletion.bumped_at == 100);
+    ensure!(archive_old_threads(&conn, board, 1)? == 1);
+    ensure!(ids(&conn, true)? == [old] && ids(&conn, false)? == [recent]);
+    // Even when a moderator clears locked, archive state remains authoritative.
+    set_thread_locked(&conn, old, false)?;
+    let rejected = create_reply_with_thread_update(&conn, &reply, "archived", true, None)
+        .err()
+        .context("archive must reject reply")?;
+    ensure!(rejected.downcast_ref::<ThreadClosed>() == Some(&ThreadClosed::Archived));
+    Ok(())
+}
+
+#[test]
+fn concurrent_oldest_reply_and_archive_obey_the_committed_bump() -> Result<()> {
+    let dir = tempfile::tempdir()?;
+    let path = dir.path().join("reply-race.sqlite3");
+    let conn = Connection::open(&path)?;
+    conn.execute_batch(crate::db::pool::CONNECTION_PRAGMAS)?;
+    let board = fixture(&conn)?;
+    for round in 0_i32..8_i32 {
+        let old = thread(&conn, board, i64::from(round) + 100)?;
+        let recent = thread(&conn, board, i64::from(round) + 200)?;
+        let barrier = std::sync::Barrier::new(2);
+        let replied = std::thread::scope(|scope| -> Result<bool> {
+            let barrier_ref = &barrier;
+            let path_ref = &path;
+            let reply_handle = scope.spawn(move || -> Result<bool> {
+                let reply_conn = Connection::open(path_ref)?;
+                reply_conn.execute_batch(crate::db::pool::CONNECTION_PRAGMAS)?;
+                reply_conn.busy_timeout(std::time::Duration::from_secs(5))?;
+                let _barrier = barrier_ref.wait();
+                let outcome = match create_reply_with_thread_update(
+                    &reply_conn,
+                    &reply_post(board, old),
+                    "race",
+                    true,
+                    None,
+                ) {
+                    Ok(_id) => Ok(true),
+                    Err(error)
+                        if error.downcast_ref::<ThreadClosed>()
+                            == Some(&ThreadClosed::Archived) =>
+                    {
+                        Ok(false)
+                    }
+                    Err(error) => Err(error),
+                };
+                outcome
+            });
+            let _barrier = barrier.wait();
+            ensure!(archive_old_threads(&conn, board, 1)? >= 1);
+            reply_handle.join().map_err(|payload| {
+                anyhow::anyhow!(
+                    "reply worker panicked: {}",
+                    crate::media::process::panic_message(payload.as_ref())
+                )
+            })?
+        })?;
+        let old_state = get_thread(&conn, old)?.context("old thread")?;
+        let recent_state = get_thread(&conn, recent)?.context("recent thread")?;
+        ensure!(old_state.archived != replied && recent_state.archived == replied);
+        ensure!(old_state.reply_count == i64::from(replied));
+        // Remove the survivor before the next round to keep each race independent.
+        let _deleted = delete_thread(&conn, if replied { old } else { recent })?;
+    }
+    crate::db::verify_database_schema(&conn)?;
+    Ok(())
+}
+
+#[test]
+fn failed_archive_commit_releases_the_lock_and_rolls_back() -> Result<()> {
+    let conn = Connection::open_in_memory()?;
+    let board = fixture(&conn)?;
+    let _old = thread(&conn, board, 1)?;
+    let _new = thread(&conn, board, 2)?;
+    conn.execute_batch("CREATE TABLE commit_failure(parent INTEGER REFERENCES threads(id) DEFERRABLE INITIALLY DEFERRED);
+        CREATE TRIGGER injected_archive_commit_failure AFTER UPDATE OF archived ON threads
+        WHEN NEW.archived=1 BEGIN INSERT INTO commit_failure VALUES(-1); END;")?;
+    ensure!(archive_old_threads(&conn, board, 1).is_err());
+    ensure!(conn.is_autocommit() && ids(&conn, true)?.is_empty());
+    conn.execute_batch("DROP TRIGGER injected_archive_commit_failure; DROP TABLE commit_failure;")?;
+    ensure!(archive_old_threads(&conn, board, 1)? == 1);
+    crate::db::verify_database_schema(&conn)?;
+    Ok(())
+}
+
+#[test]
+fn concurrent_moderation_and_archive_are_serialized_by_sqlite() -> Result<()> {
+    for action in ["sticky", "lock", "delete"] {
+        let dir = tempfile::tempdir()?;
+        let path = dir.path().join("moderation-race.sqlite3");
+        let conn = Connection::open(&path)?;
+        conn.execute_batch(crate::db::pool::CONNECTION_PRAGMAS)?;
+        let board = fixture(&conn)?;
+        let old = thread(&conn, board, 100)?;
+        let _recent = thread(&conn, board, 200)?;
+        let barrier = std::sync::Barrier::new(2);
+        let already_archived = std::thread::scope(|scope| -> Result<bool> {
+            let barrier_ref = &barrier;
+            let path_ref = &path;
+            let moderator = scope.spawn(move || -> Result<bool> {
+                let mod_conn = Connection::open(path_ref)?;
+                mod_conn.execute_batch(crate::db::pool::CONNECTION_PRAGMAS)?;
+                mod_conn.busy_timeout(std::time::Duration::from_secs(5))?;
+                let _barrier = barrier_ref.wait();
+                if action == "delete" {
+                    let _deleted = delete_thread(&mod_conn, old)?;
+                    return Ok(false);
+                }
+                let tx = rusqlite::Transaction::new_unchecked(
+                    &mod_conn,
+                    rusqlite::TransactionBehavior::Immediate,
+                )?;
+                let before = get_thread(&tx, old)?.context("moderated thread")?.archived;
+                if action == "sticky" {
+                    set_thread_sticky(&tx, old, true)?;
+                } else {
+                    set_thread_locked(&tx, old, true)?;
+                }
+                tx.commit()?;
+                Ok(before)
+            });
+            let _barrier = barrier.wait();
+            let _count = archive_old_threads(&conn, board, 1)?;
+            moderator.join().map_err(|payload| {
+                anyhow::anyhow!(
+                    "moderator panicked: {}",
+                    crate::media::process::panic_message(payload.as_ref())
+                )
+            })?
+        })?;
+        match action {
+            "sticky" => {
+                let state = get_thread(&conn, old)?.context("sticky thread")?;
+                ensure!(state.sticky && state.archived == already_archived);
+            }
+            "lock" => {
+                let state = get_thread(&conn, old)?.context("locked thread")?;
+                ensure!(state.archived && state.locked);
+            }
+            _ => ensure!(get_thread(&conn, old)?.is_none()),
+        }
+        crate::db::verify_database_schema(&conn)?;
+    }
+    Ok(())
+}
+
+#[test]
+#[ignore = "invoked only by the interrupted archive regression"]
+fn interrupted_archive_child() -> Result<()> {
+    let path = std::env::var("RUSTCHAN_ARCHIVE_CRASH_DB")?;
+    let ready = std::env::var("RUSTCHAN_ARCHIVE_CRASH_READY")?;
+    let conn = Connection::open(path)?;
+    conn.execute_batch(crate::db::pool::CONNECTION_PRAGMAS)?;
+    let tx = rusqlite::Transaction::new_unchecked(&conn, rusqlite::TransactionBehavior::Immediate)?;
+    ensure!(archive_old_threads_in_tx(&tx, 1, 1)? == 1);
+    std::fs::write(ready, b"archive updated inside uncommitted transaction")?;
+    // The parent kills this isolated fixture process while the transaction is open.
+    std::thread::sleep(std::time::Duration::from_secs(30));
+    tx.commit()?;
+    Ok(())
+}
+
+#[test]
+fn process_interruption_during_archive_recovers_without_content_loss() -> Result<()> {
+    let dir = tempfile::tempdir()?;
+    let path = dir.path().join("interrupted.sqlite3");
+    let ready = dir.path().join("ready");
+    let conn = Connection::open(&path)?;
+    conn.execute_batch(crate::db::pool::CONNECTION_PRAGMAS)?;
+    let board = fixture(&conn)?;
+    let old = thread(&conn, board, 1)?;
+    let new = thread(&conn, board, 2)?;
+    drop(conn);
+    let mut child = std::process::Command::new(std::env::current_exe()?)
+        .args([
+            "--ignored",
+            "--exact",
+            "db::threads::archive_tests::interrupted_archive_child",
+        ])
+        .env("RUSTCHAN_ARCHIVE_CRASH_DB", &path)
+        .env("RUSTCHAN_ARCHIVE_CRASH_READY", &ready)
+        .stdout(std::process::Stdio::null())
+        .stderr(std::process::Stdio::null())
+        .spawn()?;
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+    while !ready.exists() && std::time::Instant::now() < deadline {
+        if child.try_wait()?.is_some() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    if child.try_wait()?.is_none() {
+        child.kill()?;
+    }
+    let _status = child.wait()?;
+    ensure!(
+        ready.exists(),
+        "archive crash fixture did not reach its uncommitted transition"
+    );
+    let recovered = Connection::open(path)?;
+    recovered.execute_batch(crate::db::pool::CONNECTION_PRAGMAS)?;
+    ensure!(ids(&recovered, false)? == [old, new] && ids(&recovered, true)?.is_empty());
+    ensure!(archive_old_threads(&recovered, board, 1)? == 1);
+    crate::db::verify_database_schema(&recovered)?;
+    Ok(())
+}
diff --git a/src/db/threads/lifecycle_tests.rs b/src/db/threads/lifecycle_tests.rs
new file mode 100644
index 00000000..691378eb
--- /dev/null
+++ b/src/db/threads/lifecycle_tests.rs
@@ -0,0 +1,579 @@
+//! Posting state-machine regressions against the full schema and file-backed WAL pool.
+
+use super::*;
+use crate::db::{self, DbPool, NewPost};
+use crate::error::AppError;
+use anyhow::ensure;
+use std::sync::Barrier;
+
+/// Minimal valid post shared by lifecycle tests.
+fn post(board_id: i64, thread_id: i64) -> NewPost {
+    NewPost {
+        thread_id,
+        board_id,
+        name: "Anonymous".into(),
+        tripcode: None,
+        subject: None,
+        body: "lifecycle reply".into(),
+        body_html: "lifecycle reply".into(),
+        ip_hash: Some("actor".into()),
+        file_path: None,
+        file_name: None,
+        file_size: None,
+        thumb_path: None,
+        mime_type: None,
+        media_type: None,
+        audio_file_path: None,
+        audio_file_name: None,
+        audio_file_size: None,
+        audio_mime_type: None,
+        deletion_token: "secret".into(),
+        is_op: false,
+    }
+}
+
+/// Install a board and its OP in an isolated pool using production pragmas.
+fn fixture() -> Result<(DbPool, i64, i64)> {
+    let pool = db::init_test_pool()?;
+    let conn = pool.get()?;
+    let board = db::create_board(&conn, "life", "Lifecycle", "", false)?;
+    let (thread, _, _) = create_thread_with_optional_poll(
+        &conn,
+        board,
+        None,
+        &post(board, 0),
+        "op-token",
+        None,
+        None,
+    )?;
+    drop(conn);
+    Ok((pool, board, thread))
+}
+
+/// Check relational, OP, counter, ID, and cached-view invariants after mutations.
+fn invariants(conn: &rusqlite::Connection) -> Result<()> {
+    ensure!(
+        conn.is_autocommit(),
+        "a failed operation leaked its transaction"
+    );
+    let broken: i64 = conn.query_row(
+        "SELECT (SELECT COUNT(*) FROM pragma_foreign_key_check)
+            + (SELECT COUNT(*) FROM posts p LEFT JOIN threads t ON t.id=p.thread_id
+               WHERE t.id IS NULL OR p.board_id != t.board_id)
+            + (SELECT COUNT(*) FROM threads t WHERE t.reply_count !=
+                (SELECT COUNT(*) FROM posts p WHERE p.thread_id=t.id AND p.is_op=0)
+                OR 1 != (SELECT COUNT(*) FROM posts p WHERE p.thread_id=t.id AND p.is_op=1))",
+        [],
+        |row| row.get(0),
+    )?;
+    ensure!(broken == 0, "lifecycle invariants failed: {broken}");
+    for board in db::get_all_boards(conn)? {
+        for thread in get_threads_for_board(conn, board.id, 1_000, 0)? {
+            let actual: i64 = conn.query_row(
+                "SELECT COUNT(*) FROM posts WHERE thread_id=?1 AND file_path IS NOT NULL",
+                [thread.id],
+                |row| row.get(0),
+            )?;
+            ensure!(thread.image_count == actual, "listing media count diverged");
+        }
+    }
+    Ok(())
+}
+
+/// Join scoped workers without allowing a panic to hide a failed operation.
+fn join<T>(handle: std::thread::ScopedJoinHandle<'_, T>) -> Result<T> {
+    handle.join().map_err(|payload| {
+        anyhow::anyhow!(
+            "lifecycle worker panicked: {}",
+            crate::media::process::panic_message(payload.as_ref())
+        )
+    })
+}
+
+#[test]
+fn wal_reply_bursts_preserve_every_id_counter_and_sage_bump() -> Result<()> {
+    for size in [2_usize, 5, 10, 25, 64] {
+        let (pool, board, thread) = fixture()?;
+        pool.get()?
+            .execute("UPDATE threads SET bumped_at=1 WHERE id=?1", [thread])
+            .map(|_rows| ())?;
+        let barrier = Barrier::new(size);
+        let ids = std::thread::scope(|scope| -> Result<Vec<i64>> {
+            let mut handles = Vec::new();
+            for index in 0..size {
+                let pool = &pool;
+                let barrier = &barrier;
+                handles.push(scope.spawn(move || -> Result<i64> {
+                    let _wait = barrier.wait();
+                    let conn = pool.get()?;
+                    let mut reply = post(board, thread);
+                    if index.is_multiple_of(2) {
+                        reply.file_path = Some(format!("life/burst-{index}.png"));
+                    }
+                    create_reply_with_thread_update(
+                        &conn,
+                        &reply,
+                        &format!("reply-{index}"),
+                        false,
+                        None,
+                    )
+                }));
+            }
+            handles.into_iter().map(|handle| join(handle)?).collect()
+        })?;
+        ensure!(ids.iter().collect::<std::collections::HashSet<_>>().len() == size);
+        let conn = pool.get()?;
+        let target = get_thread(&conn, thread)?.context("thread")?;
+        ensure!(target.reply_count == i64::try_from(size)? && target.bumped_at == 1);
+        ensure!(db::get_posts_for_thread(&conn, thread)?.len() == size.saturating_add(1));
+        ensure!(
+            get_threads_for_board(&conn, board, 10, 0)?
+                .first()
+                .context("listed thread")?
+                .image_count
+                == i64::try_from(size.div_ceil(2))?
+        );
+        invariants(&conn)?;
+    }
+    Ok(())
+}
+
+#[test]
+fn concurrent_creators_leave_durable_coalesced_retention_work() -> Result<()> {
+    let (pool, board, _) = fixture()?;
+    pool.get()?
+        .execute("UPDATE boards SET max_threads=1 WHERE id=?1", [board])
+        .map(|_rows| ())?;
+    let barrier = Barrier::new(25);
+    std::thread::scope(|scope| -> Result<()> {
+        let mut handles = Vec::new();
+        for index in 0_i32..25_i32 {
+            let pool = &pool;
+            let barrier = &barrier;
+            handles.push(scope.spawn(move || -> Result<()> {
+                let _wait = barrier.wait();
+                let conn = pool.get()?;
+                let outcome = create_thread_submission(
+                    &conn,
+                    board,
+                    None,
+                    &post(board, 0),
+                    &format!("create-{index}"),
+                    None,
+                    PostFilesystemCommit::new(None, &[], true),
+                )?;
+                ensure!(matches!(outcome, PostCreationOutcome::Created(_, _)));
+                Ok(())
+            }));
+        }
+        for handle in handles {
+            join(handle)??;
+        }
+        Ok(())
+    })?;
+    let conn = pool.get()?;
+    let jobs: i64 = conn.query_row(
+        "SELECT COUNT(*) FROM background_jobs WHERE job_type='thread_prune' AND status='pending'",
+        [],
+        |row| row.get(0),
+    )?;
+    ensure!(jobs == 1, "overflow must leave one durable evaluation");
+    let newest: i64 = conn.query_row(
+        "SELECT MAX(id) FROM threads WHERE board_id=?1",
+        [board],
+        |row| row.get(0),
+    )?;
+    let _cleanup = prune_old_threads(&conn, board, 1)?;
+    ensure!(count_threads_for_board(&conn, board)? == 1 && get_thread(&conn, newest)?.is_some());
+    invariants(&conn)?;
+    Ok(())
+}
+
+#[test]
+fn deleted_submissions_cannot_recreate_threads_or_replies() -> Result<()> {
+    let (pool, board, thread) = fixture()?;
+    let conn = pool.get()?;
+    let reply =
+        create_reply_with_thread_update(&conn, &post(board, thread), "reply-token", true, None)?;
+    let _cleanup = db::delete_post(&conn, reply)?;
+    let receipt = db::get_post_submission(&conn, "reply-token", "actor", board)?
+        .context("deleted receipt")?;
+    ensure!(receipt.post_id == reply && !receipt.is_thread);
+    ensure!(
+        create_reply_with_thread_update(&conn, &post(board, thread), "reply-token", true, None)?
+            == reply
+    );
+    ensure!(db::get_post(&conn, reply)?.is_none());
+    delete_thread(&conn, thread).map(|_thread_cleanup| ())?;
+    let original_target = create_thread_with_optional_poll(
+        &conn,
+        board,
+        None,
+        &post(board, 0),
+        "op-token",
+        None,
+        None,
+    )?;
+    ensure!(original_target.0 == thread && get_thread(&conn, thread)?.is_none());
+    ensure!(count_threads_for_board(&conn, board)? == 0);
+    invariants(&conn)?;
+    Ok(())
+}
+
+#[test]
+fn receipts_are_bound_to_operation_and_reply_target() -> Result<()> {
+    let (pool, board, thread) = fixture()?;
+    let conn = pool.get()?;
+    let (other, _, _) =
+        create_thread_with_optional_poll(&conn, board, None, &post(board, 0), "other", None, None)?;
+    let reply =
+        create_reply_with_thread_update(&conn, &post(board, thread), "reply-token", true, None)?;
+    for (target, token) in [(other, "reply-token"), (thread, "op-token")] {
+        let error = create_reply_with_thread_update(&conn, &post(board, target), token, true, None)
+            .err()
+            .context("must reject wrong form")?;
+        ensure!(matches!(
+            error.downcast_ref::<AppError>(),
+            Some(AppError::Conflict(_))
+        ));
+    }
+    let error = create_thread_with_optional_poll(
+        &conn,
+        board,
+        None,
+        &post(board, 0),
+        "reply-token",
+        None,
+        None,
+    )
+    .err()
+    .context("must reject wrong operation")?;
+    ensure!(matches!(
+        error.downcast_ref::<AppError>(),
+        Some(AppError::Conflict(_))
+    ));
+    let mut forged_op = post(board, thread);
+    forged_op.is_op = true;
+    ensure!(create_reply_with_thread_update(&conn, &forged_op, "forged", true, None).is_err());
+    ensure!(db::get_post(&conn, reply)?.is_some());
+    invariants(&conn)?;
+    Ok(())
+}
+
+/// Competing transitions supported by the actual thread state model.
+#[derive(Clone, Copy)]
+enum Transition {
+    Lock,
+    Delete,
+    Archive,
+    Prune,
+}
+
+#[test]
+fn concurrent_reply_and_moderation_prune_always_leave_valid_state() -> Result<()> {
+    for transition in [
+        Transition::Lock,
+        Transition::Delete,
+        Transition::Archive,
+        Transition::Prune,
+    ] {
+        for _round in 0_i32..8_i32 {
+            let (pool, board, thread) = fixture()?;
+            {
+                let conn = pool.get()?;
+                conn.execute("UPDATE threads SET bumped_at=1 WHERE id=?1", [thread])
+                    .map(|_rows| ())?;
+                create_thread_with_optional_poll(
+                    &conn,
+                    board,
+                    None,
+                    &post(board, 0),
+                    "new",
+                    None,
+                    None,
+                )
+                .map(|_ids| ())?;
+            }
+            let barrier = Barrier::new(2);
+            let result = std::thread::scope(|scope| -> Result<Result<i64>> {
+                let reply = scope.spawn(|| -> Result<i64> {
+                    let _wait = barrier.wait();
+                    let conn = pool.get()?;
+                    create_reply_with_thread_update(
+                        &conn,
+                        &post(board, thread),
+                        "race",
+                        false,
+                        None,
+                    )
+                });
+                let moderation = scope.spawn(|| -> Result<()> {
+                    let _wait = barrier.wait();
+                    let conn = pool.get()?;
+                    match transition {
+                        Transition::Lock => set_thread_locked(&conn, thread, true),
+                        Transition::Delete => delete_thread(&conn, thread)
+                            .map(|_cleanup| ())
+                            .map_err(anyhow::Error::new),
+                        Transition::Archive => set_thread_archived(&conn, thread, true),
+                        Transition::Prune => prune_old_threads(&conn, board, 1).map(|_cleanup| ()),
+                    }
+                });
+                join(moderation)??;
+                join(reply)
+            })?;
+            if let Err(error) = result {
+                ensure!(
+                    error.downcast_ref::<ThreadClosed>().is_some()
+                        || matches!(
+                            error.downcast_ref::<AppError>(),
+                            Some(AppError::NotFound(_))
+                        ),
+                    "unexpected race failure: {error}"
+                );
+            }
+            let conn = pool.get()?;
+            invariants(&conn)?;
+            match transition {
+                Transition::Lock | Transition::Archive => {
+                    ensure!(get_thread(&conn, thread)?.context("closed thread")?.locked);
+                    ensure!(create_reply_with_thread_update(
+                        &conn,
+                        &post(board, thread),
+                        "new-race",
+                        true,
+                        None
+                    )
+                    .is_err());
+                }
+                Transition::Delete | Transition::Prune => {
+                    ensure!(get_thread(&conn, thread)?.is_none());
+                }
+            }
+        }
+    }
+    Ok(())
+}
+
+#[test]
+fn media_job_failure_rolls_back_post_and_claim_waits_for_publication() -> Result<()> {
+    let (pool, board, thread) = fixture()?;
+    let conn = pool.get()?;
+    let mut media_post = post(board, thread);
+    media_post.file_path = Some("life/audio.flac".into());
+    media_post.media_type = Some("audio".into());
+    conn.execute_batch("CREATE TRIGGER reject_media BEFORE INSERT ON background_jobs WHEN NEW.job_type='audio_waveform' BEGIN SELECT RAISE(ABORT, 'injected'); END;")?;
+    let pending = crate::pending_fs::PendingFsOpInsert {
+        id: "stage".into(),
+        kind: crate::pending_fs::UPLOAD_FINALIZE_KIND,
+        payload_json: r#"{"relative_paths":["life/audio.flac"]}"#.into(),
+    };
+    let create = |token: &str| {
+        create_reply_submission(
+            &conn,
+            &media_post,
+            token,
+            true,
+            PostFilesystemCommit::new_with_media_validation(
+                Some(&pending),
+                &[],
+                false,
+                Some("life"),
+                |_: &rusqlite::Connection| Ok(()),
+            ),
+        )
+    };
+    ensure!(create("failed-media").is_err());
+    invariants(&conn)?;
+    ensure!(db::get_post_submission(&conn, "failed-media", "actor", board)?.is_none());
+    conn.execute_batch("DROP TRIGGER reject_media")?;
+    let outcome = create("media")?;
+    let PostCreationOutcome::Created(post_id, created_at) = outcome else {
+        anyhow::bail!("expected new media post");
+    };
+    let stored = db::get_post(&conn, post_id)?.context("media post")?;
+    ensure!(
+        stored.created_at == created_at
+            && stored.media_processing_state.as_deref() == Some(db::MEDIA_PROCESSING_PENDING)
+    );
+    ensure!(
+        db::claim_next_job(&conn)?.is_none(),
+        "worker must wait for durable upload publication"
+    );
+    conn.execute("DELETE FROM pending_fs_ops WHERE id='stage'", [])
+        .map(|_rows| ())?;
+    let (_job_id, payload) = db::claim_next_job(&conn)?.context("published media job")?;
+    ensure!(
+        matches!(serde_json::from_str::<crate::workers::Job>(&payload)?, crate::workers::Job::AudioWaveform { post_id: target, file_path: _, board_short: _ } if target == post_id)
+    );
+    invariants(&conn)?;
+    Ok(())
+}
+
+#[test]
+fn failed_post_commit_rolls_back_every_required_row_and_releases_the_writer() -> Result<()> {
+    let (pool, board, thread) = fixture()?;
+    let conn = pool.get()?;
+    conn.execute_batch("CREATE TABLE commit_failure(parent INTEGER REFERENCES threads(id) DEFERRABLE INITIALLY DEFERRED);
+        CREATE TRIGGER reject_commit AFTER INSERT ON posts BEGIN INSERT INTO commit_failure VALUES(-1); END;")?;
+    for new_thread in [false, true] {
+        let result = if new_thread {
+            create_thread_with_optional_poll(
+                &conn,
+                board,
+                None,
+                &post(board, 0),
+                "failed",
+                None,
+                None,
+            )
+            .map(|_ids| ())
+        } else {
+            create_reply_with_thread_update(&conn, &post(board, thread), "failed", true, None)
+                .map(|_id| ())
+        };
+        ensure!(result.is_err());
+        invariants(&conn)?;
+        ensure!(
+            get_thread(&conn, thread)?
+                .context("original thread")?
+                .reply_count
+                == 0
+        );
+        ensure!(db::get_post_submission(&conn, "failed", "actor", board)?.is_none());
+        ensure!(count_threads_for_board(&conn, board)? == 1);
+        ensure!(db::get_posts_for_thread(&conn, thread)?.len() == 1);
+    }
+    conn.execute_batch("DROP TRIGGER reject_commit; DROP TABLE commit_failure;")?;
+    create_reply_with_thread_update(&conn, &post(board, thread), "failed", true, None)
+        .map(|_id| ())?;
+    invariants(&conn)?;
+    Ok(())
+}
+
+#[test]
+fn posting_busy_error_is_retryable_and_does_not_leave_a_partial_post() -> Result<()> {
+    let (pool, board, thread) = fixture()?;
+    let writer = pool.get()?;
+    writer.execute_batch("BEGIN IMMEDIATE")?;
+    let client = pool.get()?;
+    let error = create_reply_with_thread_update(&client, &post(board, thread), "busy", true, None)
+        .err()
+        .context("posting must respect the other writer")?;
+    ensure!(matches!(AppError::from(error), AppError::DbBusy));
+    invariants(&client)?;
+    writer.execute_batch("ROLLBACK")?;
+    create_reply_with_thread_update(&client, &post(board, thread), "busy", true, None)
+        .map(|_id| ())?;
+    ensure!(get_thread(&client, thread)?.context("thread")?.reply_count == 1);
+    invariants(&client)?;
+    Ok(())
+}
+
+#[test]
+fn self_actions_use_current_permission_inside_the_write_transaction() -> Result<()> {
+    let (pool, board, thread) = fixture()?;
+    let conn = pool.get()?;
+    conn.execute(
+        "UPDATE boards SET allow_editing=1,allow_self_delete=1 WHERE id=?1",
+        [board],
+    )
+    .map(|_rows| ())?;
+    let old_policy = db::get_board_by_short(&conn, "life")?.context("board")?;
+    ensure!(old_policy.allow_editing && old_policy.allow_self_delete);
+    let reply = create_reply_with_thread_update(&conn, &post(board, thread), "own", true, None)?;
+    conn.execute(
+        "UPDATE boards SET allow_editing=0,allow_self_delete=0 WHERE id=?1",
+        [board],
+    )
+    .map(|_rows| ())?;
+    let current_policy = |validation_conn: &rusqlite::Connection| -> crate::error::Result<()> {
+        if validation_conn.is_autocommit() {
+            return Err(AppError::Internal(anyhow::anyhow!(
+                "permission check ran outside the write transaction"
+            )));
+        }
+        let current = db::get_board_by_short(validation_conn, "life")?.context("board")?;
+        if !current.allow_editing || !current.allow_self_delete {
+            return Err(AppError::Forbidden("permission revoked".into()));
+        }
+        Ok(())
+    };
+    let edited = db::posts::edit_post_with_validation(
+        &conn,
+        reply,
+        "secret",
+        "changed",
+        "changed",
+        60,
+        current_policy,
+    );
+    ensure!(matches!(
+        edited
+            .err()
+            .and_then(|error| error.downcast::<AppError>().ok()),
+        Some(AppError::Forbidden(_))
+    ));
+    let deleted =
+        db::posts::self_delete_post_with_validation(&conn, reply, "secret", 60, current_policy);
+    ensure!(matches!(deleted, Err(AppError::Forbidden(_))));
+    ensure!(db::get_post(&conn, reply)?.context("preserved reply")?.body == "lifecycle reply");
+    invariants(&conn)?;
+    Ok(())
+}
+
+#[test]
+fn sequence_of_mutations_preserves_invariants_and_deleted_search_state() -> Result<()> {
+    let (pool, board, thread) = fixture()?;
+    let conn = pool.get()?;
+    let mut random = 47_u64;
+    for step in 0_i32..160_i32 {
+        random = random
+            .wrapping_mul(6_364_136_223_846_793_005)
+            .wrapping_add(1);
+        match random % 6 {
+            0 => set_thread_locked(&conn, thread, true)?,
+            1 => set_thread_locked(&conn, thread, false)?,
+            2 => {
+                let mut reply = post(board, thread);
+                reply.file_path = Some(format!("life/{step}.png"));
+                let result = create_reply_with_thread_update(
+                    &conn,
+                    &reply,
+                    &format!("sequence-{step}"),
+                    true,
+                    None,
+                );
+                if let Err(error) = result {
+                    ensure!(error.downcast_ref::<ThreadClosed>() == Some(&ThreadClosed::Locked));
+                }
+            }
+            3 => {
+                if let Some(reply) = db::get_posts_for_thread(&conn, thread)?
+                    .iter()
+                    .find(|reply| !reply.is_op)
+                {
+                    db::delete_post(&conn, reply.id).map(|_cleanup| ())?;
+                }
+            }
+            4 => set_thread_sticky(&conn, thread, random.is_multiple_of(2))?,
+            _ => {
+                let result = create_reply_with_thread_update(
+                    &conn,
+                    &post(board, thread),
+                    &format!("sequence-{step}"),
+                    false,
+                    None,
+                );
+                if let Err(error) = result {
+                    ensure!(error.downcast_ref::<ThreadClosed>() == Some(&ThreadClosed::Locked));
+                }
+            }
+        }
+        invariants(&conn)?;
+    }
+    delete_thread(&conn, thread).map(|_cleanup| ())?;
+    ensure!(db::search_posts(&conn, board, "lifecycle", 100, 0)?.is_empty());
+    invariants(&conn)?;
+    Ok(())
+}
diff --git a/src/db/user_thread_prefs.rs b/src/db/user_thread_prefs.rs
index 534eaedc..8fba9039 100644
--- a/src/db/user_thread_prefs.rs
+++ b/src/db/user_thread_prefs.rs
@@ -93,7 +93,8 @@ pub fn get_thread_preference(
     .map_err(Into::into)
 }
 
-/// Fetch all saved thread preferences for one user on one board.
+/// Fetch active preferences within the supported 1,000-thread board ceiling.
+/// Oversized imported boards cannot force an unbounded metadata allocation.
 ///
 /// # Errors
 /// Returns an error if the board preference query fails in `SQLite`.
@@ -108,7 +109,8 @@ pub fn get_preferences_for_board(
          JOIN threads t ON t.id = utp.thread_id
          WHERE utp.user_hash = ?1
            AND t.board_id = ?2
-           AND t.archived = 0",
+           AND t.archived = 0
+         ORDER BY utp.thread_id DESC LIMIT 1000",
     )?;
 
     let rows = stmt.query_map(params![user_hash, board_id], |row| {
@@ -135,6 +137,25 @@ mod tests {
     use anyhow::{Context as _, Result};
     use std::sync::{Arc, Barrier};
 
+    #[test]
+    fn board_preference_collection_is_bounded_without_losing_individual_preferences() -> Result<()>
+    {
+        let pool = crate::db::init_test_pool()?;
+        let conn = pool.get()?;
+        let board = crate::db::create_board(&conn, "bound", "Bound", "", false)?;
+        conn.execute("WITH RECURSIVE n(i) AS (SELECT 1 UNION ALL SELECT i+1 FROM n WHERE i<1000) INSERT INTO threads(id,board_id) SELECT i,?1 FROM n", [board]).map(|_rows| ())?;
+        conn.execute("INSERT INTO user_thread_preferences(user_hash,thread_id,pinned,hidden) SELECT 'viewer',id,1,0 FROM threads", []).map(|_rows| ())?;
+        let exact = super::get_preferences_for_board(&conn, "viewer", board)?;
+        anyhow::ensure!(exact.len() == 1000 && exact.contains_key(&1));
+        conn.execute("INSERT INTO threads(id,board_id) VALUES(1001,?1)", [board])
+            .map(|_rows| ())?;
+        set_thread_pinned(&conn, "viewer", 1001, true)?;
+        let over = super::get_preferences_for_board(&conn, "viewer", board)?;
+        anyhow::ensure!(over.len() == 1000 && over.contains_key(&1001) && !over.contains_key(&1));
+        anyhow::ensure!(get_thread_preference(&conn, "viewer", 1)?.is_some_and(|pref| pref.pinned));
+        Ok(())
+    }
+
     fn seeded_thread(pool: &crate::db::DbPool) -> Result<i64> {
         let conn = pool.get()?;
         let board_id = crate::db::create_board(&conn, "prefs", "Preferences", "", false)?;
diff --git a/src/error.rs b/src/error.rs
index e4eb0156..da7a4d09 100644
--- a/src/error.rs
+++ b/src/error.rs
@@ -89,6 +89,10 @@ impl From<r2d2::Error> for AppError {
 
 impl From<anyhow::Error> for AppError {
     fn from(error: anyhow::Error) -> Self {
+        let error = match error.downcast::<Self>() {
+            Ok(error) => return error,
+            Err(error) => error,
+        };
         let database_busy = error.chain().any(|cause| {
             cause
                 .downcast_ref::<rusqlite::Error>()
@@ -221,6 +225,12 @@ mod tests {
     use axum::http::{header, StatusCode};
     use axum::response::IntoResponse as _;
 
+    #[test]
+    fn wrapped_application_errors_preserve_client_error_classification() {
+        let wrapped = anyhow::Error::new(AppError::BadRequest("bounded search".into()));
+        assert!(matches!(AppError::from(wrapped), AppError::BadRequest(_)));
+    }
+
     #[test]
     #[expect(
         clippy::panic_in_result_fn,
diff --git a/src/handlers/admin/accounts.rs b/src/handlers/admin/accounts.rs
index 568c6cb5..ff188fdc 100644
--- a/src/handlers/admin/accounts.rs
+++ b/src/handlers/admin/accounts.rs
@@ -41,15 +41,17 @@ pub(in crate::server) async fn update_account(
             "Reauthentication locked; retry after the failed-login window.".into(),
         ));
     }
+    let password_permit = state.password_work_gate.try_begin()?;
     tokio::task::spawn_blocking(move || -> Result<Response> {
+        let _password_permit = password_permit;
         let mut conn = state.db.get()?;
         require_admin_session_sid(&conn, session.as_deref()).map(|_completed_value| ())?;
+        if super::auth::record_login_fail(&key) > crate::config::CONFIG.operator.admin_login_fail_limit { return Err(AppError::DbBusy); }
         if form.new_password != form.confirm_password { return Ok(super::admin_panel_error_redirect_anchor("Passwords did not match. No account changes saved.", "accounts").into_response()); }
         let result = db::manage_account(&mut conn, session.as_deref().unwrap_or_default(), action, form.username.trim(), &form.current_password, &form.new_password);
         match result {
-            Ok(true) => Ok(super::admin_panel_redirect_anchor("Account saved. Password changes revoke all sessions for that account; sign in again if you changed your own password.", "accounts").into_response()),
+            Ok(true) => { super::auth::clear_login_fails(&key); Ok(super::admin_panel_redirect_anchor("Account saved. Password changes revoke all sessions for that account; sign in again if you changed your own password.", "accounts").into_response()) },
             Ok(false) => {
-                let _failure_count = super::auth::record_login_fail(&key);
                 Ok(super::admin_panel_error_redirect_anchor("Current password did not verify. No account changes saved.", "accounts").into_response())
             }
             Err(error) => Ok(super::admin_panel_error_redirect_anchor(&format!("No account changes saved: {error}"), "accounts").into_response()),
@@ -79,17 +81,20 @@ pub(in crate::server) async fn rotate_secret(
             "Reauthentication locked; retry after the failed-login window.".into(),
         ));
     }
+    let password_permit = state.password_work_gate.try_begin()?;
     tokio::task::spawn_blocking(move || -> Result<Response> {
+        let _password_permit = password_permit;
         let conn = state.db.get()?;
         let actor = require_admin_session_sid(&conn, session.as_deref())?;
         if form.keys().any(|k| !matches!(k.as_str(), "_csrf" | "current_password" | "confirmation")) || form.get("confirmation").map(String::as_str) != Some("ROTATE") { return Ok(super::admin_panel_error_redirect_anchor("No secret changes saved. Type ROTATE to confirm the restart and identity consequences.", "storage").into_response()); }
         let password = form.get("current_password").map_or("", String::as_str);
         let actor = db::get_admin_name_by_id(&conn, actor)?.ok_or_else(|| AppError::Forbidden("Administrator missing".into()))?;
         let user = db::get_admin_by_username(&conn, &actor)?.ok_or_else(|| AppError::Forbidden("Administrator missing".into()))?;
+        if super::auth::record_login_fail(&key) > crate::config::CONFIG.operator.admin_login_fail_limit { return Err(AppError::DbBusy); }
         if password.len() > 1024 || !crate::utils::crypto::verify_password(password, &user.password_hash)? {
-            let _failure_count = super::auth::record_login_fail(&key);
             return Ok(super::admin_panel_error_redirect_anchor("Current password did not verify. No secret changes saved.", "storage").into_response());
         }
+        super::auth::clear_login_fails(&key);
         let rotation = crate::config::admin::management::rotate_secret();
         match rotation {
             Ok(()) => Ok(super::admin_panel_redirect_anchor("Fresh secret staged. Restart required; sessions and signed grants will be invalidated, and IP ban identities will change.", "storage").into_response()),
diff --git a/src/handlers/admin/auth.rs b/src/handlers/admin/auth.rs
index a02c9a34..b070f4cf 100644
--- a/src/handlers/admin/auth.rs
+++ b/src/handlers/admin/auth.rs
@@ -26,9 +26,7 @@ use axum::{
 };
 use axum_extra::extract::cookie::{Cookie, CookieJar};
 use chrono::Utc;
-use dashmap::DashMap;
 use serde::Deserialize;
-use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::LazyLock;
 use std::time::{SystemTime, UNIX_EPOCH};
 use tracing::warn;
@@ -51,9 +49,23 @@ fn admin_login_fail_window_secs() -> u64 {
 /// Admin login CSRF scope used by this handler.
 const ADMIN_LOGIN_CSRF_SCOPE: &str = "admin-login";
 
-/// `ip_hash` → (`fail_count`, `window_start_secs`).
-static ADMIN_LOGIN_FAILS: LazyLock<DashMap<String, (u32, u64)>> = LazyLock::new(DashMap::new);
-static LOGIN_CLEANUP_SECS: AtomicU64 = AtomicU64::new(0);
+/// Public dummy hash with the same Argon2 parameters as newly created accounts.
+/// Missing usernames perform password work without ever yielding an account ID.
+const MISSING_USER_HASH: &str = "$argon2id$v=19$m=65536,t=2,p=2$cnVzdGNoYW4tdjEuNi41ISE$9bLCu60YvVwNCStcJ+Uv2kvViRlaP/Rm/dg64RcLFjI";
+
+/// Avoid a cheap username-enumeration path within the shared password budget.
+fn verify_login_password(
+    user: Option<&crate::models::AdminUser>,
+    password: &str,
+) -> Result<Option<i64>> {
+    let hash = user.map_or(MISSING_USER_HASH, |account| account.password_hash.as_str());
+    let verified = verify_password(password, hash)?;
+    Ok(user.filter(|_account| verified).map(|account| account.id))
+}
+
+/// Bounded hashed-IP failure state; unknown identities fail closed at capacity.
+static ADMIN_LOGIN_FAILS: LazyLock<crate::middleware::RateTable> =
+    LazyLock::new(crate::middleware::RateTable::default);
 
 fn login_now_secs() -> u64 {
     SystemTime::now()
@@ -92,53 +104,24 @@ fn redact_login_username(username: &str) -> String {
 
 /// Returns true if this IP is currently locked out.
 pub(super) fn is_login_locked(ip_key: &str) -> bool {
-    let now = login_now_secs();
-    if let Some(entry) = ADMIN_LOGIN_FAILS.get(ip_key) {
-        let (count, window_start) = *entry;
-        if now.saturating_sub(window_start) <= admin_login_fail_window_secs() {
-            return count >= admin_login_fail_limit();
-        }
-    }
-    false
+    ADMIN_LOGIN_FAILS
+        .retry_after(ip_key, login_now_secs(), admin_login_fail_limit())
+        .is_some()
 }
 
-/// Record a failed login attempt; returns the new failure count.
-#[expect(
-    clippy::significant_drop_tightening,
-    reason = "the DashMap entry guard must remain held while its attempt count is updated"
-)]
+/// Reserve authentication work before verification; returns the current attempt count.
 pub(super) fn record_login_fail(ip_key: &str) -> u32 {
-    let now = login_now_secs();
-    let mut entry = ADMIN_LOGIN_FAILS
-        .entry(ip_key.to_owned())
-        .or_insert((0, now));
-    let (count, window_start) = entry.value_mut();
-    if now.saturating_sub(*window_start) > admin_login_fail_window_secs() {
-        *count = 1;
-        *window_start = now;
-    } else {
-        *count = count.saturating_add(1);
-    }
-    *count
+    ADMIN_LOGIN_FAILS.record(ip_key, login_now_secs(), admin_login_fail_window_secs())
 }
 
-fn clear_login_fails(ip_key: &str) {
-    drop(ADMIN_LOGIN_FAILS.remove(ip_key));
+/// Clear the successful client's failure budget.
+pub(super) fn clear_login_fails(ip_key: &str) {
+    ADMIN_LOGIN_FAILS.remove(ip_key);
 }
 
-/// Remove login-fail entries whose window has expired.
-/// Called periodically from the background task in `server/server.rs`.
+/// Expire retained failed-login identities during background cleanup.
 pub(in crate::server) fn prune_login_fails() {
-    let now = login_now_secs();
-    // Throttle to at most once per admin_login_fail_window_secs() seconds.
-    let last = LOGIN_CLEANUP_SECS.load(Ordering::Relaxed);
-    if now.saturating_sub(last) < admin_login_fail_window_secs() {
-        return;
-    }
-    LOGIN_CLEANUP_SECS.store(now, Ordering::Relaxed);
-    ADMIN_LOGIN_FAILS.retain(|_, (_, window_start)| {
-        now.saturating_sub(*window_start) <= admin_login_fail_window_secs()
-    });
+    ADMIN_LOGIN_FAILS.prune(login_now_secs());
 }
 
 /// Ensures admin login CSRF.
@@ -293,7 +276,7 @@ pub(in crate::server) async fn admin_login(
 
     let username = form.username.trim().to_owned();
     let username_log = redact_login_username(&username);
-    if username.is_empty() || username.len() > 64 {
+    if username.is_empty() || username.len() > 64 || form.password.len() > 1024 {
         return render_admin_login_response(
             &state,
             jar,
@@ -304,26 +287,32 @@ pub(in crate::server) async fn admin_login(
         .await;
     }
 
+    let permit = state.password_work_gate.try_begin()?;
+    // Reserve before Argon2 so concurrent attempts cannot all pass a stale
+    // failure-count check. Successful authentication clears this reservation.
+    let attempts = record_login_fail(&ip_key);
+    if attempts > admin_login_fail_limit() {
+        return Err(AppError::Forbidden(
+            "Too many login attempts. Please wait and try again.".into(),
+        ));
+    }
     let pool = state.db.clone();
-    let password = form.password.clone();
+    let password = form.password;
 
     // Argon2 verification is CPU-intensive; always use spawn_blocking.
     let result = tokio::task::spawn_blocking(move || -> Result<Option<i64>> {
+        let _password_permit = permit;
         let conn = pool.get()?;
         let user = db::get_admin_by_username(&conn, &username)?;
-        if let Some(u) = user {
-            if verify_password(&password, &u.password_hash)? {
-                return Ok(Some(u.id));
-            }
-        }
-        Ok(None)
+        drop(conn);
+        verify_login_password(user.as_ref(), &password)
     })
     .await
     .map_err(|e| AppError::Internal(anyhow::anyhow!(e)))??;
 
     match result {
         None => {
-            let fails = record_login_fail(&ip_key);
+            let fails = attempts;
             let locked_out = fails >= admin_login_fail_limit();
             warn!(
                 username = %username_log,
@@ -440,7 +429,31 @@ mod tests {
     };
     use tower::ServiceExt as _;
 
+    /// Assign different test threads distinct loopback client identities.
+    static NEXT_TEST_PEER: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(1);
+    std::thread_local! {
+        /// Preserve one identity throughout each asynchronous authentication test.
+        static TEST_PEER: std::net::SocketAddr = std::net::SocketAddr::from((
+            std::net::Ipv4Addr::from(0x7f00_0001_u32.saturating_add(NEXT_TEST_PEER.fetch_add(1, std::sync::atomic::Ordering::Relaxed))), 41000));
+    }
+
+    /// Keep independent tests from consuming each other's authentication reservations.
+    fn test_connect_info() -> axum::extract::ConnectInfo<std::net::SocketAddr> {
+        TEST_PEER.with(|peer| axum::extract::ConnectInfo(*peer))
+    }
+
     const TEST_CSRF_COOKIE: &str = "csrf123";
+
+    #[test]
+    fn missing_user_password_work_cannot_authenticate_the_dummy_hash() -> Result<()> {
+        anyhow::ensure!(verify_login_password(None, "legacy-admin-password")?.is_none());
+        anyhow::ensure!(verify_login_password(None, "incorrect-password")?.is_none());
+        let dummy = argon2::password_hash::phc::PasswordHash::new(MISSING_USER_HASH)?;
+        let current = crate::utils::crypto::hash_password("current-password")?;
+        let current = argon2::password_hash::phc::PasswordHash::new(&current)?;
+        anyhow::ensure!(dummy.algorithm == current.algorithm && dummy.params == current.params);
+        Ok(())
+    }
     const TEST_ADMIN_ORIGIN: &str = "http://localhost";
     const TEST_ONION_HOST: &str = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaam2dqd.onion";
     const TEST_ONION_ORIGIN: &str =
@@ -475,7 +488,7 @@ mod tests {
             .header(header::HOST, "localhost")
             .header(header::ORIGIN, TEST_ADMIN_ORIGIN)
             .header(header::COOKIE, format!("csrf_token={TEST_CSRF_COOKIE}"))
-            .extension(crate::test_support::connect_info())
+            .extension(test_connect_info())
             .body(Body::from(body))
             .context("build admin login request")
     }
@@ -552,42 +565,51 @@ mod tests {
     fn locked_after_exceeding_fail_limit() {
         let key = login_ip_key("test-lock-unique-99887766");
         // Clean up any residue from a previous run
-        drop(ADMIN_LOGIN_FAILS.remove(&key));
+        ADMIN_LOGIN_FAILS.remove(&key);
 
         let now = login_now_secs();
-        let _previous_failure_window =
-            ADMIN_LOGIN_FAILS.insert(key.clone(), (admin_login_fail_limit(), now));
+        ADMIN_LOGIN_FAILS.insert(
+            key.clone(),
+            (admin_login_fail_limit(), now),
+            admin_login_fail_window_secs(),
+        );
         assert!(is_login_locked(&key));
 
         // Cleanup
-        drop(ADMIN_LOGIN_FAILS.remove(&key));
+        ADMIN_LOGIN_FAILS.remove(&key);
     }
 
     #[test]
     fn not_locked_below_fail_limit() {
         let key = login_ip_key("test-below-limit-11223344");
-        drop(ADMIN_LOGIN_FAILS.remove(&key));
+        ADMIN_LOGIN_FAILS.remove(&key);
 
         let now = login_now_secs();
-        let _previous_failure_window =
-            ADMIN_LOGIN_FAILS.insert(key.clone(), (admin_login_fail_limit() - 1, now));
+        ADMIN_LOGIN_FAILS.insert(
+            key.clone(),
+            (admin_login_fail_limit() - 1, now),
+            admin_login_fail_window_secs(),
+        );
         assert!(!is_login_locked(&key));
 
-        drop(ADMIN_LOGIN_FAILS.remove(&key));
+        ADMIN_LOGIN_FAILS.remove(&key);
     }
 
     #[test]
     fn expired_window_is_not_locked() {
         let key = login_ip_key("test-expired-window-55667788");
-        drop(ADMIN_LOGIN_FAILS.remove(&key));
+        ADMIN_LOGIN_FAILS.remove(&key);
 
         // window_start far in the past, beyond admin_login_fail_window_secs()
         let old_ts = login_now_secs().saturating_sub(admin_login_fail_window_secs() + 60);
-        let _previous_failure_window =
-            ADMIN_LOGIN_FAILS.insert(key.clone(), (admin_login_fail_limit() + 10, old_ts));
+        ADMIN_LOGIN_FAILS.insert(
+            key.clone(),
+            (admin_login_fail_limit() + 10, old_ts),
+            admin_login_fail_window_secs(),
+        );
         assert!(!is_login_locked(&key));
 
-        drop(ADMIN_LOGIN_FAILS.remove(&key));
+        ADMIN_LOGIN_FAILS.remove(&key);
     }
 
     #[tokio::test]
@@ -596,9 +618,12 @@ mod tests {
         create_test_board(&state)?;
 
         let ip_key = login_ip_key("192.0.2.44");
-        drop(ADMIN_LOGIN_FAILS.remove(&ip_key));
-        let _previous_failure_window =
-            ADMIN_LOGIN_FAILS.insert(ip_key.clone(), (admin_login_fail_limit(), login_now_secs()));
+        ADMIN_LOGIN_FAILS.remove(&ip_key);
+        ADMIN_LOGIN_FAILS.insert(
+            ip_key.clone(),
+            (admin_login_fail_limit(), login_now_secs()),
+            admin_login_fail_window_secs(),
+        );
 
         let router = Router::new()
             .route("/admin/login", post(admin_login))
@@ -616,7 +641,7 @@ mod tests {
             .await
             .context("send locked-out admin login request")?;
 
-        drop(ADMIN_LOGIN_FAILS.remove(&ip_key));
+        ADMIN_LOGIN_FAILS.remove(&ip_key);
 
         anyhow::ensure!(
             response.status() == StatusCode::OK,
@@ -786,7 +811,7 @@ mod tests {
                             super::super::SESSION_COOKIE
                         ),
                     )
-                    .extension(crate::test_support::connect_info())
+                    .extension(test_connect_info())
                     .body(Body::from(format!(
                         "return_to=/admin&_csrf={}",
                         signed_admin_session_csrf("session123")
@@ -825,7 +850,7 @@ mod tests {
     #[tokio::test]
     async fn admin_login_marks_session_cookie_secure_for_direct_https_request() -> Result<()> {
         let state = crate::test_support::app_state();
-        clear_login_fails(&login_ip_key("127.0.0.1"));
+        clear_login_fails(&login_ip_key(&test_connect_info().0.ip().to_string()));
         create_test_admin_and_board(&state)?;
 
         let router = Router::new()
@@ -847,7 +872,7 @@ mod tests {
                     .header(header::HOST, &host)
                     .header(header::ORIGIN, &origin)
                     .header(header::COOKIE, "csrf_token=csrf123")
-                    .extension(crate::test_support::connect_info())
+                    .extension(test_connect_info())
                     .extension(crate::middleware::RequestTransport { direct_https: true })
                     .body(Body::from(format!(
                         "username=admin&password=hunter2&_csrf={}",
@@ -894,7 +919,7 @@ mod tests {
                     .header(header::HOST, "192.168.1.20:8080")
                     .header(header::ORIGIN, "http://192.168.1.20:8080")
                     .header(header::COOKIE, "csrf_token=csrf123")
-                    .extension(crate::test_support::connect_info())
+                    .extension(test_connect_info())
                     .body(Body::from(format!(
                         "username=admin&password=hunter2&_csrf={}",
                         signed_admin_csrf()
@@ -938,7 +963,7 @@ mod tests {
                     .header(header::HOST, TEST_ONION_HOST)
                     .header(header::ORIGIN, TEST_ONION_ORIGIN)
                     .header(header::COOKIE, "csrf_token=csrf123")
-                    .extension(crate::test_support::connect_info())
+                    .extension(test_connect_info())
                     .body(Body::from(format!(
                         "username=admin&password=hunter2&_csrf={}",
                         signed_admin_csrf()
@@ -1017,7 +1042,7 @@ mod tests {
                     .header(header::HOST, "localhost")
                     .header(header::ORIGIN, "http://localhost:3000")
                     .header(header::COOKIE, "csrf_token=csrf123")
-                    .extension(crate::test_support::connect_info())
+                    .extension(test_connect_info())
                     .body(Body::from(format!(
                         "username=admin&password=hunter2&_csrf={}",
                         signed_admin_csrf()
@@ -1052,7 +1077,7 @@ mod tests {
                     .header(header::HOST, "example.test:8080")
                     .header(header::ORIGIN, "https://example.test")
                     .header(header::COOKIE, "csrf_token=csrf123")
-                    .extension(crate::test_support::connect_info())
+                    .extension(test_connect_info())
                     .body(Body::from(format!(
                         "username=admin&password=hunter2&_csrf={}",
                         signed_admin_csrf()
@@ -1086,7 +1111,7 @@ mod tests {
                     .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
                     .header(header::HOST, "localhost")
                     .header(header::COOKIE, "csrf_token=csrf123")
-                    .extension(crate::test_support::connect_info())
+                    .extension(test_connect_info())
                     .body(Body::from(format!(
                         "username=admin&password=hunter2&_csrf={}",
                         signed_admin_csrf()
@@ -1120,7 +1145,7 @@ mod tests {
                     .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
                     .header(header::HOST, "localhost")
                     .header(header::COOKIE, "csrf_token=csrf123")
-                    .extension(crate::test_support::connect_info())
+                    .extension(test_connect_info())
                     .body(Body::from("username=admin&password=hunter2&_csrf=csrf123"))
                     .context("build origin-less admin login request with invalid CSRF")?,
             )
@@ -1152,7 +1177,7 @@ mod tests {
                     .header(header::HOST, "localhost")
                     .header(header::ORIGIN, "null")
                     .header(header::COOKIE, "csrf_token=csrf123")
-                    .extension(crate::test_support::connect_info())
+                    .extension(test_connect_info())
                     .body(Body::from(format!(
                         "username=admin&password=hunter2&_csrf={}",
                         signed_admin_csrf()
@@ -1187,7 +1212,7 @@ mod tests {
                     .header(header::HOST, "127.0.0.1:8080")
                     .header(header::ORIGIN, "http://localhost:8080")
                     .header(header::COOKIE, "csrf_token=csrf123")
-                    .extension(crate::test_support::connect_info())
+                    .extension(test_connect_info())
                     .body(Body::from(format!(
                         "username=admin&password=hunter2&_csrf={}",
                         signed_admin_csrf()
@@ -1222,7 +1247,7 @@ mod tests {
                     .header(header::HOST, "[::1]:8080")
                     .header(header::ORIGIN, "http://[::1]:8080")
                     .header(header::COOKIE, "csrf_token=csrf123")
-                    .extension(crate::test_support::connect_info())
+                    .extension(test_connect_info())
                     .body(Body::from(format!(
                         "username=admin&password=hunter2&_csrf={}",
                         signed_admin_csrf()
@@ -1259,7 +1284,7 @@ mod tests {
                     .header(header::ORIGIN, "null")
                     .header(header::REFERER, "https://demo.serveo.net/admin")
                     .header(header::COOKIE, "csrf_token=csrf123")
-                    .extension(crate::test_support::connect_info())
+                    .extension(test_connect_info())
                     .body(Body::from(format!(
                         "username=admin&password=hunter2&_csrf={}",
                         signed_admin_csrf()
@@ -1295,7 +1320,7 @@ mod tests {
                     .header(header::HOST, "demo.serveo.net")
                     .header("sec-fetch-site", "same-origin")
                     .header(header::COOKIE, "csrf_token=csrf123")
-                    .extension(crate::test_support::connect_info())
+                    .extension(test_connect_info())
                     .body(Body::from(format!(
                         "username=admin&password=hunter2&_csrf={}",
                         signed_admin_csrf()
diff --git a/src/handlers/admin/backup/http.rs b/src/handlers/admin/backup/http.rs
index c9726ea3..301197a2 100644
--- a/src/handlers/admin/backup/http.rs
+++ b/src/handlers/admin/backup/http.rs
@@ -14,8 +14,8 @@ pub(in crate::server) async fn backup_request_logging_middleware(
     next: Next,
 ) -> Response {
     let method = req.method().clone();
-    let uri = req.uri().clone();
-    if uri.path() == "/admin/backup/progress" {
+    let path = req.uri().path().to_owned();
+    if path == "/admin/backup/progress" {
         return next.run(req).await;
     }
     let headers = req.headers().clone();
@@ -31,10 +31,10 @@ pub(in crate::server) async fn backup_request_logging_middleware(
     tracing::info!(
         target: "admin",
         method = %method,
-        uri = %uri,
+        path = %path,
         status = status.as_u16(),
-        content_type = content_type.unwrap_or(""),
-        content_length = content_length.unwrap_or(""),
+        content_type = %content_type.unwrap_or("").chars().take(128).collect::<String>(),
+        content_length = %content_length.unwrap_or("").chars().take(32).collect::<String>(),
         "Admin backup request completed"
     );
 
@@ -78,8 +78,14 @@ pub(super) fn admin_xhr_error_response(error: &AppError) -> Response {
     }
 
     let (status, message) = match error {
-        AppError::Internal(error) => (StatusCode::INTERNAL_SERVER_ERROR, error.to_string()),
-        AppError::Tls(message) => (StatusCode::INTERNAL_SERVER_ERROR, message.clone()),
+        AppError::Internal(_) => (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "An internal error occurred.".to_owned(),
+        ),
+        AppError::Tls(_) => (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "A TLS configuration error occurred.".to_owned(),
+        ),
         AppError::NotFound(_)
         | AppError::BadRequest(_)
         | AppError::Forbidden(_)
@@ -335,8 +341,8 @@ pub(super) fn log_restore_upload_started(kind: RestoreKind, headers: &HeaderMap,
     tracing::info!(
         target: "admin",
         route = kind.route(),
-        content_type = content_type.unwrap_or(""),
-        content_length = content_length.unwrap_or(""),
+        content_type = %content_type.unwrap_or("").chars().take(128).collect::<String>(),
+        content_length = %content_length.unwrap_or("").chars().take(32).collect::<String>(),
         has_session_cookie = jar.get(SESSION_COOKIE).is_some(),
         has_csrf_cookie = jar.get("csrf_token").is_some(),
         "{} upload started",
diff --git a/src/handlers/admin/backup/restore_board.rs b/src/handlers/admin/backup/restore_board.rs
index b18d255d..80611c33 100644
--- a/src/handlers/admin/backup/restore_board.rs
+++ b/src/handlers/admin/backup/restore_board.rs
@@ -20,13 +20,18 @@ use axum::{extract::FromRequest as _, response::IntoResponse as _};
 use rusqlite::{params, OptionalExtension as _};
 use serde::Deserialize;
 
-/// Validates board restore media metadata.
+/// Validate post body bounds and board restore media metadata before staging.
 fn validate_board_restore_media_metadata(
     manifest: &board_manifest::BoardBackupManifest,
 ) -> Result<()> {
     let board_short = manifest.board.short_name.as_str();
 
     for post in &manifest.posts {
+        if post.body.chars().take(4097).count() > 4096 {
+            return Err(AppError::BadRequest(
+                "Board backup contains an oversized post body.".into(),
+            ));
+        }
         if let Some(file_path) = post.file_path.as_deref() {
             safety::validate_restored_media_path_for_board(
                 file_path,
@@ -364,8 +369,8 @@ where
 
     let board_short = manifest.board.short_name.clone();
     validate_board_short_name(&board_short)?;
-    validate_board_backup_access_settings(&mut manifest)?;
     validate_board_restore_media_metadata(&manifest)?;
+    validate_board_backup_access_settings(&mut manifest)?;
     let workspace = BoardRestoreWorkspace::prepare(upload_dir, &board_short)?;
     extract_uploads(&workspace.staged_upload_root)?;
 
@@ -1446,6 +1451,36 @@ mod tests {
         }
     }
 
+    #[test]
+    fn board_restore_body_bounds_apply_before_filesystem_or_database_mutation() -> TestResult<()> {
+        let mut manifest = sample_manifest();
+        for chars in [4095, 4096, 4097] {
+            manifest.posts.first_mut().context("fixture post")?.body = "😀".repeat(chars);
+            ensure!(validate_board_restore_media_metadata(&manifest).is_ok() == (chars <= 4096));
+        }
+        let pool = crate::db::init_test_pool()?;
+        let mut conn = pool.get()?;
+        let directory = tempfile::tempdir()?;
+        let uploads = directory.path().join("uploads");
+        let extracted = std::cell::Cell::new(false);
+        let result = super::execute_board_restore(
+            &mut conn,
+            uploads.to_str().context("fixture path")?,
+            manifest,
+            |_path| {
+                extracted.set(true);
+                Ok(())
+            },
+            "test restore",
+            "test completion",
+        );
+        ensure!(matches!(result, Err(crate::error::AppError::BadRequest(_))));
+        ensure!(!extracted.get() && !uploads.exists());
+        let posts: i64 = conn.query_row("SELECT COUNT(*) FROM posts", [], |row| row.get(0))?;
+        ensure!(posts == 0);
+        Ok(())
+    }
+
     #[test]
     fn board_restore_rejects_cross_board_media_paths_in_manifest() -> TestResult<()> {
         let mut manifest = sample_manifest();
diff --git a/src/handlers/admin/backup/restore_full.rs b/src/handlers/admin/backup/restore_full.rs
index a0b2a06e..4141b4aa 100644
--- a/src/handlers/admin/backup/restore_full.rs
+++ b/src/handlers/admin/backup/restore_full.rs
@@ -187,45 +187,58 @@ fn validate_full_restore_db_trust_boundary(conn: &rusqlite::Connection) -> Resul
 }
 
 fn recompute_restored_post_body_html(conn: &rusqlite::Connection) -> Result<()> {
-    let posts = {
-        let mut stmt = conn
-            .prepare("SELECT id, body FROM posts")
-            .map_err(|error| {
-                AppError::BadRequest(format!("Restored database is invalid: {error}"))
-            })?;
-        let rows = stmt
-            .query_map([], |row| {
+    // Keyset pages prevent an 8 GiB snapshot from materializing every body.
+    // Incremental reads bound bytes before allocation and count NUL bytes as
+    // Rust scalars, unlike SQLite text length/substr functions.
+    let mut before: Option<i64> = None;
+    loop {
+        let sql = if before.is_none() {
+            "SELECT id, typeof(body) FROM posts WHERE id >= ?1 ORDER BY id LIMIT 128"
+        } else {
+            "SELECT id, typeof(body) FROM posts WHERE id > ?1 ORDER BY id LIMIT 128"
+        };
+        let posts = conn
+            .prepare_cached(sql)?
+            .query_map([before.unwrap_or(i64::MIN)], |row| {
                 Ok((row.get::<_, i64>(0)?, row.get::<_, String>(1)?))
-            })
-            .map_err(|error| {
-                AppError::BadRequest(format!("Restored database is invalid: {error}"))
-            })?;
-        rows.collect::<rusqlite::Result<Vec<_>>>()
-            .map_err(|error| {
-                AppError::BadRequest(format!(
-                    "Restored database has an invalid post body row: {error}"
-                ))
             })?
-    };
-
-    let mut update = conn
-        .prepare("UPDATE posts SET body_html = ?1 WHERE id = ?2")
-        .map_err(|error| {
-            AppError::Internal(anyhow::anyhow!(
-                "Prepare restored body_html update: {error}"
-            ))
-        })?;
-    for (post_id, body) in posts {
-        let body_html = render_restored_body_html(&body);
-        update
-            .execute(params![body_html, post_id])
-            .map_err(|error| {
-                AppError::Internal(anyhow::anyhow!(
-                    "Update restored body_html for post {post_id}: {error}"
-                ))
-            })
-            .map(|_completed_value| ())?;
+            .collect::<rusqlite::Result<Vec<_>>>()?;
+        if posts.is_empty() {
+            break;
+        }
+        for (post_id, body_type) in posts {
+            if body_type != "text" {
+                return Err(AppError::BadRequest(
+                    "Restored database contains an invalid post body.".into(),
+                ));
+            }
+            let blob = conn.blob_open("main", "posts", "body", post_id, true)?;
+            if blob.len() > 4 * 4096 {
+                return Err(AppError::BadRequest(
+                    "Restored database contains an oversized post body.".into(),
+                ));
+            }
+            let mut bytes = vec![0; blob.len()];
+            blob.read_at_exact(&mut bytes, 0)?;
+            drop(blob);
+            let body = String::from_utf8(bytes).map_err(|_error| {
+                AppError::BadRequest("Restored post bodies must be valid UTF-8.".into())
+            })?;
+            if body.chars().count() > 4096 {
+                return Err(AppError::BadRequest(
+                    "Restored database contains an oversized post body.".into(),
+                ));
+            }
+            let body_html = render_restored_body_html(&body);
+            conn.execute(
+                "UPDATE posts SET body_html=?1 WHERE id=?2",
+                params![body_html, post_id],
+            )
+            .map(|_rows| ())?;
+            before = Some(post_id);
+        }
     }
+
     Ok(())
 }
 
@@ -1169,6 +1182,55 @@ pub(in crate::server) async fn restore_saved_full_backup(
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn restored_bodies_are_processed_in_pages_and_oversized_unicode_is_rejected(
+    ) -> anyhow::Result<()> {
+        let conn = rusqlite::Connection::open_in_memory()?;
+        conn.execute_batch(
+            "CREATE TABLE posts(id INTEGER PRIMARY KEY, body TEXT, body_html TEXT);
+            WITH RECURSIVE n(x) AS (SELECT 1 UNION ALL SELECT x+1 FROM n WHERE x<300)
+            INSERT INTO posts SELECT x,'safe <img>','<img onerror=bad>' FROM n;",
+        )?;
+        super::recompute_restored_post_body_html(&conn)?;
+        let unsafe_count: i64 = conn.query_row(
+            "SELECT COUNT(*) FROM posts WHERE body_html LIKE '%<img%'",
+            [],
+            |row| row.get(0),
+        )?;
+        anyhow::ensure!(unsafe_count == 0);
+        conn.execute("UPDATE posts SET body='' WHERE id=1", [])
+            .map(|_rows| ())?;
+        super::recompute_restored_post_body_html(&conn)?;
+        for chars in [4095, 4096, 4097] {
+            conn.execute("UPDATE posts SET body=?1 WHERE id=1", ["😀".repeat(chars)])
+                .map(|_rows| ())?;
+            let result = super::recompute_restored_post_body_html(&conn);
+            anyhow::ensure!(
+                result.is_ok() == (chars <= 4096),
+                "restore scalar boundary {chars}"
+            );
+        }
+        for chars in [4095, 4096, 4097, 65_536] {
+            conn.execute(
+                "UPDATE posts SET body=?1 WHERE id=1",
+                [format!("\0{}", "x".repeat(chars - 1))],
+            )
+            .map(|_rows| ())?;
+            let result = super::recompute_restored_post_body_html(&conn);
+            anyhow::ensure!(
+                result.is_ok() == (chars <= 4096),
+                "restore NUL boundary {chars}"
+            );
+        }
+        conn.execute("UPDATE posts SET body=CAST(X'FF' AS TEXT) WHERE id=1", [])
+            .map(|_rows| ())?;
+        anyhow::ensure!(matches!(
+            super::recompute_restored_post_body_html(&conn),
+            Err(crate::error::AppError::BadRequest(_))
+        ));
+        Ok(())
+    }
+
     #[test]
     fn restore_preflight_bounds_session_duration_for_any_clock_value() -> anyhow::Result<()> {
         use anyhow::Context as _;
diff --git a/src/handlers/admin/content.rs b/src/handlers/admin/content.rs
index a3a2e1fa..b8e95fac 100644
--- a/src/handlers/admin/content.rs
+++ b/src/handlers/admin/content.rs
@@ -18,18 +18,6 @@ use serde::Deserialize;
 #[cfg(test)]
 use std::path::{Path, PathBuf};
 
-/// Reduce a board short name to its safe character set for display or URL use.
-///
-/// Unlike the restore-side `sanitize_board_short_value`, this is infallible and
-/// may return an empty string; callers must treat emptiness as missing input.
-fn board_short_fragment(board_short: &str) -> String {
-    board_short
-        .chars()
-        .filter(char::is_ascii_alphanumeric)
-        .take(8)
-        .collect()
-}
-
 /// Validates new board short name.
 fn validate_new_board_short_name(raw_short_name: &str) -> Result<String> {
     let trimmed = raw_short_name.trim();
@@ -42,19 +30,6 @@ fn validate_new_board_short_name(raw_short_name: &str) -> Result<String> {
     Ok(trimmed.to_lowercase())
 }
 
-fn resolve_board_short_name(
-    boards: Option<&[crate::models::Board]>,
-    board_id: i64,
-    fallback_board: &str,
-) -> String {
-    boards
-        .and_then(|boards| boards.iter().find(|board| board.id == board_id))
-        .map_or_else(
-            || board_short_fragment(fallback_board),
-            |board| board.short_name.clone(),
-        )
-}
-
 #[cfg(test)]
 fn validate_board_short_for_filesystem(short: &str) -> Result<()> {
     let is_valid = !short.is_empty()
@@ -352,78 +327,57 @@ pub(in crate::server) async fn thread_action(
 
     let action = form.action.clone();
     let thread_id = form.thread_id;
-    let board_for_log = form.board.clone();
-    tokio::task::spawn_blocking({
+    let submitted_board = form.board.clone();
+    let board_name = tokio::task::spawn_blocking({
         let pool = state.db.clone();
-        move || -> Result<()> {
+        move || -> Result<String> {
             let conn = pool.get()?;
+            let tx = rusqlite::Transaction::new_unchecked(
+                &conn, rusqlite::TransactionBehavior::Immediate,
+            )?;
             let (admin_id, admin_name) =
-                super::require_admin_session_with_name(&conn, session_id.as_deref())?;
+                super::require_admin_session_with_name(&tx, session_id.as_deref())?;
+            let target = db::get_thread(&tx, thread_id)?
+                .ok_or_else(|| AppError::NotFound("Thread not found.".into()))?;
+            let logged_board: String = tx.query_row(
+                "SELECT short_name FROM boards WHERE id = ?1", [target.board_id], |row| row.get(0),
+            )?;
+            if submitted_board != logged_board {
+                return Err(AppError::BadRequest("Board mismatch.".into()));
+            }
+            if target.archived && matches!(action.as_str(), "lock" | "unlock" | "sticky") {
+                return Err(AppError::Conflict("This thread is archived.".into()));
+            }
             match action.as_str() {
-                "sticky" => db::set_thread_sticky(&conn, thread_id, true)?,
-                "unsticky" => db::set_thread_sticky(&conn, thread_id, false)?,
-                "lock" => db::set_thread_locked(&conn, thread_id, true)?,
-                "unlock" => db::set_thread_locked(&conn, thread_id, false)?,
-                "archive" => db::set_thread_archived(&conn, thread_id, true)?,
+                "sticky" => db::set_thread_sticky(&tx, thread_id, true)?,
+                "unsticky" => db::set_thread_sticky(&tx, thread_id, false)?,
+                "lock" => db::set_thread_locked(&tx, thread_id, true)?,
+                "unlock" => db::set_thread_locked(&tx, thread_id, false)?,
+                "archive" => db::set_thread_archived(&tx, thread_id, true)?,
                 _ => {}
             }
-            if let Err(error) = db::log_mod_action(
-                &conn,
-                admin_id,
-                &admin_name,
-                &action,
-                "thread",
-                Some(thread_id),
-                &board_for_log,
-                "",
-            ) {
-                tracing::error!(
-                    target: "admin",
-                    admin_id,
-                    action = %action,
-                    thread_id,
-                    board = %board_for_log,
-                    error = %error,
-                    "Privileged thread action completed without audit-log record"
-                );
+            let board_id = target.board_id;
+            if matches!(action.as_str(), "archive" | "unsticky") {
+                let _schedule = db::persist_thread_prune_intent_in_tx(&tx, board_id)?;
             }
+            // Thread moderation and its audit record must commit together.
+            db::log_mod_action(
+                &tx, admin_id, &admin_name, &action, "thread", Some(thread_id),
+                &logged_board, "",
+            )?;
+            tx.commit()?;
             tracing::info!(target: "admin", action = %action, thread_id = thread_id, "Thread action");
-            Ok(())
+            Ok(logged_board)
         }
     })
     .await
     .map_err(|e| AppError::Internal(anyhow::anyhow!(e)))??;
 
-    // Use the board name from the DB (via the thread's board_id),
-    // not the user-supplied form.board, to prevent path-confusion redirects.
-    let redirect_url = {
-        let pool = state.db.clone();
-        let board_name = tokio::task::spawn_blocking(move || -> Result<String> {
-            let conn = pool.get()?;
-            let thread = db::get_thread(&conn, thread_id)?;
-            let boards = db::get_all_boards(&conn).ok();
-            if let Some(t) = thread {
-                return Ok(resolve_board_short_name(
-                    boards.as_deref(),
-                    t.board_id,
-                    &form.board,
-                ));
-            }
-            // Fallback: sanitize the user-supplied board name to prevent open-redirect.
-            // Only allow alphanumeric characters (matching the board short_name format).
-            Ok(board_short_fragment(&form.board))
-        })
-        .await
-        .map_err(|e| AppError::Internal(anyhow::anyhow!(e)))??;
-        // After archiving, send to the board archive; for all other actions
-        // stay on the thread.
-        if form.action == "archive" {
-            format!("/{board_name}/archive")
-        } else {
-            format!("/{board_name}/thread/{}", form.thread_id)
-        }
+    let redirect_url = if form.action == "archive" {
+        format!("/{board_name}/archive")
+    } else {
+        format!("/{board_name}/thread/{thread_id}")
     };
-
     Ok(Redirect::to(&redirect_url).into_response())
 }
 
@@ -436,10 +390,6 @@ pub(in crate::server) struct AdminDeletePostForm {
     csrf: Option<String>,
 }
 
-#[expect(
-    clippy::cognitive_complexity,
-    reason = "post deletion keeps authorization, database mutation, file cleanup, and audit logging together"
-)]
 pub(in crate::server) async fn admin_delete_post(
     State(state): State<AppState>,
     jar: CookieJar,
@@ -457,65 +407,24 @@ pub(in crate::server) async fn admin_delete_post(
         let pool = state.db.clone();
         move || -> Result<String> {
             let conn = pool.get()?;
-            let (admin_id, admin_name) =
-                super::require_admin_session_with_name(&conn, session_id.as_deref())?;
-
-            let post = db::get_post(&conn, post_id)?
+            let tx = rusqlite::Transaction::new_unchecked(&conn, rusqlite::TransactionBehavior::Immediate)?;
+            let (admin_id, admin_name) = super::require_admin_session_with_name(&tx, session_id.as_deref())?;
+            let post = db::get_post(&tx, post_id)?
                 .ok_or_else(|| AppError::NotFound("Post not found.".into()))?;
-
-            // Resolve board name from DB, not user-supplied form field.
-            // Fallback sanitizes the user-supplied value to alphanumeric only.
-            let boards = db::get_all_boards(&conn).ok();
-            let board_name =
-                resolve_board_short_name(boards.as_deref(), post.board_id, &form.board);
-
+            let board_name: String = tx.query_row("SELECT short_name FROM boards WHERE id = ?1", [post.board_id], |row| row.get(0))?;
+            if board_name != form.board { return Err(AppError::BadRequest("Board mismatch.".into())); }
             let thread_id = post.thread_id;
             let is_op = post.is_op;
-
-            let deleted = if post.is_op {
-                db::delete_thread(&conn, post.thread_id)?
-            } else {
-                db::delete_post(&conn, post_id)?
-            };
-
+            let deleted = if is_op { db::delete_thread_verified(&tx, thread_id)? }
+                else { db::posts::delete_post_reply_in_tx(&tx, post_id)? };
+            db::log_mod_action(&tx, admin_id, &admin_name,
+                if is_op { "delete_thread" } else { "delete_post" }, "post", Some(post_id),
+                &board_name, &post.body.chars().take(80).collect::<String>())?;
+            tx.commit()?;
             if let Err(error) = crate::pending_fs::finalize_delete_files_payload(
-                &conn,
-                &upload_dir,
-                deleted.pending_fs_op_id.as_deref(),
-                &deleted.paths,
-            ) {
-                tracing::warn!(
-                    target: "admin",
-                    post_id = post_id,
-                    error = %error,
-                    "deleted post but file cleanup did not fully complete"
-                );
-            }
-
-            let action = if is_op {
-                "delete_thread"
-            } else {
-                "delete_post"
-            };
-            if let Err(error) = db::log_mod_action(
-                &conn,
-                admin_id,
-                &admin_name,
-                action,
-                "post",
-                Some(post_id),
-                &board_name,
-                &post.body.chars().take(80).collect::<String>(),
+                &conn, &upload_dir, deleted.pending_fs_op_id.as_deref(), &deleted.paths,
             ) {
-                tracing::error!(
-                    target: "admin",
-                    admin_id,
-                    action,
-                    post_id,
-                    board = %board_name,
-                    error = %error,
-                    "Privileged post deletion completed without audit-log record"
-                );
+                tracing::warn!(target: "admin", post_id, %error, "deletion committed; file cleanup remains pending");
             }
             tracing::info!(target: "admin", post_id = post_id, "Post deleted");
             // If the post was an OP, redirect to the board index (thread is gone).
@@ -558,59 +467,19 @@ pub(in crate::server) async fn admin_delete_thread(
         let pool = state.db.clone();
         move || -> Result<String> {
             let conn = pool.get()?;
-            let (admin_id, admin_name) =
-                super::require_admin_session_with_name(&conn, session_id.as_deref())?;
-
-            // Fall back only to a sanitized user value when the DB row is gone.
-            let board_name = db::get_thread(&conn, thread_id)?
-                .and_then(|t| {
-                    db::get_all_boards(&conn)
-                        .ok()?
-                        .into_iter()
-                        .find(|b| b.id == t.board_id)
-                        .map(|b| b.short_name)
-                })
-                .unwrap_or_else(|| {
-                    form.board
-                        .chars()
-                        .filter(char::is_ascii_alphanumeric)
-                        .take(8)
-                        .collect()
-                });
-
-            let deleted = db::delete_thread(&conn, thread_id)?;
+            let tx = rusqlite::Transaction::new_unchecked(&conn, rusqlite::TransactionBehavior::Immediate)?;
+            let (admin_id, admin_name) = super::require_admin_session_with_name(&tx, session_id.as_deref())?;
+            let target = db::get_thread(&tx, thread_id)?
+                .ok_or_else(|| AppError::NotFound("Thread not found.".into()))?;
+            let board_name: String = tx.query_row("SELECT short_name FROM boards WHERE id = ?1", [target.board_id], |row| row.get(0))?;
+            if board_name != form.board { return Err(AppError::BadRequest("Board mismatch.".into())); }
+            let deleted = db::delete_thread_verified(&tx, thread_id)?;
+            db::log_mod_action(&tx, admin_id, &admin_name, "delete_thread", "thread", Some(thread_id), &board_name, "")?;
+            tx.commit()?;
             if let Err(error) = crate::pending_fs::finalize_delete_files_payload(
-                &conn,
-                &upload_dir,
-                deleted.pending_fs_op_id.as_deref(),
-                &deleted.paths,
+                &conn, &upload_dir, deleted.pending_fs_op_id.as_deref(), &deleted.paths,
             ) {
-                tracing::warn!(
-                    target: "admin",
-                    thread_id = thread_id,
-                    error = %error,
-                    "deleted thread but file cleanup did not fully complete"
-                );
-            }
-
-            if let Err(error) = db::log_mod_action(
-                &conn,
-                admin_id,
-                &admin_name,
-                "delete_thread",
-                "thread",
-                Some(thread_id),
-                &board_name,
-                "",
-            ) {
-                tracing::error!(
-                    target: "admin",
-                    admin_id,
-                    thread_id,
-                    board = %board_name,
-                    error = %error,
-                    "Privileged thread deletion completed without audit-log record"
-                );
+                tracing::warn!(target: "admin", thread_id, %error, "deletion committed; file cleanup remains pending");
             }
             tracing::info!(target: "admin", thread_id = thread_id, "Thread deleted");
             Ok(board_name)
@@ -758,58 +627,6 @@ mod tests {
         Ok((state, thread_id, reply_id, board.id))
     }
 
-    #[test]
-    fn resolve_board_short_name_falls_back_when_boards_missing() {
-        assert_eq!(
-            resolve_board_short_name(None, 123, "fallback-board!"),
-            "fallback"
-        );
-    }
-
-    #[test]
-    fn resolve_board_short_name_prefers_matching_board() {
-        let board = crate::models::Board {
-            id: 7,
-            display_order: 0,
-            short_name: "tech".to_owned(),
-            name: "Technology".to_owned(),
-            description: String::new(),
-            nsfw: false,
-            max_threads: 100,
-            max_archived_threads: 100,
-            bump_limit: 500,
-            allow_images: true,
-            allow_video: true,
-            allow_audio: true,
-            max_image_size: 8 * 1024 * 1024,
-            max_video_size: 50 * 1024 * 1024,
-            max_audio_size: 150 * 1024 * 1024,
-            max_pdf_size: 8 * 1024 * 1024,
-            allow_pdf: false,
-            allow_any_files: false,
-            allow_tripcodes: true,
-            allow_editing: false,
-            allow_self_delete: false,
-            edit_window_secs: 300,
-            allow_archive: true,
-            allow_video_embeds: true,
-            allow_captcha: false,
-            show_poster_ids: false,
-            collapse_greentext: false,
-            post_cooldown_secs: 0,
-            default_theme: String::new(),
-            banner_mode: crate::models::BoardBannerMode::Inherit,
-            access_mode: crate::models::BoardAccessMode::Public,
-            access_password_hash: String::new(),
-            created_at: 0,
-        };
-
-        assert_eq!(
-            resolve_board_short_name(Some(std::slice::from_ref(&board)), 7, "fallback"),
-            "tech"
-        );
-    }
-
     #[test]
     fn checked_board_upload_dir_rejects_traversal_short_name_without_touching_sentinel(
     ) -> anyhow::Result<()> {
@@ -863,34 +680,26 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn admin_delete_post_uses_fallback_board_when_lookup_breaks() -> anyhow::Result<()> {
-        let (state, thread_id, reply_id, _board_id) = seed_admin_data()?;
-        let conn = state.db.get().context("get database connection")?;
-        conn.execute_batch("ALTER TABLE boards RENAME COLUMN short_name TO short_name_broken")
-            .context("break board lookup")?;
-        drop(conn);
-
+    async fn admin_delete_post_fails_closed_when_board_lookup_breaks() -> anyhow::Result<()> {
+        let (state, _thread_id, reply_id, _board_id) = seed_admin_data()?;
+        state
+            .db
+            .get()?
+            .execute_batch("ALTER TABLE boards RENAME COLUMN short_name TO short_name_broken")?;
         let response = admin_delete_post(
-            State(state),
+            State(state.clone()),
             build_admin_jar(),
             admin_headers(),
             crate::test_support::connect_info(),
             Form(AdminDeletePostForm {
                 post_id: reply_id,
-                board: "fallback".to_owned(),
+                board: "fallback".into(),
                 csrf: Some(admin_signed_csrf()),
             }),
         )
-        .await
-        .context("delete post")?;
-
-        ensure!(response.status() == StatusCode::SEE_OTHER);
-        let location = response
-            .headers()
-            .get(header::LOCATION)
-            .and_then(|value| value.to_str().ok())
-            .context("response omitted location header")?;
-        ensure!(location == format!("/fallback/thread/{thread_id}"));
+        .await;
+        ensure!(matches!(response, Err(AppError::Internal(_))));
+        ensure!(db::get_post(&*state.db.get()?, reply_id)?.is_some());
         Ok(())
     }
 
@@ -1003,7 +812,43 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn thread_action_uses_fallback_board_when_lookup_breaks() -> anyhow::Result<()> {
+    async fn manual_archive_rolls_back_when_audit_logging_fails() -> anyhow::Result<()> {
+        let (state, thread_id, _reply_id, _board_id) = seed_admin_data()?;
+        {
+            let conn = state.db.get()?;
+            conn.execute_batch(
+                "CREATE TRIGGER fail_mod_log BEFORE INSERT ON mod_log
+                BEGIN SELECT RAISE(ABORT, 'injected audit log failure'); END;",
+            )?;
+        }
+        let response = thread_action(
+            State(state.clone()),
+            build_admin_jar(),
+            admin_headers(),
+            crate::test_support::connect_info(),
+            Form(ThreadActionForm {
+                thread_id,
+                board: "test".to_owned(),
+                action: "archive".to_owned(),
+                csrf: Some(admin_signed_csrf()),
+            }),
+        )
+        .await;
+        ensure!(response.is_err());
+        let conn = state.db.get()?;
+        let thread = db::get_thread(&conn, thread_id)?.context("thread")?;
+        ensure!(!thread.archived && !thread.locked);
+        let jobs: i64 = conn.query_row(
+            "SELECT COUNT(*) FROM background_jobs WHERE job_type='thread_prune'",
+            [],
+            |row| row.get(0),
+        )?;
+        ensure!(jobs == 0);
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn thread_action_rolls_back_when_board_lookup_breaks() -> anyhow::Result<()> {
         let (state, thread_id, _reply_id, _board_id) = seed_admin_data()?;
         let conn = state.db.get().context("get database connection")?;
         conn.execute_batch("ALTER TABLE boards RENAME COLUMN short_name TO short_name_broken")
@@ -1011,7 +856,7 @@ mod tests {
         drop(conn);
 
         let response = thread_action(
-            State(state),
+            State(state.clone()),
             build_admin_jar(),
             admin_headers(),
             crate::test_support::connect_info(),
@@ -1022,16 +867,290 @@ mod tests {
                 csrf: Some(admin_signed_csrf()),
             }),
         )
+        .await;
+        ensure!(response.is_err(), "broken target lookup must fail closed");
+        let verification_conn = state.db.get()?;
+        let locked: bool = verification_conn.query_row(
+            "SELECT locked FROM threads WHERE id = ?1",
+            [thread_id],
+            |row| row.get(0),
+        )?;
+        ensure!(
+            !locked,
+            "moderation must roll back when target validation fails"
+        );
+        Ok(())
+    }
+    #[tokio::test]
+    async fn global_sticky_is_idempotent_and_commits_canonical_audit_context() -> anyhow::Result<()>
+    {
+        let (state, thread_id, _reply_id, _board_id) = seed_admin_data()?;
+        for action in ["sticky", "sticky", "unsticky", "unsticky"] {
+            let response = thread_action(
+                State(state.clone()),
+                build_admin_jar(),
+                admin_headers(),
+                crate::test_support::connect_info(),
+                Form(ThreadActionForm {
+                    thread_id,
+                    board: "test".to_owned(),
+                    action: action.to_owned(),
+                    csrf: Some(admin_signed_csrf()),
+                }),
+            )
+            .await?;
+            ensure!(response.status() == StatusCode::SEE_OTHER);
+            let conn = state.db.get()?;
+            ensure!(
+                db::get_thread(&conn, thread_id)?.context("thread")?.sticky == (action == "sticky")
+            );
+            let logged: String = conn.query_row(
+                "SELECT board_short FROM mod_log ORDER BY id DESC LIMIT 1",
+                [],
+                |row| row.get(0),
+            )?;
+            ensure!(logged == "test");
+        }
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn global_thread_actions_reject_forged_board_session_and_csrf_without_mutation(
+    ) -> anyhow::Result<()> {
+        let (state, thread_id, _reply_id, _board_id) = seed_admin_data()?;
+        let mismatch = thread_action(
+            State(state.clone()),
+            build_admin_jar(),
+            admin_headers(),
+            crate::test_support::connect_info(),
+            Form(ThreadActionForm {
+                thread_id,
+                board: "other".to_owned(),
+                action: "sticky".to_owned(),
+                csrf: Some(admin_signed_csrf()),
+            }),
+        )
+        .await;
+        ensure!(matches!(mismatch, Err(AppError::BadRequest(_))));
+        for (jar, headers, csrf) in [
+            (CookieJar::new(), admin_headers(), admin_signed_csrf()),
+            (
+                build_admin_jar(),
+                cross_origin_headers(),
+                admin_signed_csrf(),
+            ),
+            (build_admin_jar(), admin_headers(), "csrf123".to_owned()),
+        ] {
+            let response = thread_action(
+                State(state.clone()),
+                jar,
+                headers,
+                crate::test_support::connect_info(),
+                Form(ThreadActionForm {
+                    thread_id,
+                    board: "test".to_owned(),
+                    action: "sticky".to_owned(),
+                    csrf: Some(csrf),
+                }),
+            )
+            .await;
+            ensure!(matches!(response, Err(AppError::Forbidden(_))));
+        }
+        let conn = state.db.get()?;
+        ensure!(!db::get_thread(&conn, thread_id)?.context("thread")?.sticky);
+        let logs: i64 = conn.query_row("SELECT COUNT(*) FROM mod_log", [], |row| row.get(0))?;
+        ensure!(logs == 0);
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn archived_thread_actions_and_missing_targets_fail_without_contradictory_flags(
+    ) -> anyhow::Result<()> {
+        let (state, thread_id, _reply_id, _board_id) = seed_admin_data()?;
+        {
+            let conn = state.db.get()?;
+            db::set_thread_archived(&conn, thread_id, true)?;
+        }
+        for action in ["unlock", "lock", "sticky"] {
+            let response = thread_action(
+                State(state.clone()),
+                build_admin_jar(),
+                admin_headers(),
+                crate::test_support::connect_info(),
+                Form(ThreadActionForm {
+                    thread_id,
+                    board: "test".to_owned(),
+                    action: action.to_owned(),
+                    csrf: Some(admin_signed_csrf()),
+                }),
+            )
+            .await;
+            ensure!(matches!(response, Err(AppError::Conflict(_))));
+        }
+        let conn = state.db.get()?;
+        let target = db::get_thread(&conn, thread_id)?.context("thread")?;
+        ensure!(target.archived && target.locked && !target.sticky);
+        let response = thread_action(
+            State(state),
+            build_admin_jar(),
+            admin_headers(),
+            crate::test_support::connect_info(),
+            Form(ThreadActionForm {
+                thread_id: i64::MAX,
+                board: "test".to_owned(),
+                action: "sticky".to_owned(),
+                csrf: Some(admin_signed_csrf()),
+            }),
+        )
+        .await;
+        ensure!(matches!(response, Err(AppError::NotFound(_))));
+        Ok(())
+    }
+    #[tokio::test]
+    async fn concurrent_global_sticky_changes_match_the_last_committed_audit_action(
+    ) -> anyhow::Result<()> {
+        let (state, thread_id, _reply_id, _board_id) = seed_admin_data()?;
+        let action = |value: &str| ThreadActionForm {
+            thread_id,
+            board: "test".to_owned(),
+            action: value.to_owned(),
+            csrf: Some(admin_signed_csrf()),
+        };
+        let (sticky, unsticky) = tokio::join!(
+            thread_action(
+                State(state.clone()),
+                build_admin_jar(),
+                admin_headers(),
+                crate::test_support::connect_info(),
+                Form(action("sticky"))
+            ),
+            thread_action(
+                State(state.clone()),
+                build_admin_jar(),
+                admin_headers(),
+                crate::test_support::connect_info(),
+                Form(action("unsticky"))
+            ),
+        );
+        ensure!(
+            sticky?.status() == StatusCode::SEE_OTHER
+                && unsticky?.status() == StatusCode::SEE_OTHER
+        );
+        let conn = state.db.get()?;
+        let last: String = conn.query_row(
+            "SELECT action FROM mod_log ORDER BY id DESC LIMIT 1",
+            [],
+            |row| row.get(0),
+        )?;
+        ensure!(db::get_thread(&conn, thread_id)?.context("thread")?.sticky == (last == "sticky"));
+        Ok(())
+    }
+    #[tokio::test]
+    async fn privileged_deletions_roll_back_when_audit_record_fails() -> anyhow::Result<()> {
+        let (state, thread_id, reply_id, _board) = seed_admin_data()?;
+        state.db.get()?.execute_batch("CREATE TRIGGER reject_audit BEFORE INSERT ON mod_log BEGIN SELECT RAISE(ABORT, 'injected'); END;")?;
+        ensure!(admin_delete_post(
+            State(state.clone()),
+            build_admin_jar(),
+            admin_headers(),
+            crate::test_support::connect_info(),
+            Form(AdminDeletePostForm {
+                post_id: reply_id,
+                board: "test".into(),
+                csrf: Some(admin_signed_csrf())
+            })
+        )
         .await
-        .context("run thread action")?;
+        .is_err());
+        ensure!(admin_delete_thread(
+            State(state.clone()),
+            build_admin_jar(),
+            admin_headers(),
+            crate::test_support::connect_info(),
+            Form(AdminDeleteThreadForm {
+                thread_id,
+                board: "test".into(),
+                csrf: Some(admin_signed_csrf())
+            })
+        )
+        .await
+        .is_err());
+        let conn = state.db.get()?;
+        ensure!(
+            conn.is_autocommit()
+                && db::get_post(&conn, reply_id)?.is_some()
+                && db::get_thread(&conn, thread_id)?.is_some()
+        );
+        Ok(())
+    }
 
-        ensure!(response.status() == StatusCode::SEE_OTHER);
-        let location = response
-            .headers()
-            .get(header::LOCATION)
-            .and_then(|value| value.to_str().ok())
-            .context("response omitted location header")?;
-        ensure!(location == format!("/fallback/thread/{thread_id}"));
+    #[tokio::test]
+    async fn inline_ban_delete_rejects_forged_targets_and_rolls_back_failed_audit(
+    ) -> anyhow::Result<()> {
+        use axum::{body::Body, http::Request, routing::post, Router};
+        use tower::ServiceExt as _;
+        let (state, thread_id, reply_id, _board) = seed_admin_data()?;
+        let identity = "ab".repeat(32);
+        state
+            .db
+            .get()?
+            .execute("UPDATE posts SET ip_hash=?1", [&identity])
+            .map(|_rows| ())?;
+        let router = Router::new()
+            .route(
+                "/ban-delete",
+                post(super::super::moderation::admin_ban_and_delete),
+            )
+            .with_state(state.clone());
+        let request = |op: &str, actor: &str, board: &str| -> anyhow::Result<_> {
+            Ok(Request::builder().method("POST").uri("/ban-delete")
+                .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+                .header(header::HOST, "localhost").header(header::ORIGIN, "http://localhost")
+                .header(header::COOKIE, format!("{}=session123; csrf_token=csrf123", super::super::SESSION_COOKIE))
+                .extension(crate::test_support::connect_info())
+                .body(Body::from(format!("post_id={reply_id}&thread_id={thread_id}&board={board}&is_op={op}&ip_hash={actor}&_csrf={}", admin_signed_csrf())))?)
+        };
+        for (op, actor, board) in [
+            ("1", identity.as_str(), "test"),
+            ("0", "cd", "test"),
+            ("0", identity.as_str(), "wrong"),
+        ] {
+            let response = router.clone().oneshot(request(op, actor, board)?).await?;
+            ensure!(response.status() == StatusCode::BAD_REQUEST);
+        }
+        state.db.get()?.execute_batch("CREATE TRIGGER reject_audit BEFORE INSERT ON mod_log WHEN NEW.action='delete_post' BEGIN SELECT RAISE(ABORT, 'injected'); END;")?;
+        let failed = router
+            .clone()
+            .oneshot(request("0", &identity, "test")?)
+            .await?;
+        ensure!(failed.status() == StatusCode::INTERNAL_SERVER_ERROR);
+        {
+            let conn = state.db.get()?;
+            ensure!(db::get_post(&conn, reply_id)?.is_some());
+            let rows: i64 = conn.query_row(
+                "SELECT (SELECT COUNT(*) FROM bans)+(SELECT COUNT(*) FROM mod_log)",
+                [],
+                |row| row.get(0),
+            )?;
+            ensure!(rows == 0 && conn.is_autocommit());
+            conn.execute_batch("DROP TRIGGER reject_audit")?;
+        }
+        let accepted = router.oneshot(request("0", &identity, "test")?).await?;
+        ensure!(accepted.status() == StatusCode::SEE_OTHER);
+        let conn = state.db.get()?;
+        ensure!(db::get_post(&conn, reply_id)?.is_none());
+        ensure!(
+            db::get_thread(&conn, thread_id)?
+                .context("OP survives reply deletion")?
+                .reply_count
+                == 0
+        );
+        let rows: i64 = conn.query_row(
+            "SELECT (SELECT COUNT(*) FROM bans)+(SELECT COUNT(*) FROM mod_log)",
+            [],
+            |row| row.get(0),
+        )?;
+        ensure!(rows == 3);
         Ok(())
     }
 }
diff --git a/src/handlers/admin/mod.rs b/src/handlers/admin/mod.rs
index acae7a7f..47cd398e 100644
--- a/src/handlers/admin/mod.rs
+++ b/src/handlers/admin/mod.rs
@@ -105,7 +105,7 @@ pub(in crate::server::handlers) fn require_admin_session_sid(
 }
 
 /// Requires same origin request.
-pub(super) fn require_same_origin_request(
+pub(in crate::server) fn require_same_origin_request(
     headers: &HeaderMap,
     peer: Option<SocketAddr>,
 ) -> Result<()> {
@@ -3591,8 +3591,8 @@ mod tests {
         ensure!(
             response.headers().get(header::LOCATION)
                 == Some(&HeaderValue::from_static(
-                "/admin/panel?flash=Failed%20job%20counter%20dismissed.&open=site-health#site-health"
-            ))
+                    "/admin/panel?flash=Failed%20job%20counter%20dismissed.&open=site-health#site-health"
+                ))
         );
         let conn = state.db.get().context("get database connection")?;
         ensure!(
diff --git a/src/handlers/admin/moderation.rs b/src/handlers/admin/moderation.rs
index e61f7533..3a12ed95 100644
--- a/src/handlers/admin/moderation.rs
+++ b/src/handlers/admin/moderation.rs
@@ -136,14 +136,6 @@ pub(in crate::server) struct BanDeleteForm {
     csrf: Option<String>,
 }
 
-#[expect(
-    clippy::cognitive_complexity,
-    reason = "ban-and-delete keeps its authorization, mutation, cleanup, and audit steps together"
-)]
-#[expect(
-    clippy::too_many_lines,
-    reason = "authorization, ban creation, post deletion, media cleanup, and audit logging are one action"
-)]
 pub(in crate::server) async fn admin_ban_and_delete(
     State(state): State<AppState>,
     jar: CookieJar,
@@ -167,147 +159,46 @@ pub(in crate::server) async fn admin_ban_and_delete(
             .saturating_add(h.min(87_600).saturating_mul(3600))
     });
 
-    let ip_hash_log = form.ip_hash.chars().take(8).collect::<String>();
-    let post_id = form.post_id;
-    let board_short = form.board.clone();
-    let thread_id = form.thread_id;
-    let is_op = form.is_op.as_deref() == Some("1");
-
-    tokio::task::spawn_blocking({
+    let redirect = tokio::task::spawn_blocking({
         let pool = state.db.clone();
-        move || -> Result<()> {
+        move || -> Result<String> {
             let conn = pool.get()?;
-            let (admin_id, admin_name) =
-                super::require_admin_session_with_name(&conn, session_id.as_deref())?;
-
-            let post = db::get_post(&conn, post_id)?
+            let tx = rusqlite::Transaction::new_unchecked(&conn, rusqlite::TransactionBehavior::Immediate)?;
+            let (admin_id, admin_name) = super::require_admin_session_with_name(&tx, session_id.as_deref())?;
+            let post = db::get_post(&tx, form.post_id)?
                 .ok_or_else(|| AppError::NotFound("Post not found.".into()))?;
-            if post.thread_id != thread_id {
-                return Err(AppError::NotFound("Post not found.".into()));
-            }
-
-            // Validate ip_hash: must be a well-formed SHA-256 hex string (64 hex
-            // chars).  The value comes from a form field in the post toolbar; a
-            // confused or tampered submission should be rejected cleanly.
-            if form.ip_hash.len() != 64 || !form.ip_hash.chars().all(|c| c.is_ascii_hexdigit()) {
-                return Err(AppError::BadRequest("Invalid IP hash format.".into()));
+            let board_short: String = tx.query_row("SELECT short_name FROM boards WHERE id = ?1", [post.board_id], |row| row.get(0))?;
+            if post.thread_id != form.thread_id || board_short != form.board
+                || post.is_op != (form.is_op.as_deref() == Some("1")) {
+                return Err(AppError::BadRequest("The moderation target changed. Reload the page.".into()));
             }
-
-            // Ban first so the IP cannot re-post before the delete lands
-            db::add_ban(&conn, &form.ip_hash, &reason, expires_at).map(|_completed_value| ())?;
-            if let Err(error) = db::log_mod_action(
-                &conn,
-                admin_id,
-                &admin_name,
-                "ban",
-                "ban",
-                None,
-                &board_short,
-                &format!("inline ban — ip_hash={ip_hash_log}… reason={reason}"),
-            ) {
-                tracing::error!(
-                    target: "admin",
-                    admin_id,
-                    board = %board_short,
-                    ip_hash_prefix = %ip_hash_log,
-                    error = %error,
-                    "Inline ban completed without audit-log record"
-                );
+            let ip_hash = post.ip_hash.as_deref().filter(|hash| hash.len() == 64 && hash.bytes().all(|byte| byte.is_ascii_hexdigit()))
+                .ok_or_else(|| AppError::BadRequest("This post has no valid posting identity to ban.".into()))?;
+            if ip_hash != form.ip_hash {
+                return Err(AppError::BadRequest("Posting identity mismatch. Reload the page.".into()));
             }
-
-            // Delete post (or whole thread if OP)
-            if is_op {
-                let deleted = db::delete_thread(&conn, thread_id)?;
-                if let Err(error) = crate::pending_fs::finalize_delete_files_payload(
-                    &conn,
-                    &crate::config::CONFIG.upload_dir,
-                    deleted.pending_fs_op_id.as_deref(),
-                    &deleted.paths,
-                ) {
-                    tracing::warn!(
-                        target: "admin",
-                        thread_id = thread_id,
-                        error = %error,
-                        "ban-delete thread cleanup did not fully complete"
-                    );
-                }
-                if let Err(error) = db::log_mod_action(
-                    &conn,
-                    admin_id,
-                    &admin_name,
-                    "delete_thread",
-                    "thread",
-                    Some(thread_id),
-                    &board_short,
-                    "",
-                ) {
-                    tracing::error!(
-                        target: "admin",
-                        admin_id,
-                        thread_id,
-                        board = %board_short,
-                        error = %error,
-                        "Ban-delete thread action completed without audit-log record"
-                    );
-                }
+            db::add_ban(&tx, ip_hash, &reason, expires_at).map(|_ban_id| ())?;
+            db::log_mod_action(&tx, admin_id, &admin_name, "ban", "ban", None, &board_short,
+                &format!("inline ban — ip_hash={}… reason={reason}", ip_hash.chars().take(8).collect::<String>()))?;
+            let deleted = if post.is_op {
+                db::delete_thread_verified(&tx, post.thread_id)?
             } else {
-                let deleted = db::delete_post(&conn, post_id)?;
-                if let Err(error) = crate::pending_fs::finalize_delete_files_payload(
-                    &conn,
-                    &crate::config::CONFIG.upload_dir,
-                    deleted.pending_fs_op_id.as_deref(),
-                    &deleted.paths,
-                ) {
-                    tracing::warn!(
-                        target: "admin",
-                        post_id = post_id,
-                        error = %error,
-                        "ban-delete post cleanup did not fully complete"
-                    );
-                }
-                if let Err(error) = db::log_mod_action(
-                    &conn,
-                    admin_id,
-                    &admin_name,
-                    "delete_post",
-                    "post",
-                    Some(post_id),
-                    &board_short,
-                    "",
-                ) {
-                    tracing::error!(
-                        target: "admin",
-                        admin_id,
-                        post_id,
-                        board = %board_short,
-                        error = %error,
-                        "Ban-delete post action completed without audit-log record"
-                    );
-                }
+                db::posts::delete_post_reply_in_tx(&tx, post.id)?
+            };
+            db::log_mod_action(&tx, admin_id, &admin_name,
+                if post.is_op { "delete_thread" } else { "delete_post" },
+                if post.is_op { "thread" } else { "post" },
+                Some(if post.is_op { post.thread_id } else { post.id }), &board_short, "")?;
+            tx.commit()?;
+            if let Err(error) = crate::pending_fs::finalize_delete_files_payload(
+                &conn, &crate::config::CONFIG.upload_dir, deleted.pending_fs_op_id.as_deref(), &deleted.paths,
+            ) {
+                tracing::warn!(target: "admin", post_id = post.id, %error, "ban-delete committed; file cleanup remains pending");
             }
-
-            tracing::info!(target: "admin", post_id = post_id, board = %board_short, "Ban and delete");
-            Ok(())
+            tracing::info!(target: "admin", post_id = post.id, board = %board_short, "Ban and delete");
+            Ok(if post.is_op { format!("/{board_short}") } else { format!("/{board_short}/thread/{}#p{}", post.thread_id, post.id) })
         }
-    })
-    .await
-    .map_err(|e| AppError::Internal(anyhow::anyhow!(e)))??;
-
-    // form.board is user-supplied; sanitise to alphanumeric only before
-    // embedding in the redirect URL to prevent open-redirect via "
-    // " prefixes.
-    let safe_board: String = form
-        .board
-        .chars()
-        .filter(char::is_ascii_alphanumeric)
-        .take(8)
-        .collect();
-    // If OP was deleted, the thread is gone — send to board index
-    let redirect = if is_op {
-        format!("/{safe_board}")
-    } else {
-        format!("/{safe_board}/thread/{thread_id}#p{post_id}")
-    };
+    }).await.map_err(|error| AppError::Internal(anyhow::anyhow!(error)))??;
     Ok(Redirect::to(&redirect).into_response())
 }
 
diff --git a/src/handlers/admin/settings.rs b/src/handlers/admin/settings.rs
index f5c5b931..b8c2f079 100644
--- a/src/handlers/admin/settings.rs
+++ b/src/handlers/admin/settings.rs
@@ -75,11 +75,66 @@ pub(super) fn checkbox_is_on(value: Option<&str>) -> bool {
         || value.is_some_and(|item| item.eq_ignore_ascii_case("true"))
 }
 
-async fn read_text_field(field: axum::extract::multipart::Field<'_>) -> Result<String> {
-    field
-        .text()
-        .await
-        .map_err(|e| AppError::BadRequest(e.to_string()))
+/// Authenticate before multipart headers or file bytes are consumed.
+async fn preflight_asset_upload(state: &AppState, session_id: Option<String>) -> Result<()> {
+    tokio::task::spawn_blocking({
+        let pool = state.db.clone();
+        move || {
+            let conn = pool.get()?;
+            require_admin_session_sid(&conn, session_id.as_deref()).map(|_admin_id| ())
+        }
+    })
+    .await
+    .map_err(|error| AppError::Internal(error.into()))?
+}
+
+#[derive(Default)]
+/// Bound all admin asset parts and reject duplicate scalar/file fields.
+struct AssetMultipartBudget {
+    /// Every named part counts, including unknown controls.
+    names: std::collections::HashSet<String>,
+    /// Includes unnamed parts, which must also be bounded.
+    parts: usize,
+}
+
+impl AssetMultipartBudget {
+    /// Reject excessive parts or ambiguous metadata before reading the field.
+    fn note(&mut self, field: &axum::extract::multipart::Field<'_>) -> Result<()> {
+        self.parts = self.parts.saturating_add(1);
+        if self.parts > 64 {
+            return Err(AppError::BadRequest("Too many multipart fields.".into()));
+        }
+        if let Some(name) = field.name() {
+            if name.len() > 128 || !self.names.insert(name.to_owned()) {
+                return Err(AppError::BadRequest(
+                    "Invalid or duplicate multipart field.".into(),
+                ));
+            }
+        }
+        Ok(())
+    }
+}
+
+/// Bound scalar bytes incrementally and reject invalid UTF-8.
+async fn read_text_field(mut field: axum::extract::multipart::Field<'_>) -> Result<String> {
+    let mut bytes = Vec::new();
+    loop {
+        let next_chunk = field
+            .chunk()
+            .await
+            .map_err(|error| AppError::BadRequest(error.to_string()))?;
+        let Some(chunk) = next_chunk else {
+            break;
+        };
+        if bytes.len().saturating_add(chunk.len()) > 64 * 1024 {
+            return Err(AppError::UploadTooLarge(
+                "Multipart text field is too large.".into(),
+            ));
+        }
+        bytes.extend_from_slice(&chunk);
+    }
+    String::from_utf8(bytes)
+        .map_err(|_error| AppError::BadRequest("Multipart text must be valid UTF-8.".into()))
 }
 
 async fn read_checkbox_field(field: axum::extract::multipart::Field<'_>) -> Result<bool> {
diff --git a/src/handlers/admin/settings/appearance.rs b/src/handlers/admin/settings/appearance.rs
index 6506ac35..a0e32ff9 100644
--- a/src/handlers/admin/settings/appearance.rs
+++ b/src/handlers/admin/settings/appearance.rs
@@ -1,10 +1,10 @@
 use super::{
     admin_panel_error_redirect_anchor, admin_panel_error_redirect_anchor_open,
     admin_panel_redirect_anchor, admin_panel_redirect_anchor_open, check_admin_csrf_jar,
-    format_favicon_upload_error, read_limited_upload_bytes, read_text_field,
-    require_admin_post_origin_and_csrf, require_admin_session_sid, require_same_origin_request,
-    AppError, AppState, CookieJar, Form, HeaderMap, Multipart, Response, Result, State,
-    MAX_FAVICON_UPLOAD_BYTES, SESSION_COOKIE,
+    format_favicon_upload_error, preflight_asset_upload, read_limited_upload_bytes,
+    read_text_field, require_admin_post_origin_and_csrf, require_admin_session_sid,
+    require_same_origin_request, AppError, AppState, AssetMultipartBudget, CookieJar, Form,
+    HeaderMap, Multipart, Response, Result, State, MAX_FAVICON_UPLOAD_BYTES, SESSION_COOKIE,
 };
 use axum::response::IntoResponse as _;
 use serde::Deserialize;
@@ -60,7 +60,10 @@ pub(in crate::server) async fn update_site_favicon(
 ) -> Result<Response> {
     let session_id = jar.get(SESSION_COOKIE).map(|c| c.value().to_owned());
     require_same_origin_request(&headers, Some(peer))?;
+    preflight_asset_upload(&state, session_id.clone()).await?;
+    let media_permit = state.media_upload_gate.try_begin()?;
 
+    let mut budget = AssetMultipartBudget::default();
     let mut csrf = None;
     let mut favicon_bytes: Option<Vec<u8>> = None;
 
@@ -72,6 +75,7 @@ pub(in crate::server) async fn update_site_favicon(
         let Some(field) = next_field else {
             break;
         };
+        budget.note(&field)?;
         match field.name() {
             Some("_csrf") => csrf = Some(read_text_field(field).await?),
             Some("favicon") => {
@@ -80,7 +84,7 @@ pub(in crate::server) async fn update_site_favicon(
                     favicon_bytes = Some(bytes);
                 }
             }
-            _ => {}
+            _ => crate::handlers::discard_unknown_multipart_field(field).await?,
         }
     }
 
@@ -91,6 +95,7 @@ pub(in crate::server) async fn update_site_favicon(
     let favicon_result = tokio::task::spawn_blocking({
         let pool = state.db.clone();
         move || -> Result<()> {
+            let _media_permit = media_permit;
             let conn = pool.get()?;
             require_admin_session_sid(&conn, session_id.as_deref()).map(|_completed_value| ())?;
             crate::favicon::write_favicon_set(
@@ -125,7 +130,10 @@ pub(in crate::server) async fn update_board_favicon(
 ) -> Result<Response> {
     let session_id = jar.get(SESSION_COOKIE).map(|c| c.value().to_owned());
     require_same_origin_request(&headers, Some(peer))?;
+    preflight_asset_upload(&state, session_id.clone()).await?;
+    let media_permit = state.media_upload_gate.try_begin()?;
 
+    let mut budget = AssetMultipartBudget::default();
     let mut csrf = None;
     let mut board_id = None;
     let mut favicon_bytes: Option<Vec<u8>> = None;
@@ -138,6 +146,7 @@ pub(in crate::server) async fn update_board_favicon(
         let Some(field) = next_field else {
             break;
         };
+        budget.note(&field)?;
         match field.name() {
             Some("_csrf") => csrf = Some(read_text_field(field).await?),
             Some("board_id") => {
@@ -149,7 +158,7 @@ pub(in crate::server) async fn update_board_favicon(
                     favicon_bytes = Some(bytes);
                 }
             }
-            _ => {}
+            _ => crate::handlers::discard_unknown_multipart_field(field).await?,
         }
     }
 
@@ -161,6 +170,7 @@ pub(in crate::server) async fn update_board_favicon(
     let favicon_result = tokio::task::spawn_blocking({
         let pool = state.db.clone();
         move || -> Result<String> {
+            let _media_permit = media_permit;
             let conn = pool.get()?;
             require_admin_session_sid(&conn, session_id.as_deref()).map(|_completed_value| ())?;
             let board_short: String = conn.query_row(
diff --git a/src/handlers/admin/settings/banners.rs b/src/handlers/admin/settings/banners.rs
index 86ccc6ec..75bd6a2c 100644
--- a/src/handlers/admin/settings/banners.rs
+++ b/src/handlers/admin/settings/banners.rs
@@ -1,10 +1,10 @@
 use super::{
     admin_panel_error_redirect_anchor_open, admin_panel_redirect_anchor_open, banner,
-    check_admin_csrf_jar, checkbox_is_on, db, format_banner_upload_error, read_checkbox_field,
-    read_limited_upload_bytes, read_text_field, require_admin_post_origin_and_csrf,
-    require_admin_session_sid, require_same_origin_request, AppError, AppState, BannerScope,
-    BannerTargetType, CookieJar, Form, HeaderMap, Multipart, Response, Result, State,
-    MAX_BANNER_UPLOAD_BYTES, SESSION_COOKIE,
+    check_admin_csrf_jar, checkbox_is_on, db, format_banner_upload_error, preflight_asset_upload,
+    read_checkbox_field, read_limited_upload_bytes, read_text_field,
+    require_admin_post_origin_and_csrf, require_admin_session_sid, require_same_origin_request,
+    AppError, AppState, AssetMultipartBudget, BannerScope, BannerTargetType, CookieJar, Form,
+    HeaderMap, Multipart, Response, Result, State, MAX_BANNER_UPLOAD_BYTES, SESSION_COOKIE,
 };
 use anyhow::Context as _;
 use axum::response::IntoResponse as _;
@@ -25,6 +25,7 @@ struct ParsedBannerUpload {
 }
 
 async fn parse_banner_upload(mut multipart: Multipart) -> Result<ParsedBannerUpload> {
+    let mut budget = AssetMultipartBudget::default();
     let mut csrf = None;
     let mut board_id = None;
     let mut target_type = String::from("none");
@@ -45,6 +46,7 @@ async fn parse_banner_upload(mut multipart: Multipart) -> Result<ParsedBannerUpl
         let Some(field) = next_field else {
             break;
         };
+        budget.note(&field)?;
         match field.name() {
             Some("_csrf") => csrf = Some(read_text_field(field).await?),
             Some("board_id") => board_id = read_text_field(field).await?.trim().parse::<i64>().ok(),
@@ -66,7 +68,7 @@ async fn parse_banner_upload(mut multipart: Multipart) -> Result<ParsedBannerUpl
                     banner_bytes = Some(bytes);
                 }
             }
-            _ => {}
+            _ => crate::handlers::discard_unknown_multipart_field(field).await?,
         }
     }
 
@@ -269,8 +271,10 @@ async fn upload_banner_for_scope(
     scope: BannerScope,
     board_id: Option<i64>,
     parsed: ParsedBannerUpload,
+    media_permit: crate::middleware::MediaUploadGuard,
 ) -> Result<String> {
     tokio::task::spawn_blocking(move || -> Result<String> {
+        let _media_permit = media_permit;
         let mut conn = state.db.get()?;
         require_admin_session_sid(&conn, session_id.as_deref()).map(|_completed_value| ())?;
         let (target_type, target_value) = resolve_banner_target_selection(
@@ -386,9 +390,20 @@ pub(in crate::server) async fn upload_global_banner(
         .get(SESSION_COOKIE)
         .map(|cookie| cookie.value().to_owned());
     require_same_origin_request(&headers, Some(peer))?;
+    preflight_asset_upload(&state, session_id.clone()).await?;
+    let media_permit = state.media_upload_gate.try_begin()?;
     let parsed = parse_banner_upload(multipart).await?;
     check_admin_csrf_jar(&jar, parsed.csrf.as_deref())?;
-    match upload_banner_for_scope(state, session_id, BannerScope::Global, None, parsed).await {
+    match upload_banner_for_scope(
+        state,
+        session_id,
+        BannerScope::Global,
+        None,
+        parsed,
+        media_permit,
+    )
+    .await
+    {
         Ok(anchor) => Ok(admin_panel_redirect_anchor_open(
             "Global banner uploaded.",
             &anchor,
@@ -422,9 +437,20 @@ pub(in crate::server) async fn upload_home_banner(
         .get(SESSION_COOKIE)
         .map(|cookie| cookie.value().to_owned());
     require_same_origin_request(&headers, Some(peer))?;
+    preflight_asset_upload(&state, session_id.clone()).await?;
+    let media_permit = state.media_upload_gate.try_begin()?;
     let parsed = parse_banner_upload(multipart).await?;
     check_admin_csrf_jar(&jar, parsed.csrf.as_deref())?;
-    match upload_banner_for_scope(state, session_id, BannerScope::Home, None, parsed).await {
+    match upload_banner_for_scope(
+        state,
+        session_id,
+        BannerScope::Home,
+        None,
+        parsed,
+        media_permit,
+    )
+    .await
+    {
         Ok(anchor) => Ok(admin_panel_redirect_anchor_open(
             "Home page banner uploaded.",
             &anchor,
@@ -458,6 +484,8 @@ pub(in crate::server) async fn upload_board_banner(
         .get(SESSION_COOKIE)
         .map(|cookie| cookie.value().to_owned());
     require_same_origin_request(&headers, Some(peer))?;
+    preflight_asset_upload(&state, session_id.clone()).await?;
+    let media_permit = state.media_upload_gate.try_begin()?;
     let parsed = parse_banner_upload(multipart).await?;
     check_admin_csrf_jar(&jar, parsed.csrf.as_deref())?;
     let board_id = parsed
@@ -470,6 +498,7 @@ pub(in crate::server) async fn upload_board_banner(
         BannerScope::Board,
         Some(board_id),
         parsed,
+        media_permit,
     )
     .await
     {
@@ -613,7 +642,7 @@ pub(in crate::server) async fn move_banner(
         _ => {
             return Err(AppError::BadRequest(
                 "Invalid banner move direction.".into(),
-            ))
+            ));
         }
     };
     let anchor = tokio::task::spawn_blocking({
diff --git a/src/handlers/admin/settings/board.rs b/src/handlers/admin/settings/board.rs
index 520d2684..48bcaacf 100644
--- a/src/handlers/admin/settings/board.rs
+++ b/src/handlers/admin/settings/board.rs
@@ -42,6 +42,29 @@ pub(in crate::server) struct BoardSettingsForm {
     csrf: Option<String>,
 }
 
+/// Parse destructive retention settings without silently reducing saved limits.
+fn parse_retention_setting(raw: Option<&str>, archived: bool) -> Result<Option<i64>> {
+    let upper = if archived { 10_000 } else { 1_000 };
+    let label = if archived {
+        "Archive thread limit"
+    } else {
+        "Active thread limit"
+    };
+    raw.map(|value| {
+        let invalid = || {
+            AppError::BadRequest(format!(
+                "{label} must be a whole number between 1 and {upper}."
+            ))
+        };
+        let parsed = value.trim().parse::<i64>().map_err(|_error| invalid())?;
+        if !(1..=upper).contains(&parsed) {
+            return Err(invalid());
+        }
+        Ok(parsed)
+    })
+    .transpose()
+}
+
 fn parse_board_upload_limit_bytes(raw_value: Option<&str>, fallback_bytes: i64) -> Result<i64> {
     const MIB: i64 = 1024 * 1024;
     // Deliberate site maximum for each per-board media cap. Aggregate public
@@ -125,18 +148,8 @@ pub(in crate::server) async fn update_board_settings(
         .and_then(|v| v.parse::<i64>().ok())
         .unwrap_or(500)
         .clamp(1, 10_000);
-    let max_threads = form
-        .max_threads
-        .as_deref()
-        .and_then(|v| v.parse::<i64>().ok())
-        .unwrap_or(150)
-        .clamp(1, 1_000);
-    let max_archived_threads = form
-        .max_archived_threads
-        .as_deref()
-        .and_then(|v| v.parse::<i64>().ok())
-        .unwrap_or(150)
-        .clamp(1, 10_000);
+    let max_threads = parse_retention_setting(form.max_threads.as_deref(), false)?;
+    let max_archived_threads = parse_retention_setting(form.max_archived_threads.as_deref(), true)?;
     let post_cooldown_secs = form
         .post_cooldown_secs
         .as_deref()
@@ -160,9 +173,11 @@ pub(in crate::server) async fn update_board_settings(
         BoardBannerMode::from_db_str(form.banner_mode.as_deref().unwrap_or("inherit"))
             .ok_or_else(|| AppError::BadRequest("Invalid board banner mode.".into()))?;
 
+    let password_permit = state.password_work_gate.try_begin()?;
     let board_short = tokio::task::spawn_blocking({
         let pool = state.db.clone();
         move || -> Result<String> {
+            let _password_permit = password_permit;
             let mut conn = pool.get()?;
             require_admin_session_sid(&conn, session_id.as_deref()).map(|_completed_value| ())?;
             let board_short: String = conn.query_row(
@@ -213,8 +228,8 @@ pub(in crate::server) async fn update_board_settings(
                 &description,
                 form.nsfw.as_deref() == Some("1"),
                 bump_limit,
-                max_threads,
-                max_archived_threads,
+                max_threads.unwrap_or(current_board.max_threads),
+                max_archived_threads.unwrap_or(current_board.max_archived_threads),
                 form.allow_images.as_deref() == Some("1"),
                 form.allow_video.as_deref() == Some("1"),
                 form.allow_audio.as_deref() == Some("1"),
@@ -262,3 +277,89 @@ pub(in crate::server) async fn update_board_settings(
             .into_response(),
     )
 }
+
+#[cfg(test)]
+mod tests {
+    use super::parse_retention_setting;
+    use anyhow::{ensure, Result};
+
+    #[test]
+    fn retention_settings_reject_invalid_values_and_preserve_omitted_limits() -> Result<()> {
+        for archived in [false, true] {
+            let upper = if archived { 10_000_i64 } else { 1_000_i64 };
+            ensure!(parse_retention_setting(None, archived)?.is_none());
+            ensure!(parse_retention_setting(Some(" 1 "), archived)? == Some(1));
+            ensure!(parse_retention_setting(Some(&upper.to_string()), archived)? == Some(upper));
+            for value in ["", "0", "-1", "garbage", "1.5", "9223372036854775808"] {
+                ensure!(parse_retention_setting(Some(value), archived).is_err());
+            }
+            ensure!(parse_retention_setting(Some(&(upper + 1_i64).to_string()), archived).is_err());
+        }
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn invalid_retention_http_settings_cannot_reduce_saved_caps() -> Result<()> {
+        use super::{
+            db, update_board_settings, BoardSettingsForm, CookieJar, Form, HeaderMap, State,
+        };
+        use axum::http::{header, HeaderValue};
+        use axum_extra::extract::cookie::Cookie;
+        let state = crate::test_support::app_state();
+        let board_id = {
+            let conn = state.db.get()?;
+            let admin = db::create_admin(
+                &conn,
+                "archive-admin",
+                &crate::utils::crypto::hash_password("password")?,
+            )?;
+            db::create_session(
+                &conn,
+                "session123",
+                admin,
+                chrono::Utc::now().timestamp() + 3600,
+            )?;
+            let id = db::create_board(&conn, "settings", "Settings", "", false)?;
+            conn.execute(
+                "UPDATE boards SET max_threads=200,max_archived_threads=2000 WHERE id=?1",
+                [id],
+            )
+            .map(|_rows| ())?;
+            id
+        };
+        for value in [Some("0"), Some("-1"), Some("garbage"), None] {
+            let input = serde_json::json!({
+                "board_id": board_id, "name": "Settings", "description": "",
+                "max_archived_threads": value,
+                "_csrf": crate::test_support::admin_signed_csrf()
+            });
+            let form: BoardSettingsForm = serde_json::from_value(input)?;
+            let jar = CookieJar::new()
+                .add(Cookie::new(super::SESSION_COOKIE, "session123"))
+                .add(Cookie::new("csrf_token", "csrf123"));
+            let mut headers = HeaderMap::new();
+            let _host = headers.insert(header::HOST, HeaderValue::from_static("localhost"));
+            let _origin =
+                headers.insert(header::ORIGIN, HeaderValue::from_static("http://localhost"));
+            let outcome = update_board_settings(
+                State(state.clone()),
+                jar,
+                headers,
+                crate::test_support::connect_info(),
+                Form(form),
+            )
+            .await;
+            if value.is_some() {
+                ensure!(matches!(outcome, Err(super::AppError::BadRequest(_))));
+            } else {
+                let response = outcome?;
+                ensure!(response.status() == axum::http::StatusCode::SEE_OTHER);
+            }
+            let conn = state.db.get()?;
+            let board = db::get_board_by_short(&conn, "settings")?
+                .ok_or_else(|| anyhow::anyhow!("saved board"))?;
+            ensure!(board.max_threads == 200 && board.max_archived_threads == 2000);
+        }
+        Ok(())
+    }
+}
diff --git a/src/handlers/admin/updates.rs b/src/handlers/admin/updates.rs
index d755428c..cc3e8fb1 100644
--- a/src/handlers/admin/updates.rs
+++ b/src/handlers/admin/updates.rs
@@ -163,21 +163,29 @@ pub(in crate::server) async fn install(
     let password = form.current_password;
     let confirmation = form.confirmation;
     let approval_valid = uuid::Uuid::parse_str(&approval).is_ok();
+    let password_permit = state.password_work_gate.try_begin()?;
     let administrator = tokio::task::spawn_blocking(move || -> Result<i64> {
+        let _password_permit = password_permit;
         let conn = state.db.get()?;
         let actor = require_admin_session_sid(&conn, session.as_deref())?;
         let name = db::get_admin_name_by_id(&conn, actor)?
             .ok_or_else(|| AppError::Forbidden("Administrator missing.".to_owned()))?;
         let user = db::get_admin_by_username(&conn, &name)?
             .ok_or_else(|| AppError::Forbidden("Administrator missing.".to_owned()))?;
+        drop(conn);
+        if super::auth::record_login_fail(&key)
+            > crate::config::CONFIG.operator.admin_login_fail_limit
+        {
+            return Err(AppError::DbBusy);
+        }
         if password.len() > 1024
             || !crate::utils::crypto::verify_password(&password, &user.password_hash)?
         {
-            let _failure_count = super::auth::record_login_fail(&key);
             return Err(AppError::Forbidden(
                 "Current password did not verify. No update started.".to_owned(),
             ));
         }
+        super::auth::clear_login_fails(&key);
         if !updates::managed() || confirmation != "INSTALL" || !approval_valid {
             return Err(AppError::BadRequest(
                 "Native installation is unavailable or confirmation is invalid.".to_owned(),
diff --git a/src/handlers/board.rs b/src/handlers/board.rs
index f04badb4..e219d808 100644
--- a/src/handlers/board.rs
+++ b/src/handlers/board.rs
@@ -27,14 +27,15 @@ use axum::{
     response::{Html, IntoResponse as _, Redirect, Response},
 };
 use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite};
-use dashmap::DashMap;
 use serde::{Deserialize, Serialize};
 use std::collections::{HashMap, HashSet};
-use std::sync::{atomic::AtomicU64, LazyLock};
+use std::sync::LazyLock;
 use std::time::{SystemTime, UNIX_EPOCH};
 use time::Duration;
 
 mod access_preferences;
+#[cfg(test)]
+mod action_tests;
 mod catalog;
 mod create_thread;
 mod media;
@@ -100,8 +101,9 @@ const HTML_CACHE_CONTROL: &str = crate::cache::CACHE_CONTROL_DYNAMIC_PUBLIC;
 /// X rustchan redirect header used by this handler.
 const X_RUSTCHAN_REDIRECT_HEADER: &str = "x-rustchan-redirect";
 
-static BOARD_UNLOCK_FAILS: LazyLock<DashMap<String, (u32, u64)>> = LazyLock::new(DashMap::new);
-static BOARD_UNLOCK_CLEANUP_SECS: AtomicU64 = AtomicU64::new(0);
+/// Bounded board-password failure state, independent of public visitor cookies.
+static BOARD_UNLOCK_FAILS: LazyLock<crate::middleware::RateTable> =
+    LazyLock::new(crate::middleware::RateTable::default);
 
 pub(super) struct BoardAccessContext {
     pub board: Board,
@@ -145,6 +147,15 @@ pub(super) const fn activity_html_cache_control(activity_markers_enabled: bool)
     }
 }
 
+/// Personal thread state must never be stored in a shared cache by IP identity.
+pub(super) const fn personal_html_cache_control(activity_markers_enabled: bool) -> &'static str {
+    if activity_markers_enabled {
+        crate::cache::CACHE_CONTROL_PRIVATE_NO_STORE
+    } else {
+        crate::cache::CACHE_CONTROL_PRIVATE_NO_CACHE
+    }
+}
+
 fn thread_unread_counts(
     threads: &[crate::models::Thread],
     markers: &HashMap<i64, ThreadActivityMarker>,
@@ -341,6 +352,49 @@ pub(super) fn check_csrf_jar(jar: &CookieJar, form_token: Option<&str>) -> Resul
     }
 }
 
+/// Bind menu actions to the visitor cookie and reject cross-site signed-token replay.
+/// Cookie-disabled browsers may use a signed token only with same-origin evidence.
+pub(super) fn check_menu_action_csrf(
+    jar: &CookieJar,
+    headers: &HeaderMap,
+    peer: SecureCookieContext,
+    form_token: Option<&str>,
+) -> Result<()> {
+    check_csrf_jar(jar, form_token)?;
+    let token = form_token.unwrap_or("");
+    let cookie = jar.get("csrf_token").map(Cookie::value);
+    let raw = token
+        .rsplit_once('.')
+        .map_or(token, |(raw, _signature)| raw);
+    let cookie_bound = cookie.is_some_and(|cookie| cookie == token || cookie == raw);
+    if cookie.is_some() && !cookie_bound {
+        return Err(AppError::Forbidden("CSRF token mismatch.".into()));
+    }
+    let fetch_site = headers
+        .get("sec-fetch-site")
+        .and_then(|value| value.to_str().ok());
+    if fetch_site.is_some_and(|value| value.eq_ignore_ascii_case("cross-site")) {
+        return Err(AppError::Forbidden("Cross-site action denied.".into()));
+    }
+    let null_origin_without_referer = headers
+        .get(header::ORIGIN)
+        .and_then(|value| value.to_str().ok())
+        .map(str::trim)
+        == Some("null")
+        && !headers.contains_key(header::REFERER);
+    if null_origin_without_referer {
+        // The site's no-referrer policy makes native form POSTs send Origin:
+        // null in supported browsers. Fetch metadata or a bound Strict cookie
+        // distinguishes these from a cross-site signed-token replay.
+        if cookie_bound || fetch_site.is_some_and(|value| value.eq_ignore_ascii_case("same-origin"))
+        {
+            return Ok(());
+        }
+        return Err(AppError::Forbidden("Cross-site action denied.".into()));
+    }
+    crate::handlers::admin::require_same_origin_or_valid_csrf(headers, peer.peer, cookie_bound)
+}
+
 pub(super) fn admin_scoped_csrf_token(
     jar: &CookieJar,
     admin_session_id: Option<&str>,
@@ -596,60 +650,27 @@ fn board_unlock_attempt_key(board_short: &str, client_ip: &str) -> String {
     sha256_hex(format!("{board_short}:{client_ip}").as_bytes())
 }
 
-fn prune_board_unlock_failures(now_secs: u64) {
-    let last_cleanup = BOARD_UNLOCK_CLEANUP_SECS.load(std::sync::atomic::Ordering::Relaxed);
-    if now_secs.saturating_sub(last_cleanup) < 60 {
-        return;
-    }
-    if BOARD_UNLOCK_CLEANUP_SECS
-        .compare_exchange(
-            last_cleanup,
-            now_secs,
-            std::sync::atomic::Ordering::Relaxed,
-            std::sync::atomic::Ordering::Relaxed,
-        )
-        .is_err()
-    {
-        return;
-    }
-    BOARD_UNLOCK_FAILS.retain(|_, (_, window_start)| {
-        now_secs.saturating_sub(*window_start) <= board_password_fail_window_secs()
-    });
+/// Return the remaining lockout or saturation interval.
+fn board_unlock_retry_after_secs(attempt_key: &str) -> Option<u64> {
+    BOARD_UNLOCK_FAILS.retry_after(
+        attempt_key,
+        board_unlock_now_secs(),
+        board_password_fail_limit(),
+    )
 }
 
-fn board_unlock_retry_after_secs(attempt_key: &str) -> Option<u64> {
-    let now_secs = board_unlock_now_secs();
-    prune_board_unlock_failures(now_secs);
-    let (count, window_start) = *BOARD_UNLOCK_FAILS.get(attempt_key)?;
-    let elapsed = now_secs.saturating_sub(window_start);
-    if elapsed > board_password_fail_window_secs() {
-        let _previous_value = BOARD_UNLOCK_FAILS.remove(attempt_key);
-        return None;
-    }
-    if count < board_password_fail_limit() {
-        return None;
-    }
-    Some((board_password_fail_window_secs().saturating_sub(elapsed)).max(1))
-}
-
-fn record_board_unlock_failure(attempt_key: &str) {
-    let now_secs = board_unlock_now_secs();
-    prune_board_unlock_failures(now_secs);
-    let mut entry = BOARD_UNLOCK_FAILS
-        .entry(attempt_key.to_owned())
-        .or_insert((0, now_secs));
-    let (count, window_start) = entry.value_mut();
-    if now_secs.saturating_sub(*window_start) > board_password_fail_window_secs() {
-        *count = 1;
-        *window_start = now_secs;
-    } else {
-        *count = count.saturating_add(1);
-    }
-    drop(entry);
+/// Record one failed password attempt without unbounded retained identity growth.
+fn record_board_unlock_failure(attempt_key: &str) -> u32 {
+    BOARD_UNLOCK_FAILS.record(
+        attempt_key,
+        board_unlock_now_secs(),
+        board_password_fail_window_secs(),
+    )
 }
 
+/// Remove an authenticated client's failure counter.
 fn clear_board_unlock_failures(attempt_key: &str) {
-    let _previous_value = BOARD_UNLOCK_FAILS.remove(attempt_key);
+    BOARD_UNLOCK_FAILS.remove(attempt_key);
 }
 
 fn board_unlock_rate_limit_message(retry_after_secs: u64) -> String {
@@ -727,6 +748,11 @@ fn safe_return_to(path: Option<&str>, fallback: &str) -> String {
     crate::utils::redirect::strict_safe_internal_path_or(path, fallback).to_owned()
 }
 
+/// Accept only a complete board identifier, never a lossily sanitized target.
+pub(super) fn valid_action_board(value: &str) -> bool {
+    !value.is_empty() && value.len() <= 8 && value.bytes().all(|byte| byte.is_ascii_alphanumeric())
+}
+
 pub(super) fn identity_key(client_ip: &str, jar: &CookieJar) -> String {
     if client_ip.starts_with("tor:") {
         return client_ip.to_owned();
@@ -747,45 +773,4 @@ fn viewer_preference_key(client_ip: &str, jar: &CookieJar) -> String {
     hash_ip(&identity_key(client_ip, jar), &CONFIG.cookie_secret)
 }
 
-fn split_catalog_threads(
-    threads: Vec<crate::models::Thread>,
-    prefs: &HashMap<i64, db::UserThreadPreference>,
-) -> (
-    Vec<crate::models::Thread>,
-    Vec<crate::models::Thread>,
-    HashSet<i64>,
-) {
-    let mut visible = Vec::new();
-    let mut hidden = Vec::new();
-    let mut pinned_ids = HashSet::new();
-
-    for thread in threads {
-        if let Some(pref) = prefs.get(&thread.id) {
-            if pref.pinned {
-                let _completed_value = pinned_ids.insert(thread.id);
-            }
-            if pref.hidden {
-                hidden.push(thread);
-                continue;
-            }
-        }
-        visible.push(thread);
-    }
-
-    let sort_threads = |items: &mut Vec<crate::models::Thread>| {
-        items.sort_by(|a, b| {
-            let a_pinned = pinned_ids.contains(&a.id);
-            let b_pinned = pinned_ids.contains(&b.id);
-            b_pinned
-                .cmp(&a_pinned)
-                .then_with(|| b.sticky.cmp(&a.sticky))
-                .then_with(|| b.bumped_at.cmp(&a.bumped_at))
-        });
-    };
-
-    sort_threads(&mut visible);
-    sort_threads(&mut hidden);
-    (visible, hidden, pinned_ids)
-}
-
 // GET / — board list
diff --git a/src/handlers/board/access_preferences.rs b/src/handlers/board/access_preferences.rs
index 53f20a05..f58ce476 100644
--- a/src/handlers/board/access_preferences.rs
+++ b/src/handlers/board/access_preferences.rs
@@ -994,11 +994,17 @@ pub(in crate::server) async fn unlock_board_access(
         return Ok(board_access_required_response(jar, html));
     }
 
+    let permit = state.password_work_gate.try_begin()?;
+    if record_board_unlock_failure(&attempt_key) > super::board_password_fail_limit() {
+        return Err(AppError::DbBusy);
+    }
     let password_hash = access_context.board.access_password_hash.clone();
-    let password_valid_result =
-        tokio::task::spawn_blocking(move || verify_password(&password, &password_hash))
-            .await
-            .map_err(|e| AppError::Internal(anyhow::anyhow!(e)))?;
+    let password_valid_result = tokio::task::spawn_blocking(move || {
+        let _password_permit = permit;
+        verify_password(&password, &password_hash)
+    })
+    .await
+    .map_err(|e| AppError::Internal(anyhow::anyhow!(e)))?;
     let password_valid = match password_valid_result {
         Ok(valid) => valid,
         Err(error) => {
@@ -1020,7 +1026,6 @@ pub(in crate::server) async fn unlock_board_access(
     };
 
     if !password_valid {
-        record_board_unlock_failure(&attempt_key);
         if let Some(retry_after_secs) = board_unlock_retry_after_secs(&attempt_key) {
             let html = render_board_unlock_html(
                 &access_context.board,
@@ -1084,27 +1089,52 @@ pub(in crate::server) struct ThreadPreferenceForm {
     pub csrf: Option<String>,
 }
 
+/// Validated personal thread action; none of these changes global moderation state.
+#[derive(Clone, Copy)]
+enum ThreadPreferenceAction {
+    /// Set the personal pin.
+    Pin,
+    /// Clear the personal pin.
+    Unpin,
+    /// Hide from active board listings.
+    Hide,
+    /// Restore to active board listings.
+    Unhide,
+}
+
+impl ThreadPreferenceAction {
+    /// Reject unknown actions before entering a write transaction.
+    fn parse(value: &str) -> Result<Self> {
+        match value {
+            "pin" => Ok(Self::Pin),
+            "unpin" => Ok(Self::Unpin),
+            "hide" => Ok(Self::Hide),
+            "unhide" => Ok(Self::Unhide),
+            _ => Err(AppError::BadRequest("Unknown thread action.".into())),
+        }
+    }
+}
+
 pub(in crate::server) async fn update_thread_preference(
     State(state): State<AppState>,
     Path(board_short): Path<String>,
     crate::middleware::ClientIp(client_ip): crate::middleware::ClientIp,
     jar: CookieJar,
+    req_headers: HeaderMap,
+    peer: SecureCookieContext,
     Form(form): Form<ThreadPreferenceForm>,
 ) -> Result<Response> {
-    check_csrf_jar(&jar, form.csrf.as_deref())?;
+    super::check_menu_action_csrf(&jar, &req_headers, peer, form.csrf.as_deref())?;
 
-    let board_from_form = form
-        .board
-        .chars()
-        .filter(char::is_ascii_alphanumeric)
-        .take(8)
-        .collect::<String>();
-    if board_from_form != board_short {
+    if form.board != board_short || !super::valid_action_board(&board_short) {
         return Err(AppError::BadRequest("Board mismatch.".into()));
     }
+    if form.thread_id <= 0 {
+        return Err(AppError::BadRequest("Invalid thread ID.".into()));
+    }
 
     let viewer_key = viewer_preference_key(&client_ip, &jar);
-    let action = form.action.trim().to_ascii_lowercase();
+    let action = ThreadPreferenceAction::parse(&form.action)?;
     let thread_id = form.thread_id;
     let admin_session_id = jar
         .get(ADMIN_SESSION_COOKIE)
@@ -1116,8 +1146,14 @@ pub(in crate::server) async fn update_thread_preference(
         let board_short = board_short.clone();
         move || -> Result<()> {
             let conn = pool.get()?;
-            let access_context = load_board_access_context(
+            // Keep access/target validation, both flags, and default-row cleanup
+            // atomic with archiving, deletion, and another preference action.
+            let tx = rusqlite::Transaction::new_unchecked(
                 &conn,
+                rusqlite::TransactionBehavior::Immediate,
+            )?;
+            let access_context = load_board_access_context(
+                &tx,
                 &board_short,
                 admin_session_id.as_deref(),
                 access_cookie.as_deref(),
@@ -1128,19 +1164,35 @@ pub(in crate::server) async fn update_thread_preference(
                 ));
             }
             let board = access_context.board;
-            let thread = db::get_thread(&conn, thread_id)?
+            let thread = db::get_thread(&tx, thread_id)?
                 .ok_or_else(|| AppError::NotFound("Thread not found.".into()))?;
-            if thread.board_id != board.id || thread.archived {
+            if thread.board_id != board.id {
                 return Err(AppError::NotFound("Thread not found.".into()));
             }
+            if thread.archived
+                && matches!(
+                    action,
+                    ThreadPreferenceAction::Pin | ThreadPreferenceAction::Hide
+                )
+            {
+                return Err(AppError::Conflict("This thread is archived.".into()));
+            }
 
-            match action.as_str() {
-                "pin" => db::set_thread_pinned(&conn, &viewer_key, thread.id, true)?,
-                "unpin" => db::set_thread_pinned(&conn, &viewer_key, thread.id, false)?,
-                "hide" => db::set_thread_hidden(&conn, &viewer_key, thread.id, true)?,
-                "unhide" => db::set_thread_hidden(&conn, &viewer_key, thread.id, false)?,
-                _ => return Err(AppError::BadRequest("Unknown thread action.".into())),
+            match action {
+                ThreadPreferenceAction::Pin => {
+                    db::set_thread_pinned(&tx, &viewer_key, thread.id, true)?;
+                }
+                ThreadPreferenceAction::Unpin => {
+                    db::set_thread_pinned(&tx, &viewer_key, thread.id, false)?;
+                }
+                ThreadPreferenceAction::Hide => {
+                    db::set_thread_hidden(&tx, &viewer_key, thread.id, true)?;
+                }
+                ThreadPreferenceAction::Unhide => {
+                    db::set_thread_hidden(&tx, &viewer_key, thread.id, false)?;
+                }
             }
+            tx.commit()?;
             Ok(())
         }
     })
diff --git a/src/handlers/board/action_tests.rs b/src/handlers/board/action_tests.rs
new file mode 100644
index 00000000..8f5661cf
--- /dev/null
+++ b/src/handlers/board/action_tests.rs
@@ -0,0 +1,657 @@
+//! End-to-end regression coverage for personal thread actions and reporting.
+
+use anyhow::{ensure, Context as _, Result};
+use axum::{
+    body::{to_bytes, Body},
+    http::{header, Request, StatusCode},
+    response::Response,
+    routing::{get, post},
+    Router,
+};
+use tower::ServiceExt as _;
+
+/// Seed a renderable thread with intentionally different thread/post identifiers.
+fn seed_thread(conn: &rusqlite::Connection, board_id: i64) -> Result<(i64, i64)> {
+    let thread_id = conn.query_row(
+        "INSERT INTO threads (board_id, bumped_at) VALUES (?1, 100) RETURNING id",
+        [board_id],
+        |row| row.get(0),
+    )?;
+    let post_id = conn.query_row(
+        "INSERT INTO posts (id, thread_id, board_id, body, body_html, deletion_token, is_op)
+         VALUES (?1 + 100, ?1, ?2, 'action target', 'action target', 'token', 1) RETURNING id",
+        rusqlite::params![thread_id, board_id],
+        |row| row.get(0),
+    )?;
+    Ok((thread_id, post_id))
+}
+
+/// Exercise actual Axum extraction and handler responses with a stable viewer.
+async fn request(router: &Router, method: &str, path: &str, body: String) -> Result<Response> {
+    Ok(router
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method(method)
+                .uri(path)
+                .header(header::HOST, "localhost")
+                .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+                .header(
+                    header::COOKIE,
+                    "csrf_token=csrf123; rustchan_visitor_id=actions-viewer",
+                )
+                .extension(crate::test_support::connect_info())
+                .body(Body::from(body))?,
+        )
+        .await?)
+}
+
+/// Read a bounded rendered response for state and identifier assertions.
+async fn html(response: Response) -> Result<String> {
+    Ok(String::from_utf8(
+        to_bytes(response.into_body(), 1_000_000).await?.to_vec(),
+    )?)
+}
+
+/// Router covering the same preference, report, and rendering paths as production.
+fn action_router(state: crate::middleware::AppState) -> Router {
+    Router::new()
+        .route(
+            "/{board}/thread-preference",
+            post(super::update_thread_preference),
+        )
+        .route("/{board}/catalog", get(super::catalog))
+        .route("/{board}/hidden", get(super::hidden_threads))
+        .route("/{board}", get(super::board_index))
+        .route(
+            "/{board}/thread/{id}",
+            get(crate::handlers::thread::view_thread),
+        )
+        .route(
+            "/report",
+            post(super::file_report).layer(axum::extract::DefaultBodyLimit::max(65_536)),
+        )
+        .with_state(state)
+}
+
+/// Identity corresponding to the request fixture's loopback visitor cookie.
+fn viewer_key() -> String {
+    crate::utils::crypto::hash_ip(
+        "visitor:actions-viewer",
+        &crate::config::CONFIG.cookie_secret,
+    )
+}
+
+#[tokio::test]
+async fn personal_actions_are_explicit_idempotent_isolated_and_reversible() -> Result<()> {
+    let state = crate::test_support::app_state();
+    let conn = state.db.get()?;
+    let board = crate::db::create_board(&conn, "actions", "Actions", "", false)?;
+    let (thread, _post) = seed_thread(&conn, board)?;
+    let router = action_router(state.clone());
+    for action in ["pin", "pin", "hide", "hide", "unhide", "unpin", "unpin"] {
+        let response = request(&router, "POST", "/actions/thread-preference", format!(
+            "thread_id={thread}&board=actions&action={action}&_csrf=csrf123&return_to=%2F%2Fevil.example"
+        )).await?;
+        ensure!(response.status() == StatusCode::SEE_OTHER);
+        ensure!(
+            response
+                .headers()
+                .get(header::LOCATION)
+                .context("redirect")?
+                == "/actions/catalog"
+        );
+        let preference =
+            crate::db::get_thread_preference(&conn, &viewer_key(), thread)?.unwrap_or_default();
+        match action {
+            "pin" | "unhide" => ensure!(preference.pinned && !preference.hidden),
+            "hide" => ensure!(preference.pinned && preference.hidden),
+            "unpin" => ensure!(!preference.pinned && !preference.hidden),
+            _ => anyhow::bail!("unknown test action"),
+        }
+        ensure!(crate::db::get_thread_preference(&conn, "another-viewer", thread)?.is_none());
+        ensure!(
+            !crate::db::get_thread(&conn, thread)?
+                .context("thread")?
+                .sticky,
+            "personal pin must never mutate global moderation state"
+        );
+    }
+    let rows: i64 = conn.query_row("SELECT COUNT(*) FROM user_thread_preferences", [], |row| {
+        row.get(0)
+    })?;
+    ensure!(rows == 0, "default preferences must be removed");
+    Ok(())
+}
+
+#[tokio::test]
+async fn forged_personal_actions_cannot_mutate_another_board_or_bypass_view_access() -> Result<()> {
+    let state = crate::test_support::app_state();
+    let conn = state.db.get()?;
+    let board = crate::db::create_board(&conn, "actions", "Actions", "", false)?;
+    let other = crate::db::create_board(&conn, "other", "Other", "", false)?;
+    let (thread, _post) = seed_thread(&conn, other)?;
+    let router = action_router(state);
+    for (body, status) in [
+        (
+            format!("thread_id={thread}&board=actions&action=pin&_csrf=bad"),
+            StatusCode::FORBIDDEN,
+        ),
+        (
+            format!("thread_id={thread}&board=act%2Fions&action=pin&_csrf=csrf123"),
+            StatusCode::BAD_REQUEST,
+        ),
+        (
+            format!("thread_id={thread}&board=actions&action=pin&_csrf=csrf123"),
+            StatusCode::NOT_FOUND,
+        ),
+        (
+            "thread_id=-1&board=actions&action=pin&_csrf=csrf123".to_owned(),
+            StatusCode::BAD_REQUEST,
+        ),
+        (
+            "thread_id=1&board=actions&action=sticky&_csrf=csrf123".to_owned(),
+            StatusCode::BAD_REQUEST,
+        ),
+    ] {
+        ensure!(
+            request(&router, "POST", "/actions/thread-preference", body)
+                .await?
+                .status()
+                == status
+        );
+    }
+    let (private_thread, _private_post) = seed_thread(&conn, board)?;
+    conn.execute(
+        "UPDATE boards SET access_mode='view_password', access_password_hash='locked' WHERE id=?1",
+        [board],
+    )
+    .map(|_rows| ())?;
+    ensure!(
+        request(
+            &router,
+            "POST",
+            "/actions/thread-preference",
+            format!("thread_id={private_thread}&board=actions&action=pin&_csrf=csrf123")
+        )
+        .await?
+        .status()
+            == StatusCode::FORBIDDEN
+    );
+    ensure!(
+        request(&router, "GET", "/actions/thread-preference", String::new())
+            .await?
+            .status()
+            == StatusCode::METHOD_NOT_ALLOWED
+    );
+    let rows: i64 = conn.query_row("SELECT COUNT(*) FROM user_thread_preferences", [], |row| {
+        row.get(0)
+    })?;
+    ensure!(rows == 0);
+    Ok(())
+}
+
+#[test]
+fn personal_listing_filters_before_pagination_and_orders_all_pins_deterministically() -> Result<()>
+{
+    let pool = crate::db::init_test_pool()?;
+    let conn = pool.get()?;
+    let board = crate::db::create_board(&conn, "actions", "Actions", "", false)?;
+    let mut ids = Vec::new();
+    for _number in 0_i32..205_i32 {
+        ids.push(seed_thread(&conn, board)?.0);
+    }
+    let first = *ids.first().context("first")?;
+    let second = *ids.get(1).context("second")?;
+    let sticky = *ids.get(2).context("sticky")?;
+    let last = *ids.last().context("last")?;
+    crate::db::set_thread_pinned(&conn, "viewer", first, true)?;
+    crate::db::set_thread_pinned(&conn, "viewer", second, true)?;
+    crate::db::set_thread_sticky(&conn, sticky, true)?;
+    crate::db::set_thread_hidden(&conn, "viewer", last, true)?;
+    let page = crate::db::get_threads_for_viewer(&conn, board, "viewer", false, 3, 0)?;
+    ensure!(page.iter().map(|thread| thread.id).collect::<Vec<_>>() == [second, first, sticky]);
+    let next = crate::db::get_threads_for_viewer(&conn, board, "viewer", false, 3, 3)?;
+    ensure!(!next
+        .iter()
+        .any(|thread| [first, second, sticky, last].contains(&thread.id)));
+    ensure!(crate::db::count_threads_for_viewer(&conn, board, "viewer", false)? == 204);
+    ensure!(crate::db::get_threads_for_viewer(&conn, board, "viewer", false, -1, 0)?.len() == 204);
+    crate::db::set_thread_pinned(&conn, "viewer", first, false)?;
+    crate::db::set_thread_pinned(&conn, "viewer", second, false)?;
+    let unpinned_page = crate::db::get_threads_for_viewer(&conn, board, "viewer", false, 1, 0)?;
+    ensure!(unpinned_page.first().context("first page")?.id == sticky);
+    let other = crate::db::get_threads_for_viewer(&conn, board, "other", false, -1, 0)?;
+    ensure!(other.len() == 205 && other.first().context("other first")?.id == sticky);
+    Ok(())
+}
+
+#[tokio::test]
+async fn hide_reload_and_unhide_are_consistent_across_index_catalog_and_direct_thread() -> Result<()>
+{
+    let state = crate::test_support::app_state();
+    let conn = state.db.get()?;
+    let board = crate::db::create_board(&conn, "actions", "Actions", "", false)?;
+    let (thread, _post) = seed_thread(&conn, board)?;
+    let (second_thread, _second_post) = seed_thread(&conn, board)?;
+    crate::templates::set_live_boards(crate::db::get_all_boards(&conn)?);
+    let router = action_router(state);
+    let before = request(&router, "GET", "/actions/catalog", String::new()).await?;
+    let before_etag = before
+        .headers()
+        .get(header::ETAG)
+        .context("catalog ETag")?
+        .clone();
+    ensure!(
+        request(
+            &router,
+            "POST",
+            "/actions/thread-preference",
+            format!("thread_id={thread}&board=actions&action=hide&_csrf=csrf123")
+        )
+        .await?
+        .status()
+            == StatusCode::SEE_OTHER
+    );
+    ensure!(
+        request(
+            &router,
+            "POST",
+            "/actions/thread-preference",
+            format!("thread_id={second_thread}&board=actions&action=hide&_csrf=csrf123")
+        )
+        .await?
+        .status()
+            == StatusCode::SEE_OTHER
+    );
+    crate::db::set_thread_pinned(&conn, &viewer_key(), thread, true)?;
+    crate::db::set_thread_sticky(&conn, thread, true)?;
+    crate::db::set_thread_locked(&conn, thread, true)?;
+    conn.execute(
+        "INSERT INTO posts (thread_id, board_id, body, body_html, deletion_token, is_op)
+         VALUES (?1, ?2, 'hidden new reply', 'hidden new reply', 'reply', 0)",
+        rusqlite::params![thread, board],
+    )
+    .map(|_rows| ())?;
+    for path in ["/actions", "/actions/catalog"] {
+        let response = request(&router, "GET", path, String::new()).await?;
+        ensure!(response
+            .headers()
+            .get(header::CACHE_CONTROL)
+            .context("cache policy")?
+            .to_str()?
+            .contains("private"));
+        ensure!(response.headers().get(header::ETAG).context("ETag")? != before_etag);
+        let page = html(response).await?;
+        ensure!(
+            !page.contains("action target") && !page.contains("hidden new reply"),
+            "hidden OP and previews must leave listings together"
+        );
+        ensure!(page.contains("Hidden (2)") || page.contains("Hidden Threads: 2"));
+    }
+    let hidden = html(request(&router, "GET", "/actions/hidden", String::new()).await?).await?;
+    ensure!(hidden.contains("action target") && hidden.contains("Unhide thread"));
+    let direct = html(
+        request(
+            &router,
+            "GET",
+            &format!("/actions/thread/{thread}"),
+            String::new(),
+        )
+        .await?,
+    )
+    .await?;
+    ensure!(
+        direct.contains("action target")
+            && direct.contains("Unhide thread")
+            && direct.contains("Unpin thread")
+            && direct.contains("hidden new reply")
+            && direct.contains("Hidden from your index")
+    );
+    ensure!(
+        request(
+            &router,
+            "POST",
+            "/actions/thread-preference",
+            format!("thread_id={thread}&board=actions&action=unhide&_csrf=csrf123")
+        )
+        .await?
+        .status()
+            == StatusCode::SEE_OTHER
+    );
+    ensure!(
+        html(request(&router, "GET", "/actions", String::new()).await?)
+            .await?
+            .contains("action target")
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn archived_targets_reject_new_preferences_but_allow_cleanup_and_deletion_cascades(
+) -> Result<()> {
+    let state = crate::test_support::app_state();
+    let conn = state.db.get()?;
+    let board = crate::db::create_board(&conn, "actions", "Actions", "", false)?;
+    let (thread, _post) = seed_thread(&conn, board)?;
+    crate::db::set_thread_hidden(&conn, &viewer_key(), thread, true)?;
+    crate::db::set_thread_pinned(&conn, &viewer_key(), thread, true)?;
+    ensure!(conn
+        .execute("UPDATE user_thread_preferences SET hidden=2", [])
+        .is_err());
+    crate::db::set_thread_archived(&conn, thread, true)?;
+    let router = action_router(state);
+    for (action, status) in [
+        ("pin", StatusCode::CONFLICT),
+        ("hide", StatusCode::CONFLICT),
+        ("unpin", StatusCode::SEE_OTHER),
+        ("unhide", StatusCode::SEE_OTHER),
+    ] {
+        ensure!(
+            request(
+                &router,
+                "POST",
+                "/actions/thread-preference",
+                format!("thread_id={thread}&board=actions&action={action}&_csrf=csrf123")
+            )
+            .await?
+            .status()
+                == status
+        );
+    }
+    crate::db::set_thread_hidden(&conn, &viewer_key(), thread, true)?;
+    conn.execute("DELETE FROM threads WHERE id=?1", [thread])
+        .map(|_rows| ())?;
+    ensure!(crate::db::get_thread_preference(&conn, &viewer_key(), thread)?.is_none());
+    ensure!(
+        request(
+            &router,
+            "POST",
+            "/actions/thread-preference",
+            format!("thread_id={thread}&board=actions&action=pin&_csrf=csrf123")
+        )
+        .await?
+        .status()
+            == StatusCode::NOT_FOUND
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn reports_validate_complete_targets_and_distinguish_duplicates() -> Result<()> {
+    let state = crate::test_support::app_state();
+    let conn = state.db.get()?;
+    let board = crate::db::create_board(&conn, "actions", "Actions", "", false)?;
+    let (thread, post_id) = seed_thread(&conn, board)?;
+    let router = action_router(state);
+    for (target, status) in [
+        (
+            format!("post_id={post_id}&thread_id={thread}&board=actions&_csrf=bad"),
+            StatusCode::FORBIDDEN,
+        ),
+        (
+            format!("post_id={post_id}&thread_id=999&board=actions&_csrf=csrf123"),
+            StatusCode::BAD_REQUEST,
+        ),
+        (
+            format!("post_id={post_id}&thread_id={thread}&board=act%2Fions&_csrf=csrf123"),
+            StatusCode::BAD_REQUEST,
+        ),
+        (
+            format!("post_id=-1&thread_id={thread}&board=actions&_csrf=csrf123"),
+            StatusCode::BAD_REQUEST,
+        ),
+        (
+            format!("post_id=999&thread_id={thread}&board=actions&_csrf=csrf123"),
+            StatusCode::NOT_FOUND,
+        ),
+        (
+            format!(
+                "post_id={post_id}&thread_id={thread}&board=actions&reason=a%00b&_csrf=csrf123"
+            ),
+            StatusCode::BAD_REQUEST,
+        ),
+    ] {
+        ensure!(request(&router, "POST", "/report", target).await?.status() == status);
+    }
+    for outcome in ["1", "duplicate"] {
+        let response = request(
+            &router,
+            "POST",
+            "/report",
+            format!("post_id={post_id}&thread_id={thread}&board=actions&reason=&_csrf=csrf123"),
+        )
+        .await?;
+        ensure!(response.status() == StatusCode::SEE_OTHER);
+        ensure!(
+            response
+                .headers()
+                .get(header::LOCATION)
+                .context("report redirect")?
+                .to_str()?
+                == format!("/actions/thread/{thread}?reported={outcome}#p{post_id}")
+        );
+    }
+    let reports: i64 = conn.query_row("SELECT COUNT(*) FROM reports", [], |row| row.get(0))?;
+    ensure!(reports == 1);
+    conn.execute("DELETE FROM threads WHERE id=?1", [thread])
+        .map(|_rows| ())?;
+    ensure!(crate::db::get_open_reports(&conn)?.is_empty());
+    Ok(())
+}
+
+#[tokio::test]
+async fn reports_bound_unicode_reasons_and_reject_oversized_requests_and_wrong_boards() -> Result<()>
+{
+    let state = crate::test_support::app_state();
+    let conn = state.db.get()?;
+    let board = crate::db::create_board(&conn, "actions", "Actions", "", false)?;
+    let _other = crate::db::create_board(&conn, "other", "Other", "", false)?;
+    let (thread, post_id) = seed_thread(&conn, board)?;
+    let router = action_router(state);
+    let fields = format!("post_id={post_id}&thread_id={thread}&board=actions&_csrf=csrf123");
+    ensure!(
+        request(
+            &router,
+            "POST",
+            "/report",
+            format!("{fields}&reason={}", "x".repeat(70_000))
+        )
+        .await?
+        .status()
+            == StatusCode::PAYLOAD_TOO_LARGE
+    );
+    ensure!(
+        request(
+            &router,
+            "POST",
+            "/report",
+            format!("post_id={post_id}&thread_id={thread}&board=other&_csrf=csrf123")
+        )
+        .await?
+        .status()
+            == StatusCode::BAD_REQUEST
+    );
+    let reason = "日本語😀".repeat(100);
+    ensure!(
+        request(
+            &router,
+            "POST",
+            "/report",
+            format!("{fields}&reason={reason}")
+        )
+        .await?
+        .status()
+            == StatusCode::SEE_OTHER
+    );
+    let stored: String = conn.query_row("SELECT reason FROM reports", [], |row| row.get(0))?;
+    ensure!(stored == reason.chars().take(256).collect::<String>());
+    ensure!(stored.chars().count() == 256);
+    Ok(())
+}
+
+#[tokio::test]
+async fn report_budget_is_persistent_and_duplicate_does_not_consume_it() -> Result<()> {
+    let state = crate::test_support::app_state();
+    let conn = state.db.get()?;
+    let board = crate::db::create_board(&conn, "actions", "Actions", "", false)?;
+    let mut targets = Vec::new();
+    for _number in 0_i32..21_i32 {
+        targets.push(seed_thread(&conn, board)?);
+    }
+    for (_thread, post_id) in targets.iter().take(20) {
+        let _submission = crate::db::file_report(&conn, *post_id, "", &viewer_key())?;
+    }
+    let router = action_router(state);
+    let (thread, post_id) = targets.last().copied().context("last target")?;
+    let response = request(
+        &router,
+        "POST",
+        "/report",
+        format!("post_id={post_id}&thread_id={thread}&board=actions&_csrf=csrf123"),
+    )
+    .await?;
+    ensure!(response.status() == StatusCode::TOO_MANY_REQUESTS);
+    ensure!(
+        response
+            .headers()
+            .get(header::RETRY_AFTER)
+            .context("retry header")?
+            == "3600"
+    );
+    let (duplicate_thread, duplicate_post) = targets.first().copied().context("first target")?;
+    ensure!(
+        request(
+            &router,
+            "POST",
+            "/report",
+            format!(
+                "post_id={duplicate_post}&thread_id={duplicate_thread}&board=actions&_csrf=csrf123"
+            )
+        )
+        .await?
+        .status()
+            == StatusCode::SEE_OTHER
+    );
+    Ok(())
+}
+
+#[test]
+fn menu_csrf_rejects_foreign_signed_tokens_and_preserves_cookie_disabled_same_origin_forms(
+) -> Result<()> {
+    use axum_extra::extract::cookie::{Cookie, CookieJar};
+    let jar = CookieJar::new().add(Cookie::new("csrf_token", "viewer"));
+    let own =
+        crate::utils::crypto::make_csrf_form_token("viewer", &crate::config::CONFIG.cookie_secret);
+    let foreign = crate::utils::crypto::make_csrf_form_token(
+        "attacker",
+        &crate::config::CONFIG.cookie_secret,
+    );
+    let mut headers = axum::http::HeaderMap::new();
+    let _old_host = headers.insert(
+        header::HOST,
+        axum::http::HeaderValue::from_static("example.test"),
+    );
+    let _old_origin = headers.insert(
+        header::ORIGIN,
+        axum::http::HeaderValue::from_static("http://example.test"),
+    );
+    let peer = crate::middleware::SecureCookieContext::default();
+    ensure!(super::check_menu_action_csrf(&jar, &headers, peer, Some(&own)).is_ok());
+    ensure!(super::check_menu_action_csrf(&jar, &headers, peer, Some(&foreign)).is_err());
+    ensure!(
+        super::check_menu_action_csrf(&CookieJar::new(), &headers, peer, Some(&foreign)).is_ok()
+    );
+    let _same_origin = headers.insert(
+        header::ORIGIN,
+        axum::http::HeaderValue::from_static("http://evil.test"),
+    );
+    ensure!(super::check_menu_action_csrf(&jar, &headers, peer, Some(&own)).is_err());
+    ensure!(
+        super::check_menu_action_csrf(&CookieJar::new(), &headers, peer, Some(&foreign)).is_err()
+    );
+    let _origin = headers.remove(header::ORIGIN);
+    ensure!(super::check_menu_action_csrf(&jar, &headers, peer, Some(&own)).is_ok());
+    ensure!(
+        super::check_menu_action_csrf(&CookieJar::new(), &headers, peer, Some(&foreign)).is_err()
+    );
+    let _privacy_origin =
+        headers.insert(header::ORIGIN, axum::http::HeaderValue::from_static("null"));
+    ensure!(super::check_menu_action_csrf(&jar, &headers, peer, Some(&own)).is_ok());
+    ensure!(
+        super::check_menu_action_csrf(&CookieJar::new(), &headers, peer, Some(&foreign)).is_err()
+    );
+    let _same_site = headers.insert(
+        "sec-fetch-site",
+        axum::http::HeaderValue::from_static("same-origin"),
+    );
+    ensure!(
+        super::check_menu_action_csrf(&CookieJar::new(), &headers, peer, Some(&foreign)).is_ok()
+    );
+    let _old_site = headers.insert(
+        "sec-fetch-site",
+        axum::http::HeaderValue::from_static("cross-site"),
+    );
+    ensure!(super::check_menu_action_csrf(&jar, &headers, peer, Some(&own)).is_err());
+    Ok(())
+}
+
+#[tokio::test]
+async fn concurrent_menu_requests_preserve_flags_deduplicate_reports_and_cascade_deleted_targets(
+) -> Result<()> {
+    let state = crate::test_support::app_state();
+    let conn = state.db.get()?;
+    let board = crate::db::create_board(&conn, "actions", "Actions", "", false)?;
+    let (thread, post_id) = seed_thread(&conn, board)?;
+    let router = action_router(state.clone());
+    let (pin, hide) = tokio::join!(
+        request(
+            &router,
+            "POST",
+            "/actions/thread-preference",
+            format!("thread_id={thread}&board=actions&action=pin&_csrf=csrf123")
+        ),
+        request(
+            &router,
+            "POST",
+            "/actions/thread-preference",
+            format!("thread_id={thread}&board=actions&action=hide&_csrf=csrf123")
+        ),
+    );
+    ensure!(pin?.status() == StatusCode::SEE_OTHER && hide?.status() == StatusCode::SEE_OTHER);
+    let preference =
+        crate::db::get_thread_preference(&conn, &viewer_key(), thread)?.context("preference")?;
+    ensure!(preference.pinned && preference.hidden);
+    let report_body = format!("post_id={post_id}&thread_id={thread}&board=actions&_csrf=csrf123");
+    let (first_report, second_report) = tokio::join!(
+        request(&router, "POST", "/report", report_body.clone()),
+        request(&router, "POST", "/report", report_body),
+    );
+    ensure!(
+        first_report?.status() == StatusCode::SEE_OTHER
+            && second_report?.status() == StatusCode::SEE_OTHER
+    );
+    let reports: i64 = conn.query_row("SELECT COUNT(*) FROM reports", [], |row| row.get(0))?;
+    ensure!(reports == 1);
+    let delete_pool = state.db.clone();
+    let (delete, unhide) = tokio::join!(
+        tokio::task::spawn_blocking(move || -> Result<()> {
+            let deletion_conn = delete_pool.get()?;
+            deletion_conn
+                .execute("DELETE FROM threads WHERE id=?1", [thread])
+                .map(|_rows| ())?;
+            Ok(())
+        }),
+        request(
+            &router,
+            "POST",
+            "/actions/thread-preference",
+            format!("thread_id={thread}&board=actions&action=unhide&_csrf=csrf123")
+        ),
+    );
+    delete??;
+    ensure!([StatusCode::SEE_OTHER, StatusCode::NOT_FOUND].contains(&unhide?.status()));
+    ensure!(crate::db::get_thread_preference(&conn, &viewer_key(), thread)?.is_none());
+    ensure!(crate::db::get_open_reports(&conn)?.is_empty());
+    Ok(())
+}
diff --git a/src/handlers/board/catalog.rs b/src/handlers/board/catalog.rs
index 5e96ea7b..c4f7cdf7 100644
--- a/src/handlers/board/catalog.rs
+++ b/src/handlers/board/catalog.rs
@@ -1,13 +1,12 @@
 use super::{
-    activity_html_cache_control, admin_scoped_csrf_token, board_access_cookie_from_jar,
-    board_access_denied_response, board_access_preflight, current_theme_from_jar, db,
-    ensure_csrf_for_request, header, latest_visible_thread_marker_tuple, remember_board_activity,
-    remember_visible_thread_activity, sha256_hex, split_catalog_threads, templates,
-    thread_activity_markers_from_jar, thread_unread_counts, user_preferences_from_jar,
-    viewer_preference_key, AppError, AppState, BoardAccessDecision, BoardAccessRequirement,
-    CatalogRenderData, CookieJar, HashMap, HeaderMap, HeaderValue, Html, Pagination, Path, Query,
-    Response, Result, SearchQuery, SecureCookieContext, State, StatusCode, ADMIN_SESSION_COOKIE,
-    SEARCH_QUERY_MAX_CHARS, THREAD_ACTIVITY_MARKER_LIMIT,
+    admin_scoped_csrf_token, board_access_cookie_from_jar, board_access_denied_response,
+    board_access_preflight, current_theme_from_jar, db, ensure_csrf_for_request, header,
+    latest_visible_thread_marker_tuple, personal_html_cache_control, remember_board_activity,
+    remember_visible_thread_activity, sha256_hex, templates, thread_activity_markers_from_jar,
+    thread_unread_counts, user_preferences_from_jar, viewer_preference_key, AppError, AppState,
+    BoardAccessDecision, BoardAccessRequirement, CatalogRenderData, CookieJar, HashMap, HeaderMap,
+    HeaderValue, Html, Pagination, Path, Query, Response, Result, SearchQuery, SecureCookieContext,
+    State, StatusCode, ADMIN_SESSION_COOKIE, SEARCH_QUERY_MAX_CHARS, THREAD_ACTIVITY_MARKER_LIMIT,
 };
 use axum::response::IntoResponse as _;
 use std::fmt::Write as _;
@@ -45,7 +44,7 @@ pub(in crate::server) async fn catalog(
         &state,
         &board_short,
         admin_session_id.clone(),
-        access_cookie,
+        access_cookie.clone(),
         BoardAccessRequirement::View,
         format!("/{board_short}/catalog"),
     )
@@ -67,27 +66,33 @@ pub(in crate::server) async fn catalog(
     let catalog_data = tokio::task::spawn_blocking({
         let pool = state.db.clone();
         let board_short = board_short.clone();
+        let admin_session_id = admin_session_id.clone();
+        let access_cookie = access_cookie.clone();
         let viewer_key = viewer_key.clone();
         move || -> Result<CatalogLoadResult> {
-            let conn = pool.get()?;
-            let board = db::get_board_by_short(&conn, &board_short)?
-                .ok_or_else(|| AppError::NotFound(format!("Board /{board_short}/ not found")))?;
-            let all_threads = db::get_threads_for_board(&conn, board.id, 200, 0)?;
+            let connection = pool.get()?;
+            let conn = connection.unchecked_transaction()?;
+            let access = super::load_board_access_context(
+                &conn,
+                &board_short,
+                admin_session_id.as_deref(),
+                access_cookie.as_deref(),
+            )?;
+            if !access.can_view {
+                return Err(AppError::Forbidden(
+                    "This board requires a password.".into(),
+                ));
+            }
+            let board = access.board;
+            let threads =
+                db::get_threads_for_viewer(&conn, board.id, &viewer_key, false, 1_000, 0)?;
             let prefs = db::get_preferences_for_board(&conn, &viewer_key, board.id)?;
-            let (threads, hidden_threads, pinned_ids) = split_catalog_threads(all_threads, &prefs);
-            let catalog_sig = threads
+            let hidden_count = db::count_threads_for_viewer(&conn, board.id, &viewer_key, true)?;
+            let pinned_ids = prefs
                 .iter()
-                .map(|thread| {
-                    format!(
-                        "{}:{}:{}:{}",
-                        thread.id,
-                        thread.bumped_at,
-                        i32::from(thread.sticky),
-                        i32::from(thread.archived)
-                    )
-                })
-                .collect::<Vec<_>>()
-                .join("|");
+                .filter_map(|(id, pref)| pref.pinned.then_some(*id))
+                .collect();
+            let catalog_sig = crate::handlers::render::threads_etag_signature(&threads);
             let mut pref_sig_parts = prefs
                 .iter()
                 .map(|(thread_id, pref)| {
@@ -115,7 +120,7 @@ pub(in crate::server) async fn catalog(
                     board.clone(),
                     threads,
                     pinned_ids,
-                    hidden_threads.len(),
+                    usize::try_from(hidden_count).unwrap_or(0),
                     etag_signature,
                 ),
                 banner_selection,
@@ -223,7 +228,7 @@ pub(in crate::server) async fn catalog(
         ));
         drop(resp.headers_mut().insert(
             header::CACHE_CONTROL,
-            HeaderValue::from_static(activity_html_cache_control(activity_markers_enabled)),
+            HeaderValue::from_static(personal_html_cache_control(activity_markers_enabled)),
         ));
         crate::cache::insert_vary_cookie(resp.headers_mut());
         return Ok((jar, resp).into_response());
@@ -259,7 +264,7 @@ pub(in crate::server) async fn catalog(
     }
     drop(resp.headers_mut().insert(
         header::CACHE_CONTROL,
-        HeaderValue::from_static(activity_html_cache_control(activity_markers_enabled)),
+        HeaderValue::from_static(personal_html_cache_control(activity_markers_enabled)),
     ));
     crate::cache::insert_vary_cookie(resp.headers_mut());
     Ok((jar, resp).into_response())
@@ -285,7 +290,7 @@ pub(in crate::server) async fn hidden_threads(
         &state,
         &board_short,
         admin_session_id.clone(),
-        access_cookie,
+        access_cookie.clone(),
         BoardAccessRequirement::View,
         format!("/{board_short}/hidden"),
     )
@@ -307,14 +312,31 @@ pub(in crate::server) async fn hidden_threads(
     let html = tokio::task::spawn_blocking({
         let pool = state.db.clone();
         let board_short = board_short.clone();
+        let admin_session_id = admin_session_id.clone();
+        let access_cookie = access_cookie.clone();
         let admin_csrf = admin_csrf.clone();
         move || -> Result<String> {
-            let conn = pool.get()?;
-            let board = db::get_board_by_short(&conn, &board_short)?
-                .ok_or_else(|| AppError::NotFound(format!("Board /{board_short}/ not found")))?;
-            let all_threads = db::get_threads_for_board(&conn, board.id, 200, 0)?;
+            let connection = pool.get()?;
+            let conn = connection.unchecked_transaction()?;
+            let access = super::load_board_access_context(
+                &conn,
+                &board_short,
+                admin_session_id.as_deref(),
+                access_cookie.as_deref(),
+            )?;
+            if !access.can_view {
+                return Err(AppError::Forbidden(
+                    "This board requires a password.".into(),
+                ));
+            }
+            let board = access.board;
             let prefs = db::get_preferences_for_board(&conn, &viewer_key, board.id)?;
-            let (_visible, hidden_threads, pinned_ids) = split_catalog_threads(all_threads, &prefs);
+            let hidden_threads =
+                db::get_threads_for_viewer(&conn, board.id, &viewer_key, true, 1_000, 0)?;
+            let pinned_ids = prefs
+                .iter()
+                .filter_map(|(id, pref)| pref.pinned.then_some(*id))
+                .collect();
 
             let all_boards = templates::live_boards();
             Ok(templates::catalog_page(
@@ -340,7 +362,13 @@ pub(in crate::server) async fn hidden_threads(
     .await
     .map_err(|e| AppError::Internal(anyhow::anyhow!(e)))??;
 
-    Ok((jar, Html(html)).into_response())
+    let mut response = (jar, Html(html)).into_response();
+    drop(response.headers_mut().insert(
+        header::CACHE_CONTROL,
+        HeaderValue::from_static(crate::cache::CACHE_CONTROL_PRIVATE_NO_STORE),
+    ));
+    crate::cache::insert_vary_cookie(response.headers_mut());
+    Ok(response)
 }
 
 // GET /:board/archive
@@ -375,7 +403,7 @@ pub(in crate::server) async fn board_archive(
         &state,
         &board_short,
         admin_session_id.clone(),
-        access_cookie,
+        access_cookie.clone(),
         BoardAccessRequirement::View,
         return_to,
     )
@@ -394,24 +422,32 @@ pub(in crate::server) async fn board_archive(
         let csrf_clone = csrf.clone();
         move || -> Result<String> {
             let conn = pool.get()?;
-            let board = db::get_board_by_short(&conn, &board_short)?
-                .ok_or_else(|| AppError::NotFound(format!("Board /{board_short}/ not found")))?;
-
-            if !board.allow_archive {
-                return Err(AppError::NotFound(format!(
-                    "/{board_short}/ does not have an archive."
-                )));
+            let tx = conn.unchecked_transaction()?;
+            // Recheck access in the same snapshot as content, so a concurrent
+            // password change cannot expose newly protected archived posts.
+            let access = super::load_board_access_context(
+                &tx,
+                &board_short,
+                admin_session_id.as_deref(),
+                access_cookie.as_deref(),
+            )?;
+            if !access.can_view {
+                return Err(AppError::Forbidden(
+                    "Board access changed. Unlock this board and retry.".into(),
+                ));
             }
+            let board = access.board;
 
-            let total = db::count_archived_threads_for_board(&conn, board.id)?;
+            let total = db::count_archived_threads_for_board(&tx, board.id)?;
             let pagination = Pagination::new(page, ARCHIVE_PER_PAGE, total);
             let threads = db::get_archived_threads_for_board(
-                &conn,
+                &tx,
                 board.id,
                 ARCHIVE_PER_PAGE,
                 pagination.offset(),
             )?;
 
+            tx.commit()?;
             let all_boards = templates::live_boards();
             Ok(templates::archive_page(
                 &board,
@@ -442,6 +478,17 @@ pub(in crate::server) async fn search(
     peer: SecureCookieContext,
 ) -> Result<Response> {
     const SEARCH_PER_PAGE: i64 = 20;
+    let search_permit = state.search_work_gate.try_begin()?;
+    if q.page > 500 {
+        return Err(AppError::BadRequest(
+            "Search is limited to 500 pages. Please refine the query.".into(),
+        ));
+    }
+    if q.q.chars().count() > SEARCH_QUERY_MAX_CHARS {
+        return Err(AppError::BadRequest(
+            "Search queries must be 256 characters or fewer.".into(),
+        ));
+    }
     let current_theme = current_theme_from_jar(&jar);
     let user_preferences = user_preferences_from_jar(&jar);
     let (jar, csrf) = ensure_csrf_for_request(jar, &req_headers, peer);
@@ -450,8 +497,8 @@ pub(in crate::server) async fn search(
         .map(|cookie| cookie.value().to_owned());
     let access_cookie = board_access_cookie_from_jar(&jar, &board_short);
 
-    // Cap query length to prevent excessively large LIKE pattern scans.
-    let query_str: String = q.q.trim().chars().take(SEARCH_QUERY_MAX_CHARS).collect();
+    // The validated scalar bound also bounds UTF-8 bytes and FTS term parsing.
+    let query_str = q.q.trim().to_owned();
     let page = q.page.max(1);
     let mut return_to = format!(
         "/{board_short}/search?q={}",
@@ -484,6 +531,7 @@ pub(in crate::server) async fn search(
         let pool = state.db.clone();
         let csrf_clone = csrf.clone();
         move || -> Result<String> {
+            let _search_permit = search_permit;
             let conn = pool.get()?;
             let board = db::get_board_by_short(&conn, &board_short)?
                 .ok_or_else(|| AppError::NotFound(format!("Board /{board_short}/ not found")))?;
diff --git a/src/handlers/board/create_thread.rs b/src/handlers/board/create_thread.rs
index 8adb8817..a04ad65a 100644
--- a/src/handlers/board/create_thread.rs
+++ b/src/handlers/board/create_thread.rs
@@ -193,6 +193,7 @@ pub(in crate::server) async fn create_thread(
             let board_short_render = board_short_err.clone();
             let pool = state.db.clone();
             let current_theme = current_theme.clone();
+            let viewer_key = super::viewer_preference_key(&client_ip, &jar);
             let html = tokio::task::spawn_blocking(move || -> Result<String> {
                 let conn = pool.get()?;
                 // Error re-render only: resolve the board for this request.
@@ -208,6 +209,7 @@ pub(in crate::server) async fn create_thread(
                     index_threads_per_page(),
                     index_reply_previews(),
                     is_admin,
+                    &viewer_key,
                 )?;
                 let banner_selection = crate::banner::resolve_board_banner(
                     &conn,
diff --git a/src/handlers/board/media.rs b/src/handlers/board/media.rs
index 6f0a499f..1e413961 100644
--- a/src/handlers/board/media.rs
+++ b/src/handlers/board/media.rs
@@ -1,7 +1,7 @@
 use super::{
     board_access_cookie_from_jar, db, load_board_access_context, templates, unlock_redirect_url,
-    user_preferences_from_jar, AppError, AppState, BoardAccessContext, CookieJar, HeaderMap, Path,
-    Redirect, Response, Result, State, StatusCode, ADMIN_SESSION_COOKIE, CONFIG,
+    user_preferences_from_jar, AppError, AppState, CookieJar, HeaderMap, Path, Redirect, Response,
+    Result, State, StatusCode, ADMIN_SESSION_COOKIE, CONFIG,
 };
 use axum::http::header::{
     HeaderValue, CONTENT_DISPOSITION, CONTENT_SECURITY_POLICY, CONTENT_TYPE,
@@ -9,6 +9,10 @@ use axum::http::header::{
 };
 use axum::response::IntoResponse as _;
 
+#[cfg(test)]
+#[path = "media/performance.rs"]
+mod performance;
+
 fn media_content_type(path: &std::path::Path) -> Option<&'static str> {
     match path.extension().and_then(|e| e.to_str()) {
         Some("ico") => Some("image/x-icon"),
@@ -109,6 +113,42 @@ fn stale_waveform_redirect_path(base: &std::path::Path, media_path: &str) -> Opt
     Some(location)
 }
 
+/// Validated delivery target, resolved on a blocking worker after authorization.
+enum BoardMediaTarget {
+    File(std::path::PathBuf),
+    Redirect(Redirect),
+    Missing,
+}
+
+/// Preserve legacy URLs without doing filesystem work on the async executor.
+fn stale_media_redirect(base: &std::path::Path, media_path: &str) -> Option<Redirect> {
+    stale_waveform_redirect_path(base, media_path)
+        .map(|path| Redirect::temporary(&path))
+        .or_else(|| {
+            stale_webm_redirect_path(base, media_path).map(|path| Redirect::permanent(&path))
+        })
+}
+
+/// Validate every component; only an absent file may resolve to a legacy sibling.
+fn resolve_board_media_target(base: &std::path::Path, media_path: &str) -> BoardMediaTarget {
+    match safe_board_media_file(base, media_path) {
+        Ok(path) => BoardMediaTarget::File(path),
+        Err(error) if is_not_found_error(&error) => stale_media_redirect(base, media_path)
+            .map_or(BoardMediaTarget::Missing, BoardMediaTarget::Redirect),
+        Err(_) => BoardMediaTarget::Missing,
+    }
+}
+
+/// A missing/generated-later file or denied request must not be negatively cached.
+fn media_error_response(status: StatusCode) -> Response {
+    let mut response = status.into_response();
+    crate::cache::set_cache_control(
+        response.headers_mut(),
+        crate::cache::CACHE_CONTROL_PRIVATE_NO_STORE,
+    );
+    response
+}
+
 // Legacy `.mp4` and `.mkv` links redirect to transcoded `.webm` files; all
 // other validated paths are served directly.
 
@@ -122,49 +162,52 @@ pub(in crate::server) async fn serve_board_media(
     jar: CookieJar,
     req: axum::extract::Request,
 ) -> Response {
-    use std::path::PathBuf;
     use tower::ServiceExt as _;
     use tower_http::services::ServeFile;
 
     // Reject path-traversal attempts and absolute-path escapes.
     if media_path.contains("..") || media_path.starts_with('/') {
-        return StatusCode::BAD_REQUEST.into_response();
+        return media_error_response(StatusCode::BAD_REQUEST);
     }
 
     let Some(board_short) = media_path.split('/').next().filter(|part| !part.is_empty()) else {
-        return StatusCode::NOT_FOUND.into_response();
+        return media_error_response(StatusCode::NOT_FOUND);
     };
 
     let admin_session_id = jar
         .get(ADMIN_SESSION_COOKIE)
         .map(|cookie| cookie.value().to_owned());
     let access_cookie = board_access_cookie_from_jar(&jar, board_short);
-    let access_context = match tokio::task::spawn_blocking({
+    let (is_protected_board, target) = match tokio::task::spawn_blocking({
         let pool = state.db.clone();
         let board_short = board_short.to_owned();
-        move || -> Result<BoardAccessContext> {
+        let media_path = media_path.clone();
+        move || -> Result<(bool, BoardMediaTarget)> {
             let conn = pool.get()?;
-            load_board_access_context(
-                &conn,
-                &board_short,
-                admin_session_id.as_deref(),
-                access_cookie.as_deref(),
-            )
+            let board = db::get_board_by_short(&conn, &board_short)?
+                .ok_or_else(|| AppError::NotFound(format!("Board /{board_short}/ not found")))?;
+            // Public/post-password boards and valid unlock cookies already grant
+            // viewing. Only a remaining password gate needs a session lookup.
+            if !super::can_view_board(&board, false, access_cookie.as_deref())
+                && !super::posting::is_admin_session(&conn, admin_session_id.as_deref())
+            {
+                return Err(AppError::Forbidden("Board access denied".to_owned()));
+            }
+            let is_protected_board = board.access_mode.requires_view_password();
+            // Release the pooled connection before the synchronous path checks.
+            drop(conn);
+            let target =
+                resolve_board_media_target(std::path::Path::new(&CONFIG.upload_dir), &media_path);
+            Ok((is_protected_board, target))
         }
     })
     .await
     {
         Ok(Ok(context)) => context,
-        Ok(Err(AppError::NotFound(_))) => return StatusCode::NOT_FOUND.into_response(),
-        Ok(Err(_)) | Err(_) => return StatusCode::FORBIDDEN.into_response(),
+        Ok(Err(AppError::NotFound(_))) => return media_error_response(StatusCode::NOT_FOUND),
+        Ok(Err(_)) | Err(_) => return media_error_response(StatusCode::FORBIDDEN),
     };
 
-    if !access_context.can_view {
-        return StatusCode::FORBIDDEN.into_response();
-    }
-
-    let base = PathBuf::from(&CONFIG.upload_dir);
-    let target = base.join(&media_path);
     let has_version = req
         .uri()
         .query()
@@ -173,118 +216,93 @@ pub(in crate::server) async fn serve_board_media(
         .components()
         .nth(1)
         .is_some_and(|part| part.as_os_str() == "_favicon");
-    let is_pdf = target
+    let updated_target = match target {
+        BoardMediaTarget::File(path) => path,
+        BoardMediaTarget::Redirect(redirect) => return redirect.into_response(),
+        BoardMediaTarget::Missing => return media_error_response(StatusCode::NOT_FOUND),
+    };
+    let is_pdf = updated_target
         .extension()
         .and_then(|ext| ext.to_str())
         .is_some_and(|ext| ext.eq_ignore_ascii_case("pdf"));
 
-    let updated_target = match safe_board_media_file(&base, &media_path) {
-        Ok(path) => Some(path),
-        Err(error)
-            if is_not_found_error(&error)
-                && (std::path::Path::new(&media_path)
-                    .extension()
-                    .is_some_and(|ext| {
-                        ext.eq_ignore_ascii_case("mp4") || ext.eq_ignore_ascii_case("mkv")
-                    })
-                    || is_generated_svg_placeholder_thumb(&media_path)) =>
-        {
-            None
+    // File present — forward the real request (with Range, ETag, etc.) to
+    // ServeFile so it can respond with 206 Partial Content when needed.
+    // iOS Safari requires Range request support to play video — dropping
+    // the request headers caused it to receive 200 instead of 206 and
+    // refuse playback on videos it tried to stream in chunks.
+    let req = req.map(|_| axum::body::Body::empty());
+    let response = ServeFile::new(&updated_target).oneshot(req).await;
+    // A worker may replace the SVG/video between validation and open.
+    if response
+        .as_ref()
+        .is_ok_and(|resp| resp.status() == StatusCode::NOT_FOUND)
+    {
+        let stale_media_path = media_path.clone();
+        let redirect = tokio::task::spawn_blocking(move || {
+            stale_media_redirect(std::path::Path::new(&CONFIG.upload_dir), &stale_media_path)
+        })
+        .await;
+        if let Ok(Some(redirect)) = redirect {
+            return redirect.into_response();
         }
-        Err(_) => return StatusCode::NOT_FOUND.into_response(),
-    };
-
-    if let Some(updated_target) = updated_target {
-        // File present — forward the real request (with Range, ETag, etc.) to
-        // ServeFile so it can respond with 206 Partial Content when needed.
-        // iOS Safari requires Range request support to play video — dropping
-        // the request headers caused it to receive 200 instead of 206 and
-        // refuse playback on videos it tried to stream in chunks.
-        let req = req.map(|_| axum::body::Body::empty());
-        ServeFile::new(&updated_target)
-            .oneshot(req)
-            .await
-            .map_or_else(
-                |_| StatusCode::INTERNAL_SERVER_ERROR.into_response(),
-                |resp| {
-                    // The waveform worker can remove the SVG between our path check
-                    // and ServeFile opening it. Resolve the completed PNG again.
-                    if let Some(path) = (resp.status() == StatusCode::NOT_FOUND)
-                        .then(|| stale_waveform_redirect_path(&base, &media_path))
-                        .flatten()
-                    {
-                        return Redirect::temporary(&path).into_response();
-                    }
-                    if let Some(path) = (resp.status() == StatusCode::NOT_FOUND)
-                        .then(|| stale_webm_redirect_path(&base, &media_path))
-                        .flatten()
-                    {
-                        return Redirect::permanent(&path).into_response();
-                    }
-                    let mut resp = resp.map(axum::body::Body::new);
-                    crate::cache::set_cache_control(
-                        resp.headers_mut(),
-                        board_media_cache_control(
-                            access_context.board.access_mode.requires_view_password(),
-                            is_board_favicon,
-                            has_version,
-                        ),
-                    );
-                    if is_generated_svg_placeholder_thumb(&media_path) {
-                        drop(
-                            resp.headers_mut()
-                                .insert(CONTENT_TYPE, HeaderValue::from_static("image/svg+xml")),
-                        );
-                        drop(
-                            resp.headers_mut().insert(
-                                X_CONTENT_TYPE_OPTIONS,
-                                HeaderValue::from_static("nosniff"),
-                            ),
-                        );
-                        drop(resp.headers_mut().insert(
-                            CONTENT_SECURITY_POLICY,
-                            HeaderValue::from_static("default-src 'none'; script-src 'none'"),
-                        ));
-                    } else if let Some(ct) = media_content_type(&updated_target) {
-                        drop(
-                            resp.headers_mut()
-                                .insert(CONTENT_TYPE, HeaderValue::from_static(ct)),
-                        );
-                    } else {
-                        drop(resp.headers_mut().insert(
-                            CONTENT_TYPE,
-                            HeaderValue::from_static("application/octet-stream"),
-                        ));
-                        drop(
-                            resp.headers_mut().insert(
-                                X_CONTENT_TYPE_OPTIONS,
-                                HeaderValue::from_static("nosniff"),
-                            ),
-                        );
-                        let filename = updated_target
-                            .file_name()
-                            .and_then(|name| name.to_str())
-                            .unwrap_or("download.bin")
-                            .replace(['\\', '"'], "_");
-                        let disposition = format!("attachment; filename=\"{filename}\"");
-                        let parsed_disposition = HeaderValue::from_str(&disposition);
-                        if let Ok(value) = parsed_disposition {
-                            drop(resp.headers_mut().insert(CONTENT_DISPOSITION, value));
-                        }
-                    }
-                    if is_pdf {
-                        apply_pdf_embed_headers(resp.headers_mut());
-                    }
-                    resp.into_response()
-                },
-            )
-    } else if let Some(redirect_path) = stale_waveform_redirect_path(&base, &media_path) {
-        Redirect::temporary(&redirect_path).into_response()
-    } else if let Some(redirect_path) = stale_webm_redirect_path(&base, &media_path) {
-        Redirect::permanent(&redirect_path).into_response()
-    } else {
-        StatusCode::NOT_FOUND.into_response()
     }
+    response.map_or_else(
+        |_| media_error_response(StatusCode::INTERNAL_SERVER_ERROR),
+        |resp| {
+            let mut resp = resp.map(axum::body::Body::new);
+            // Do not give a failed open (including a delete race) a year's TTL.
+            let cache_control =
+                if resp.status().is_success() || resp.status() == StatusCode::NOT_MODIFIED {
+                    board_media_cache_control(is_protected_board, is_board_favicon, has_version)
+                } else {
+                    crate::cache::CACHE_CONTROL_PRIVATE_NO_STORE
+                };
+            crate::cache::set_cache_control(resp.headers_mut(), cache_control);
+            if is_generated_svg_placeholder_thumb(&media_path) {
+                drop(
+                    resp.headers_mut()
+                        .insert(CONTENT_TYPE, HeaderValue::from_static("image/svg+xml")),
+                );
+                drop(
+                    resp.headers_mut()
+                        .insert(X_CONTENT_TYPE_OPTIONS, HeaderValue::from_static("nosniff")),
+                );
+                drop(resp.headers_mut().insert(
+                    CONTENT_SECURITY_POLICY,
+                    HeaderValue::from_static("default-src 'none'; script-src 'none'"),
+                ));
+            } else if let Some(ct) = media_content_type(&updated_target) {
+                drop(
+                    resp.headers_mut()
+                        .insert(CONTENT_TYPE, HeaderValue::from_static(ct)),
+                );
+            } else {
+                drop(resp.headers_mut().insert(
+                    CONTENT_TYPE,
+                    HeaderValue::from_static("application/octet-stream"),
+                ));
+                drop(
+                    resp.headers_mut()
+                        .insert(X_CONTENT_TYPE_OPTIONS, HeaderValue::from_static("nosniff")),
+                );
+                let filename = updated_target
+                    .file_name()
+                    .and_then(|name| name.to_str())
+                    .unwrap_or("download.bin")
+                    .replace(['\\', '"'], "_");
+                let disposition = format!("attachment; filename=\"{filename}\"");
+                let parsed_disposition = HeaderValue::from_str(&disposition);
+                if let Ok(value) = parsed_disposition {
+                    drop(resp.headers_mut().insert(CONTENT_DISPOSITION, value));
+                }
+            }
+            if is_pdf {
+                apply_pdf_embed_headers(resp.headers_mut());
+            }
+            resp.into_response()
+        },
+    )
 }
 
 const fn board_media_cache_control(
@@ -444,7 +462,7 @@ pub(in crate::server) async fn redirect_to_post(
     .await;
 
     if let Ok(Ok((Some(thread_id), _))) = result {
-        let url = format!("/{board_short_for_url}/thread/{thread_id}#p{post_id}");
+        let url = format!("/{board_short_for_url}/thread/{thread_id}?post={post_id}#p{post_id}");
         Redirect::to(&url).into_response()
     } else if matches!(result, Ok(Ok((None, true)))) {
         Redirect::to(&unlock_redirect_url(
@@ -469,6 +487,287 @@ mod tests {
     use super::safe_board_media_file;
     use super::stale_webm_redirect_path;
     use anyhow::{ensure, Context as _, Result as AnyResult};
+    use axum::{
+        body::{to_bytes, Body},
+        http::{header, Request},
+        routing::get,
+        Router,
+    };
+    use tower::ServiceExt as _;
+
+    /// Creates real files below the configured root and an isolated database.
+    fn media_fixture() -> AnyResult<(crate::middleware::AppState, tempfile::TempDir, String)> {
+        let state = crate::test_support::app_state();
+        let directory = tempfile::Builder::new()
+            .prefix("t")
+            .tempdir_in(&super::CONFIG.upload_dir)?;
+        let board = directory
+            .path()
+            .file_name()
+            .and_then(|name| name.to_str())
+            .context("fixture board name")?
+            .to_owned();
+        crate::db::create_board(&*state.db.get()?, &board, "Media", "", false).map(|_id| ())?;
+        std::fs::create_dir(directory.path().join("thumbs"))?;
+        std::fs::write(
+            directory.path().join("thumbs/image.webp"),
+            b"thumbnail bytes",
+        )?;
+        std::fs::write(directory.path().join("original.webp"), b"original bytes")?;
+        Ok((state, directory, board))
+    }
+
+    /// Runs an actual handler request, optionally carrying access and validators.
+    async fn request_media(
+        router: &Router,
+        uri: &str,
+        cookie: Option<&str>,
+        modified: Option<&str>,
+    ) -> AnyResult<super::Response> {
+        let mut request = Request::builder().uri(uri);
+        if let Some(cookie) = cookie {
+            request = request.header(header::COOKIE, cookie);
+        }
+        if let Some(modified) = modified {
+            request = request.header(header::IF_MODIFIED_SINCE, modified);
+        }
+        Ok(router.clone().oneshot(request.body(Body::empty())?).await?)
+    }
+
+    #[tokio::test]
+    async fn thumbnail_delivery_preserves_http_validators() -> AnyResult<()> {
+        let (state, _directory, board) = media_fixture()?;
+        let router = Router::new()
+            .route("/boards/{*media_path}", get(super::serve_board_media))
+            .with_state(state);
+        let uri = format!("/boards/{board}/thumbs/image.webp");
+        let response = request_media(&router, &uri, None, None).await?;
+        ensure!(response.status() == super::StatusCode::OK);
+        ensure!(
+            response
+                .headers()
+                .get(header::CACHE_CONTROL)
+                .context("cache policy")?
+                == crate::cache::CACHE_CONTROL_IMMUTABLE_MEDIA
+        );
+        ensure!(
+            response
+                .headers()
+                .get(header::CONTENT_TYPE)
+                .context("content type")?
+                == "image/webp"
+        );
+        let modified = response
+            .headers()
+            .get(header::LAST_MODIFIED)
+            .context("validator")?
+            .to_str()?
+            .to_owned();
+        let etag = response
+            .headers()
+            .get(header::ETAG)
+            .context("etag")?
+            .to_str()?
+            .to_owned();
+        ensure!(to_bytes(response.into_body(), 1024).await?.as_ref() == b"thumbnail bytes");
+        let conditional = request_media(&router, &uri, None, Some(&modified)).await?;
+        ensure!(conditional.status() == super::StatusCode::NOT_MODIFIED);
+        ensure!(to_bytes(conditional.into_body(), 1024).await?.is_empty());
+        let conditional_etag = router
+            .clone()
+            .oneshot(
+                Request::builder()
+                    .uri(&uri)
+                    .header(header::IF_NONE_MATCH, &etag)
+                    .body(Body::empty())?,
+            )
+            .await?;
+        ensure!(conditional_etag.status() == super::StatusCode::NOT_MODIFIED);
+        ensure!(
+            conditional_etag
+                .headers()
+                .get(header::ETAG)
+                .context("conditional etag")?
+                .to_str()?
+                == etag
+        );
+        ensure!(to_bytes(conditional_etag.into_body(), 1024)
+            .await?
+            .is_empty());
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn thumbnail_delivery_preserves_head_ranges_and_missing_file_recovery() -> AnyResult<()> {
+        let (state, directory, board) = media_fixture()?;
+        let router = Router::new()
+            .route("/boards/{*media_path}", get(super::serve_board_media))
+            .with_state(state);
+        let uri = format!("/boards/{board}/thumbs/image.webp");
+        let head = router
+            .clone()
+            .oneshot(
+                Request::builder()
+                    .method("HEAD")
+                    .uri(&uri)
+                    .body(Body::empty())?,
+            )
+            .await?;
+        ensure!(head.status() == super::StatusCode::OK);
+        ensure!(
+            head.headers()
+                .get(header::CONTENT_LENGTH)
+                .context("head size")?
+                == "15"
+        );
+        ensure!(to_bytes(head.into_body(), 1024).await?.is_empty());
+        let range = router
+            .clone()
+            .oneshot(
+                Request::builder()
+                    .uri(&uri)
+                    .header(header::RANGE, "bytes=0-4")
+                    .body(Body::empty())?,
+            )
+            .await?;
+        ensure!(range.status() == super::StatusCode::PARTIAL_CONTENT);
+        ensure!(to_bytes(range.into_body(), 1024).await?.as_ref() == b"thumb");
+        let original_uri = format!("/boards/{board}/original.webp");
+        let original = request_media(&router, &original_uri, None, None).await?;
+        ensure!(to_bytes(original.into_body(), 1024).await?.as_ref() == b"original bytes");
+        // No original file, post lookup, or runtime image generation is required.
+        std::fs::remove_file(directory.path().join("original.webp"))?;
+        ensure!(request_media(&router, &uri, None, None).await?.status() == super::StatusCode::OK);
+        let missing = format!("/boards/{board}/thumbs/missing.webp");
+        let missing_response = request_media(&router, &missing, None, None).await?;
+        ensure!(missing_response.status() == super::StatusCode::NOT_FOUND);
+        ensure!(
+            missing_response
+                .headers()
+                .get(header::CACHE_CONTROL)
+                .context("missing policy")?
+                == crate::cache::CACHE_CONTROL_PRIVATE_NO_STORE
+        );
+        std::fs::write(
+            directory.path().join("thumbs/missing.webp"),
+            b"generated later",
+        )?;
+        ensure!(
+            request_media(&router, &missing, None, None).await?.status() == super::StatusCode::OK
+        );
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn conditional_media_requests_recheck_unlock_and_session_revocation() -> AnyResult<()> {
+        let (state, _directory, board) = media_fixture()?;
+        let router = Router::new()
+            .route("/boards/{*media_path}", get(super::serve_board_media))
+            .with_state(state.clone());
+        let uri = format!("/boards/{board}/thumbs/image.webp");
+        let public = request_media(&router, &uri, None, None).await?;
+        let modified = public
+            .headers()
+            .get(header::LAST_MODIFIED)
+            .context("validator")?
+            .to_str()?
+            .to_owned();
+        {
+            let conn = state.db.get()?;
+            conn.execute("UPDATE boards SET access_mode='view_password', access_password_hash='fixture-hash' WHERE short_name=?1", [&board]).map(|_rows| ())?;
+            let admin = crate::db::create_admin(&conn, "media-admin", "fixture-hash")?;
+            crate::db::create_session(&conn, "media-session", admin, i64::MAX)?;
+        }
+        let unlock_value = super::super::expected_board_access_cookie_value(&board, "fixture-hash")
+            .context("unlock value")?;
+        let unlock = format!(
+            "{}={unlock_value}",
+            super::super::board_access_cookie_name(&board)
+        );
+        let admin = format!("{}=media-session", super::ADMIN_SESSION_COOKIE);
+        let invalid = format!("{}=invalid", super::ADMIN_SESSION_COOKIE);
+        for cookie in [None, Some(invalid.as_str())] {
+            ensure!(
+                request_media(&router, &uri, cookie, Some(&modified))
+                    .await?
+                    .status()
+                    == super::StatusCode::FORBIDDEN
+            );
+        }
+        for cookie in [&unlock, &admin] {
+            let response = request_media(&router, &uri, Some(cookie), Some(&modified)).await?;
+            ensure!(response.status() == super::StatusCode::NOT_MODIFIED);
+            ensure!(
+                response
+                    .headers()
+                    .get(header::CACHE_CONTROL)
+                    .context("private policy")?
+                    == crate::cache::CACHE_CONTROL_PRIVATE_NO_CACHE
+            );
+        }
+        state.db.get()?.execute_batch(
+            "DELETE FROM admin_sessions; UPDATE boards SET access_password_hash='changed';",
+        )?;
+        for cookie in [&unlock, &admin] {
+            ensure!(
+                request_media(&router, &uri, Some(cookie), Some(&modified))
+                    .await?
+                    .status()
+                    == super::StatusCode::FORBIDDEN
+            );
+        }
+        state
+            .db
+            .get()?
+            .execute_batch("UPDATE boards SET access_mode='post_password';")?;
+        ensure!(
+            request_media(&router, &uri, Some(&invalid), Some(&modified))
+                .await?
+                .status()
+                == super::StatusCode::NOT_MODIFIED
+        );
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn legacy_media_redirects_preserve_status_and_safe_targets() -> AnyResult<()> {
+        let (state, directory, board) = media_fixture()?;
+        std::fs::write(directory.path().join("clip.webm"), b"video")?;
+        std::fs::write(directory.path().join("thumbs/audio.png"), b"waveform")?;
+        let router = Router::new()
+            .route("/boards/{*media_path}", get(super::serve_board_media))
+            .with_state(state);
+        for (requested, target, status) in [
+            (
+                "clip.mp4",
+                "clip.webm",
+                super::StatusCode::PERMANENT_REDIRECT,
+            ),
+            (
+                "clip.mkv",
+                "clip.webm",
+                super::StatusCode::PERMANENT_REDIRECT,
+            ),
+            (
+                "thumbs/audio.svg",
+                "thumbs/audio.png",
+                super::StatusCode::TEMPORARY_REDIRECT,
+            ),
+        ] {
+            let uri = format!("/boards/{board}/{requested}");
+            let response = request_media(&router, &uri, None, None).await?;
+            ensure!(response.status() == status);
+            ensure!(
+                response
+                    .headers()
+                    .get(header::LOCATION)
+                    .context("redirect location")?
+                    .to_str()?
+                    == format!("/boards/{board}/{target}")
+            );
+        }
+        Ok(())
+    }
 
     #[test]
     fn stale_waveform_svg_redirects_only_to_an_existing_generated_png() -> AnyResult<()> {
diff --git a/src/handlers/board/media/performance.rs b/src/handlers/board/media/performance.rs
new file mode 100644
index 00000000..0f317f41
--- /dev/null
+++ b/src/handlers/board/media/performance.rs
@@ -0,0 +1,193 @@
+//! Opt-in HTTP thumbnail workload using the production handler and file service.
+
+use anyhow::{ensure, Context as _, Result};
+use axum::{routing::get, Router};
+use futures::{stream, StreamExt as _, TryStreamExt as _};
+use std::sync::{
+    atomic::{AtomicU64, Ordering},
+    Arc,
+};
+use std::time::Instant;
+
+/// Counts pooled checkouts during measured requests, excluding fixture creation.
+#[derive(Clone, Debug, Default)]
+struct CheckoutProbe(Arc<AtomicU64>);
+
+impl r2d2::HandleEvent for CheckoutProbe {
+    fn handle_checkout(&self, _event: r2d2::event::CheckoutEvent) {
+        let _previous = self.0.fetch_add(1, Ordering::Relaxed);
+    }
+}
+
+/// Summarizes complete HTTP response times without imposing noisy time limits.
+fn latencies(mut values: Vec<u128>) -> serde_json::Value {
+    values.sort_unstable();
+    let pick = |percent: usize| {
+        values
+            .get(
+                values
+                    .len()
+                    .saturating_mul(percent)
+                    .div_ceil(100)
+                    .saturating_sub(1),
+            )
+            .copied()
+            .unwrap_or(0)
+    };
+    serde_json::json!({"p50_us":pick(50), "p95_us":pick(95), "max_us":values.last().copied().unwrap_or(0)})
+}
+
+/// Samples process observations; CPU is cumulative and RSS is an end-of-batch sample.
+fn process_observation() -> Result<String> {
+    let output = std::process::Command::new("ps")
+        .args(["-o", "time=,rss=", "-p", &std::process::id().to_string()])
+        .output()?;
+    ensure!(output.status.success(), "ps failed");
+    Ok(String::from_utf8(output.stdout)?.trim().to_owned())
+}
+
+/// Sends a bounded concurrent batch through actual loopback HTTP connections.
+async fn batch(
+    client: &reqwest::Client,
+    base: &str,
+    cookie: bool,
+    modified: Option<&str>,
+    probe: &CheckoutProbe,
+) -> Result<serde_json::Value> {
+    probe.0.store(0, Ordering::Relaxed);
+    let started = Instant::now();
+    let results: Vec<_> = stream::iter(0_u32..128)
+        .map(|number| async move {
+            let request_started = Instant::now();
+            let mut request = client.get(format!("{base}/thumbs/{number}.webp"));
+            if cookie {
+                request = request.header(
+                    reqwest::header::COOKIE,
+                    format!("{}=benchmark-invalid", super::ADMIN_SESSION_COOKIE),
+                );
+            }
+            if let Some(modified) = modified {
+                request = request.header(reqwest::header::IF_MODIFIED_SINCE, modified);
+            }
+            let response = request.send().await?;
+            let expected = if modified.is_some() {
+                reqwest::StatusCode::NOT_MODIFIED
+            } else {
+                reqwest::StatusCode::OK
+            };
+            ensure!(
+                response.status() == expected,
+                "unexpected thumbnail status {}",
+                response.status()
+            );
+            ensure!(
+                response
+                    .headers()
+                    .get(reqwest::header::CACHE_CONTROL)
+                    .and_then(|value| value.to_str().ok())
+                    == Some(crate::cache::CACHE_CONTROL_IMMUTABLE_MEDIA),
+                "immutable cache policy changed"
+            );
+            let bytes = response.bytes().await?.len();
+            Ok::<_, anyhow::Error>((request_started.elapsed().as_micros(), bytes))
+        })
+        .buffer_unordered(16)
+        .try_collect()
+        .await?;
+    Ok(serde_json::json!({
+        "requests":results.len(), "concurrency":16_u32, "elapsed_us":started.elapsed().as_micros(),
+        "body_bytes":results.iter().map(|entry| entry.1).sum::<usize>(),
+        "latency":latencies(results.iter().map(|entry| entry.0).collect()),
+        "database_checkouts":probe.0.load(Ordering::Relaxed),
+        "process_cpu_time_and_rss_kib":process_observation()?,
+    }))
+}
+
+#[tokio::test]
+#[ignore = "explicit 128-thumbnail HTTP benchmark; set RUSTCHAN_THUMB_EVIDENCE"]
+async fn thumbnail_http_workload() -> Result<()> {
+    // Normal server startup installs this; isolated handler tests bypass startup.
+    drop(rustls::crypto::ring::default_provider().install_default());
+    let output = std::env::var("RUSTCHAN_THUMB_EVIDENCE")?;
+    let mut state = crate::test_support::app_state();
+    let database = state
+        .db
+        .get()?
+        .path()
+        .context("test database path")?
+        .to_owned();
+    let probe = CheckoutProbe::default();
+    state.db = r2d2::Pool::builder()
+        .max_size(8)
+        .event_handler(Box::new(probe.clone()))
+        .build(r2d2_sqlite::SqliteConnectionManager::file(database))?;
+    let directory = tempfile::Builder::new()
+        .prefix("t")
+        .tempdir_in(&crate::config::CONFIG.upload_dir)?;
+    let board = directory
+        .path()
+        .file_name()
+        .and_then(|name| name.to_str())
+        .context("board directory name")?;
+    crate::db::create_board(&*state.db.get()?, board, "Thumbnails", "", false).map(|_id| ())?;
+    let thumbs = directory.path().join("thumbs");
+    std::fs::create_dir(&thumbs)?;
+    let original = directory.path().join("source.png");
+    image::RgbImage::from_fn(1024, 768, |x, y| {
+        image::Rgb([
+            u8::try_from(x % 256).unwrap_or(0),
+            u8::try_from(y % 256).unwrap_or(0),
+            80,
+        ])
+    })
+    .save(&original)?;
+    let generated = crate::media::thumbnail::generate_thumbnail(
+        &original,
+        "image/png",
+        &thumbs.join("0.webp"),
+        250,
+        false,
+    )?;
+    for number in 1_u32..128 {
+        std::fs::copy(&generated, thumbs.join(format!("{number}.webp"))).map(|_bytes| ())?;
+    }
+    // Delivery must succeed after the original disappears: no request-time resize.
+    std::fs::remove_file(original)?;
+    let router = Router::new()
+        .route("/boards/{*media_path}", get(super::serve_board_media))
+        .with_state(state);
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await?;
+    let base = format!("http://{}/boards/{board}", listener.local_addr()?);
+    let (stop, stopped) = tokio::sync::oneshot::channel();
+    let server = tokio::spawn(async move {
+        axum::serve(listener, router)
+            .with_graceful_shutdown(async {
+                drop(stopped.await);
+            })
+            .await
+    });
+    let result = async {
+        let client = reqwest::Client::new();
+        let response = client.get(format!("{base}/thumbs/127.webp")).send().await?;
+        let modified = response.headers().get(reqwest::header::LAST_MODIFIED).context("Last-Modified missing")?.to_str()?.to_owned();
+        drop(response.bytes().await?);
+        let mut samples = Vec::new();
+        for _sample in 0_u32..5 {
+            for cookie in [false, true] {
+                for conditional in [false, true] {
+                    let measured = batch(&client, &base, cookie, conditional.then_some(modified.as_str()), &probe).await?;
+                    samples.push(serde_json::json!({"admin_cookie":cookie, "conditional":conditional, "measurement":measured}));
+                }
+            }
+        }
+        std::fs::write(output, serde_json::to_vec_pretty(&serde_json::json!({
+            "thumbnail_bytes":std::fs::metadata(generated)?.len(), "samples":samples,
+            "limitations":"Debug build, loopback HTTP/1.1, warm OS cache, 16 concurrent requests, current-thread runtime; middleware/browser cache excluded. DB checkouts measured; SQL count and syscall count require separate instrumentation. ps CPU cumulative; RSS sampled, not peak. Original removed before requests."
+        }))?)?;
+        Ok::<_, anyhow::Error>(())
+    }.await;
+    stop.send(())
+        .map_err(|()| anyhow::anyhow!("benchmark server stopped early"))?;
+    server.await.context("join benchmark server")??;
+    result
+}
diff --git a/src/handlers/board/pages.rs b/src/handlers/board/pages.rs
index a1dc6c02..20ff63d0 100644
--- a/src/handlers/board/pages.rs
+++ b/src/handlers/board/pages.rs
@@ -227,6 +227,7 @@ pub(in crate::server) async fn board_index(
     State(state): State<AppState>,
     Path(board_short): Path<String>,
     Query(params): Query<HashMap<String, String>>,
+    crate::middleware::ClientIp(client_ip): crate::middleware::ClientIp,
     jar: CookieJar,
     req_headers: HeaderMap,
     peer: SecureCookieContext,
@@ -238,6 +239,7 @@ pub(in crate::server) async fn board_index(
         .get(ADMIN_SESSION_COOKIE)
         .map(|cookie| cookie.value().to_owned());
 
+    let viewer_key = super::viewer_preference_key(&client_ip, &jar);
     let page: i64 = params
         .get("page")
         .and_then(|p| p.parse().ok())
@@ -290,6 +292,7 @@ pub(in crate::server) async fn board_index(
                 index_threads_per_page(),
                 index_reply_previews(),
                 is_admin,
+                &viewer_key,
             )?;
             let banner_selection = crate::banner::resolve_board_banner(
                 &conn,
@@ -422,7 +425,7 @@ pub(in crate::server) async fn board_index(
         ));
         drop(resp.headers_mut().insert(
             header::CACHE_CONTROL,
-            HeaderValue::from_static(activity_html_cache_control(activity_markers_enabled)),
+            HeaderValue::from_static(super::personal_html_cache_control(activity_markers_enabled)),
         ));
         crate::cache::insert_vary_cookie(resp.headers_mut());
         return Ok((jar, resp).into_response());
@@ -457,7 +460,7 @@ pub(in crate::server) async fn board_index(
     }
     drop(resp.headers_mut().insert(
         header::CACHE_CONTROL,
-        HeaderValue::from_static(activity_html_cache_control(activity_markers_enabled)),
+        HeaderValue::from_static(super::personal_html_cache_control(activity_markers_enabled)),
     ));
     crate::cache::insert_vary_cookie(resp.headers_mut());
     Ok((jar, resp).into_response())
diff --git a/src/handlers/board/reports.rs b/src/handlers/board/reports.rs
index 74098c4c..5db78f9f 100644
--- a/src/handlers/board/reports.rs
+++ b/src/handlers/board/reports.rs
@@ -15,31 +15,35 @@ pub(in crate::server) struct ReportForm {
     pub csrf: Option<String>,
 }
 
+/// Bound optional Unicode report text while rejecting hidden control characters.
+fn report_reason(raw: Option<&str>) -> Result<String> {
+    let raw = raw.unwrap_or("");
+    if raw.chars().any(char::is_control) {
+        return Err(AppError::BadRequest(
+            "Report reason contains control characters.".into(),
+        ));
+    }
+    Ok(raw.trim().chars().take(256).collect())
+}
+
 pub(in crate::server) async fn file_report(
     State(state): State<AppState>,
     crate::middleware::ClientIp(client_ip): crate::middleware::ClientIp,
     jar: CookieJar,
+    req_headers: axum::http::HeaderMap,
+    peer: crate::middleware::SecureCookieContext,
     Form(form): Form<ReportForm>,
 ) -> Result<Response> {
-    check_csrf_jar(&jar, form.csrf.as_deref())?;
+    super::check_menu_action_csrf(&jar, &req_headers, peer, form.csrf.as_deref())?;
 
     let ip_hash = hash_ip(&identity_key(&client_ip, &jar), &CONFIG.cookie_secret);
-    let reason = form
-        .reason
-        .as_deref()
-        .unwrap_or("")
-        .trim()
-        .chars()
-        .take(256)
-        .collect::<String>();
+    let reason = report_reason(form.reason.as_deref())?;
 
     let post_id = form.post_id;
-    let board_raw = form
-        .board
-        .chars()
-        .filter(char::is_ascii_alphanumeric)
-        .take(8)
-        .collect::<String>();
+    if post_id <= 0 || form.thread_id <= 0 || !super::valid_action_board(&form.board) {
+        return Err(AppError::BadRequest("Invalid report target.".into()));
+    }
+    let board_raw = form.board.clone();
     let admin_session_id = jar
         .get(ADMIN_SESSION_COOKIE)
         .map(|cookie| cookie.value().to_owned());
@@ -50,12 +54,13 @@ pub(in crate::server) async fn file_report(
         .get("csrf_token")
         .map(|cookie| cookie.value().to_owned())
         .unwrap_or_default();
-    let db_thread_id = tokio::task::spawn_blocking({
+    let outcome = tokio::task::spawn_blocking({
         let pool = state.db.clone();
-        move || -> Result<i64> {
+        move || -> Result<Option<(i64, db::ReportSubmission)>> {
             let conn = pool.get()?;
+            let tx = rusqlite::Transaction::new_unchecked(&conn, rusqlite::TransactionBehavior::Immediate)?;
             let access_context = load_board_access_context(
-                &conn,
+                &tx,
                 &board_raw_closure,
                 admin_session_id.as_deref(),
                 access_cookie.as_deref(),
@@ -67,10 +72,10 @@ pub(in crate::server) async fn file_report(
             }
             // Banned identities must not file reports. CSRF has already been
             // validated above, so the ban notice can render its appeal form.
-            super::ensure_actor_not_banned(&conn, &ip_hash, csrf_cookie)?;
+            super::ensure_actor_not_banned(&tx, &ip_hash, csrf_cookie)?;
             let board = access_context.board;
             // Verify post exists and belongs to this board to prevent spoofed reports.
-            let post = db::get_post(&conn, post_id)?
+            let post = db::get_post(&tx, post_id)?
                 .ok_or_else(|| AppError::NotFound("Post not found.".into()))?;
             if post.board_id != board.id {
                 return Err(AppError::BadRequest(
@@ -85,17 +90,46 @@ pub(in crate::server) async fn file_report(
             // Use the DB's thread_id for the redirect — not the user-submitted value.
             let authoritative_thread_id = post.thread_id;
             // The report ID does not affect the authoritative thread redirect.
-            db::file_report(&conn, post_id, &reason, &ip_hash).map(|_report_id| ())?;
-            Ok(authoritative_thread_id)
+            // Serialize the abuse budget and insertion. Duplicates remain
+            // idempotent even when the reporter has exhausted the budget.
+            let (recent, duplicate): (i64, bool) = tx.query_row(
+                "SELECT (SELECT COUNT(*) FROM reports WHERE reporter_hash = ?1 AND created_at > unixepoch() - 3600),
+                        EXISTS(SELECT 1 FROM reports WHERE post_id = ?2 AND reporter_hash = ?1 AND status = 'open')",
+                rusqlite::params![ip_hash, post_id],
+                |row| Ok((row.get(0)?, row.get(1)?)),
+            )?;
+            if recent >= 20 && !duplicate {
+                return Ok(None);
+            }
+            let submission = db::file_report(&tx, post_id, &reason, &ip_hash)?;
+            tx.commit()?;
+            Ok(Some((authoritative_thread_id, submission)))
         }
     })
     .await
     .map_err(|e| AppError::Internal(anyhow::anyhow!(e)))??;
 
-    // Redirect back to the thread using the DB-resolved IDs.
-    // `board_raw` is already sanitised to alphanumeric earlier in this handler.
+    let Some((db_thread_id, submission)) = outcome else {
+        let message = "Too many reports. Please try again in an hour.";
+        let mut response = (
+            axum::http::StatusCode::TOO_MANY_REQUESTS,
+            axum::Extension(crate::error::ErrorPage::Message(message.to_owned())),
+            axum::response::Html(templates::error_page(429, message)),
+        )
+            .into_response();
+        drop(response.headers_mut().insert(
+            axum::http::header::RETRY_AFTER,
+            axum::http::HeaderValue::from_static("3600"),
+        ));
+        return Ok(response);
+    };
+    let reported = match submission {
+        db::ReportSubmission::Filed => "1",
+        db::ReportSubmission::AlreadyFiled => "duplicate",
+    };
+    // Target and board were checked together under the write lock.
     Ok(Redirect::to(&format!(
-        "/{board_raw}/thread/{db_thread_id}?reported=1#p{}",
+        "/{board_raw}/thread/{db_thread_id}?reported={reported}#p{}",
         form.post_id
     ))
     .into_response())
diff --git a/src/handlers/board/tests.rs b/src/handlers/board/tests.rs
index f4186967..7f441bca 100644
--- a/src/handlers/board/tests.rs
+++ b/src/handlers/board/tests.rs
@@ -267,6 +267,7 @@ fn activity_router(state: crate::middleware::AppState) -> Router {
         .route("/", get(super::index))
         .route("/{board}", get(super::board_index))
         .route("/{board}/catalog", get(super::catalog))
+        .route("/{board}/archive", get(super::board_archive))
         .route(
             "/{board}/thread/{id}",
             get(crate::handlers::thread::view_thread),
@@ -2583,6 +2584,101 @@ async fn password_protected_board_does_not_leak_homepage_new_activity_badge() ->
     Ok(())
 }
 
+#[tokio::test]
+async fn thread_controls_render_ssr_live_locked_and_archived_states() -> anyhow::Result<()> {
+    let state = crate::test_support::app_state();
+    let (_board_id, thread_id) = seed_board_with_thread(&state, "tech", "op")?;
+    let router = activity_router(state.clone());
+    for (locked, archived) in [(false, false), (true, false), (true, true)] {
+        {
+            let conn = state.db.get().context("db connection")?;
+            conn.execute(
+                "UPDATE threads SET locked = ?1, archived = ?2 WHERE id = ?3",
+                rusqlite::params![locked, archived, thread_id],
+            )
+            .context("update thread state")
+            .map(|_completed_value| ())?;
+        }
+        let response = router
+            .clone()
+            .oneshot(
+                Request::builder()
+                    .method("GET")
+                    .uri(format!("/tech/thread/{thread_id}"))
+                    .extension(crate::test_support::connect_info())
+                    .body(Body::empty())
+                    .context("request")?,
+            )
+            .await
+            .context("response")?;
+        ensure_eq!(response.status(), StatusCode::OK);
+        let body = response_body_string(response).await?;
+        let parent = if archived { "/tech/archive" } else { "/tech" };
+        ensure_eq!(
+            body.matches(&format!(r#"href="{parent}">[ Return ]</a>"#))
+                .count(),
+            2
+        );
+        ensure_eq!(body.matches(r#"id="top""#).count(), 1);
+        ensure_eq!(body.matches(r#"id="bottom""#).count(), 1);
+        ensure_eq!(body.contains("fetch-updates"), !archived);
+        ensure_eq!(
+            body.contains("<noscript><a class=\"thread-nav-control"),
+            !archived
+        );
+        ensure_eq!(body.contains("autoupdate-toggle"), !archived);
+        ensure_eq!(body.contains("id=\"post-form-wrap\""), !locked);
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn thread_updates_use_get_without_csrf_and_do_not_create_posts() -> anyhow::Result<()> {
+    let state = crate::test_support::app_state();
+    let (board_id, thread_id) = seed_board_with_thread(&state, "tech", "op")?;
+    create_reply_on_thread(&state, board_id, thread_id, "new reply")?;
+    let router = activity_router(state.clone());
+    for _ in 0_u8..2 {
+        let response = router
+            .clone()
+            .oneshot(
+                Request::builder()
+                    .method("GET")
+                    .uri(format!("/tech/thread/{thread_id}/updates?since=0"))
+                    .body(Body::empty())
+                    .context("request")?,
+            )
+            .await
+            .context("response")?;
+        ensure_eq!(response.status(), StatusCode::OK);
+        let data: serde_json::Value =
+            serde_json::from_str(&response_body_string(response).await?).context("updates JSON")?;
+        ensure_eq!(
+            data.get("count").and_then(serde_json::Value::as_u64),
+            Some(2)
+        );
+    }
+    let response = router
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri(format!("/tech/thread/{thread_id}/updates"))
+                .body(Body::empty())
+                .context("request")?,
+        )
+        .await
+        .context("response")?;
+    ensure_eq!(response.status(), StatusCode::METHOD_NOT_ALLOWED);
+    let conn = state.db.get().context("db connection")?;
+    let count: i64 = conn.query_row(
+        "SELECT COUNT(*) FROM posts WHERE thread_id = ?1",
+        [thread_id],
+        |row| row.get(0),
+    )?;
+    ensure_eq!(count, 2);
+    Ok(())
+}
+
 #[tokio::test]
 async fn thread_updates_rejects_thread_id_from_other_board() -> anyhow::Result<()> {
     let state = crate::test_support::app_state();
@@ -2714,7 +2810,8 @@ async fn new_activity_pages_keep_private_no_store_cache_headers() -> anyhow::Res
 }
 
 #[tokio::test]
-async fn activity_pages_keep_existing_cache_policy_when_tracking_disabled() -> anyhow::Result<()> {
+async fn personal_action_pages_use_private_cache_even_when_tracking_disabled() -> anyhow::Result<()>
+{
     let state = crate::test_support::app_state();
     set_new_activity_settings(&state, false, false, false)?;
     let (_board_id, thread_id) = seed_board_with_thread(&state, "tech", "op")?;
@@ -2739,8 +2836,12 @@ async fn activity_pages_keep_existing_cache_policy_when_tracking_disabled() -> a
                 .headers()
                 .get(header::CACHE_CONTROL)
                 .and_then(|value| value.to_str().ok()),
-            Some(super::HTML_CACHE_CONTROL),
-            "{uri} should keep no-cache when activity tracking is disabled"
+            Some(if uri == "/" {
+                super::HTML_CACHE_CONTROL
+            } else {
+                crate::cache::CACHE_CONTROL_PRIVATE_NO_CACHE
+            }),
+            "{uri} should revalidate personal action state without shared caching"
         );
     }
     Ok(())
@@ -2982,13 +3083,14 @@ async fn duplicate_report_redirects_back_without_500() -> anyhow::Result<()> {
         .route("/report", post(super::file_report))
         .with_state(state.clone());
 
-    for _ in 0_i32..2_i32 {
+    for attempt in 0_i32..2_i32 {
         let response = router
             .clone()
             .oneshot(
                 Request::builder()
                     .method("POST")
                     .uri("/report")
+                    .header(header::HOST, "localhost")
                     .header(
                         header::CONTENT_TYPE,
                         "application/x-www-form-urlencoded",
@@ -3011,7 +3113,10 @@ async fn duplicate_report_redirects_back_without_500() -> anyhow::Result<()> {
             .context("location header")?;
         ensure_eq!(
             location,
-            format!("/test/thread/{thread_id}?reported=1#p{post_id}")
+            format!(
+                "/test/thread/{thread_id}?reported={}#p{post_id}",
+                if attempt == 0_i32 { "1" } else { "duplicate" }
+            )
         );
     }
 
@@ -3091,6 +3196,7 @@ async fn banned_actor_cannot_file_reports_and_unban_restores_reporting() -> anyh
         Request::builder()
             .method("POST")
             .uri("/report")
+            .header(header::HOST, "localhost")
             .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
             .header(header::COOKIE, "csrf_token=csrf123")
             .extension(crate::test_support::connect_info())
@@ -4420,3 +4526,201 @@ async fn submit_appeal_is_rate_limited_to_one_open_window() -> anyhow::Result<()
     anyhow::ensure!(second_body.contains("already filed an appeal"));
     Ok(())
 }
+
+#[tokio::test]
+async fn archive_index_remains_accessible_when_overflow_archiving_is_disabled() -> anyhow::Result<()>
+{
+    let state = crate::test_support::app_state();
+    let (board_id, thread_id) = seed_board_with_thread(&state, "history", "archive needle")?;
+    {
+        let conn = state.db.get()?;
+        crate::db::set_thread_archived(&conn, thread_id, true)?;
+        conn.execute("UPDATE boards SET allow_archive=0 WHERE id=?1", [board_id])
+            .map(|_rows| ())?;
+    }
+    let router = activity_router(state);
+    for path in [
+        "/history/archive".to_owned(),
+        format!("/history/thread/{thread_id}"),
+    ] {
+        let response = router
+            .clone()
+            .oneshot(
+                Request::builder()
+                    .uri(path)
+                    .extension(crate::test_support::connect_info())
+                    .body(Body::empty())?,
+            )
+            .await?;
+        ensure_eq!(response.status(), StatusCode::OK);
+        let body = response_body_string(response).await?;
+        anyhow::ensure!(body.contains("archive needle"));
+        anyhow::ensure!(!body.contains("post-reply-form"));
+    }
+    for path in [
+        "/missing/archive".to_owned(),
+        "/history/thread/-1".to_owned(),
+        "/history/thread/9223372036854775807".to_owned(),
+    ] {
+        let response = router
+            .clone()
+            .oneshot(
+                Request::builder()
+                    .uri(path)
+                    .extension(crate::test_support::connect_info())
+                    .body(Body::empty())?,
+            )
+            .await?;
+        ensure_eq!(response.status(), StatusCode::NOT_FOUND);
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn archive_pagination_and_wrong_board_urls_are_consistent() -> anyhow::Result<()> {
+    let state = crate::test_support::app_state();
+    let (board_id, thread_id) = seed_board_with_thread(&state, "paged", "first archive body")?;
+    {
+        let conn = state.db.get()?;
+        crate::db::set_thread_archived(&conn, thread_id, true)?;
+    }
+    for number in 0_i32..20_i32 {
+        let id = create_thread_on_board(&state, board_id, &format!("archive item {number}"))?;
+        let conn = state.db.get()?;
+        crate::db::set_thread_archived(&conn, id, true)?;
+    }
+    let (_other, _thread) = seed_board_with_thread(&state, "other", "other board")?;
+    let router = activity_router(state);
+    let response = router
+        .clone()
+        .oneshot(
+            Request::builder()
+                .uri("/paged/archive?page=2")
+                .body(Body::empty())?,
+        )
+        .await?;
+    ensure_eq!(response.status(), StatusCode::OK);
+    let body = response_body_string(response).await?;
+    anyhow::ensure!(
+        body.matches("class=\"archive-row archive-thread-link\"")
+            .count()
+            == 1
+    );
+    let wrong_board_response = router
+        .oneshot(
+            Request::builder()
+                .uri(format!("/other/thread/{thread_id}"))
+                .extension(crate::test_support::connect_info())
+                .body(Body::empty())?,
+        )
+        .await?;
+    ensure_eq!(wrong_board_response.status(), StatusCode::NOT_FOUND);
+    Ok(())
+}
+
+#[tokio::test]
+async fn archived_poll_is_read_only_in_thread_and_vote_route() -> anyhow::Result<()> {
+    let state = crate::test_support::app_state();
+    let (thread_id, _post_id, option_id) = seed_post_password_board(&state)?;
+    {
+        let conn = state.db.get()?;
+        conn.execute("UPDATE boards SET access_mode='public',access_password_hash='' WHERE short_name='secret'", []).map(|_rows| ())?;
+        crate::db::set_thread_archived(&conn, thread_id, true)?;
+    }
+    let router = activity_router(state.clone()).merge(
+        Router::new()
+            .route("/vote", post(crate::handlers::thread::vote_handler))
+            .with_state(state.clone()),
+    );
+    let response = router
+        .clone()
+        .oneshot(
+            Request::builder()
+                .uri(format!("/secret/thread/{thread_id}"))
+                .extension(crate::test_support::connect_info())
+                .body(Body::empty())?,
+        )
+        .await?;
+    ensure_eq!(response.status(), StatusCode::OK);
+    let body = response_body_string(response).await?;
+    anyhow::ensure!(body.contains("poll-results") && body.contains("[archived]"));
+    anyhow::ensure!(!body.contains("poll-vote-form"));
+    let vote_response = router
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/vote")
+                .header(header::COOKIE, "csrf_token=archive-csrf")
+                .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+                .extension(crate::test_support::connect_info())
+                .body(Body::from(format!(
+                    "_csrf=archive-csrf&option_id={option_id}"
+                )))?,
+        )
+        .await?;
+    ensure_eq!(vote_response.status(), StatusCode::BAD_REQUEST);
+    let conn = state.db.get()?;
+    let votes: i64 = conn.query_row("SELECT COUNT(*) FROM poll_votes", [], |row| row.get(0))?;
+    anyhow::ensure!(votes == 0);
+    Ok(())
+}
+
+#[tokio::test]
+async fn archived_pages_enforce_board_view_passwords() -> anyhow::Result<()> {
+    let state = crate::test_support::app_state();
+    let (board_id, thread_id) =
+        seed_board_with_thread(&state, "private", "private archived needle")?;
+    {
+        let conn = state.db.get()?;
+        crate::db::set_thread_archived(&conn, thread_id, true)?;
+        conn.execute(
+            "UPDATE boards SET access_mode='view_password',access_password_hash=?1 WHERE id=?2",
+            rusqlite::params![crate::utils::crypto::hash_password("swordfish")?, board_id],
+        )
+        .map(|_rows| ())?;
+    }
+    let router = activity_router(state.clone());
+    for uri in [
+        "/private/archive".to_owned(),
+        format!("/private/thread/{thread_id}"),
+    ] {
+        let response = router
+            .clone()
+            .oneshot(
+                Request::builder()
+                    .uri(&uri)
+                    .header(
+                        header::COOKIE,
+                        format!("{}=forged", super::board_access_cookie_name("private")),
+                    )
+                    .extension(crate::test_support::connect_info())
+                    .body(Body::empty())?,
+            )
+            .await?;
+        ensure_eq!(response.status(), StatusCode::FORBIDDEN);
+        let body = response_body_string(response).await?;
+        anyhow::ensure!(!body.contains("private archived needle"));
+        anyhow::ensure!(body.contains("/private/unlock"));
+    }
+    {
+        let conn = state.db.get()?;
+        conn.execute(
+            "UPDATE boards SET access_mode='post_password' WHERE id=?1",
+            [board_id],
+        )
+        .map(|_rows| ())?;
+    }
+    let response = router
+        .oneshot(
+            Request::builder()
+                .uri("/private/archive")
+                .extension(crate::test_support::connect_info())
+                .body(Body::empty())?,
+        )
+        .await?;
+    ensure_eq!(response.status(), StatusCode::OK);
+    anyhow::ensure!(response_body_string(response)
+        .await?
+        .contains("private archived needle"));
+    Ok(())
+}
diff --git a/src/handlers/captcha.rs b/src/handlers/captcha.rs
index 2cbb923c..fdf347c3 100644
--- a/src/handlers/captcha.rs
+++ b/src/handlers/captcha.rs
@@ -1,6 +1,6 @@
 use crate::error::{AppError, Result};
 use axum::{
-    extract::{Path, Query},
+    extract::{Path, Query, State},
     http::{header, HeaderMap, HeaderValue, StatusCode},
     response::{IntoResponse as _, Response},
 };
@@ -12,20 +12,26 @@ pub(in crate::server) struct CaptchaImageQuery {
 }
 
 pub(in crate::server) async fn serve_captcha_image(
+    State(state): State<crate::middleware::AppState>,
     Path(captcha_id): Path<String>,
     Query(query): Query<CaptchaImageQuery>,
 ) -> Result<Response> {
-    let png =
-        crate::captcha::generate_captcha_image(&query.board, &captcha_id).map_err(
-            |err| match err {
-                crate::captcha::CaptchaImageError::InvalidRequest => {
-                    AppError::BadRequest("Invalid CAPTCHA request.".to_owned())
-                }
-                crate::captcha::CaptchaImageError::GenerationFailed => {
-                    AppError::Internal(anyhow::anyhow!("failed to generate captcha image"))
-                }
-            },
-        )?;
+    let permit = state.captcha_work_gate.try_begin()?;
+    let png = tokio::task::spawn_blocking(move || {
+        let _captcha_permit = permit;
+        crate::captcha::generate_captcha_image(&query.board, &captcha_id)
+    })
+    .await
+    .map_err(|error| AppError::Internal(error.into()))?
+    .map_err(|error| match error {
+        crate::captcha::CaptchaImageError::InvalidRequest => {
+            AppError::BadRequest("Invalid CAPTCHA request.".to_owned())
+        }
+        crate::captcha::CaptchaImageError::GenerationFailed => {
+            AppError::Internal(anyhow::anyhow!("failed to generate captcha image"))
+        }
+        crate::captcha::CaptchaImageError::Busy => AppError::DbBusy,
+    })?;
 
     let mut headers = HeaderMap::new();
     let _previous_value =
@@ -57,7 +63,9 @@ mod tests {
         const CAPTCHA_ROUTE: &str = concat!("/captcha/", "{id}");
 
         let id = "00000000000000000000000000000006";
-        let app = Router::new().route(CAPTCHA_ROUTE, get(serve_captcha_image));
+        let app = Router::new()
+            .route(CAPTCHA_ROUTE, get(serve_captcha_image))
+            .with_state(crate::test_support::app_state());
 
         let response = app
             .oneshot(
diff --git a/src/handlers/mod.rs b/src/handlers/mod.rs
index 76ae5ac8..fe76bc7a 100644
--- a/src/handlers/mod.rs
+++ b/src/handlers/mod.rs
@@ -892,7 +892,7 @@ fn capture_post_draft(
         "poll_question" => {
             return Err(AppError::BadRequest(
                 "Poll recovery question exceeds its limit.".into(),
-            ))
+            ));
         }
         _ => {}
     }
@@ -1029,6 +1029,7 @@ pub(crate) async fn parse_post_multipart(
     let mut captcha_answer = String::new();
     let mut budget = PublicMultipartBudget::default();
     let mut seen_upload_slots = HashSet::new();
+    let mut seen_scalar_fields = HashSet::new();
     let mut media_upload_guard = None;
 
     loop {
@@ -1040,6 +1041,29 @@ pub(crate) async fn parse_post_multipart(
             break;
         };
         budget.note_field()?;
+        if let Some(field_name) = field.name().filter(|control_name| {
+            matches!(
+                *control_name,
+                "_csrf"
+                    | "submission_token"
+                    | "name"
+                    | "subject"
+                    | "body"
+                    | "deletion_token"
+                    | "sage"
+                    | "captcha_id"
+                    | "captcha_answer"
+                    | "poll_question"
+                    | "poll_duration_value"
+                    | "poll_duration_unit"
+            )
+        }) {
+            if !seen_scalar_fields.insert(field_name.to_owned()) {
+                return Err(AppError::BadRequest(format!(
+                    "Duplicate posting field '{field_name}'."
+                )));
+            }
+        }
         match field.name() {
             Some("_csrf") => {
                 let v = read_text_field(field, &mut budget).await?;
@@ -1206,7 +1230,9 @@ pub(crate) async fn parse_post_multipart(
                     "hours" => v.saturating_mul(3600),
                     "days" => v.saturating_mul(86_400),
                     other => {
-                        return Err(AppError::BadRequest(format!("Invalid poll duration unit '{other}'. Use 'minutes', 'hours', or 'days'.")));
+                        return Err(AppError::BadRequest(format!(
+                            "Invalid poll duration unit '{other}'. Use 'minutes', 'hours', or 'days'."
+                        )));
                     }
                 };
                 Some(secs)
@@ -1241,7 +1267,8 @@ pub(crate) async fn parse_post_multipart(
 ///   • "Insufficient disk space" → 413 `UploadTooLarge`
 ///   • "File type not allowed"   → 415 `InvalidMediaType`
 ///   • "Not an audio file"       → 415 `InvalidMediaType`
-///   • anything else             → 400 `BadRequest`.
+///   • filesystem errors         → generic 500, with details retained for logging.
+///   • other decoder errors      → a generic 400, without tool output or paths.
 pub(crate) fn classify_upload_error(e: &anyhow::Error) -> AppError {
     let msg = e.to_string();
     // Compare lower-cased so minor wording changes in save_upload don't silently
@@ -1251,8 +1278,17 @@ pub(crate) fn classify_upload_error(e: &anyhow::Error) -> AppError {
         AppError::UploadTooLarge(msg)
     } else if lower.starts_with("file type not allowed") || lower.starts_with("not an audio file") {
         AppError::InvalidMediaType(msg)
+    } else if e
+        .chain()
+        .any(<dyn std::error::Error + 'static>::is::<std::io::Error>)
+    {
+        AppError::Internal(anyhow::anyhow!("Upload filesystem operation failed: {e:#}"))
+    } else if lower.contains("image header is malformed") {
+        AppError::BadRequest("The image header is malformed. Check that the image is valid.".into())
     } else {
-        AppError::BadRequest(msg)
+        AppError::BadRequest(
+            "The server could not validate this upload. Check that the file is valid and supported.".into(),
+        )
     }
 }
 
@@ -1313,22 +1349,22 @@ pub(crate) fn process_primary_upload(
         crate::models::MediaType::Image if !board.allow_images => {
             return Err(AppError::BadRequest(
                 "Image uploads are disabled on this board.".into(),
-            ))
+            ));
         }
         crate::models::MediaType::Video if !board.allow_video => {
             return Err(AppError::BadRequest(
                 "Video uploads are disabled on this board.".into(),
-            ))
+            ));
         }
         crate::models::MediaType::Audio if !board.allow_audio => {
             return Err(AppError::BadRequest(
                 "Audio uploads are disabled on this board.".into(),
-            ))
+            ));
         }
         crate::models::MediaType::Pdf if !board.allow_pdf => {
             return Err(AppError::BadRequest(
                 "PDF uploads are disabled on this board.".into(),
-            ))
+            ));
         }
         crate::models::MediaType::Other
             if ambiguous_webm && (!board.allow_video || !board.allow_audio) =>
@@ -1341,7 +1377,7 @@ pub(crate) fn process_primary_upload(
         crate::models::MediaType::Other if !ambiguous_webm && !allow_any_files => {
             return Err(AppError::BadRequest(
                 "This board only accepts image, video, audio, or PDF uploads.".into(),
-            ))
+            ));
         }
         crate::models::MediaType::Image
         | crate::models::MediaType::Video
@@ -1745,6 +1781,25 @@ mod tests {
             .map_err(|rejection| anyhow::anyhow!(rejection.to_string()))
     }
 
+    #[test]
+    fn upload_errors_do_not_disclose_paths_or_decoder_diagnostics() -> anyhow::Result<()> {
+        let io = anyhow::Error::new(std::io::Error::other(
+            "private /srv/rustchan/uploads/secret",
+        ));
+        ensure!(matches!(
+            super::classify_upload_error(&io),
+            crate::error::AppError::Internal(_)
+        ));
+        let decoder =
+            anyhow::anyhow!("decoder failed at /private/tmp/input; external tool diagnostic");
+        let crate::error::AppError::BadRequest(message) = super::classify_upload_error(&decoder)
+        else {
+            anyhow::bail!("decoder failure should be a client error");
+        };
+        ensure!(!message.contains("/private") && !message.contains("diagnostic"));
+        Ok(())
+    }
+
     #[tokio::test]
     async fn rejected_upload_discard_finishes_without_staging_bytes() -> anyhow::Result<()> {
         let (boundary, body) =
@@ -2788,9 +2843,6 @@ mod tests {
         };
         let uploads_dir = tempfile::tempdir().context("create uploads directory")?;
         let save_root = tempfile::tempdir().context("create save root")?;
-        let _override = crate::media::thumbnail::override_pdf_renderer_mode(
-            crate::media::thumbnail::TestPdfRendererMode::Unavailable,
-        );
         let (uploaded, _) = super::process_primary_upload(
             Some(temp_upload("doc.pdf", valid_pdf())?),
             &board,
@@ -2816,10 +2868,52 @@ mod tests {
         ensure!(uploaded.mime_type == "application/pdf");
         ensure!(uploaded.media_type == crate::models::MediaType::Pdf);
         ensure!(save_root.path().join(uploaded.file_path).exists());
-        ensure!(std::path::Path::new(&uploaded.thumb_path)
+        // Validate both documented PDF preview outcomes by their actual contents.
+        let thumbnail = std::fs::read(save_root.path().join(&uploaded.thumb_path))?;
+        let extension = std::path::Path::new(&uploaded.thumb_path)
             .extension()
-            .is_some_and(|ext| ext.eq_ignore_ascii_case("svg")));
-        ensure!(save_root.path().join(&uploaded.thumb_path).exists());
+            .context("thumbnail extension")?;
+        ensure!(
+            (extension.eq_ignore_ascii_case("png") && thumbnail.starts_with(b"\x89PNG\r\n\x1a\n"))
+                || (extension.eq_ignore_ascii_case("svg")
+                    && String::from_utf8(thumbnail)?.contains("<svg"))
+        );
+        Ok(())
+    }
+    #[tokio::test]
+    async fn multipart_parser_rejects_ambiguous_scalar_fields() -> anyhow::Result<()> {
+        for field in [
+            "_csrf",
+            "body",
+            "sage",
+            "submission_token",
+            "captcha_id",
+            "poll_duration_unit",
+        ] {
+            let fields = [(field, "first"), (field, "second")];
+            let (boundary, bytes) = crate::test_support::multipart_body(&fields, None);
+            let multipart = multipart_from_bytes(&boundary, bytes).await?;
+            let gate = crate::middleware::MediaUploadGate::new();
+            let mut draft = crate::templates::forms::PostFormState::default();
+            let result = parse_post_multipart(
+                multipart,
+                Some("csrf123"),
+                1024,
+                1024,
+                1024,
+                1024,
+                super::PostMultipartContext {
+                    media_upload_gate: &gate,
+                    draft: &mut draft,
+                },
+            )
+            .await;
+            ensure!(
+                matches!(result, Err(crate::error::AppError::BadRequest(_))),
+                "duplicate {field} must be rejected"
+            );
+            drop(result);
+        }
         Ok(())
     }
 }
diff --git a/src/handlers/posting.rs b/src/handlers/posting.rs
index 5b8de2d0..cd1dfb74 100644
--- a/src/handlers/posting.rs
+++ b/src/handlers/posting.rs
@@ -347,7 +347,7 @@ fn checkout_post_connection(
 }
 
 /// Preserve a transaction's typed public rejection.
-fn post_creation_error(error: anyhow::Error) -> AppError {
+pub(super) fn post_creation_error(error: anyhow::Error) -> AppError {
     match error.downcast::<AppError>() {
         Ok(error) => error,
         Err(error) => error.into(),
@@ -637,6 +637,15 @@ fn submit_post_with_preparation(
         ffmpeg_available,
     } = command;
 
+    if submission_token.len() > 128
+        || !submission_token
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
+    {
+        return Err(AppError::BadRequest(
+            "Invalid submission token. Reload the posting form.".into(),
+        ));
+    }
     let conn = pool.get()?;
     let board = db::get_board_by_short(&conn, &board_short)?
         .ok_or_else(|| AppError::NotFound(format!("Board /{board_short}/ not found")))?;
@@ -645,6 +654,22 @@ fn submit_post_with_preparation(
     let effective_max_audio_size = board.max_audio_size_bytes();
     let effective_max_pdf_size = board.max_pdf_size_bytes();
 
+    let ip_hash = hash_ip(&identity_key, &cookie_secret);
+    crate::handlers::board::ensure_actor_not_banned(&conn, &ip_hash, ban_csrf_token.clone())?;
+    if let Some(existing) = db::get_post_submission(&conn, &submission_token, &ip_hash, board.id)? {
+        let target = match &mode {
+            SubmitPostMode::Reply { thread_id, sage: _ } => Some(*thread_id),
+            SubmitPostMode::NewThread {
+                subject: _,
+                poll_question: _,
+                poll_options: _,
+                poll_duration_secs: _,
+            } => None,
+        };
+        db::threads::validate_submission_target(existing, target).map_err(post_creation_error)?;
+        return existing_submission_result(&conn, board.short_name, existing);
+    }
+
     let reply_context = match &mode {
         SubmitPostMode::Reply { thread_id, sage } => {
             let thread = db::get_thread(&conn, *thread_id)?
@@ -653,12 +678,12 @@ fn submit_post_with_preparation(
             if thread.board_id != board.id {
                 return Err(AppError::NotFound("Thread not found in this board.".into()));
             }
-            if thread.locked {
-                return Err(AppError::Forbidden("This thread is locked.".into()));
-            }
             if thread.archived {
                 return Err(AppError::Forbidden("This thread is archived.".into()));
             }
+            if thread.locked {
+                return Err(AppError::Forbidden("This thread is locked.".into()));
+            }
 
             Some((*thread_id, *sage))
         }
@@ -670,12 +695,6 @@ fn submit_post_with_preparation(
         } => None,
     };
 
-    let ip_hash = hash_ip(&identity_key, &cookie_secret);
-    crate::handlers::board::ensure_actor_not_banned(&conn, &ip_hash, ban_csrf_token.clone())?;
-    if let Some(existing) = db::get_post_submission(&conn, &submission_token, &ip_hash, board.id)? {
-        return existing_submission_result(&conn, board.short_name, existing);
-    }
-
     let is_admin = is_admin_session(&conn, admin_session_id.as_deref());
     if board.post_cooldown_secs > 0 && !is_admin {
         let elapsed = db::get_seconds_since_last_post(&conn, board.id, &ip_hash)?;
@@ -756,7 +775,12 @@ fn submit_post_with_preparation(
         )
         .map_err(anyhow::Error::new)
     };
-    let (post_id, thread_id, redirect_url, prune_board_id) = match mode {
+    let pending_media_board = uploads
+        .primary
+        .as_ref()
+        .filter(|upload| upload.processing_pending)
+        .map(|_upload| board.short_name.as_str());
+    let (post_id, thread_id, redirect_url, prune_board_id, created_at) = match mode {
         SubmitPostMode::NewThread {
             subject,
             poll_question,
@@ -820,17 +844,18 @@ fn submit_post_with_preparation(
                 &new_post,
                 &submission_token,
                 poll_insert.as_ref(),
-                db::threads::PostFilesystemCommit::new_with_validation(
+                db::threads::PostFilesystemCommit::new_with_media_validation(
                     pending_upload_op.as_ref(),
                     &deduplicated_paths,
                     true,
+                    pending_media_board,
                     validate,
                 ),
             );
-            let (thread_id, post_id, _) = match create_result {
-                Ok(db::threads::PostCreationOutcome::Created(ids)) => {
+            let ((thread_id, post_id, _), created_at) = match create_result {
+                Ok(db::threads::PostCreationOutcome::Created(ids, created_at)) => {
                     drop(recovered_conn);
-                    ids
+                    (ids, created_at)
                 }
                 Ok(db::threads::PostCreationOutcome::Replayed(existing)) => {
                     let result =
@@ -850,6 +875,7 @@ fn submit_post_with_preparation(
                 thread_id,
                 format!("/{}/thread/{thread_id}#p{post_id}", board.short_name),
                 Some(board.id),
+                created_at,
             )
         }
         SubmitPostMode::Reply {
@@ -873,21 +899,22 @@ fn submit_post_with_preparation(
                 false,
             );
             let recovered_conn = checkout_post_connection(pool, &uploads, &upload_dir)?;
-            let post_id = match db::threads::create_reply_submission(
+            let (post_id, created_at) = match db::threads::create_reply_submission(
                 &recovered_conn,
                 &new_post,
                 &submission_token,
                 should_bump,
-                db::threads::PostFilesystemCommit::new_with_validation(
+                db::threads::PostFilesystemCommit::new_with_media_validation(
                     pending_upload_op.as_ref(),
                     &deduplicated_paths,
                     false,
+                    pending_media_board,
                     validate,
                 ),
             ) {
-                Ok(db::threads::PostCreationOutcome::Created(post_id)) => {
+                Ok(db::threads::PostCreationOutcome::Created(post_id, created_at)) => {
                     drop(recovered_conn);
-                    post_id
+                    (post_id, created_at)
                 }
                 Ok(db::threads::PostCreationOutcome::Replayed(existing)) => {
                     let result =
@@ -910,35 +937,40 @@ fn submit_post_with_preparation(
                 thread_id,
                 format!("/{}/thread/{thread_id}#p{post_id}", board.short_name),
                 None,
+                created_at,
             )
         }
     };
 
     finalize_pending_uploads(pool, &upload_dir, &uploads);
-    crate::handlers::enqueue_post_jobs(
+    if let Err(error) = crate::handlers::enqueue_post_jobs(
         job_queue,
         pool,
         post_id,
         &ip_hash,
         body_text.len(),
-        uploads.primary.as_ref(),
+        None,
         &board.short_name,
-    )?;
-    if let Some(prune_board_id) = prune_board_id {
-        let recovered_conn = pool.get()?;
-        if let Err(error) = job_queue.notify_persisted_thread_prune(&recovered_conn) {
-            tracing::warn!(
-                target: "workers",
-                board = %board.short_name,
-                board_id = prune_board_id,
-                error = %error,
-                "durable board prune intent persisted but worker notification accounting failed"
-            );
+    ) {
+        tracing::warn!(target: "workers", post_id, %error, "post committed; auxiliary scheduling failed");
+    }
+    if prune_board_id.is_some() || pending_media_board.is_some() {
+        if let Err(error) = pool
+            .get()
+            .map_err(anyhow::Error::new)
+            .and_then(|notification_conn| {
+                job_queue.notify_persisted_thread_prune(&notification_conn)
+            })
+        {
+            tracing::warn!(target: "workers", post_id, %error, "durable posting work will be discovered by worker polling");
         }
+    }
+    if let Some(prune_board_id) = prune_board_id {
         tracing::info!(
             target: "board",
             board = %board.short_name,
             thread_id = thread_id,
+            board_id = prune_board_id,
             "Created new thread"
         );
     } else {
@@ -953,17 +985,13 @@ fn submit_post_with_preparation(
         );
     }
 
-    let recovered_conn = pool.get()?;
-    let stored_post = db::get_post(&recovered_conn, post_id)?
-        .ok_or_else(|| AppError::NotFound("Posted row not found.".into()))?;
-
     Ok(SubmitPostResult {
         redirect_url,
         board_short: board.short_name,
         thread_id,
         post_id,
         deletion_token,
-        created_at: stored_post.created_at,
+        created_at,
     })
 }
 
@@ -1110,7 +1138,7 @@ mod tests {
         }
     }
 
-    fn reply_command(
+    pub(super) fn reply_command(
         board_short: &str,
         thread_id: i64,
         submission_token: &str,
@@ -1159,7 +1187,7 @@ mod tests {
         ))
     }
 
-    fn one_pixel_png() -> Result<Vec<u8>> {
+    pub(super) fn one_pixel_png() -> Result<Vec<u8>> {
         let mut bytes = Vec::new();
         image::DynamicImage::new_rgba8(1, 1)
             .write_to(
@@ -1190,7 +1218,7 @@ mod tests {
         include_bytes!("../../tests/fixtures/media/video.mp4").to_vec()
     }
 
-    fn pending_upload_stage_count(upload_dir: &std::path::Path) -> Result<usize> {
+    pub(super) fn pending_upload_stage_count(upload_dir: &std::path::Path) -> Result<usize> {
         let pending = upload_dir.join(".pending");
         if !pending.exists() {
             return Ok(0);
@@ -2934,7 +2962,7 @@ mod tests {
     }
 
     /// Replace the test state's pool with one connection to expose nested borrowing.
-    fn single_connection_state() -> Result<crate::middleware::AppState> {
+    pub(super) fn single_connection_state() -> Result<crate::middleware::AppState> {
         let mut state = crate::test_support::app_state();
         let path = {
             let conn = state.db.get()?;
@@ -3018,7 +3046,12 @@ mod tests {
                     }
                     Ok(())
                 });
-            assert!(matches!(result, Err(AppError::Forbidden(_))));
+            let expected = if archived {
+                "This thread is archived."
+            } else {
+                "This thread is locked."
+            };
+            assert!(matches!(result, Err(AppError::Forbidden(message)) if message == expected));
             let recovered_conn = state.db.get()?;
             assert_eq!(
                 crate::db::get_posts_for_thread(&recovered_conn, thread)?.len(),
@@ -3188,3 +3221,7 @@ mod tests {
 #[cfg(test)]
 /// Opt-in posting/media connection-lifetime measurements.
 mod performance;
+
+#[cfg(test)]
+/// End-to-end regression coverage for retries and stale posting state.
+mod lifecycle_tests;
diff --git a/src/handlers/posting/lifecycle_tests.rs b/src/handlers/posting/lifecycle_tests.rs
new file mode 100644
index 00000000..edac71b1
--- /dev/null
+++ b/src/handlers/posting/lifecycle_tests.rs
@@ -0,0 +1,186 @@
+//! Shared posting-service regressions including staged media and mutable policy.
+
+use super::tests::{reply_command, single_connection_state, temp_upload, thread_command};
+use super::*;
+use anyhow::{ensure, Context as _};
+
+#[test]
+fn committed_reply_replays_after_lock_or_archive_and_deleted_retry_does_not_repost(
+) -> anyhow::Result<()> {
+    for archived in [false, true] {
+        let state = crate::test_support::app_state();
+        let uploads = tempfile::tempdir()?;
+        let path = uploads.path().to_str().context("upload path")?;
+        db::create_board(&*state.db.get()?, "test", "Test", "", false).map(|_board| ())?;
+        let op = submit_post(
+            &state.db,
+            &state.job_queue,
+            thread_command("test", "op", "op", path),
+        )?;
+        let reply = submit_post(
+            &state.db,
+            &state.job_queue,
+            reply_command("test", op.thread_id, "reply", "reply", path),
+        )?;
+        {
+            let conn = state.db.get()?;
+            if archived {
+                db::set_thread_archived(&conn, op.thread_id, true)?;
+            } else {
+                db::set_thread_locked(&conn, op.thread_id, true)?;
+            }
+        }
+        let retry = submit_post(
+            &state.db,
+            &state.job_queue,
+            reply_command(
+                "test",
+                op.thread_id,
+                "reply",
+                "different content ignored",
+                path,
+            ),
+        )?;
+        ensure!(retry.post_id == reply.post_id && retry.redirect_url == reply.redirect_url);
+        db::delete_post(&*state.db.get()?, reply.post_id).map(|_cleanup| ())?;
+        ensure!(matches!(
+            submit_post(
+                &state.db,
+                &state.job_queue,
+                reply_command("test", op.thread_id, "reply", "retry", path)
+            ),
+            Err(AppError::NotFound(_))
+        ));
+        db::delete_thread(&*state.db.get()?, op.thread_id).map(|_cleanup| ())?;
+        ensure!(matches!(
+            submit_post(
+                &state.db,
+                &state.job_queue,
+                thread_command("test", "op", "retry", path)
+            ),
+            Err(AppError::NotFound(_))
+        ));
+        let conn = state.db.get()?;
+        ensure!(db::get_all_boards(&conn)?
+            .iter()
+            .all(
+                |board| db::count_threads_for_board(&conn, board.id).is_ok_and(|count| count == 0)
+            ));
+        ensure!(db::get_post(&conn, op.post_id)?.is_none());
+    }
+    Ok(())
+}
+
+#[test]
+fn reply_deleted_during_preparation_returns_not_found_and_cleans_staged_media() -> anyhow::Result<()>
+{
+    let state = single_connection_state()?;
+    let uploads = tempfile::tempdir()?;
+    let path = uploads.path().to_str().context("upload path")?;
+    db::create_board(&*state.db.get()?, "test", "Test", "", false).map(|_board| ())?;
+    let op = submit_post(
+        &state.db,
+        &state.job_queue,
+        thread_command("test", "op", "op", path),
+    )?;
+    let mut command = reply_command("test", op.thread_id, "deleted", "saved draft", path);
+    command.file_data = Some(temp_upload("image.png", &tests::one_pixel_png()?)?);
+    let result = submit_post_with_preparation(&state.db, &state.job_queue, command, || {
+        db::delete_thread(&*state.db.get()?, op.thread_id).map(|_cleanup| ())?;
+        Ok(())
+    });
+    ensure!(matches!(result, Err(AppError::NotFound(_))));
+    let conn = state.db.get()?;
+    ensure!(conn.is_autocommit());
+    ensure!(db::get_post_submission(&conn, "deleted", "actor", 1)?.is_none());
+    ensure!(tests::pending_upload_stage_count(uploads.path())? == 0);
+    Ok(())
+}
+
+#[test]
+fn failure_to_schedule_required_media_rolls_back_post_and_staged_files() -> anyhow::Result<()> {
+    let state = single_connection_state()?;
+    let uploads = tempfile::tempdir()?;
+    let path = uploads.path().to_str().context("upload path")?;
+    {
+        let conn = state.db.get()?;
+        db::create_board(&conn, "test", "Test", "", false).map(|_board| ())?;
+        conn.execute("UPDATE boards SET allow_audio=1", [])
+            .map(|_rows| ())?;
+        conn.execute_batch("CREATE TRIGGER reject_media BEFORE INSERT ON background_jobs WHEN NEW.job_type='audio_waveform' BEGIN SELECT RAISE(ABORT, 'injected media failure'); END;")?;
+    }
+    let mut command = thread_command("test", "media", "", path);
+    command.file_data = Some(temp_upload(
+        "tone.flac",
+        include_bytes!("../../../tests/fixtures/media/tone.flac"),
+    )?);
+    ensure!(submit_post(&state.db, &state.job_queue, command).is_err());
+    let conn = state.db.get()?;
+    let rows: i64 = conn.query_row("SELECT (SELECT COUNT(*) FROM posts)+(SELECT COUNT(*) FROM threads)+(SELECT COUNT(*) FROM post_submissions)+(SELECT COUNT(*) FROM pending_fs_ops)", [], |row| row.get(0))?;
+    ensure!(rows == 0 && conn.is_autocommit());
+    ensure!(tests::pending_upload_stage_count(uploads.path())? == 0);
+    Ok(())
+}
+
+#[test]
+fn auxiliary_spam_job_failure_cannot_turn_a_committed_post_into_failure() -> anyhow::Result<()> {
+    let state = single_connection_state()?;
+    let uploads = tempfile::tempdir()?;
+    let path = uploads.path().to_str().context("upload path")?;
+    {
+        let conn = state.db.get()?;
+        db::create_board(&conn, "test", "Test", "", false).map(|_board| ())?;
+        conn.execute_batch("CREATE TRIGGER reject_spam BEFORE INSERT ON background_jobs WHEN NEW.job_type='spam_check' BEGIN SELECT RAISE(ABORT, 'injected spam failure'); END;")?;
+    }
+    let accepted = submit_post(
+        &state.db,
+        &state.job_queue,
+        thread_command("test", "committed", "accepted", path),
+    )?;
+    let conn = state.db.get()?;
+    ensure!(
+        db::get_post(&conn, accepted.post_id)?
+            .context("accepted post")?
+            .created_at
+            == accepted.created_at
+    );
+    ensure!(conn.is_autocommit());
+    Ok(())
+}
+
+#[test]
+fn lost_admin_session_is_rechecked_before_cooldown_bypass() -> anyhow::Result<()> {
+    let state = single_connection_state()?;
+    let uploads = tempfile::tempdir()?;
+    let path = uploads.path().to_str().context("upload path")?;
+    db::create_board(&*state.db.get()?, "test", "Test", "", false).map(|_board| ())?;
+    let op = submit_post(
+        &state.db,
+        &state.job_queue,
+        thread_command("test", "op", "op", path),
+    )?;
+    {
+        let conn = state.db.get()?;
+        conn.execute("UPDATE boards SET post_cooldown_secs=60", [])
+            .map(|_rows| ())?;
+        conn.execute(
+            "INSERT INTO admin_users(username,password_hash) VALUES('admin','test')",
+            [],
+        )
+        .map(|_rows| ())?;
+        conn.execute("INSERT INTO admin_sessions(id,admin_id,expires_at) VALUES('session',last_insert_rowid(),unixepoch()+3600)", []).map(|_rows| ())?;
+    }
+    let mut command = reply_command("test", op.thread_id, "lost-session", "reply", path);
+    command.admin_session_id = Some("session".into());
+    let result = submit_post_with_preparation(&state.db, &state.job_queue, command, || {
+        state
+            .db
+            .get()?
+            .execute("DELETE FROM admin_sessions", [])
+            .map(|_rows| ())?;
+        Ok(())
+    });
+    ensure!(matches!(result, Err(AppError::BadRequest(_))));
+    ensure!(db::get_posts_for_thread(&*state.db.get()?, op.thread_id)?.len() == 1);
+    Ok(())
+}
diff --git a/src/handlers/render.rs b/src/handlers/render.rs
index 448f361d..a062f203 100644
--- a/src/handlers/render.rs
+++ b/src/handlers/render.rs
@@ -12,20 +12,29 @@ pub(super) struct BoardPageData {
     pub pagination: Pagination,
     pub summaries: Vec<ThreadSummary>,
     pub is_admin: bool,
+    pub thread_preferences: std::collections::HashMap<i64, db::UserThreadPreference>,
 }
 
 pub(super) struct ThreadPageData {
+    pub window: templates::thread::ThreadWindow,
     pub board: Board,
     pub thread: Thread,
     pub posts: Vec<crate::models::Post>,
     pub poll: Option<PollData>,
     pub is_admin: bool,
+    pub thread_preference: db::UserThreadPreference,
     pub owned_post_controls: std::collections::BTreeMap<i64, templates::thread::OwnedPostControls>,
 }
 
 #[must_use]
 pub(super) fn board_page_etag_signature(data: &BoardPageData) -> String {
     let mut hasher = Sha256::new();
+    let mut preferences = data.thread_preferences.iter().collect::<Vec<_>>();
+    preferences.sort_by_key(|(id, _pref)| **id);
+    for (id, pref) in preferences {
+        update_sig_i64(&mut hasher, *id);
+        hasher.update([u8::from(pref.pinned), u8::from(pref.hidden)]);
+    }
     for summary in &data.summaries {
         update_thread_signature(&mut hasher, &summary.thread);
         update_sig_field(&mut hasher, &summary.omitted.to_string());
@@ -36,10 +45,26 @@ pub(super) fn board_page_etag_signature(data: &BoardPageData) -> String {
     hex::encode(hasher.finalize())
 }
 
+/// Hash all catalog metadata that changes the rendered cards or actions.
+#[must_use]
+pub(super) fn threads_etag_signature(threads: &[Thread]) -> String {
+    let mut hasher = Sha256::new();
+    for thread in threads {
+        update_thread_signature(&mut hasher, thread);
+    }
+    hex::encode(hasher.finalize())
+}
+
 #[must_use]
 pub(super) fn thread_page_etag_signature(data: &ThreadPageData) -> String {
     let mut hasher = Sha256::new();
     update_thread_signature(&mut hasher, &data.thread);
+    hasher.update([u8::from(data.window.historical)]);
+    update_sig_i64(&mut hasher, data.window.older_before.unwrap_or(0));
+    hasher.update([
+        u8::from(data.thread_preference.pinned),
+        u8::from(data.thread_preference.hidden),
+    ]);
     for post in &data.posts {
         update_post_signature(&mut hasher, post);
     }
@@ -63,6 +88,13 @@ fn update_sig_i64(hasher: &mut Sha256, value: i64) {
 fn update_thread_signature(hasher: &mut Sha256, thread: &Thread) {
     update_sig_i64(hasher, thread.id);
     update_sig_i64(hasher, thread.bumped_at);
+    update_sig_i64(hasher, thread.created_at);
+    update_sig_i64(hasher, thread.op_id.unwrap_or(0));
+    update_sig_i64(hasher, thread.last_post_at);
+    update_sig_i64(hasher, thread.image_count);
+    update_sig_field(hasher, thread.subject.as_deref().unwrap_or(""));
+    update_sig_field(hasher, thread.op_body.as_deref().unwrap_or(""));
+    update_sig_field(hasher, thread.op_name.as_deref().unwrap_or(""));
     update_sig_field(hasher, if thread.locked { "1" } else { "0" });
     update_sig_field(hasher, if thread.sticky { "1" } else { "0" });
     update_sig_field(hasher, if thread.archived { "1" } else { "0" });
@@ -109,12 +141,22 @@ pub(super) fn load_board_page_data(
     threads_per_page: i64,
     preview_replies: i64,
     is_admin: bool,
+    viewer_key: &str,
 ) -> Result<BoardPageData> {
-    let total = db::count_threads_for_board(conn, board.id)?;
+    let tx = conn.unchecked_transaction()?;
+    let thread_preferences = db::get_preferences_for_board(&tx, viewer_key, board.id)?;
+    let total = db::count_threads_for_viewer(&tx, board.id, viewer_key, false)?;
     let pagination = Pagination::new(page, threads_per_page, total);
-    let threads = db::get_threads_for_board(conn, board.id, threads_per_page, pagination.offset())?;
+    let threads = db::get_threads_for_viewer(
+        &tx,
+        board.id,
+        viewer_key,
+        false,
+        threads_per_page,
+        pagination.offset(),
+    )?;
     let thread_ids = threads.iter().map(|thread| thread.id).collect::<Vec<_>>();
-    let mut previews = db::get_preview_posts_for_threads(conn, &thread_ids, preview_replies)?;
+    let mut previews = db::get_preview_posts_for_threads(&tx, &thread_ids, preview_replies)?;
     let summaries = threads
         .into_iter()
         .map(|thread| {
@@ -132,11 +174,13 @@ pub(super) fn load_board_page_data(
             }
         })
         .collect();
+    tx.commit()?;
     Ok(BoardPageData {
         board,
         pagination,
         summaries,
         is_admin,
+        thread_preferences,
     })
 }
 
@@ -174,6 +218,7 @@ pub(super) fn render_board_page(
         current_theme,
         data.board.collapse_greentext,
         can_post,
+        &data.thread_preferences,
         user_preferences,
     )
 }
@@ -187,21 +232,51 @@ pub(super) fn load_thread_page_data(
     cookie_secret: &str,
     is_admin: bool,
 ) -> Result<ThreadPageData> {
+    load_thread_page_data_before(
+        conn,
+        board,
+        thread_id,
+        client_ip,
+        cookie_secret,
+        is_admin,
+        None,
+    )
+}
+
+/// Load a bounded historical or current thread window.
+pub(super) fn load_thread_page_data_before(
+    conn: &rusqlite::Connection,
+    board: Board,
+    thread_id: i64,
+    client_ip: &str,
+    cookie_secret: &str,
+    is_admin: bool,
+    before: Option<i64>,
+) -> Result<ThreadPageData> {
+    let tx = conn.unchecked_transaction()?;
     let board_id = board.id;
-    let thread = db::get_thread(conn, thread_id)?
+    let thread = db::get_thread(&tx, thread_id)?
         .ok_or_else(|| AppError::NotFound(format!("Thread {thread_id} not found")))?;
     if thread.board_id != board_id {
         return Err(AppError::NotFound("Thread not found in this board.".into()));
     }
-    let posts = db::get_posts_for_thread(conn, thread_id)?;
+    let (posts, older_before) = db::get_thread_post_window(&tx, thread_id, before)?;
     let ip_hash = hash_ip(client_ip, cookie_secret);
-    let poll = db::get_poll_for_thread(conn, thread_id, &ip_hash)?;
+    let poll = db::get_poll_for_thread(&tx, thread_id, &ip_hash)?;
+    let thread_preference =
+        db::get_thread_preference(&tx, &ip_hash, thread_id)?.unwrap_or_default();
+    tx.commit()?;
     Ok(ThreadPageData {
+        window: templates::thread::ThreadWindow {
+            older_before,
+            historical: before.is_some(),
+        },
         board,
         thread,
         posts,
         poll,
         is_admin,
+        thread_preference,
         owned_post_controls: std::collections::BTreeMap::new(),
     })
 }
@@ -223,7 +298,7 @@ pub(super) fn render_thread_page(
     user_preferences: templates::UserPreferences,
 ) -> String {
     let boards = templates::live_boards();
-    templates::thread_page(
+    templates::thread::thread_page_window(
         &data.board,
         &data.thread,
         &data.posts,
@@ -240,7 +315,9 @@ pub(super) fn render_thread_page(
         current_theme,
         data.board.collapse_greentext,
         can_post,
+        data.thread_preference,
         user_preferences,
+        data.window,
     )
 }
 
@@ -249,6 +326,7 @@ mod tests {
     use super::{
         board_page_etag_signature, thread_page_etag_signature, BoardPageData, ThreadPageData,
     };
+    use crate::db;
     use crate::models::{
         Board, Pagination, Poll, PollData, PollOption, Post, Thread, ThreadSummary,
     };
@@ -355,19 +433,23 @@ mod tests {
     fn thread_page_etag_changes_when_reply_is_removed() {
         let board = sample_board();
         let before = ThreadPageData {
+            window: crate::templates::thread::ThreadWindow::default(),
             board: board.clone(),
             thread: sample_thread(2),
             posts: vec![sample_post(1), sample_post(2), sample_post(3)],
             poll: None,
             is_admin: false,
+            thread_preference: db::UserThreadPreference::default(),
             owned_post_controls: std::collections::BTreeMap::new(),
         };
         let after = ThreadPageData {
+            window: crate::templates::thread::ThreadWindow::default(),
             board,
             thread: sample_thread(1),
             posts: vec![sample_post(1), sample_post(3)],
             poll: None,
             is_admin: false,
+            thread_preference: db::UserThreadPreference::default(),
             owned_post_controls: std::collections::BTreeMap::new(),
         };
 
@@ -387,11 +469,13 @@ mod tests {
         pending_post.media_processing_state = Some("pending".into());
 
         let before = ThreadPageData {
+            window: crate::templates::thread::ThreadWindow::default(),
             board: board.clone(),
             thread: sample_thread(1),
             posts: vec![sample_post(1), pending_post.clone()],
             poll: None,
             is_admin: false,
+            thread_preference: db::UserThreadPreference::default(),
             owned_post_controls: std::collections::BTreeMap::new(),
         };
 
@@ -400,11 +484,13 @@ mod tests {
         pending_post.media_processing_state = None;
 
         let after = ThreadPageData {
+            window: crate::templates::thread::ThreadWindow::default(),
             board,
             thread: sample_thread(1),
             posts: vec![sample_post(1), pending_post],
             poll: None,
             is_admin: false,
+            thread_preference: db::UserThreadPreference::default(),
             owned_post_controls: std::collections::BTreeMap::new(),
         };
 
@@ -418,19 +504,23 @@ mod tests {
     fn thread_page_etag_changes_when_poll_vote_count_changes() {
         let board = sample_board();
         let before = ThreadPageData {
+            window: crate::templates::thread::ThreadWindow::default(),
             board: board.clone(),
             thread: sample_thread(0),
             posts: vec![sample_post(1)],
             poll: Some(sample_poll_data(None, [0, 0])),
             is_admin: false,
+            thread_preference: db::UserThreadPreference::default(),
             owned_post_controls: std::collections::BTreeMap::new(),
         };
         let after = ThreadPageData {
+            window: crate::templates::thread::ThreadWindow::default(),
             board,
             thread: sample_thread(0),
             posts: vec![sample_post(1)],
             poll: Some(sample_poll_data(Some(11), [1, 0])),
             is_admin: false,
+            thread_preference: db::UserThreadPreference::default(),
             owned_post_controls: std::collections::BTreeMap::new(),
         };
 
@@ -444,19 +534,23 @@ mod tests {
     fn thread_page_etag_changes_when_poll_viewer_vote_state_changes() {
         let board = sample_board();
         let before = ThreadPageData {
+            window: crate::templates::thread::ThreadWindow::default(),
             board: board.clone(),
             thread: sample_thread(0),
             posts: vec![sample_post(1)],
             poll: Some(sample_poll_data(None, [1, 0])),
             is_admin: false,
+            thread_preference: db::UserThreadPreference::default(),
             owned_post_controls: std::collections::BTreeMap::new(),
         };
         let after = ThreadPageData {
+            window: crate::templates::thread::ThreadWindow::default(),
             board,
             thread: sample_thread(0),
             posts: vec![sample_post(1)],
             poll: Some(sample_poll_data(Some(11), [1, 0])),
             is_admin: false,
+            thread_preference: db::UserThreadPreference::default(),
             owned_post_controls: std::collections::BTreeMap::new(),
         };
 
@@ -478,6 +572,7 @@ mod tests {
                 omitted: 0,
             }],
             is_admin: false,
+            thread_preferences: std::collections::HashMap::new(),
         };
         let after = BoardPageData {
             board,
@@ -488,6 +583,7 @@ mod tests {
                 omitted: 0,
             }],
             is_admin: false,
+            thread_preferences: std::collections::HashMap::new(),
         };
 
         assert_ne!(
@@ -515,6 +611,7 @@ mod tests {
                 omitted: 0,
             }],
             is_admin: false,
+            thread_preferences: std::collections::HashMap::new(),
         };
         let after = BoardPageData {
             board,
@@ -525,6 +622,7 @@ mod tests {
                 omitted: 0,
             }],
             is_admin: false,
+            thread_preferences: std::collections::HashMap::new(),
         };
 
         assert_ne!(
diff --git a/src/handlers/setup.rs b/src/handlers/setup.rs
index 83a9cf5e..44f2cddd 100644
--- a/src/handlers/setup.rs
+++ b/src/handlers/setup.rs
@@ -645,7 +645,14 @@ pub(in crate::server) async fn setup_review(
             .admin_password
             .as_deref()
             .ok_or_else(|| AppError::BadRequest("Initial admin password is required.".into()))?;
-        let password_hash = crypto::hash_password(password)?;
+        let password = password.to_owned();
+        let permit = state.password_work_gate.try_begin()?;
+        let password_hash = tokio::task::spawn_blocking(move || {
+            let _password_permit = permit;
+            crypto::hash_password(&password)
+        })
+        .await
+        .map_err(|error| AppError::Internal(error.into()))??;
         let token = crypto::random_hex(32);
         jar = jar.add(make_pending_admin_hash_cookie(
             &token,
@@ -690,9 +697,23 @@ pub(in crate::server) async fn setup_finish(
             .map_err(|errors| AppError::BadRequest(errors.join(" ")))?;
     let board_slug = parsed.board_slug.clone();
     let auto_backup_settings = state.auto_full_backup_settings.clone();
+    let permit = state.password_work_gate.try_begin()?;
     tokio::task::spawn_blocking({
         let pool = state.db.clone();
         move || -> Result<()> {
+            let _password_permit = permit;
+            // Hash before beginning a write transaction; availability and admin
+            // presence are rechecked under the transaction before publication.
+            let prepared_hash = pending_admin_hash;
+            let prepared_hash = if prepared_hash.is_some() {
+                prepared_hash
+            } else {
+                parsed
+                    .admin_password
+                    .as_deref()
+                    .map(crypto::hash_password)
+                    .transpose()?
+            };
             let mut conn = pool.get()?;
             let tx = conn.transaction()?;
             db::ensure_setup_available(&tx)
@@ -704,15 +725,10 @@ pub(in crate::server) async fn setup_finish(
                 let username = parsed.admin_username.as_deref().ok_or_else(|| {
                     AppError::BadRequest("Initial admin username is required.".into())
                 })?;
-                let password_hash = if let Some(hash) = pending_admin_hash.as_deref() {
-                    hash.to_owned()
-                } else {
-                    let password = parsed.admin_password.as_deref().ok_or_else(|| {
-                        AppError::BadRequest("Initial admin password is required.".into())
-                    })?;
-                    crypto::hash_password(password)?
-                };
-                db::create_admin(&tx, username, &password_hash).map(|_completed_value| ())?;
+                let password_hash = prepared_hash.as_deref().ok_or_else(|| {
+                    AppError::BadRequest("Initial admin password is required.".into())
+                })?;
+                db::create_admin(&tx, username, password_hash).map(|_completed_value| ())?;
             }
             if db::board_slug_exists(&tx, &parsed.board_slug)? {
                 return Err(AppError::Conflict(format!(
diff --git a/src/handlers/thread.rs b/src/handlers/thread.rs
index 95d63071..b490e15a 100644
--- a/src/handlers/thread.rs
+++ b/src/handlers/thread.rs
@@ -2,7 +2,7 @@
 const LOG_TARGET: &str = concat!(env!("CARGO_CRATE_NAME"), "::handlers::thread");
 
 // Routes:
-//   GET  /:board/thread/:id   — view thread with all posts
+//   GET  /:board/thread/:id   — view a bounded thread window
 //   POST /:board/thread/:id   — post a reply
 //   POST /vote                — cast a poll vote
 
@@ -52,6 +52,14 @@ pub(in crate::server) async fn view_thread(
     req_headers: HeaderMap,
     peer: crate::middleware::SecureCookieContext,
 ) -> Result<Response> {
+    if params.before.is_some_and(|id| id <= 0) || params.post.is_some_and(|id| id <= 0) {
+        return Err(AppError::BadRequest(
+            "Thread cursors must be positive post IDs.".into(),
+        ));
+    }
+    // The largest SQLite ID is already in the latest window; it cannot have
+    // an exclusive successor cursor. Preserve post focus at that boundary.
+    let before = params.post.map_or(params.before, |id| id.checked_add(1));
     let current_theme = crate::handlers::board::current_theme_from_jar(&jar);
     let user_preferences = crate::handlers::board::user_preferences_from_jar(&jar);
     let (jar, csrf) = ensure_csrf_for_request(jar, &req_headers, peer);
@@ -93,13 +101,14 @@ pub(in crate::server) async fn view_thread(
         let pool = state.db.clone();
         move || -> Result<ThreadViewLoadResult> {
             let conn = pool.get()?;
-            let page_data = render::load_thread_page_data(
+            let page_data = render::load_thread_page_data_before(
                 &conn,
                 board,
                 thread_id,
                 &identity_key,
                 &CONFIG.cookie_secret,
                 is_admin,
+                before,
             )?;
             let effective_is_admin = page_data.is_admin;
             let thread_badges_enabled = db::get_thread_new_reply_badges_enabled(&conn);
@@ -221,7 +230,7 @@ pub(in crate::server) async fn view_thread(
         ));
         drop(resp.headers_mut().insert(
             header::CACHE_CONTROL,
-            HeaderValue::from_static(crate::handlers::board::activity_html_cache_control(
+            HeaderValue::from_static(crate::handlers::board::personal_html_cache_control(
                 activity_markers_enabled,
             )),
         ));
@@ -229,10 +238,10 @@ pub(in crate::server) async fn view_thread(
         return Ok((jar, resp).into_response());
     }
 
-    let success_message = if params.reported.as_deref() == Some("1") {
-        Some("Report submitted. Thank you.")
-    } else {
-        None
+    let success_message = match params.reported.as_deref() {
+        Some("1") => Some("Report submitted. Thank you."),
+        Some("duplicate") => Some("A matching report is already open. Thank you."),
+        _ => None,
     };
     // HTML assembly is CPU work on already-owned data; keep it off the async workers.
     let html = tokio::task::spawn_blocking(move || {
@@ -257,7 +266,7 @@ pub(in crate::server) async fn view_thread(
     }
     drop(resp.headers_mut().insert(
         header::CACHE_CONTROL,
-        HeaderValue::from_static(crate::handlers::board::activity_html_cache_control(
+        HeaderValue::from_static(crate::handlers::board::personal_html_cache_control(
             activity_markers_enabled,
         )),
     ));
@@ -519,6 +528,8 @@ pub(in crate::server) async fn post_reply(
 #[derive(Deserialize, Default)]
 pub(in crate::server) struct ThreadPageQuery {
     pub reported: Option<String>,
+    pub before: Option<i64>,
+    pub post: Option<i64>,
 }
 
 struct SelfActionPostContext {
@@ -782,6 +793,7 @@ pub(in crate::server) async fn edit_post_post(
     let board_short_for_edit = board_short.clone();
     let outcome = tokio::task::spawn_blocking({
         let pool = state.db.clone();
+        let admin_session_id = admin_session_id.clone();
         let raw_body = raw_body.clone();
         let deletion_token = owned_grant.deletion_token.clone();
         move || -> Result<String> {
@@ -825,14 +837,24 @@ pub(in crate::server) async fn edit_post_post(
             let body_html =
                 crate::utils::sanitize::render_post_body(&escaped, board.collapse_greentext);
 
-            let success = db::edit_post(
-                &conn,
-                post_id,
-                &deletion_token,
-                &body_text,
-                &body_html,
+            let success = db::posts::edit_post_with_validation(
+                &conn, post_id, &deletion_token, &body_text, &body_html,
                 crate::handlers::board::self_action_window_secs(),
-            )?;
+                |validation_conn| {
+                    let current = crate::handlers::board::load_board_access_context(
+                        validation_conn, &board_short_for_edit, admin_session_id.as_deref(), access_cookie.as_deref(),
+                    )?;
+                    if !current.can_post || !current.board.allow_editing || current.board.id != post.board_id {
+                        return Err(AppError::Forbidden("Board editing permission changed. Reload the page.".into()));
+                    }
+                    let current_filters: Vec<_> = db::get_word_filters(validation_conn)?.into_iter()
+                        .map(|filter| (filter.pattern, filter.replacement)).collect();
+                    if current_filters != filters || current.board.collapse_greentext != board.collapse_greentext {
+                        return Err(AppError::Conflict("Board posting settings changed. Reload the page.".into()));
+                    }
+                    Ok(())
+                },
+            ).map_err(posting::post_creation_error)?;
 
             if !success {
                 return Err(AppError::Forbidden(
@@ -1059,11 +1081,28 @@ pub(in crate::server) async fn delete_own_post(
             }
 
             let redirect_thread_id = post.thread_id;
-            let (result, deleted) = db::posts::self_delete_post(
+            let (result, deleted) = db::posts::self_delete_post_with_validation(
                 &conn,
                 post_id,
                 &deletion_token,
                 crate::handlers::board::self_action_window_secs(),
+                |validation_conn| {
+                    let current = crate::handlers::board::load_board_access_context(
+                        validation_conn,
+                        &board_short_for_delete,
+                        admin_session_id.as_deref(),
+                        access_cookie.as_deref(),
+                    )?;
+                    if !current.can_post
+                        || !current.board.allow_self_delete
+                        || current.board.id != post.board_id
+                    {
+                        return Err(AppError::Forbidden(
+                            "Board deletion permission changed. Reload the page.".into(),
+                        ));
+                    }
+                    Ok(())
+                },
             )?;
 
             if let Some(deleted) = deleted.as_ref() {
@@ -1213,7 +1252,7 @@ pub(in crate::server) async fn vote_handler(
             let recorded = db::cast_vote(&conn, poll_id, option_id, &ip_hash)?;
             if !recorded {
                 return Err(AppError::BadRequest(
-                    "This poll has closed or you have already voted.".into(),
+                    "This poll is closed, archived, or you have already voted.".into(),
                 ));
             }
             tracing::info!(
diff --git a/src/middleware/csrf.rs b/src/middleware/csrf.rs
index a7a29b36..39c35322 100644
--- a/src/middleware/csrf.rs
+++ b/src/middleware/csrf.rs
@@ -22,6 +22,9 @@ pub fn validate_csrf(cookie_token: Option<&str>, form_token: &str) -> bool {
     if raw.is_empty() || sig.is_empty() {
         return false;
     }
+    if cookie_token.is_some_and(|cookie| !constant_time_eq(cookie.as_bytes(), raw.as_bytes())) {
+        return false;
+    }
 
     let expected = sign_csrf_token(raw, &CONFIG.cookie_secret);
     constant_time_eq(expected.as_bytes(), sig.as_bytes())
@@ -157,4 +160,17 @@ mod tests {
             "identical byte slices should compare equal"
         );
     }
+    #[test]
+    fn signed_public_token_cannot_override_a_different_browser_cookie() {
+        let token = crate::utils::crypto::make_csrf_form_token(
+            "attacker",
+            &crate::config::CONFIG.cookie_secret,
+        );
+        assert!(!validate_csrf(Some("victim"), &token));
+        assert!(validate_csrf(Some("attacker"), &token));
+        assert!(
+            validate_csrf(None, &token),
+            "cookie-disabled same-origin forms retain signed tokens"
+        );
+    }
 }
diff --git a/src/middleware/ip.rs b/src/middleware/ip.rs
index fb1651b1..27e287c0 100644
--- a/src/middleware/ip.rs
+++ b/src/middleware/ip.rs
@@ -8,14 +8,20 @@ use ipnet::IpNet;
 use std::convert::Infallible;
 use std::net::SocketAddr;
 
-/// Returns the first non-empty address in a forwarded-for header.
-fn forwarded_client_ip(value: &str) -> Option<String> {
-    value
-        .split(',')
-        .map(str::trim)
-        .find(|ip| !ip.is_empty())
-        .and_then(|ip| ip.parse::<std::net::IpAddr>().ok())
-        .map(|ip| ip.to_string())
+/// Walk an appended proxy chain from the trusted peer toward the first untrusted hop.
+fn forwarded_client_ip(
+    value: &str,
+    peer: SocketAddr,
+    trusted_proxy_cidrs: &[String],
+) -> Option<String> {
+    let mut client = peer.ip();
+    for forwarded in value.rsplit(',') {
+        if !trusted_proxy_peer_with(Some(SocketAddr::new(client, 0)), trusted_proxy_cidrs) {
+            break;
+        }
+        client = forwarded.trim().parse::<std::net::IpAddr>().ok()?;
+    }
+    Some(client.to_string())
 }
 
 /// Returns whether the peer belongs to a configured trusted proxy network.
@@ -48,7 +54,7 @@ pub(super) fn forwarded_proto_is_https(
         .and_then(|value| value.to_str().ok())
         .is_some_and(|value| {
             value
-                .split(',')
+                .rsplit(',')
                 .next()
                 .is_some_and(|proto| proto.trim().eq_ignore_ascii_case("https"))
         })
@@ -65,6 +71,17 @@ fn forwarded_ip_from_headers_with(
         return None;
     }
 
+    // An appending proxy preserves attacker-supplied left-hand values. Prefer
+    // its authoritative chain over X-Real-IP and stop at the first untrusted hop.
+    if headers.contains_key("x-forwarded-for") {
+        let mut values = headers.get_all("x-forwarded-for").iter();
+        let value = values.next()?.to_str().ok()?;
+        if values.next().is_some() {
+            return None;
+        }
+        return forwarded_client_ip(value, peer?, trusted_proxy_cidrs);
+    }
+
     if let Some(value) = headers
         .get("x-real-ip")
         .and_then(|header_value| header_value.to_str().ok())
@@ -74,10 +91,7 @@ fn forwarded_ip_from_headers_with(
         return Some(value.to_string());
     }
 
-    headers
-        .get("x-forwarded-for")
-        .and_then(|header_value| header_value.to_str().ok())
-        .and_then(forwarded_client_ip)
+    None
 }
 
 /// Resolves the effective client identity from Tor, proxy, or peer metadata.
@@ -176,19 +190,21 @@ mod tests {
     }
 
     #[test]
-    fn forwarded_ip_prefers_leftmost_hop() {
+    fn forwarded_ip_ignores_spoofed_leftmost_hops() {
+        let peer = SocketAddr::from(([127, 0, 0, 1], 8080));
+        let trusted = vec!["127.0.0.1/32".to_owned(), "10.0.0.0/8".to_owned()];
         assert_eq!(
-            forwarded_client_ip("198.51.100.10, 203.0.113.7, 10.0.0.1").as_deref(),
-            Some("198.51.100.10")
+            forwarded_client_ip("198.51.100.10, 203.0.113.7, 10.0.0.1", peer, &trusted).as_deref(),
+            Some("203.0.113.7")
         );
-    }
-
-    #[test]
-    fn forwarded_ip_skips_empty_entries() {
         assert_eq!(
-            forwarded_client_ip(" , 198.51.100.10").as_deref(),
+            forwarded_client_ip(" , 198.51.100.10", peer, &trusted).as_deref(),
             Some("198.51.100.10")
         );
+        assert_eq!(
+            forwarded_client_ip("198.51.100.10, invalid", peer, &trusted),
+            None
+        );
     }
 
     #[test]
@@ -297,9 +313,10 @@ mod tests {
         let trusted = vec!["127.0.0.1/32".to_owned()];
         assert_eq!(
             resolved_client_ip(&headers, Some(peer), true, &trusted, false),
-            "127.0.0.1",
-            "malformed proxy identities must not create arbitrary counters"
+            "203.0.113.1",
+            "spoofed left-hand values must not replace the first untrusted hop"
         );
+        drop(headers.remove("x-forwarded-for"));
         drop(headers.insert(
             "x-real-ip",
             HeaderValue::from_static("2001:0db8:0:0:0:0:0:1"),
diff --git a/src/middleware/mod.rs b/src/middleware/mod.rs
index bc80dfc9..fd91ac7c 100644
--- a/src/middleware/mod.rs
+++ b/src/middleware/mod.rs
@@ -6,8 +6,13 @@ mod csrf;
 mod ip;
 /// Request-path normalization.
 mod normalize;
+/// Concurrency admission for memory-hard authentication work.
+mod work_gate;
+
 /// Per-client request rate limiting.
 mod rate_limit;
+/// Bounded storage for browsing, action, and authentication budgets.
+mod rate_table;
 /// Shared application and maintenance state.
 mod state;
 /// Request transport metadata and cookie context.
@@ -19,6 +24,7 @@ pub use csrf::{validate_csrf, validate_signed_csrf};
 pub use ip::{extract_ip, ClientIp};
 pub use normalize::normalize_trailing_slash;
 pub use rate_limit::rate_limit_middleware;
+
 pub use state::{
     AppState, AutoFullBackupSettings, AutoFullBackupSettingsSnapshot, DbMaintenanceJobPhase,
     DbMaintenanceJobStatus, DbMaintenanceJobs, MaintenanceGate,
@@ -34,3 +40,17 @@ pub(crate) fn forwarded_proto_is_https(
 ) -> bool {
     ip::forwarded_proto_is_https(headers, peer, behind_proxy)
 }
+
+/// Non-queueing work allowance shared across clones of one application state.
+#[derive(Clone, Debug)]
+pub(crate) struct WorkGate {
+    /// Owned permits remain with blocking work after request cancellation.
+    semaphore: std::sync::Arc<tokio::sync::Semaphore>,
+}
+
+/// Bounded fixed-window storage for hashed visitor identities.
+#[derive(Debug, Default)]
+pub(crate) struct RateTable {
+    /// Serializes only admission and amortized expiration, never application work.
+    state: parking_lot::Mutex<rate_table::TableState>,
+}
diff --git a/src/middleware/rate_limit.rs b/src/middleware/rate_limit.rs
index c9cec6fc..346e1a55 100644
--- a/src/middleware/rate_limit.rs
+++ b/src/middleware/rate_limit.rs
@@ -5,17 +5,124 @@ use axum::{
     middleware::Next,
     response::{IntoResponse as _, Response},
 };
-use dashmap::DashMap;
-use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::LazyLock;
 use std::time::{SystemTime, UNIX_EPOCH};
 
-use super::ip::extract_ip;
+use super::{ip::extract_ip, RateTable};
 
-/// Per-client request count and window start, keyed by a client-address hash.
-static RATE_TABLE: LazyLock<DashMap<String, (u32, u64)>> = LazyLock::new(DashMap::new);
-/// Unix timestamp of the most recent rate-table cleanup.
-static LAST_CLEANUP_SECS: AtomicU64 = AtomicU64::new(0);
+/// Browsing state is capped independently of action-specific request budgets.
+static RATE_TABLE: LazyLock<RateTable> = LazyLock::new(RateTable::default);
+/// Each key hashes a client and a fixed action class, never a board or request path.
+static ACTION_TABLE: LazyLock<RateTable> = LazyLock::new(RateTable::default);
+
+/// Cost-sensitive request classes, independent of board cooldown configuration.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Action {
+    /// Thread creation across all boards.
+    Thread,
+    /// Replies across all threads and boards, including sage.
+    Reply,
+    /// Reports and appeals, including failed or duplicate requests.
+    Report,
+    /// Full-text count/sort work.
+    Search,
+    /// Login, board unlock, and first-run password hashing.
+    Password,
+    /// CAPTCHA image generation.
+    Captcha,
+    /// Other state-changing requests.
+    Mutation,
+}
+
+impl Action {
+    /// Per-minute request allowance and domain-separated identity label.
+    const fn policy(self) -> (&'static str, u32) {
+        match self {
+            Self::Thread => ("thread", 6),
+            Self::Reply => ("reply", 30),
+            Self::Report => ("report", 30),
+            Self::Search => ("search", 20),
+            Self::Password => ("password", 20),
+            Self::Captcha => ("captcha", 20),
+            Self::Mutation => ("mutation", 120),
+        }
+    }
+}
+
+/// Classify route shapes without creating state for attacker-controlled path values.
+fn request_action(method: &Method, path: &str) -> Option<Action> {
+    let mut parts = path.trim_matches('/').split('/');
+    let first = parts.next().unwrap_or_default();
+    let second = parts.next();
+    let third = parts.next();
+    let fourth = parts.next();
+    let no_more = parts.next().is_none();
+    if *method == Method::GET || *method == Method::HEAD {
+        return if second == Some("search") && third.is_none() {
+            Some(Action::Search)
+        } else if first == "captcha" && second.is_some() && third.is_none() {
+            Some(Action::Captcha)
+        } else {
+            None
+        };
+    }
+    if *method != Method::POST {
+        return None;
+    }
+    Some(
+        if matches!(first, "report" | "appeal") && second.is_none() {
+            Action::Report
+        } else if matches!(first, "vote" | "preferences") && second.is_none() {
+            Action::Mutation
+        } else if path == "/admin/login"
+            || path.starts_with("/setup/")
+            || (second == Some("unlock") && third.is_none())
+        {
+            Action::Password
+        } else if (!first.is_empty()
+            && first.len() <= 8
+            && first.bytes().all(|byte| byte.is_ascii_alphanumeric()))
+            && second.is_none()
+        {
+            Action::Thread
+        } else if second == Some("thread") && third.is_some() && fourth.is_none() && no_more {
+            Action::Reply
+        } else {
+            Action::Mutation
+        },
+    )
+}
+
+/// Hash one client/action key without retaining raw addresses or request values.
+fn budget_key(ip: &str, action: &str) -> String {
+    use sha2::{Digest as _, Sha256};
+    let mut hasher = Sha256::new();
+    hasher.update(ip.as_bytes());
+    hasher.update(b":");
+    hasher.update(action.as_bytes());
+    hex::encode(hasher.finalize())
+}
+
+/// Cheap retryable rejection; denied requests never allocate a form or query the DB.
+fn action_limit_response(retry_after: u64) -> Response {
+    let mut response = (
+        axum::http::StatusCode::TOO_MANY_REQUESTS,
+        "Too many requests for this action. Please wait and try again.",
+    )
+        .into_response();
+    if let Ok(value) = axum::http::HeaderValue::from_str(&retry_after.to_string()) {
+        drop(
+            response
+                .headers_mut()
+                .insert(axum::http::header::RETRY_AFTER, value),
+        );
+    }
+    drop(response.headers_mut().insert(
+        axum::http::header::CACHE_CONTROL,
+        axum::http::HeaderValue::from_static("private, no-store"),
+    ));
+    response
+}
 
 /// Returns the current Unix timestamp in whole seconds.
 fn now_secs() -> u64 {
@@ -37,44 +144,25 @@ fn counts_request(method: &Method, path: &str, policy: RateLimitPolicy) -> bool
         && (policy == RateLimitPolicy::Legacy || method == Method::GET || method == Method::HEAD)
 }
 
-/// Advance one visitor's counter using the historical whole-second boundary.
-const fn consume_budget(counter: &mut (u32, u64), now: u64, window: u64, limit: u32) -> bool {
-    let (count, window_start) = counter;
-    if now.saturating_sub(*window_start) > window {
-        *count = 1;
-        *window_start = now;
-        false
-    } else {
-        *count = count.saturating_add(1);
-        *count > limit
-    }
-}
-
 /// Apply the configured per-visitor browsing request limit.
 pub async fn rate_limit_middleware(req: Request, next: Next) -> Response {
+    let ip = extract_ip(&req);
+    let now = now_secs();
+    if let Some(action) = request_action(req.method(), req.uri().path()) {
+        let (label, allowance) = action.policy();
+        let key = budget_key(&ip, label);
+        if ACTION_TABLE.record(&key, now, 60) > allowance {
+            return action_limit_response(
+                ACTION_TABLE.retry_after(&key, now, allowance).unwrap_or(60),
+            );
+        }
+    }
     if !counts_request(req.method(), req.uri().path(), CONFIG.rate_limit_policy) {
         return next.run(req).await;
     }
-
-    let ip = extract_ip(&req);
-    let ip_key = {
-        use sha2::{Digest as _, Sha256};
-        let mut hasher = Sha256::new();
-        hasher.update(ip.as_bytes());
-        hasher.update(b"G");
-        hex::encode(hasher.finalize())
-    };
-
-    let now = now_secs();
-    let window = CONFIG.rate_limit_window;
-    let limit = CONFIG.rate_limit_gets;
-
-    let blocked = {
-        let mut binding = RATE_TABLE.entry(ip_key).or_insert((0, now));
-        let blocked = consume_budget(binding.value_mut(), now, window, limit);
-        drop(binding);
-        blocked
-    };
+    let ip_key = budget_key(&ip, "browse");
+    let blocked =
+        RATE_TABLE.record(&ip_key, now, CONFIG.rate_limit_window) > CONFIG.rate_limit_gets;
 
     if blocked {
         let jar = axum_extra::extract::CookieJar::from_headers(req.headers());
@@ -94,24 +182,12 @@ pub async fn rate_limit_middleware(req: Request, next: Next) -> Response {
             .into_response();
     }
 
-    let last_cleanup = LAST_CLEANUP_SECS.load(Ordering::Relaxed);
-    let should_clean = RATE_TABLE.len() > 5000 || now.saturating_sub(last_cleanup) > 600;
-    if should_clean
-        && LAST_CLEANUP_SECS
-            .compare_exchange(last_cleanup, now, Ordering::AcqRel, Ordering::Relaxed)
-            .is_ok()
-    {
-        RATE_TABLE.retain(|_, (_, window_start)| {
-            now.saturating_sub(*window_start) <= window.saturating_mul(2)
-        });
-    }
-
     next.run(req).await
 }
 
 #[cfg(test)]
 mod tests {
-    use super::{consume_budget, counts_request, Method, RateLimitPolicy};
+    use super::{counts_request, request_action, Action, Method, RateLimitPolicy};
 
     #[test]
     fn legacy_counts_writes_polling_and_nonexempt_assets() {
@@ -164,38 +240,29 @@ mod tests {
     }
 
     #[test]
-    fn budget_boundary_and_independent_visitors_preserve_defaults() {
-        let mut visitor_a = (0, 100);
-        let mut visitor_b = (0, 100);
-        assert!(
-            !consume_budget(&mut visitor_a, 100, 60, 2),
-            "first request allowed"
-        );
-        assert!(
-            !consume_budget(&mut visitor_a, 100, 60, 2),
-            "second request allowed"
-        );
-        assert!(
-            consume_budget(&mut visitor_a, 160, 60, 2),
-            "equal boundary retains historical limit"
-        );
-        assert!(
-            !consume_budget(&mut visitor_b, 160, 60, 2),
-            "other visitor remains independent"
-        );
-        assert!(
-            !consume_budget(&mut visitor_a, 161, 60, 2),
-            "greater boundary resets"
-        );
-        assert_eq!(visitor_a, (1, 161), "rollover consumes one request");
-    }
-
-    #[test]
-    fn counter_cannot_wrap_to_bypass_limit() {
-        let mut visitor = (u32::MAX, 100);
-        assert!(
-            consume_budget(&mut visitor, 101, 60, 60),
-            "saturated counter remains blocked"
-        );
+    fn action_budgets_cover_all_posting_and_expensive_entry_points() {
+        for (method, path, expected) in [
+            (Method::POST, "/b", Action::Thread),
+            (Method::POST, "/tech/", Action::Thread),
+            (Method::POST, "/b/thread/1", Action::Reply),
+            (Method::POST, "/b/thread/999999999999999999", Action::Reply),
+            (Method::POST, "/report", Action::Report),
+            (Method::POST, "/appeal", Action::Report),
+            (Method::GET, "/b/search", Action::Search),
+            (Method::HEAD, "/b/search", Action::Search),
+            (Method::GET, "/captcha/id", Action::Captcha),
+            (Method::POST, "/admin/login", Action::Password),
+            (Method::POST, "/b/unlock", Action::Password),
+            (Method::POST, "/setup/review", Action::Password),
+            (Method::POST, "/vote", Action::Mutation),
+        ] {
+            assert_eq!(
+                request_action(&method, path),
+                Some(expected),
+                "{method} {path}"
+            );
+        }
+        assert_eq!(request_action(&Method::GET, "/b/thread/1/updates"), None);
+        assert_eq!(request_action(&Method::GET, "/boards/b/test.webp"), None);
     }
 }
diff --git a/src/middleware/rate_table.rs b/src/middleware/rate_table.rs
new file mode 100644
index 00000000..a82066d2
--- /dev/null
+++ b/src/middleware/rate_table.rs
@@ -0,0 +1,145 @@
+//! Fixed-window budgets with bounded retention and atomic admission.
+
+use super::RateTable;
+use std::collections::HashMap;
+
+/// Maximum retained identities in each abuse-control table.
+const MAX_RATE_IDENTITIES: usize = 16_384;
+/// Minimum interval between whole-table expiration scans.
+const CLEANUP_INTERVAL_SECS: u64 = 60;
+
+#[derive(Debug)]
+/// One visitor/action counter and its exclusive expiration time.
+struct Counter {
+    /// Attempts admitted or rejected during this window.
+    count: u32,
+    /// First second outside the historical inclusive window.
+    expires_at: u64,
+}
+
+#[derive(Debug, Default)]
+/// Counters and cleanup scheduling protected by one short-lived lock.
+pub(super) struct TableState {
+    /// Fixed-size, hashed client/action keys; never request paths or cookies.
+    entries: HashMap<String, Counter>,
+    /// Last expiration scan, including scans of a saturated table.
+    last_cleanup: Option<u64>,
+}
+
+impl RateTable {
+    /// Reserve one attempt before work; saturation rejects new identities.
+    pub(crate) fn record(&self, key: &str, now: u64, window: u64) -> u32 {
+        let mut state = self.state.lock();
+        Self::prune_state(&mut state, now);
+        if !state.entries.contains_key(key) && state.entries.len() >= MAX_RATE_IDENTITIES {
+            return u32::MAX;
+        }
+        let counter = state
+            .entries
+            .entry(key.to_owned())
+            .or_insert_with(|| Counter {
+                count: 0,
+                expires_at: now.saturating_add(window).saturating_add(1),
+            });
+        if now >= counter.expires_at {
+            counter.count = 0;
+            counter.expires_at = now.saturating_add(window).saturating_add(1);
+        }
+        counter.count = counter.count.saturating_add(1);
+        let count = counter.count;
+        drop(state);
+        count
+    }
+
+    /// Return a retry delay for exhausted budgets or a saturated identity table.
+    pub(crate) fn retry_after(&self, key: &str, now: u64, limit: u32) -> Option<u64> {
+        let mut state = self.state.lock();
+        Self::prune_state(&mut state, now);
+        match state.entries.get(key) {
+            Some(counter) if now < counter.expires_at && counter.count >= limit => {
+                Some(counter.expires_at.saturating_sub(now).max(1))
+            }
+            None if state.entries.len() >= MAX_RATE_IDENTITIES => Some(CLEANUP_INTERVAL_SECS),
+            Some(_) | None => None,
+        }
+    }
+
+    /// Clear an authenticated visitor's failure counter.
+    pub(crate) fn remove(&self, key: &str) {
+        let _removed = self.state.lock().entries.remove(key);
+    }
+
+    /// Periodically expire counters even when request activity stops.
+    pub(crate) fn prune(&self, now: u64) {
+        Self::prune_state(&mut self.state.lock(), now);
+    }
+
+    /// Scan at most once a minute; saturation never causes a scan on every request.
+    fn prune_state(state: &mut TableState, now: u64) {
+        if state
+            .last_cleanup
+            .is_some_and(|last| now.saturating_sub(last) < CLEANUP_INTERVAL_SECS)
+        {
+            return;
+        }
+        state.entries.retain(|_, counter| now < counter.expires_at);
+        state.last_cleanup = Some(now);
+    }
+
+    #[cfg(test)]
+    /// Install a deterministic failure counter without performing password work.
+    pub(crate) fn insert(&self, key: String, value: (u32, u64), window: u64) {
+        let _previous = self.state.lock().entries.insert(
+            key,
+            Counter {
+                count: value.0,
+                expires_at: value.1.saturating_add(window).saturating_add(1),
+            },
+        );
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{RateTable, MAX_RATE_IDENTITIES};
+
+    #[test]
+    fn exact_window_boundary_and_saturation_are_bounded() {
+        let table = RateTable::default();
+        assert_eq!(table.record("visitor", 100, 60), 1);
+        assert_eq!(table.record("visitor", 160, 60), 2);
+        assert_eq!(table.retry_after("visitor", 160, 2), Some(1));
+        assert_eq!(table.record("visitor", 161, 60), 1);
+        for index in 1..MAX_RATE_IDENTITIES {
+            assert_eq!(table.record(&index.to_string(), 161, 60), 1);
+        }
+        assert_eq!(table.record("overflow", 161, 60), u32::MAX);
+        assert!(table.retry_after("overflow", 161, 2).is_some());
+        assert_eq!(table.state.lock().entries.len(), MAX_RATE_IDENTITIES);
+        assert_eq!(table.record("overflow", 222, 60), 1);
+        assert_eq!(table.state.lock().entries.len(), 1);
+    }
+
+    #[test]
+    fn concurrent_admission_never_exceeds_the_budget() -> anyhow::Result<()> {
+        let table = RateTable::default();
+        let admitted = std::thread::scope(|scope| {
+            let handles = (0usize..64)
+                .map(|_| {
+                    let table = &table;
+                    scope.spawn(move || table.record("visitor", 100, 60) <= 20)
+                })
+                .collect::<Vec<_>>();
+            handles
+                .into_iter()
+                .map(|handle| {
+                    handle
+                        .join()
+                        .map_err(|_error| anyhow::anyhow!("budget worker panicked"))
+                })
+                .collect::<anyhow::Result<Vec<_>>>()
+        })?;
+        anyhow::ensure!(admitted.into_iter().filter(|admitted| *admitted).count() == 20);
+        Ok(())
+    }
+}
diff --git a/src/middleware/state.rs b/src/middleware/state.rs
index 4dc08fd5..c4938b27 100644
--- a/src/middleware/state.rs
+++ b/src/middleware/state.rs
@@ -466,6 +466,14 @@ pub struct AppState {
     pub maintenance_gate: MaintenanceGate,
     /// Gate limiting concurrent public media parsing and processing.
     pub(crate) media_upload_gate: MediaUploadGate,
+    /// Bound admitted HTTP requests and response streams without queuing.
+    pub(crate) request_work_gate: super::WorkGate,
+    /// Bound memory-hard authentication independently of media and search.
+    pub(crate) password_work_gate: super::WorkGate,
+    /// Bound anonymous CAPTCHA generation without blocking async workers.
+    pub(crate) captcha_work_gate: super::WorkGate,
+    /// Bound concurrent FTS counting and sorting without a waiter queue.
+    pub(crate) search_work_gate: super::WorkGate,
     /// State of database maintenance jobs.
     pub db_maintenance_jobs: DbMaintenanceJobs,
     /// Current Tor onion address, when onion service is enabled.
diff --git a/src/middleware/work_gate.rs b/src/middleware/work_gate.rs
new file mode 100644
index 00000000..41dca6f2
--- /dev/null
+++ b/src/middleware/work_gate.rs
@@ -0,0 +1,68 @@
+//! Non-queueing concurrency admission for expensive request work.
+
+use std::sync::Arc;
+use tokio::sync::{OwnedSemaphorePermit, Semaphore};
+
+use super::WorkGate;
+
+impl WorkGate {
+    /// Create an independent gate for one resource class.
+    pub(crate) fn new(permits: usize) -> Self {
+        Self {
+            semaphore: Arc::new(Semaphore::new(permits)),
+        }
+    }
+
+    /// Reject overload immediately instead of creating an unbounded waiter queue.
+    pub(crate) fn try_begin(&self) -> crate::error::Result<OwnedSemaphorePermit> {
+        Arc::clone(&self.semaphore)
+            .try_acquire_owned()
+            .map_err(|_error| crate::error::AppError::DbBusy)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::WorkGate;
+
+    #[test]
+    fn cloned_gates_share_capacity_and_release_after_work() -> anyhow::Result<()> {
+        let gate = WorkGate::new(2);
+        let cloned = gate.clone();
+        let first = gate.try_begin()?;
+        let second = cloned.try_begin()?;
+        anyhow::ensure!(matches!(
+            gate.try_begin(),
+            Err(crate::error::AppError::DbBusy)
+        ));
+        drop(first);
+        let replacement = cloned.try_begin()?;
+        anyhow::ensure!(gate.try_begin().is_err());
+        drop(second);
+        drop(replacement);
+        anyhow::ensure!(gate.try_begin().is_ok());
+        Ok(())
+    }
+    #[tokio::test]
+    async fn cancelled_requests_cannot_release_running_blocking_work() -> anyhow::Result<()> {
+        let gate = WorkGate::new(1);
+        let permit = gate.try_begin()?;
+        let (started, started_rx) = tokio::sync::oneshot::channel();
+        let (release, release_rx) = std::sync::mpsc::channel();
+        let (finished, finished_rx) = tokio::sync::oneshot::channel();
+        let task = tokio::task::spawn_blocking(move || {
+            let _started = started.send(());
+            let _released = release_rx.recv();
+            drop(permit);
+            let _finished = finished.send(());
+        });
+        started_rx.await?;
+        task.abort();
+        anyhow::ensure!(gate.try_begin().is_err());
+        release.send(())?;
+        finished_rx.await?;
+        task.await?;
+        anyhow::ensure!(gate.try_begin().is_ok());
+        Ok(())
+    }
+}
diff --git a/src/server/server.rs b/src/server/server.rs
index 8d450fc8..d57546f1 100644
--- a/src/server/server.rs
+++ b/src/server/server.rs
@@ -20,6 +20,8 @@ use crate::config::{
 use crate::middleware::AppState;
 
 mod assets;
+/// Native listener socket admission and handshake deadlines.
+mod connections;
 mod headers;
 mod lifecycle;
 mod observability;
@@ -639,6 +641,10 @@ async fn run_server_lifecycle(
         ),
         maintenance_gate: crate::middleware::MaintenanceGate::new(),
         media_upload_gate: crate::middleware::MediaUploadGate::new(),
+        request_work_gate: crate::middleware::WorkGate::new(256),
+        password_work_gate: crate::middleware::WorkGate::new(2),
+        captcha_work_gate: crate::middleware::WorkGate::new(2),
+        search_work_gate: crate::middleware::WorkGate::new(2),
         db_maintenance_jobs: crate::middleware::DbMaintenanceJobs::new(),
         onion_address: Arc::new(tokio::sync::RwLock::new(None)),
     };
@@ -1766,10 +1772,15 @@ fn seed_initial_default_theme(conn: &rusqlite::Connection, initial_default_theme
 fn configure_http_limits(
     builder: &mut hyper_util::server::conn::auto::Builder<hyper_util::rt::TokioExecutor>,
 ) {
-    let _configured_http1 = builder.http1().max_buf_size(headers::HTTP_MAX_HEADER_BYTES);
+    let _configured_http1 = builder
+        .http1()
+        .max_buf_size(headers::HTTP_MAX_HEADER_BYTES)
+        .timer(hyper_util::rt::TokioTimer::new())
+        .header_read_timeout(Duration::from_secs(15));
     let _configured_http2 = builder
         .http2()
-        .max_header_list_size(u32::try_from(headers::HTTP_MAX_HEADER_BYTES).unwrap_or(u32::MAX));
+        .max_header_list_size(u32::try_from(headers::HTTP_MAX_HEADER_BYTES).unwrap_or(u32::MAX))
+        .max_concurrent_streams(128);
 }
 
 /// Listener label paired with its task result.
@@ -1848,7 +1859,7 @@ async fn run_plain_http(
     }));
 
     let std_listener = listener.into_std()?;
-    let mut server = axum_server::from_tcp(std_listener)?;
+    let mut server = axum_server::from_tcp(std_listener)?.map(connections::BoundedAcceptor::new);
     configure_http_limits(server.http_builder());
     server
         .handle(handle)
@@ -1891,7 +1902,8 @@ pub async fn run_https_static(
     // Convert tokio TcpListener → std TcpListener for axum_server::from_tcp_rustls.
     // set_nonblocking(true) is required — axum-server expects a non-blocking socket.
     let std_listener = listener.into_std()?;
-    let mut server = axum_server::from_tcp_rustls(std_listener, tls_config)?;
+    let mut server = axum_server::from_tcp_rustls(std_listener, tls_config)?
+        .map(connections::BoundedAcceptor::new);
     configure_http_limits(server.http_builder());
 
     server
@@ -1900,6 +1912,12 @@ pub async fn run_https_static(
         .await
 }
 
+/// Keep failed connection diagnostics separate from the listener admission loop.
+#[cfg(feature = "tls-acme")]
+fn log_acme_connection_failure(error: &tokio::task::JoinError) {
+    tracing::warn!(target: "server", %error, "ACME HTTPS connection task failed");
+}
+
 // HTTPS listener (ACME / Let's Encrypt path)
 // ACME requires a manual accept loop because AcmeAcceptor::accept() must
 // inspect each connection for TLS-ALPN-01 challenges before the TLS handshake
@@ -1925,6 +1943,7 @@ pub async fn run_https_acme(
     use tower::Service as _;
 
     let mut connections = tokio::task::JoinSet::new();
+    let connection_slots = Arc::new(tokio::sync::Semaphore::new(256));
     loop {
         tokio::select! {
             () = cancel.cancelled() => {
@@ -1933,6 +1952,7 @@ pub async fn run_https_acme(
             }
             result = listener.accept() => {
                 let (tcp, peer_addr) = result?;
+                let Ok(permit) = Arc::clone(&connection_slots).try_acquire_owned() else { continue; };
 
                 let acme_acceptor = Arc::clone(&acme_acceptor);
                 let server_cfg = Arc::clone(&server_cfg);
@@ -1942,10 +1962,13 @@ pub async fn run_https_acme(
                     use tokio_util::compat::{TokioAsyncReadCompatExt as _, FuturesAsyncReadCompatExt as _};
                     // rustls-acme requires futures::{AsyncRead, AsyncWrite}; wrap
                     // the tokio TcpStream with the tokio-util compat shim.
+                    let _connection_permit = permit;
                     let tcp = tcp.compat();
-                    match acme_acceptor.accept(tcp).await {
+                    let Ok(accepted) = tokio::time::timeout(Duration::from_secs(15), acme_acceptor.accept(tcp)).await else { return; };
+                    match accepted {
                         Ok(Some(start)) => {
-                            match start.into_stream(server_cfg).await {
+                            let Ok(handshake) = tokio::time::timeout(Duration::from_secs(15), start.into_stream(server_cfg)).await else { return; };
+                            match handshake {
                                 Ok(tls_stream) => {
                                     // Convert the futures-io TLS stream back to a
                                     // tokio-io stream so TokioIo / hyper can use it.
@@ -1963,7 +1986,7 @@ pub async fn run_https_acme(
                                         svc.clone().call(request)
                                     });
                                     let mut builder = http1::Builder::new();
-                                    let _configured = builder.max_buf_size(headers::HTTP_MAX_HEADER_BYTES);
+                                    let _configured = builder.max_buf_size(headers::HTTP_MAX_HEADER_BYTES).timer(hyper_util::rt::TokioTimer::new()).header_read_timeout(Duration::from_secs(15));
                                     let connection_result = builder.serve_connection(io, svc).await;
                                     if let Err(e) = connection_result {
                                         tracing::debug!(
@@ -1994,11 +2017,7 @@ pub async fn run_https_acme(
             }
             Some(result) = connections.join_next(), if !connections.is_empty() => {
                 if let Err(error) = result {
-                    tracing::warn!(
-                        target: "server",
-                        %error,
-                        "ACME HTTPS connection task failed"
-                    );
+                    log_acme_connection_failure(&error);
                 }
             }
         }
diff --git a/src/server/server/assets.rs b/src/server/server/assets.rs
index 67e32aaa..a31e8f22 100644
--- a/src/server/server/assets.rs
+++ b/src/server/server/assets.rs
@@ -181,8 +181,8 @@ mod tests {
     /// Positions mobile menus against the visual viewport.
     fn main_js_positions_mobile_menus_and_popups_against_visual_viewport() {
         for expected in [
-            "function getThreadMenuBounds(gutter)",
-            "window.visualViewport && window.visualViewport.height",
+            "function positionThreadMenu(toggle, menu)",
+            "var viewport = window.visualViewport;",
             "function clampPopupToViewport(anchor, popup)",
             "visualViewport.offsetLeft",
             "visualViewport.offsetTop",
diff --git a/src/server/server/connections.rs b/src/server/server/connections.rs
new file mode 100644
index 00000000..e7f76760
--- /dev/null
+++ b/src/server/server/connections.rs
@@ -0,0 +1,161 @@
+//! Bound open sockets before TLS handshakes and HTTP request heads.
+
+use axum_server::accept::Accept;
+use std::{
+    future::Future,
+    io,
+    pin::Pin,
+    sync::Arc,
+    task::{Context, Poll},
+    time::Duration,
+};
+use tokio::{
+    io::{AsyncRead, AsyncWrite, ReadBuf},
+    sync::{OwnedSemaphorePermit, Semaphore},
+};
+
+/// Maximum simultaneous sockets on each native HTTP or static HTTPS listener.
+const MAX_CONNECTIONS: usize = 256;
+
+/// Preserve the existing acceptor while rejecting excess sockets without queueing.
+#[derive(Clone)]
+pub(super) struct BoundedAcceptor<A> {
+    /// Default plaintext or configured TLS acceptor.
+    inner: A,
+    /// Permits remain with the stream until the connection is dropped.
+    permits: Arc<Semaphore>,
+}
+
+impl<A> BoundedAcceptor<A> {
+    /// Wrap a listener's existing transport acceptor.
+    pub(super) fn new(inner: A) -> Self {
+        Self {
+            inner,
+            permits: Arc::new(Semaphore::new(MAX_CONNECTIONS)),
+        }
+    }
+}
+
+/// Pinned accept future with admission already reserved before handshake work.
+pub(super) struct AcceptFuture<F> {
+    /// Boxing pins the generic transport future without requiring it to be Unpin.
+    inner: Option<Pin<Box<tokio::time::Timeout<F>>>>,
+    /// Transferred to the accepted stream on success; released on error/cancellation.
+    permit: Option<OwnedSemaphorePermit>,
+}
+
+impl<I, S, A: Accept<I, S>> Accept<I, S> for BoundedAcceptor<A> {
+    type Stream = ConnectionIo<A::Stream>;
+    type Service = A::Service;
+    type Future = AcceptFuture<A::Future>;
+
+    fn accept(&self, stream: I, service: S) -> Self::Future {
+        let permit = Arc::clone(&self.permits).try_acquire_owned().ok();
+        let inner = permit.as_ref().map(|_permit| {
+            Box::pin(tokio::time::timeout(
+                Duration::from_secs(15),
+                self.inner.accept(stream, service),
+            ))
+        });
+        AcceptFuture { inner, permit }
+    }
+}
+
+impl<I, S, F: Future<Output = io::Result<(I, S)>>> Future for AcceptFuture<F> {
+    type Output = io::Result<(ConnectionIo<I>, S)>;
+
+    fn poll(self: Pin<&mut Self>, context: &mut Context<'_>) -> Poll<Self::Output> {
+        let Self { inner, permit } = self.get_mut();
+        let Some(accept_future) = inner.as_mut() else {
+            return Poll::Ready(Err(io::Error::new(
+                io::ErrorKind::ConnectionRefused,
+                "connection capacity reached",
+            )));
+        };
+        match accept_future.as_mut().poll(context) {
+            Poll::Pending => Poll::Pending,
+            Poll::Ready(result) => Poll::Ready(
+                result
+                    .map_err(|_elapsed| {
+                        io::Error::new(io::ErrorKind::TimedOut, "transport handshake timed out")
+                    })?
+                    .and_then(|(stream, service)| {
+                        let permit = permit
+                            .take()
+                            .ok_or_else(|| io::Error::other("connection admission missing"))?;
+                        Ok((
+                            ConnectionIo {
+                                inner: stream,
+                                _permit: permit,
+                            },
+                            service,
+                        ))
+                    }),
+            ),
+        }
+    }
+}
+
+/// Hold socket admission for the entire HTTP connection, including idle keepalive.
+pub(super) struct ConnectionIo<I> {
+    /// Existing plaintext/TLS stream.
+    inner: I,
+    /// Released only when transport work and its socket end.
+    _permit: OwnedSemaphorePermit,
+}
+
+impl<I: AsyncRead + Unpin> AsyncRead for ConnectionIo<I> {
+    fn poll_read(
+        self: Pin<&mut Self>,
+        context: &mut Context<'_>,
+        buffer: &mut ReadBuf<'_>,
+    ) -> Poll<io::Result<()>> {
+        Pin::new(&mut self.get_mut().inner).poll_read(context, buffer)
+    }
+}
+
+impl<I: AsyncWrite + Unpin> AsyncWrite for ConnectionIo<I> {
+    fn poll_write(
+        self: Pin<&mut Self>,
+        context: &mut Context<'_>,
+        buffer: &[u8],
+    ) -> Poll<io::Result<usize>> {
+        Pin::new(&mut self.get_mut().inner).poll_write(context, buffer)
+    }
+    fn poll_flush(self: Pin<&mut Self>, context: &mut Context<'_>) -> Poll<io::Result<()>> {
+        Pin::new(&mut self.get_mut().inner).poll_flush(context)
+    }
+    fn poll_shutdown(self: Pin<&mut Self>, context: &mut Context<'_>) -> Poll<io::Result<()>> {
+        Pin::new(&mut self.get_mut().inner).poll_shutdown(context)
+    }
+    fn is_write_vectored(&self) -> bool {
+        self.inner.is_write_vectored()
+    }
+    fn poll_write_vectored(
+        self: Pin<&mut Self>,
+        context: &mut Context<'_>,
+        buffers: &[io::IoSlice<'_>],
+    ) -> Poll<io::Result<usize>> {
+        Pin::new(&mut self.get_mut().inner).poll_write_vectored(context, buffers)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn sockets_are_bounded_and_release_capacity_when_dropped() -> anyhow::Result<()> {
+        let acceptor = BoundedAcceptor::new(axum_server::accept::DefaultAcceptor::new());
+        let mut sockets = Vec::new();
+        for _ in 0..MAX_CONNECTIONS {
+            let (stream, _service) = acceptor.accept(tokio::io::empty(), ()).await?;
+            sockets.push(stream);
+        }
+        anyhow::ensure!(acceptor.accept(tokio::io::empty(), ()).await.is_err());
+        drop(sockets.pop());
+        let (_stream, _service) = acceptor.accept(tokio::io::empty(), ()).await?;
+        drop(sockets);
+        Ok(())
+    }
+}
diff --git a/src/server/server/headers.rs b/src/server/server/headers.rs
index 4d442249..0224280e 100644
--- a/src/server/server/headers.rs
+++ b/src/server/server/headers.rs
@@ -11,6 +11,10 @@ use std::net::{IpAddr, SocketAddr};
 pub(super) const HTTP_MAX_HEADER_BYTES: usize = 64 * 1024;
 /// Maximum bytes accepted in one request-header value.
 pub(super) const HTTP_MAX_HEADER_VALUE_BYTES: usize = 32 * 1024;
+/// Maximum request-target bytes, before query decoding or diagnostic logging.
+pub(super) const HTTP_MAX_URI_BYTES: usize = 8 * 1024;
+/// Default form/body cap; explicit multipart routes retain their larger limits.
+pub(super) const HTTP_FORM_MAX_BYTES: usize = 64 * 1024;
 
 /// Content Security Policy applied to HTML responses.
 pub(super) const CONTENT_SECURITY_POLICY: &str = "default-src 'self'; \
@@ -32,6 +36,15 @@ pub(super) async fn request_boundary_middleware(
     req: axum::extract::Request,
     next: axum::middleware::Next,
 ) -> axum::response::Response {
+    let uri_bytes = req
+        .uri()
+        .path_and_query()
+        .map_or(0, |part| part.as_str().len())
+        .saturating_add(req.uri().authority().map_or(0, |part| part.as_str().len()))
+        .saturating_add(req.uri().scheme_str().map_or(0, str::len));
+    if uri_bytes > HTTP_MAX_URI_BYTES {
+        return boundary_error_response(http::StatusCode::URI_TOO_LONG, "Request URL is too long");
+    }
     if request_headers_exceed_limits(req.headers()) {
         return boundary_error_response(
             http::StatusCode::REQUEST_HEADER_FIELDS_TOO_LARGE,
@@ -51,9 +64,113 @@ pub(super) async fn request_boundary_middleware(
         );
     }
 
+    if !valid_request_host(req.headers()) {
+        return boundary_error_response(http::StatusCode::BAD_REQUEST, "Invalid Host header");
+    }
+    let limit = request_body_limit(req.method(), req.uri().path());
+    if req
+        .headers()
+        .get(header::CONTENT_LENGTH)
+        .and_then(|value| value.to_str().ok())
+        .and_then(|value| value.parse::<u64>().ok())
+        .is_some_and(|length| length > limit)
+    {
+        return boundary_error_response(
+            http::StatusCode::PAYLOAD_TOO_LARGE,
+            "Request body is too large",
+        );
+    }
+
+    next.run(req).await
+}
+
+/// Reject explicit cross-site evidence before any mutation body is consumed.
+pub(super) async fn mutation_origin_middleware(
+    context: crate::middleware::SecureCookieContext,
+    req: axum::extract::Request,
+    next: axum::middleware::Next,
+) -> axum::response::Response {
+    if !matches!(
+        *req.method(),
+        http::Method::GET | http::Method::HEAD | http::Method::OPTIONS
+    ) {
+        if req
+            .headers()
+            .get("sec-fetch-site")
+            .and_then(|value| value.to_str().ok())
+            .is_some_and(|value| value.eq_ignore_ascii_case("cross-site"))
+        {
+            return (http::StatusCode::FORBIDDEN, "Cross-site action denied").into_response();
+        }
+        if req.headers().contains_key(header::ORIGIN) || req.headers().contains_key(header::REFERER)
+        {
+            let jar = axum_extra::extract::CookieJar::from_headers(req.headers());
+            // A Strict public CSRF cookie is unavailable to cross-site forms;
+            // preserve supported same-origin browsers that send Origin: null.
+            let null_with_cookie = req
+                .headers()
+                .get(header::ORIGIN)
+                .and_then(|value| value.to_str().ok())
+                == Some("null")
+                && jar.get("csrf_token").is_some()
+                && !req.headers().contains_key(header::REFERER);
+            if !null_with_cookie {
+                if let Err(error) =
+                    crate::handlers::admin::require_same_origin_request(req.headers(), context.peer)
+                {
+                    return error.into_response();
+                }
+            }
+        }
+    }
     next.run(req).await
 }
 
+/// Match the explicit multipart overrides without trusting the submitted MIME type.
+fn request_body_limit(method: &http::Method, path: &str) -> u64 {
+    if *method == http::Method::POST {
+        if is_post_upload_path(path) {
+            return u64::try_from(crate::handlers::PUBLIC_MULTIPART_REQUEST_MAX_BYTES)
+                .unwrap_or(u64::MAX);
+        }
+        return match path {
+            "/admin/restore" | "/admin/board/restore" => 8 * 1024 * 1024 * 1024,
+            "/admin/site/favicon" | "/admin/board/favicon" => 5 * 1024 * 1024,
+            "/admin/site/banner" | "/admin/home/banner" | "/admin/board/banner" => 8 * 1024 * 1024,
+            _ => u64::try_from(HTTP_FORM_MAX_BYTES).unwrap_or(u64::MAX),
+        };
+    }
+    u64::try_from(HTTP_FORM_MAX_BYTES).unwrap_or(u64::MAX)
+}
+
+/// Reject duplicate authorities and parser-ambiguous Host values.
+fn valid_request_host(headers: &http::HeaderMap) -> bool {
+    let mut hosts = headers.get_all(header::HOST).iter();
+    let Some(host) = hosts.next() else {
+        return true;
+    };
+    if hosts.next().is_some() {
+        return false;
+    }
+    let Ok(host) = host.to_str() else {
+        return false;
+    };
+    !host.is_empty()
+        && !host.bytes().any(|byte| {
+            byte.is_ascii_whitespace()
+                || matches!(byte, b'@' | b'\\' | b',' | b'%' | b'/' | b'#' | b'?')
+        })
+        && host.parse::<http::uri::Authority>().is_ok_and(|authority| {
+            !authority.host().is_empty()
+                && host.strip_prefix(authority.host()).is_some_and(|suffix| {
+                    suffix.is_empty()
+                        || suffix
+                            .strip_prefix(':')
+                            .is_some_and(|port| port.parse::<u16>().is_ok())
+                })
+        })
+}
+
 /// Render application notices with request preferences before response compression.
 pub(super) async fn theme_error_response(
     secure_context: crate::middleware::SecureCookieContext,
@@ -380,6 +497,21 @@ fn is_post_upload_path(path: &str) -> bool {
         return false;
     }
 
+    if matches!(
+        path.trim_end_matches('/'),
+        "/vote"
+            | "/report"
+            | "/appeal"
+            | "/preferences"
+            | "/admin"
+            | "/setup"
+            | "/banned"
+            | "/healthz"
+            | "/readyz"
+            | "/metrics"
+    ) {
+        return false;
+    }
     let mut segments = trimmed.split('/');
     matches!(
         (
diff --git a/src/server/server/lifecycle.rs b/src/server/server/lifecycle.rs
index 422a27d1..e8c2bb3a 100644
--- a/src/server/server/lifecycle.rs
+++ b/src/server/server/lifecycle.rs
@@ -1,5 +1,7 @@
 //! Request lifecycle accounting and shutdown-signal handling.
 
+use futures::StreamExt as _;
+
 use std::sync::atomic::Ordering;
 use std::time::Instant;
 use tracing::Instrument as _;
@@ -26,13 +28,17 @@ pub(super) async fn track_requests(
     {
         return recovery_unavailable();
     }
+    let permit = match state.request_work_gate.try_begin() {
+        Ok(permit) => permit,
+        Err(error) => return axum::response::IntoResponse::into_response(error),
+    };
     let _previous_request_count = REQUEST_COUNT.fetch_add(1, Ordering::Relaxed);
     let _previous_in_flight_count = IN_FLIGHT.fetch_add(1, Ordering::Relaxed);
     let _in_flight_guard = ScopedDecrement(&IN_FLIGHT);
 
     let req_id = uuid::Uuid::new_v4().to_string();
     let method = req.method().clone();
-    let path = req.uri().path().to_owned();
+    let path = req.uri().path().chars().take(256).collect::<String>();
     let mut req = req;
     let _previous_request_id = req.extensions_mut().insert(req_id.clone());
     let span = tracing::info_span!(
@@ -68,7 +74,14 @@ pub(super) async fn track_requests(
     if let Ok(value) = axum::http::HeaderValue::from_str(&req_id) {
         let _previous_request_header = response.headers_mut().insert(REQUEST_ID_HEADER, value);
     }
-    response
+    // Retain admission through streamed media responses, including clients
+    // that stop reading after the response headers have been sent.
+    response.map(move |body| {
+        axum::body::Body::from_stream(body.into_data_stream().map(move |chunk| {
+            let _request_permit = &permit;
+            chunk
+        }))
+    })
 }
 
 /// Wait for a platform shutdown signal.
diff --git a/src/server/server/router.rs b/src/server/server/router.rs
index f31f2e4f..62cf5d5a 100644
--- a/src/server/server/router.rs
+++ b/src/server/server/router.rs
@@ -19,6 +19,19 @@ use super::{
 };
 use routes::{admin_routes, public_routes};
 
+#[cfg(test)]
+/// Adversarial requests through the complete middleware stack.
+mod security_tests;
+
+/// Record generic server failures without exposing request query strings.
+fn log_http_failure(
+    error: &tower_http::classify::ServerErrorsFailureClass,
+    latency: std::time::Duration,
+    _span: &tracing::Span,
+) {
+    tracing::error!(target: "server", %error, latency_ms = latency.as_millis(), "request failed");
+}
+
 /// Build the complete application router around shared state and transport mode.
 pub(super) fn build_router(state: AppState, direct_https: bool) -> Router {
     let behind_proxy = crate::config::CONFIG.behind_proxy;
@@ -32,9 +45,16 @@ pub(super) fn build_router(state: AppState, direct_https: bool) -> Router {
         .route("/static/theme-init.js", get(serve_theme_init_js))
         .merge(public_routes().layer(axum_middleware::from_fn(public_cache_middleware)))
         .merge(admin_routes().layer(axum_middleware::from_fn(admin_cache_middleware)))
+        // Inner upload routes explicitly override this streaming extractor cap.
+        .layer(axum::extract::DefaultBodyLimit::max(
+            super::headers::HTTP_FORM_MAX_BYTES,
+        ))
         .layer(axum_middleware::from_fn(
             crate::middleware::rate_limit_middleware,
         ))
+        .layer(axum_middleware::from_fn(
+            super::headers::mutation_origin_middleware,
+        ))
         .layer(axum_middleware::from_fn_with_state(
             state.clone(),
             track_requests,
@@ -93,24 +113,15 @@ pub(super) fn build_router(state: AppState, direct_https: bool) -> Router {
                     tracing::debug_span!(
                         "http",
                         method = %request.method(),
-                        uri    = %request.uri(),
+                        path = %request.uri().path().chars().take(256).collect::<String>(),
                     )
                 })
                 .on_response(
                     tower_http::trace::DefaultOnResponse::new().level(tracing::Level::TRACE),
                 )
-                .on_failure(
-                    |error: tower_http::classify::ServerErrorsFailureClass,
-                     latency: std::time::Duration,
-                     _span: &tracing::Span| {
-                        tracing::error!(
-                            target: "server",
-                            %error,
-                            latency_ms = latency.as_millis(),
-                            "request failed",
-                        );
-                    },
-                ),
+                .on_failure(|error, latency, span: &tracing::Span| {
+                    log_http_failure(&error, latency, span);
+                }),
         )
         .layer(axum_middleware::from_fn_with_state(
             state.clone(),
diff --git a/src/server/server/router/security_tests.rs b/src/server/server/router/security_tests.rs
new file mode 100644
index 00000000..081b807f
--- /dev/null
+++ b/src/server/server/router/security_tests.rs
@@ -0,0 +1,474 @@
+//! Hostile requests exercise the assembled application, not only validators.
+
+use super::build_router;
+use crate::middleware::AppState;
+use anyhow::{ensure, Context as _};
+use axum::{
+    body::{to_bytes, Body},
+    http::{header, Request, StatusCode},
+    Router,
+};
+use std::net::SocketAddr;
+use tower::ServiceExt as _;
+
+/// Build isolated board state while retaining the production middleware stack.
+fn fixture() -> anyhow::Result<(AppState, Router)> {
+    let state = crate::test_support::app_state();
+    let _board_id = crate::db::create_board(&*state.db.get()?, "audit", "Audit", "", false)?;
+    let router = build_router(state.clone(), false);
+    Ok((state, router))
+}
+
+/// Give each scenario a distinct direct peer; forged headers cannot change it.
+fn request(method: &str, path: &str, scenario: u8, body: Body) -> anyhow::Result<Request<Body>> {
+    let mut request = Request::builder()
+        .method(method)
+        .uri(path)
+        .header(header::HOST, "localhost")
+        .header(header::ORIGIN, "http://localhost")
+        .header(header::COOKIE, "csrf_token=csrf123")
+        .body(body)?;
+    let _previous_peer =
+        request
+            .extensions_mut()
+            .insert(axum::extract::ConnectInfo(SocketAddr::from((
+                [192, 0, 2, scenario],
+                41000,
+            ))));
+    Ok(request)
+}
+
+#[tokio::test]
+async fn posting_bursts_are_limited_without_censoring_identical_posts() -> anyhow::Result<()> {
+    let (state, router) = fixture()?;
+    for attempt in 0u8..7 {
+        let (boundary, bytes) = crate::test_support::multipart_body(
+            &[("_csrf", "csrf123"), ("body", "identical legitimate body")],
+            None,
+        );
+        let mut req = request("POST", "/audit", 201, Body::from(bytes))?;
+        drop(req.headers_mut().insert(
+            header::CONTENT_TYPE,
+            format!("multipart/form-data; boundary={boundary}").parse()?,
+        ));
+        drop(
+            req.headers_mut()
+                .insert("x-forwarded-for", format!("203.0.113.{attempt}").parse()?),
+        );
+        let response = router.clone().oneshot(req).await?;
+        ensure!(
+            response.status()
+                == if attempt < 6 {
+                    StatusCode::SEE_OTHER
+                } else {
+                    StatusCode::TOO_MANY_REQUESTS
+                },
+            "posting attempt {attempt}: {}",
+            response.status()
+        );
+    }
+    let conn = state.db.get()?;
+    let count: i64 = conn.query_row("SELECT COUNT(*) FROM posts", [], |row| row.get(0))?;
+    ensure!(
+        count == 6,
+        "separate identical posts should survive, rejected requests must not mutate"
+    );
+    drop(conn);
+    let response = router
+        .oneshot(request("GET", "/audit", 201, Body::empty())?)
+        .await?;
+    ensure!(
+        response.status() == StatusCode::OK,
+        "posting budget must not disable ordinary reads"
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn failed_reports_and_expensive_searches_have_separate_budgets() -> anyhow::Result<()> {
+    let (_state, router) = fixture()?;
+    for attempt in 0u8..31 {
+        let mut req = request(
+            "POST",
+            "/report",
+            202,
+            Body::from("board=audit&post_id=0&thread_id=0&_csrf=csrf123"),
+        )?;
+        drop(req.headers_mut().insert(
+            header::CONTENT_TYPE,
+            "application/x-www-form-urlencoded".parse()?,
+        ));
+        let response = router.clone().oneshot(req).await?;
+        ensure!(
+            response.status()
+                == if attempt < 30 {
+                    StatusCode::BAD_REQUEST
+                } else {
+                    StatusCode::TOO_MANY_REQUESTS
+                },
+            "report attempt {attempt}: {}",
+            response.status()
+        );
+    }
+    for attempt in 0u8..21 {
+        let response = router
+            .clone()
+            .oneshot(request(
+                "GET",
+                "/audit/search?q=ordinary",
+                203,
+                Body::empty(),
+            )?)
+            .await?;
+        ensure!(
+            response.status()
+                == if attempt < 20 {
+                    StatusCode::OK
+                } else {
+                    StatusCode::TOO_MANY_REQUESTS
+                },
+            "search attempt {attempt}: {}",
+            response.status()
+        );
+    }
+    ensure!(
+        router
+            .oneshot(request("GET", "/audit", 203, Body::empty())?)
+            .await?
+            .status()
+            == StatusCode::OK
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn form_and_uri_limits_reject_before_expensive_work() -> anyhow::Result<()> {
+    let (_state, router) = fixture()?;
+    for bytes in [65_535, 65_536, 65_537] {
+        let mut req = request("POST", "/vote", 204, Body::from("x".repeat(bytes)))?;
+        drop(req.headers_mut().insert(
+            header::CONTENT_TYPE,
+            "application/x-www-form-urlencoded".parse()?,
+        ));
+        let response = router.clone().oneshot(req).await?;
+        ensure!(
+            response.status()
+                == if bytes > 65_536 {
+                    StatusCode::PAYLOAD_TOO_LARGE
+                } else {
+                    StatusCode::UNPROCESSABLE_ENTITY
+                },
+            "body boundary {bytes}: {}",
+            response.status()
+        );
+    }
+    for path in ["/vote", "/report", "/appeal", "/preferences"] {
+        let mut declared_form = request("POST", path, 204, Body::empty())?;
+        drop(
+            declared_form
+                .headers_mut()
+                .insert(header::CONTENT_LENGTH, "65537".parse()?),
+        );
+        ensure!(
+            router.clone().oneshot(declared_form).await?.status() == StatusCode::PAYLOAD_TOO_LARGE,
+            "form routes must not inherit upload allowances: {path}"
+        );
+    }
+    for length in [8191usize, 8192, 8193] {
+        let path = format!("/{}", "x".repeat(length.saturating_sub(1)));
+        let response = router
+            .clone()
+            .oneshot(request("GET", &path, 205, Body::empty())?)
+            .await?;
+        ensure!(
+            response.status()
+                == if length > 8192 {
+                    StatusCode::URI_TOO_LONG
+                } else {
+                    StatusCode::NOT_FOUND
+                },
+            "URI boundary {length}: {}",
+            response.status()
+        );
+    }
+    let mut req = request("POST", "/audit", 206, Body::empty())?;
+    drop(
+        req.headers_mut()
+            .insert(header::CONTENT_LENGTH, "541065217".parse()?),
+    );
+    ensure!(router.oneshot(req).await?.status() == StatusCode::PAYLOAD_TOO_LARGE);
+    Ok(())
+}
+
+#[tokio::test]
+async fn malformed_hosts_ids_and_cross_site_requests_fail_safely() -> anyhow::Result<()> {
+    let (_state, router) = fixture()?;
+    for host in [
+        "localhost@attacker.invalid",
+        "localhost\\attacker.invalid",
+        "localhost:abc",
+        "localhost:65536",
+    ] {
+        let mut req = request("GET", "/audit", 207, Body::empty())?;
+        drop(req.headers_mut().insert(header::HOST, host.parse()?));
+        ensure!(
+            router.clone().oneshot(req).await?.status() == StatusCode::BAD_REQUEST,
+            "malformed Host {host}"
+        );
+    }
+    for id in [
+        "-1",
+        "0",
+        "9223372036854775807",
+        "9223372036854775808",
+        "not-an-id",
+    ] {
+        let response = router
+            .clone()
+            .oneshot(request(
+                "GET",
+                &format!("/audit/thread/{id}"),
+                208,
+                Body::empty(),
+            )?)
+            .await?;
+        ensure!(
+            matches!(
+                response.status(),
+                StatusCode::BAD_REQUEST | StatusCode::NOT_FOUND
+            ),
+            "malformed ID {id}: {}",
+            response.status()
+        );
+    }
+    let mut req = request("POST", "/audit", 209, Body::empty())?;
+    drop(
+        req.headers_mut()
+            .insert(header::ORIGIN, "https://attacker.invalid".parse()?),
+    );
+    ensure!(router.clone().oneshot(req).await?.status() == StatusCode::FORBIDDEN);
+    let mut cross_site_request = request("POST", "/report", 209, Body::empty())?;
+    drop(
+        cross_site_request
+            .headers_mut()
+            .insert("sec-fetch-site", "cross-site".parse()?),
+    );
+    ensure!(router.oneshot(cross_site_request).await?.status() == StatusCode::FORBIDDEN);
+    Ok(())
+}
+
+#[tokio::test]
+async fn search_rejects_overlong_unicode_and_huge_pages() -> anyhow::Result<()> {
+    let (_state, router) = fixture()?;
+    for path in [
+        "/audit/search?q=word&page=9223372036854775807".to_owned(),
+        format!(
+            "/audit/search?q={}",
+            crate::utils::redirect::encode_query_component(&"😀".repeat(257))
+        ),
+    ] {
+        ensure!(
+            router
+                .clone()
+                .oneshot(request("GET", &path, 210, Body::empty())?)
+                .await?
+                .status()
+                == StatusCode::BAD_REQUEST
+        );
+    }
+    let path = format!(
+        "/audit/search?q={}",
+        crate::utils::redirect::encode_query_component("<script>\"&e\u{0301}\u{202e}")
+    );
+    let response = router
+        .oneshot(request("GET", &path, 210, Body::empty())?)
+        .await?;
+    ensure!(response.status() == StatusCode::OK);
+    let html = String::from_utf8(
+        to_bytes(response.into_body(), 2 * 1024 * 1024)
+            .await?
+            .to_vec(),
+    )?;
+    ensure!(
+        html.contains("&lt;script&gt;"),
+        "search echo must escape tags"
+    );
+    ensure!(!html.contains("<script>"));
+    Ok(())
+}
+
+#[tokio::test]
+async fn unauthenticated_admin_upload_is_rejected_before_reading_body() -> anyhow::Result<()> {
+    let (_state, router) = fixture()?;
+    let body = Body::from_stream(futures::stream::pending::<
+        Result<axum::body::Bytes, std::io::Error>,
+    >());
+    let mut req = request("POST", "/admin/site/favicon", 211, body)?;
+    drop(req.headers_mut().insert(
+        header::CONTENT_TYPE,
+        "multipart/form-data; boundary=audit-boundary".parse()?,
+    ));
+    let response = tokio::time::timeout(std::time::Duration::from_secs(2), router.oneshot(req))
+        .await
+        .context("unauthenticated upload read a stalled body")??;
+    ensure!(response.status() == StatusCode::FORBIDDEN);
+    Ok(())
+}
+
+#[tokio::test]
+async fn thread_history_and_quote_destinations_work_without_javascript() -> anyhow::Result<()> {
+    let (state, router) = fixture()?;
+    let conn = state.db.get()?;
+    let board = crate::db::get_board_by_short(&conn, "audit")?.context("board exists")?;
+    conn.execute("INSERT INTO threads(id,board_id) VALUES(1,?1)", [board.id])
+        .map(|_count| ())?;
+    conn.execute("INSERT INTO posts(id,thread_id,board_id,body,body_html,deletion_token,is_op) VALUES(1,1,?1,'OP','OP','delete',1)", [board.id]).map(|_count| ())?;
+    conn.execute("WITH RECURSIVE n(x) AS (SELECT 2 UNION ALL SELECT x+1 FROM n WHERE x<402) INSERT INTO posts(id,thread_id,board_id,body,body_html,deletion_token) SELECT x,1,?1,'reply','reply','delete' FROM n", [board.id]).map(|_count| ())?;
+    conn.execute(
+        "UPDATE posts SET body_html=?1 WHERE id=402",
+        [crate::utils::sanitize::render_post_body("&gt;&gt;2", false)],
+    )
+    .map(|_count| ())?;
+    drop(conn);
+    let response = router
+        .clone()
+        .oneshot(request("GET", "/audit/thread/1", 212, Body::empty())?)
+        .await?;
+    ensure!(response.status() == StatusCode::OK);
+    let html = String::from_utf8(
+        to_bytes(response.into_body(), 8 * 1024 * 1024)
+            .await?
+            .to_vec(),
+    )?;
+    ensure!(html.contains("Older replies") && html.contains("/audit/post/2"));
+    ensure!(!html.contains("id=\"p2\""));
+    let quote_redirect = router
+        .clone()
+        .oneshot(request("GET", "/audit/post/2", 212, Body::empty())?)
+        .await?;
+    let destination = quote_redirect
+        .headers()
+        .get(header::LOCATION)
+        .context("quote redirect")?
+        .to_str()?
+        .to_owned();
+    ensure!(destination == "/audit/thread/1?post=2#p2");
+    let historical_response = router
+        .clone()
+        .oneshot(request(
+            "GET",
+            "/audit/thread/1?post=2",
+            212,
+            Body::empty(),
+        )?)
+        .await?;
+    let historical_html = String::from_utf8(
+        to_bytes(historical_response.into_body(), 8 * 1024 * 1024)
+            .await?
+            .to_vec(),
+    )?;
+    ensure!(historical_html.contains("id=\"p2\"") && historical_html.contains("Latest replies"));
+    let max_id_conn = state.db.get()?;
+    max_id_conn.execute("INSERT INTO posts(id,thread_id,board_id,body,body_html,deletion_token) VALUES(?1,1,?2,'last ID','last ID','delete')", [i64::MAX, board.id]).map(|_count| ())?;
+    drop(max_id_conn);
+    let focused_response = router
+        .oneshot(request(
+            "GET",
+            "/audit/thread/1?post=9223372036854775807",
+            212,
+            Body::empty(),
+        )?)
+        .await?;
+    ensure!(focused_response.status() == StatusCode::OK);
+    let focused_html = String::from_utf8(
+        to_bytes(focused_response.into_body(), 8 * 1024 * 1024)
+            .await?
+            .to_vec(),
+    )?;
+    ensure!(focused_html.contains("id=\"p9223372036854775807\""));
+    Ok(())
+}
+
+#[tokio::test]
+async fn streaming_responses_hold_request_capacity_until_dropped() -> anyhow::Result<()> {
+    let (mut state, _router) = fixture()?;
+    state.request_work_gate = crate::middleware::WorkGate::new(2);
+    let router = build_router(state, false);
+    let first = router
+        .clone()
+        .oneshot(request("GET", "/audit", 213, Body::empty())?)
+        .await?;
+    let second = router
+        .clone()
+        .oneshot(request("GET", "/audit", 213, Body::empty())?)
+        .await?;
+    ensure!(first.status() == StatusCode::OK && second.status() == StatusCode::OK);
+    ensure!(
+        router
+            .clone()
+            .oneshot(request("GET", "/audit", 213, Body::empty())?)
+            .await?
+            .status()
+            == StatusCode::SERVICE_UNAVAILABLE
+    );
+    drop(first);
+    ensure!(
+        router
+            .oneshot(request("GET", "/audit", 213, Body::empty())?)
+            .await?
+            .status()
+            == StatusCode::OK
+    );
+    drop(second);
+    Ok(())
+}
+
+#[tokio::test]
+async fn admin_asset_fields_are_bounded_and_duplicate_parts_are_rejected() -> anyhow::Result<()> {
+    let (state, router) = fixture()?;
+    let conn = state.db.get()?;
+    let admin = crate::db::create_admin(&conn, "asset-admin", "fixture-hash")?;
+    crate::db::create_session(&conn, "asset-session", admin, i64::MAX)?;
+    drop(conn);
+    for size in [65_535, 65_536, 65_537] {
+        let (boundary, body) =
+            crate::test_support::multipart_body(&[("_csrf", &"x".repeat(size))], None);
+        let mut req = request("POST", "/admin/site/favicon", 214, Body::from(body))?;
+        drop(req.headers_mut().insert(
+            header::COOKIE,
+            "csrf_token=csrf123; chan_admin_session=asset-session".parse()?,
+        ));
+        drop(req.headers_mut().insert(
+            header::CONTENT_TYPE,
+            format!("multipart/form-data; boundary={boundary}").parse()?,
+        ));
+        let response = router.clone().oneshot(req).await?;
+        ensure!(
+            response.status()
+                == if size > 65_536 {
+                    StatusCode::PAYLOAD_TOO_LARGE
+                } else {
+                    StatusCode::FORBIDDEN
+                },
+            "admin field boundary {size}: {}",
+            response.status()
+        );
+    }
+    let (boundary, body) =
+        crate::test_support::multipart_body(&[("_csrf", "a"), ("_csrf", "b")], None);
+    let mut req = request("POST", "/admin/home/banner", 214, Body::from(body))?;
+    drop(req.headers_mut().insert(
+        header::COOKIE,
+        "csrf_token=csrf123; chan_admin_session=asset-session".parse()?,
+    ));
+    drop(req.headers_mut().insert(
+        header::CONTENT_TYPE,
+        format!("multipart/form-data; boundary={boundary}").parse()?,
+    ));
+    ensure!(router.oneshot(req).await?.status() == StatusCode::BAD_REQUEST);
+    ensure!(
+        state.media_upload_gate.try_begin().is_ok(),
+        "rejected assets must release media admission"
+    );
+    Ok(())
+}
diff --git a/src/server/server/routes.rs b/src/server/server/routes.rs
index 67d0e0d6..ed619e41 100644
--- a/src/server/server/routes.rs
+++ b/src/server/server/routes.rs
@@ -268,11 +268,17 @@ fn admin_board_routes() -> Router<AppState> {
         .route(
             "/admin/site/favicon",
             post(crate::handlers::admin::update_site_favicon)
+                .layer::<_, std::convert::Infallible>(axum::middleware::from_fn(
+                    crate::handlers::enforce_public_multipart_envelope,
+                ))
                 .layer(DefaultBodyLimit::max(5 * 1024 * 1024)),
         )
         .route(
             "/admin/board/favicon",
             post(crate::handlers::admin::update_board_favicon)
+                .layer::<_, std::convert::Infallible>(axum::middleware::from_fn(
+                    crate::handlers::enforce_public_multipart_envelope,
+                ))
                 .layer(DefaultBodyLimit::max(5 * 1024 * 1024)),
         )
         .route(
@@ -282,16 +288,25 @@ fn admin_board_routes() -> Router<AppState> {
         .route(
             "/admin/site/banner",
             post(crate::handlers::admin::upload_global_banner)
+                .layer::<_, std::convert::Infallible>(axum::middleware::from_fn(
+                    crate::handlers::enforce_public_multipart_envelope,
+                ))
                 .layer(DefaultBodyLimit::max(8 * 1024 * 1024)),
         )
         .route(
             "/admin/home/banner",
             post(crate::handlers::admin::upload_home_banner)
+                .layer::<_, std::convert::Infallible>(axum::middleware::from_fn(
+                    crate::handlers::enforce_public_multipart_envelope,
+                ))
                 .layer(DefaultBodyLimit::max(8 * 1024 * 1024)),
         )
         .route(
             "/admin/board/banner",
             post(crate::handlers::admin::upload_board_banner)
+                .layer::<_, std::convert::Infallible>(axum::middleware::from_fn(
+                    crate::handlers::enforce_public_multipart_envelope,
+                ))
                 .layer(DefaultBodyLimit::max(8 * 1024 * 1024)),
         )
         .route(
diff --git a/src/templates/admin.rs b/src/templates/admin.rs
index b0f86fad..fee9d07c 100644
--- a/src/templates/admin.rs
+++ b/src/templates/admin.rs
@@ -903,6 +903,7 @@ fn render_board_settings_card(
     <label><input type="checkbox" name="nsfw" value="1"{nsfw_checked}> NSFW</label>
     <label><input type="checkbox" name="allow_archive" value="1"{archive_checked}> Archive overflow threads</label>
   </div>
+  <p class="admin-meta-note">Archive retention keeps the most recently bumped threads, including archived sticky threads. Lowering the archive limit permanently removes overflow threads. The global Archive before prune setting can also archive live overflow when this checkbox is off.</p>
 </div>
 <div class="admin-subsection">
   <div class="admin-card-header">
diff --git a/src/templates/board.rs b/src/templates/board.rs
index daf94810..46ee249b 100644
--- a/src/templates/board.rs
+++ b/src/templates/board.rs
@@ -397,6 +397,34 @@ fn render_catalog_thumb(thread: &Thread) -> String {
     format!(r#"<div class="catalog-card-media">{media}{badges}</div>"#)
 }
 
+/// Render personal actions using the same authoritative labels on every active view.
+pub(super) fn render_thread_actions(
+    board_short: &str,
+    thread: &Thread,
+    csrf_token: &str,
+    preference: crate::db::UserThreadPreference,
+    return_to: &str,
+) -> String {
+    render_catalog_actions(
+        board_short,
+        thread,
+        csrf_token,
+        if preference.pinned { "unpin" } else { "pin" },
+        if preference.pinned {
+            "Unpin thread"
+        } else {
+            "Pin thread"
+        },
+        if preference.hidden { "unhide" } else { "hide" },
+        if preference.hidden {
+            "Unhide thread"
+        } else {
+            "Hide thread"
+        },
+        return_to,
+    )
+}
+
 #[expect(
     clippy::too_many_arguments,
     reason = "the action menu accepts independent labels and form values for two actions"
@@ -417,16 +445,16 @@ fn render_catalog_actions(
         super::report_fallback_form(board_short, report_post_id, thread.id, csrf_token, "submit");
     format!(
         r#"<div class="catalog-card-actions">
-  <button type="button" class="catalog-thread-menu-toggle" data-action="toggle-thread-menu" aria-haspopup="true" aria-expanded="false" aria-controls="catalog-thread-menu-{thread_id}" aria-label="Thread actions"></button>
-  <div class="catalog-thread-menu" id="catalog-thread-menu-{thread_id}" hidden inert aria-hidden="true">
-    <button type="button" class="catalog-thread-menu-item" data-action="open-report" data-pid="{post_id}" data-tid="{thread_id}" data-board="{board}" data-csrf="{csrf}" data-report-label="Reporting thread No.{thread_id}">Report thread</button>
+  <button type="button" class="catalog-thread-menu-toggle" data-action="toggle-thread-menu" aria-haspopup="menu" aria-expanded="false" aria-controls="catalog-thread-menu-{thread_id}" aria-label="Thread actions"></button>
+  <div class="catalog-thread-menu" id="catalog-thread-menu-{thread_id}" role="menu" aria-label="Thread actions" hidden inert aria-hidden="true">
+    <button type="button" class="catalog-thread-menu-item" role="menuitem" tabindex="-1" data-action="open-report" data-pid="{post_id}" data-tid="{thread_id}" data-board="{board}" data-csrf="{csrf}" data-report-label="Reporting thread No.{thread_id}">Report thread</button>
     <form method="POST" action="/{board}/thread-preference">
       <input type="hidden" name="_csrf" value="{csrf}">
       <input type="hidden" name="thread_id" value="{thread_id}">
       <input type="hidden" name="board" value="{board}">
       <input type="hidden" name="action" value="{pin_action}">
       <input type="hidden" name="return_to" value="{return_to}">
-      <button type="submit" class="catalog-thread-menu-item">{pin_label}</button>
+      <button type="submit" class="catalog-thread-menu-item" role="menuitem" tabindex="-1"{pin_disabled}>{pin_label}</button>
     </form>
     <form method="POST" action="/{board}/thread-preference">
       <input type="hidden" name="_csrf" value="{csrf}">
@@ -434,7 +462,7 @@ fn render_catalog_actions(
       <input type="hidden" name="board" value="{board}">
       <input type="hidden" name="action" value="{hide_action}">
       <input type="hidden" name="return_to" value="{return_to}">
-      <button type="submit" class="catalog-thread-menu-item">{hide_label}</button>
+      <button type="submit" class="catalog-thread-menu-item" role="menuitem" tabindex="-1"{hide_disabled}>{hide_label}</button>
     </form>
   </div>
   <details class="catalog-thread-fallback-actions" aria-label="Thread actions" open>
@@ -447,7 +475,7 @@ fn render_catalog_actions(
         <input type="hidden" name="board" value="{board}">
         <input type="hidden" name="action" value="{pin_action}">
         <input type="hidden" name="return_to" value="{return_to}">
-        <button type="submit" class="catalog-thread-fallback-submit">{pin_label}</button>
+        <button type="submit" class="catalog-thread-fallback-submit"{pin_disabled}>{pin_label}</button>
       </form>
       <form class="catalog-thread-fallback-form" method="POST" action="/{board}/thread-preference">
         <input type="hidden" name="_csrf" value="{csrf}">
@@ -455,7 +483,7 @@ fn render_catalog_actions(
         <input type="hidden" name="board" value="{board}">
         <input type="hidden" name="action" value="{hide_action}">
         <input type="hidden" name="return_to" value="{return_to}">
-        <button type="submit" class="catalog-thread-fallback-submit">{hide_label}</button>
+        <button type="submit" class="catalog-thread-fallback-submit"{hide_disabled}>{hide_label}</button>
       </form>
     </div>
   </details>
@@ -464,6 +492,16 @@ fn render_catalog_actions(
         thread_id = thread.id,
         board = escape_html(board_short),
         csrf = escape_html(csrf_token),
+        pin_disabled = if thread.archived && pin_action == "pin" {
+            " disabled"
+        } else {
+            ""
+        },
+        hide_disabled = if thread.archived && hide_action == "hide" {
+            " disabled"
+        } else {
+            ""
+        },
         pin_action = escape_html(pin_action),
         pin_label = escape_html(pin_label),
         hide_action = escape_html(hide_action),
@@ -536,7 +574,7 @@ fn render_catalog_card(
     };
 
     format!(
-        r#"<div class="catalog-item{sticky}{pinned_class}" data-replies="{replies}" data-created="{created}" data-bumped="{bumped}" data-last-reply="{last_reply}" data-sticky="{is_sticky}" data-pinned="{is_pinned}">
+        r#"<div class="catalog-item{sticky}{pinned_class}" data-thread-id="{thread_id}" data-replies="{replies}" data-created="{created}" data-bumped="{bumped}" data-last-reply="{last_reply}" data-sticky="{is_sticky}" data-pinned="{is_pinned}">
 <a class="catalog-card-link" href="/{board}/thread/{thread_id}">
   {thumb}
 </a>
@@ -588,7 +626,7 @@ fn render_archive_row(board_short: &str, thread: &Thread) -> String {
     });
     let thumb_html = thread.op_thumb.as_ref().map_or_else(String::new, |thumb| {
         format!(
-            r#"<div class="archive-row-media"><img src="/boards/{}" class="archive-thumb" alt="thumb" loading="lazy" decoding="async"></div>"#,
+            r#"<div class="archive-row-media"><img src="/boards/{}" class="archive-thumb" alt="" loading="lazy" decoding="async"></div>"#,
             escape_html(thumb),
         )
     });
@@ -601,7 +639,7 @@ fn render_archive_row(board_short: &str, thread: &Thread) -> String {
     <span class="archive-thread-link-text">
       {subject}<span class="archive-preview">{preview}</span>
     </span>
-    <span class="archive-meta">No.{thread_id}{state_badges} - {replies} replies - {created_at}</span>
+    <span class="archive-meta">No.{thread_id}{state_badges} - {replies} replies - {attachments} attachments - Created {created_at} - Last bump {bumped_at}</span>
   </div>
 </a>"#,
         board = escape_html(board_short),
@@ -612,6 +650,8 @@ fn render_archive_row(board_short: &str, thread: &Thread) -> String {
         state_badges = thread_state_badges,
         replies = thread.reply_count,
         created_at = fmt_ts(thread.created_at),
+        bumped_at = fmt_ts(thread.bumped_at),
+        attachments = thread.image_count,
     )
 }
 
@@ -685,7 +725,16 @@ pub fn index_page<S: std::hash::BuildHasher>(
     } else {
         format!(
             "<div class=\"index-section\"><h2 class=\"index-section-title\">// Boards</h2><div class=\"board-cards\">{}</div></div>",
-            board_cards(&sfw, board_badges, board_reply_badges, nsfw_consent, csrf_token, admin_csrf_token, is_admin, user_preferences)
+            board_cards(
+                &sfw,
+                board_badges,
+                board_reply_badges,
+                nsfw_consent,
+                csrf_token,
+                admin_csrf_token,
+                is_admin,
+                user_preferences
+            )
         )
     };
 
@@ -694,7 +743,16 @@ pub fn index_page<S: std::hash::BuildHasher>(
     } else {
         format!(
             "<div class=\"index-section\" data-board-nsfw=\"1\"><h2 class=\"index-section-title\">// Adult Boards <span class=\"nsfw-badge\">NSFW</span></h2><div class=\"board-cards\">{}</div></div>",
-            board_cards(&nsfw, board_badges, board_reply_badges, nsfw_consent, csrf_token, admin_csrf_token, is_admin, user_preferences)
+            board_cards(
+                &nsfw,
+                board_badges,
+                board_reply_badges,
+                nsfw_consent,
+                csrf_token,
+                admin_csrf_token,
+                is_admin,
+                user_preferences
+            )
         )
     };
 
@@ -863,7 +921,7 @@ pub fn index_page<S: std::hash::BuildHasher>(
     reason = "the board index consumes distinct paging, moderation, activity, and visitor contexts"
 )]
 /// Renders a board's paginated thread index.
-pub fn board_page<S: std::hash::BuildHasher>(
+pub fn board_page<S: std::hash::BuildHasher, P: std::hash::BuildHasher>(
     board: &Board,
     summaries: &[ThreadSummary],
     pagination: &Pagination,
@@ -879,6 +937,7 @@ pub fn board_page<S: std::hash::BuildHasher>(
     current_theme: Option<&str>,
     collapse_greentext: bool,
     can_post: bool,
+    thread_preferences: &HashMap<i64, crate::db::UserThreadPreference, P>,
     user_preferences: crate::templates::UserPreferences,
 ) -> String {
     let mut body = String::new();
@@ -917,17 +976,21 @@ pub fn board_page<S: std::hash::BuildHasher>(
         let name = escape_html(&board.name);
         let desc = escape_html(&board.description);
         let access_badge = board_access_badge(board);
-        let nav_archive = if board.allow_archive {
-            format!(r#"<a class="board-nav-link" href="/{short}/archive">[Archive]</a>"#)
-        } else {
-            String::new()
-        };
+        let hidden_count = thread_preferences
+            .values()
+            .filter(|pref| pref.hidden)
+            .count();
+        let nav_hidden = format!(
+            r#"<a class="board-nav-link" href="/{short}/hidden">[Hidden ({hidden_count})]</a>"#
+        );
+        let nav_archive =
+            format!(r#"<a class="board-nav-link" href="/{short}/archive">[Archive]</a>"#);
         crate::templates::append_html(
             &mut body,
             format_args!(
                 r#"<div class="board-header board-index-header" data-activity-page="board-index"><h1>/{short}/  — {name}{access_badge}</h1><p class="board-desc">{desc}</p></div>
 {board_banner_html}
-<div class="board-nav"><a class="board-nav-link active" href="/{short}">[Index]</a><a class="board-nav-link" href="/{short}/catalog">[Catalog]</a>{nav_archive}</div>"#
+<div class="board-nav"><a class="board-nav-link active" href="/{short}">[Index]</a><a class="board-nav-link" href="/{short}/catalog">[Catalog]</a>{nav_archive}{nav_hidden}</div>"#
             ),
         );
     }
@@ -971,7 +1034,24 @@ pub fn board_page<S: std::hash::BuildHasher>(
         ));
     }
 
+    let return_to = if pagination.page > 1 {
+        format!("/{}?page={}", board.short_name, pagination.page)
+    } else {
+        format!("/{}", board.short_name)
+    };
     for summary in summaries {
+        body.push_str(r#"<div class="thread-list-entry">"#);
+        let preference = thread_preferences
+            .get(&summary.thread.id)
+            .copied()
+            .unwrap_or_default();
+        body.push_str(&render_thread_actions(
+            &board.short_name,
+            &summary.thread,
+            csrf_token,
+            preference,
+            &return_to,
+        ));
         body.push_str(&render_thread_summary(
             summary,
             &board.short_name,
@@ -987,6 +1067,7 @@ pub fn board_page<S: std::hash::BuildHasher>(
             },
             user_preferences,
         ));
+        body.push_str("</div>");
     }
 
     // escape_html on board.short_name before embedding in the URL.
@@ -995,6 +1076,7 @@ pub fn board_page<S: std::hash::BuildHasher>(
         &format!("/{}", escape_html(&board.short_name)),
     ));
 
+    body.push_str(report_modal_script());
     body.push_str(&compress_modal_script(
         board.max_image_size_bytes(),
         board.max_video_size_bytes(),
@@ -1255,7 +1337,7 @@ fn render_thread_summary(
         ));
     }
 
-    html.push_str("<hr class=\"thread-sep\">");
+    html.push_str("</div><hr class=\"thread-sep\">");
     html
 }
 
@@ -1314,11 +1396,7 @@ pub fn catalog_page<S: std::hash::BuildHasher>(
         );
     }
 
-    let nav_archive = if board.allow_archive {
-        format!(r#"<a class="board-nav-link" href="/{bs}/archive">[Archive]</a>"#)
-    } else {
-        String::new()
-    };
+    let nav_archive = format!(r#"<a class="board-nav-link" href="/{bs}/archive">[Archive]</a>"#);
     let hidden_nav = if hidden_count > 0 {
         let active_class = if hidden_view { " active" } else { "" };
         format!(
@@ -1513,7 +1591,9 @@ pub fn search_page(
     collapse_greentext: bool,
     user_preferences: crate::templates::UserPreferences,
 ) -> String {
-    let result_label = if pagination.total == 1 {
+    let result_label = if pagination.total >= 10_000 {
+        "10,000+ results (refine your query to see more)".to_owned()
+    } else if pagination.total == 1 {
         "1 result".to_owned()
     } else {
         format!("{} results", pagination.total)
@@ -1621,16 +1701,17 @@ pub fn archive_page(
   <a class="board-nav-link active" href="/{bs}/archive">[Archive]</a>
 </div>
 <div class="page-box">
-<p class="archive-subtext">Threads cycled off the board index — read-only, retained up to this board's archive limit.</p>
+<p class="archive-subtext">Read-only threads, ordered by last bump. This board retains up to {archive_limit} archived threads.</p>
 </div>"#,
         bs = bs,
         bn = bn,
         desc = escape_html(&board.description),
+        archive_limit = board.max_archived_threads,
     );
 
     if threads.is_empty() {
         body.push_str(
-            r#"<div class="page-box"><p style="color:var(--text-dim)">no archived threads yet.</p></div>"#,
+            r#"<div class="page-box"><p style="color:var(--text-dim)">No archived threads yet.</p></div>"#,
         );
     } else {
         body.push_str(r#"<div class="archive-list">"#);
@@ -2235,6 +2316,11 @@ mod tests {
 
         assert!(html.contains("media-expanded-video"));
         assert!(html.contains("controls preload=\"none\" playsinline webkit-playsinline muted"));
+        assert_eq!(
+            html.matches("<div").count(),
+            html.matches("</div>").count(),
+            "a summary must close its container so later thread actions remain siblings"
+        );
     }
 
     #[test]
@@ -2304,6 +2390,7 @@ mod tests {
             None,
             false,
             true,
+            &HashMap::new(),
             crate::templates::UserPreferences::default(),
         );
 
diff --git a/src/templates/thread.rs b/src/templates/thread.rs
index 1bad0a3e..68b708b7 100644
--- a/src/templates/thread.rs
+++ b/src/templates/thread.rs
@@ -5,13 +5,51 @@ use crate::utils::{
     files::format_file_size, redirect::encode_query_component, sanitize::escape_html,
 };
 use sha2::{Digest as _, Sha256};
-use std::collections::BTreeMap;
+use std::collections::{BTreeMap, HashSet};
 
 use super::{
     admin_ban_delete_modal_script, base_layout, base_layout_with_preferences,
     compress_modal_script, fmt_ts, fmt_ts_short, report_modal_script, thread_autoupdate_script,
 };
 
+/// Navigation metadata for bounded thread pages.
+#[derive(Clone, Copy, Debug, Default)]
+pub(crate) struct ThreadWindow {
+    /// Exclusive upper post ID for the next older page.
+    pub(crate) older_before: Option<i64>,
+    /// Historical pages retain their selected range rather than polling forward.
+    pub(crate) historical: bool,
+}
+
+/// Render links that also work when JavaScript is disabled.
+fn render_window_nav(board: &Board, thread: &Thread, window: ThreadWindow) -> String {
+    let mut nav = String::new();
+    let short = escape_html(&board.short_name);
+    if let Some(before) = window.older_before {
+        super::append_html(
+            &mut nav,
+            format_args!(
+                r#"<a href="/{short}/thread/{}?before={before}">[ Older replies ]</a> "#,
+                thread.id
+            ),
+        );
+    }
+    if window.historical {
+        super::append_html(
+            &mut nav,
+            format_args!(
+                r#"<a href="/{short}/thread/{}">[ Latest replies ]</a>"#,
+                thread.id
+            ),
+        );
+    }
+    if nav.is_empty() {
+        nav
+    } else {
+        format!(r#"<nav class="thread-window-nav" aria-label="Reply pages">{nav}</nav>"#)
+    }
+}
+
 /// Number of seconds during which a poster may edit or delete a new post.
 const SELF_ACTION_WINDOW_SECS: i64 = 60;
 /// User-facing explanation of the edit and delete window.
@@ -200,40 +238,57 @@ pub fn delete_post_page(
 
 /// Renders the top or bottom thread navigation controls.
 fn render_thread_nav(board: &Board, thread: &Thread, is_bottom: bool) -> String {
+    let board_short = escape_html(&board.short_name);
+    let position = if is_bottom { "bottom" } else { "top" };
     let jump_link = if is_bottom { "#top" } else { "#bottom" };
     let jump_label = if is_bottom { "Top" } else { "Bottom" };
-    let nav_class = if is_bottom {
-        "board-header thread-nav thread-nav-bottom"
+    let return_suffix = if thread.archived { "/archive" } else { "" };
+    let refresh_controls = if thread.archived {
+        String::new()
     } else {
-        "board-header thread-nav"
-    };
-    format!(
-        r#"<div class="{nav_class}">
-  <div class="thread-nav-group thread-nav-links">
-    <a href="/{board_short}">[ Return ]</a>
-    <a href="/{board_short}/catalog">[ Catalog ]</a>
-    <a href="{jump_link}">[ {jump_label} ]</a>
-  </div>
-  <div class="thread-nav-group thread-nav-refresh">
-    <noscript><a href="/{board_short}/thread/{thread_id}">[ Update now ]</a></noscript>
-    <button class="thread-nav-btn" type="button" data-action="fetch-updates" data-busy-label="[ Updating… ]">[ Update now ]</button>
+        format!(
+            r#"  <div class="thread-nav-group thread-nav-refresh">
+    <noscript><a class="thread-nav-control thread-nav-update" href="/{board_short}/thread/{thread_id}">[ Update now ]</a></noscript>
+    <button class="thread-nav-control thread-nav-btn thread-nav-update" type="button" data-action="fetch-updates" data-busy-label="[ Updating… ]">[ Update now ]</button>
     <label class="autoupdate-label">
       <input type="checkbox" data-role="autoupdate-toggle" data-action="autoupdate-toggle">
       <span>Auto refresh</span>
     </label>
   </div>
-  <div class="thread-nav-group thread-nav-state">
-    <span class="autoupdate-status" data-role="autoupdate-status" role="status" aria-live="polite"></span>
-    <span class="thread-reply-stat" title="Reply count"><span class="thread-reply-stat-label">Replies</span>: <span data-role="thread-reply-count">{reply_count}</span></span>
+"#,
+            thread_id = thread.id,
+        )
+    };
+    let update_status = if thread.archived {
+        ""
+    } else if is_bottom {
+        r#"<span class="autoupdate-status" data-role="autoupdate-status"></span>"#
+    } else {
+        // Announce updates once; the bottom copy is visual feedback only.
+        r#"<span class="autoupdate-status" data-role="autoupdate-status" role="status"></span>"#
+    };
+    let nav_class = if is_bottom {
+        "board-header thread-nav thread-nav-bottom"
+    } else {
+        "board-header thread-nav"
+    };
+    format!(
+        r#"<div class="{nav_class}" id="{position}" tabindex="-1" role="group" aria-label="Thread controls at {position}">
+  <nav class="thread-nav-group thread-nav-links" aria-label="Thread navigation at {position}">
+    <a class="thread-nav-control" href="/{board_short}{return_suffix}">[ Return ]</a>
+    <a class="thread-nav-control" href="/{board_short}/catalog">[ Catalog ]</a>
+    <a class="thread-nav-control" href="{jump_link}">[ {jump_label} ]</a>
+  </nav>
+{refresh_controls}  <div class="thread-nav-group thread-nav-state">
+    {update_status}
+    <span class="thread-reply-stat" title="Reply count"><span class="thread-reply-stat-label">Replies:</span> <span data-role="thread-reply-count">{reply_count}</span></span>
   </div>
 </div>
 "#,
         nav_class = nav_class,
-        board_short = escape_html(&board.short_name),
         jump_link = jump_link,
         jump_label = jump_label,
         reply_count = thread.reply_count,
-        thread_id = thread.id,
     )
 }
 
@@ -291,6 +346,56 @@ pub fn render_archive_state_badges(sticky: bool) -> String {
 
 // Thread page
 #[must_use]
+#[expect(
+    clippy::too_many_arguments,
+    reason = "thread rendering consumes distinct moderation, poll, form, theme, and visitor contexts"
+)]
+/// Renders a complete thread page.
+pub fn thread_page(
+    board: &Board,
+    thread: &Thread,
+    posts: &[Post],
+    owned_post_controls: &BTreeMap<i64, OwnedPostControls>,
+    csrf_token: &str,
+    boards: &[Board],
+    is_admin: bool,
+    admin_csrf_token: Option<&str>,
+    poll: Option<&crate::models::PollData>,
+    error: Option<&str>,
+    success: Option<&str>,
+    reply_prefill: Option<&super::forms::PostFormState>,
+    edit_overlay_state: Option<&EditOverlayState>,
+    current_theme: Option<&str>,
+    collapse_greentext: bool,
+    can_post: bool,
+    thread_preference: crate::db::UserThreadPreference,
+    user_preferences: crate::templates::UserPreferences,
+) -> String {
+    thread_page_window(
+        board,
+        thread,
+        posts,
+        owned_post_controls,
+        csrf_token,
+        boards,
+        is_admin,
+        admin_csrf_token,
+        poll,
+        error,
+        success,
+        reply_prefill,
+        edit_overlay_state,
+        current_theme,
+        collapse_greentext,
+        can_post,
+        thread_preference,
+        user_preferences,
+        ThreadWindow::default(),
+    )
+}
+
+/// Render a bounded thread window while preserving the normal document hooks.
+#[must_use]
 #[expect(
     clippy::too_many_lines,
     reason = "the thread document keeps navigation, posts, poll, forms, and modals together"
@@ -299,8 +404,7 @@ pub fn render_archive_state_badges(sticky: bool) -> String {
     clippy::too_many_arguments,
     reason = "thread rendering consumes distinct moderation, poll, form, theme, and visitor contexts"
 )]
-/// Renders a complete thread page.
-pub fn thread_page(
+pub(crate) fn thread_page_window(
     board: &Board,
     thread: &Thread,
     posts: &[Post],
@@ -317,7 +421,9 @@ pub fn thread_page(
     current_theme: Option<&str>,
     collapse_greentext: bool,
     can_post: bool,
+    thread_preference: crate::db::UserThreadPreference,
     user_preferences: crate::templates::UserPreferences,
+    window: ThreadWindow,
 ) -> String {
     let mut body = String::new();
     let admin_form_csrf = admin_csrf_token.unwrap_or(csrf_token);
@@ -340,14 +446,14 @@ pub fn thread_page(
 <input type="hidden" name="thread_id" value="{tid}">
 <input type="hidden" name="action" value="{sticky_act}">
 <input type="hidden" name="board" value="{board}">
-<button type="submit" class="admin-toolbar-btn">{sticky_lbl}</button>
+<button type="submit" class="admin-toolbar-btn"{sticky_disabled}>{sticky_lbl}</button>
 </form>
 <form method="POST" action="/admin/thread/action" style="display:inline">
 <input type="hidden" name="_csrf" value="{csrf}">
 <input type="hidden" name="thread_id" value="{tid}">
 <input type="hidden" name="action" value="{lock_act}">
 <input type="hidden" name="board" value="{board}">
-<button type="submit" class="admin-toolbar-btn">{lock_lbl}</button>
+<button type="submit" class="admin-toolbar-btn"{lock_disabled}>{lock_lbl}</button>
 </form>
 {archive_btn}
 <form method="POST" action="/admin/thread/delete" style="display:inline">
@@ -366,6 +472,12 @@ pub fn thread_page(
             csrf = escape_html(admin_form_csrf),
             tid = thread.id,
             board = escape_html(&board.short_name),
+            sticky_disabled = if thread.archived && !thread.sticky {
+                " disabled"
+            } else {
+                ""
+            },
+            lock_disabled = if thread.archived { " disabled" } else { "" },
             sticky_act = sticky_action.0,
             sticky_lbl = sticky_action.1,
             lock_act = lock_action.0,
@@ -425,8 +537,7 @@ pub fn thread_page(
     crate::templates::append_html(
         &mut body,
         format_args!(
-            r#"<div id="top"></div>
-<div class="thread-board-banner board-thread-header">/{s}/ — {bn}{access_badge}</div>
+            r#"<div class="thread-board-banner board-thread-header">/{s}/ — {bn}{access_badge}</div>
 {admin_toolbar}
 {top_nav}"#,
             s = escape_html(&board.short_name),
@@ -436,27 +547,44 @@ pub fn thread_page(
             top_nav = render_thread_nav(board, thread, false)
         ),
     );
+    {
+        body.push_str(r#"<div class="thread-actions-row">"#);
+        if thread_preference.hidden {
+            body.push_str(r#"<span class="notice">Hidden from your index and catalog. This direct link remains available.</span>"#);
+        }
+        body.push_str(&super::board::render_thread_actions(
+            &board.short_name,
+            thread,
+            csrf_token,
+            thread_preference,
+            &format!("/{}/thread/{}", board.short_name, thread.id),
+        ));
+        body.push_str("</div>");
+    }
     body.push_str(thread_notice);
 
     if let Some(pd) = poll {
-        body.push_str(&render_poll(pd, thread.id, &board.short_name, csrf_token));
+        body.push_str(&render_poll(pd, thread, &board.short_name, csrf_token));
     }
 
+    body.push_str(&render_window_nav(board, thread, window));
+    let visible_ids = posts.iter().map(|post| post.id).collect::<HashSet<_>>();
     let last_post_id = posts.iter().map(|p| p.id).max().unwrap_or(0);
     crate::templates::append_html(
         &mut body,
         format_args!(
-            r#"<div id="thread-posts" data-activity-page="thread" data-thread-id="{tid}" data-board="{board}" data-last-id="{last}" data-locked="{locked}" data-sticky="{sticky}" data-archived="{archived}">"#,
+            r#"<div id="thread-posts" data-activity-page="thread" data-thread-id="{tid}" data-board="{board}" data-last-id="{last}" data-history-page="{history}" data-locked="{locked}" data-sticky="{sticky}" data-archived="{archived}">"#,
             tid = thread.id,
             board = escape_html(&board.short_name),
             last = last_post_id,
+            history = window.historical,
             locked = thread.locked,
             sticky = thread.sticky,
             archived = thread.archived,
         ),
     );
     for post in posts {
-        body.push_str(&render_post(
+        let post_html = render_post(
             post,
             &board.short_name,
             csrf_token,
@@ -480,10 +608,16 @@ pub fn thread_page(
                 video_audio_muted: user_preferences.video_audio_muted,
             },
             SELF_ACTION_WINDOW_SECS,
+        );
+        body.push_str(&crate::utils::sanitize::route_missing_quote_links(
+            &post_html,
+            &board.short_name,
+            &visible_ids,
         ));
     }
 
     body.push_str("</div>\n");
+    body.push_str(&render_window_nav(board, thread, window));
     body.push_str(&render_edit_overlay(
         board,
         thread.id,
@@ -533,7 +667,6 @@ pub fn thread_page(
             "unlock posting",
         ));
     }
-    body.push_str("<div id=\"bottom\"></div>\n");
     body.push_str(&render_thread_nav(board, thread, true));
 
     body.push_str(&compress_modal_script(
@@ -602,12 +735,16 @@ fn poll_expiry_label(pd: &crate::models::PollData) -> String {
 /// Renders a poll voting form or its results.
 fn render_poll(
     pd: &crate::models::PollData,
-    thread_id: i64,
+    thread: &Thread,
     board_short: &str,
     csrf_token: &str,
 ) -> String {
-    let expires_str = poll_expiry_label(pd);
-    let show_results = pd.is_expired || pd.user_voted_option.is_some();
+    let expires_str = if thread.archived {
+        "archived".to_owned()
+    } else {
+        poll_expiry_label(pd)
+    };
+    let show_results = thread.archived || pd.is_expired || pd.user_voted_option.is_some();
 
     let mut html = format!(
         r#"<div class="poll-container" id="poll">
@@ -617,7 +754,7 @@ fn render_poll(
   <span class="poll-status {status_class}">[{expires}]</span>
 </div>"#,
         q = escape_html(&pd.poll.question),
-        status_class = if pd.is_expired {
+        status_class = if thread.archived || pd.is_expired {
             "poll-closed"
         } else {
             "poll-open"
@@ -675,7 +812,7 @@ fn render_poll(
 <input type="hidden" name="thread_id" value="{tid}">
 <input type="hidden" name="board"     value="{board}">"#,
                 csrf = escape_html(csrf_token),
-                tid = thread_id,
+                tid = thread.id,
                 board = escape_html(board_short)
             ),
         );
@@ -1394,8 +1531,11 @@ fn render_post_with_context(
     }
 
     // Post body (pre-rendered, sanitised HTML)
-    let body_html =
-        crate::utils::sanitize::normalize_greentext_blocks(&post.body_html, collapse_greentext);
+    let body_html = crate::utils::sanitize::safe_stored_post_html(
+        &post.body,
+        &post.body_html,
+        collapse_greentext,
+    );
     let body_html = annotate_op_quotelinks(&body_html, thread_op_id);
     let body_html = match link_context {
         PostLinkContext::Inline => body_html,
@@ -1612,7 +1752,7 @@ fn render_edit_overlay(
 mod tests {
     use super::{
         delete_post_page, display_file_name, edit_post_page, render_post, render_search_post,
-        thread_page, EditOverlayState, OwnedPostControls, RenderPostOpts,
+        render_thread_nav, thread_page, EditOverlayState, OwnedPostControls, RenderPostOpts,
     };
     use crate::models::{BoardAccessMode, MediaType, Post, Thread};
 
@@ -1668,6 +1808,136 @@ mod tests {
         }
     }
 
+    #[test]
+    fn archived_media_and_markup_use_the_same_safe_post_renderer() {
+        for (media, mime) in [
+            (Some(MediaType::Image), "image/webp"),
+            (Some(MediaType::Video), "video/webm"),
+            (Some(MediaType::Audio), "audio/ogg"),
+            (Some(MediaType::Pdf), "application/pdf"),
+            (Some(MediaType::Other), "application/octet-stream"),
+            (None, "image/webp"),
+        ] {
+            let post = Post {
+                media_type: media,
+                mime_type: Some(mime.to_owned()),
+                // Keep hostile fixtures distinct from served inline-script source.
+                name: concat!("<scr", "ipt>alert(1)</script>").to_owned(),
+                file_name: Some(concat!("unsafe\"<scr", "ipt>.webp").to_owned()),
+                body_html: crate::utils::sanitize::render_post_body(
+                    &crate::utils::sanitize::escape_html(concat!(
+                        ">quote\n>>1 [spoiler]hidden[/spoiler] <scr",
+                        "ipt>alert(1)</script>"
+                    )),
+                    false,
+                ),
+                audio_file_path: Some("test/companion.opus".to_owned()),
+                audio_file_name: Some("companion.opus".to_owned()),
+                audio_mime_type: Some("audio/ogg".to_owned()),
+                ..sample_post()
+            };
+            let render = |archived| {
+                render_post(
+                    &post,
+                    "test",
+                    "csrf",
+                    RenderPostOpts {
+                        show_delete: false,
+                        is_admin: false,
+                        admin_csrf_token: None,
+                        show_media: true,
+                        allow_editing: false,
+                        allow_self_delete: false,
+                        owned_post_controls: None,
+                        show_poster_ids: false,
+                        collapse_greentext: false,
+                        thread_state: Some((false, archived, archived)),
+                        thread_op_id: Some(1),
+                        video_audio_muted: false,
+                    },
+                    0,
+                )
+            };
+            let active = render(false);
+            let archived = render(true);
+            assert_eq!(
+                active, archived,
+                "archive state must preserve reply media and markup"
+            );
+            assert!(
+                !archived.contains("<script>"),
+                "user text must remain escaped"
+            );
+            assert!(archived.contains("data-media-thumb"));
+            assert!(archived.contains("quotelink"));
+        }
+    }
+
+    #[test]
+    fn thread_nav_preserves_live_and_locked_routes_and_refresh_semantics() {
+        let board = crate::test_fixtures::sample_board();
+        for locked in [false, true] {
+            let thread = Thread {
+                locked,
+                ..sample_thread()
+            };
+            for is_bottom in [false, true] {
+                let html = render_thread_nav(&board, &thread, is_bottom);
+                let position = if is_bottom { "bottom" } else { "top" };
+                let jump = if is_bottom { "top" } else { "bottom" };
+                assert!(html.contains(r#"href="/test">[ Return ]</a>"#));
+                assert!(html.contains(r#"href="/test/catalog">[ Catalog ]</a>"#));
+                assert!(html.contains(&format!(r##"href="#{jump}""##)));
+                assert!(html.contains(&format!(r#"id="{position}" tabindex="-1""#)));
+                assert!(html.contains(r#"<nav class="thread-nav-group thread-nav-links""#));
+                assert!(html.contains(r#"<noscript><a class="thread-nav-control thread-nav-update" href="/test/thread/87">[ Update now ]</a></noscript>"#));
+                assert!(html.contains(r#"type="button" data-action="fetch-updates""#));
+                assert!(html.contains(r#"data-role="autoupdate-toggle""#));
+                assert_eq!(
+                    html.matches(r#"role="status""#).count(),
+                    usize::from(!is_bottom)
+                );
+                assert!(!html.contains("<form"));
+                assert!(!html.contains("&nbsp;"));
+            }
+        }
+    }
+
+    #[test]
+    fn archived_thread_nav_returns_to_archive_without_refresh_actions() {
+        // Rendering relies on the archive state even if restored data is unlocked
+        // or the board has stopped automatically archiving new threads.
+        let board = crate::test_fixtures::sample_board();
+        for locked in [false, true] {
+            let thread = Thread {
+                archived: true,
+                locked,
+                ..sample_thread()
+            };
+            for is_bottom in [false, true] {
+                let html = render_thread_nav(&board, &thread, is_bottom);
+                assert!(html.contains(r#"href="/test/archive">[ Return ]</a>"#));
+                assert!(html.contains(r#"href="/test/catalog">[ Catalog ]</a>"#));
+                assert!(html.contains(r#"data-role="thread-reply-count">12"#));
+                assert!(!html.contains("thread-nav-refresh"));
+                assert!(!html.contains("Update now"));
+                assert!(!html.contains("autoupdate"));
+            }
+        }
+    }
+
+    #[test]
+    fn thread_nav_escapes_board_names_in_all_destinations() {
+        let board = crate::models::Board {
+            short_name: "a\"<>&".into(),
+            ..crate::test_fixtures::sample_board()
+        };
+        let html = render_thread_nav(&board, &sample_thread(), false);
+        assert!(html.contains(r#"href="/a&quot;&lt;&gt;&amp;">[ Return ]"#));
+        assert!(html.contains(r#"href="/a&quot;&lt;&gt;&amp;/catalog""#));
+        assert!(html.contains(r#"href="/a&quot;&lt;&gt;&amp;/thread/87""#));
+    }
+
     #[test]
     fn thread_page_renders_thread_nav_links_and_reply_open_action() {
         let board = crate::test_fixtures::sample_board();
@@ -1694,6 +1964,7 @@ mod tests {
             None,
             false,
             true,
+            crate::db::UserThreadPreference::default(),
             crate::templates::UserPreferences::default(),
         );
 
@@ -1703,6 +1974,16 @@ mod tests {
         assert!(html.contains(r##"href="#top">[ Top ]</a>"##));
         assert!(html.contains(r#"data-activity-page="thread""#));
         assert!(html.contains(r#"data-action="toggle-post-form""#));
+        assert_eq!(html.matches(r#"id="top""#).count(), 1);
+        assert_eq!(html.matches(r#"id="bottom""#).count(), 1);
+        assert_eq!(html.matches(r#"class="thread-nav-control""#).count(), 6);
+        assert_eq!(html.matches(r#"data-action="fetch-updates""#).count(), 2);
+        assert_eq!(
+            html.matches(r#"data-role="autoupdate-status" role="status""#)
+                .count(),
+            1
+        );
+        assert!(html.find(r#"id="bottom""#) > html.find(r#"id="thread-posts""#));
     }
 
     #[test]
@@ -1735,6 +2016,7 @@ mod tests {
             None,
             false,
             false,
+            crate::db::UserThreadPreference::default(),
             crate::templates::UserPreferences::default(),
         );
 
@@ -1773,6 +2055,7 @@ mod tests {
             None,
             false,
             true,
+            crate::db::UserThreadPreference::default(),
             crate::templates::UserPreferences::default(),
         );
 
@@ -2332,6 +2615,7 @@ mod tests {
             None,
             false,
             true,
+            crate::db::UserThreadPreference::default(),
             crate::templates::UserPreferences::default(),
         );
 
@@ -2377,6 +2661,7 @@ mod tests {
             None,
             false,
             true,
+            crate::db::UserThreadPreference::default(),
             crate::templates::UserPreferences::default(),
         );
 
@@ -2408,6 +2693,7 @@ mod tests {
             None,
             false,
             true,
+            crate::db::UserThreadPreference::default(),
             crate::templates::UserPreferences::default(),
         );
 
@@ -2432,6 +2718,7 @@ mod tests {
             None,
             false,
             true,
+            crate::db::UserThreadPreference::default(),
             crate::templates::UserPreferences::default(),
         );
 
@@ -2468,6 +2755,7 @@ mod tests {
             None,
             false,
             true,
+            crate::db::UserThreadPreference::default(),
             crate::templates::UserPreferences::default(),
         );
 
@@ -2543,6 +2831,7 @@ mod tests {
                 None,
                 false,
                 true,
+                crate::db::UserThreadPreference::default(),
                 crate::templates::UserPreferences::default(),
             );
             assert_eq!(html.contains(r#"data-action="open-edit-modal""#), can_edit);
@@ -2630,6 +2919,7 @@ mod tests {
             None,
             false,
             true,
+            crate::db::UserThreadPreference::default(),
             crate::templates::UserPreferences::default(),
         );
 
diff --git a/src/test_fixtures.rs b/src/test_fixtures.rs
index fa6274af..ad265eb5 100644
--- a/src/test_fixtures.rs
+++ b/src/test_fixtures.rs
@@ -96,6 +96,10 @@ pub(crate) fn app_state() -> crate::middleware::AppState {
         ),
         maintenance_gate: crate::middleware::MaintenanceGate::new(),
         media_upload_gate: crate::middleware::MediaUploadGate::new(),
+        request_work_gate: crate::middleware::WorkGate::new(256),
+        password_work_gate: crate::middleware::WorkGate::new(2),
+        captcha_work_gate: crate::middleware::WorkGate::new(2),
+        search_work_gate: crate::middleware::WorkGate::new(2),
         db_maintenance_jobs: crate::middleware::DbMaintenanceJobs::new(),
         onion_address: std::sync::Arc::new(tokio::sync::RwLock::new(None)),
     }
diff --git a/src/updates/restart.rs b/src/updates/restart.rs
index 0608fa87..f93b71bf 100644
--- a/src/updates/restart.rs
+++ b/src/updates/restart.rs
@@ -4,6 +4,7 @@ use super::{
     transaction::native::{Engine, Service},
     Operation, Phase, Status,
 };
+use crate::config::admin::SettingsLease;
 use crate::restart::{configuration_digest, Store};
 use anyhow::Context as _;
 use std::fs::File;
@@ -45,7 +46,7 @@ impl Engine {
         instance: Uuid,
         administrator: i64,
         service: &impl Service,
-    ) -> anyhow::Result<(Status, File, File)> {
+    ) -> anyhow::Result<(Status, File, SettingsLease)> {
         let update = self.lock()?;
         let settings = crate::config::admin::settings_lease(&self.config.settings_path)?;
         let mut status = self.status()?;
diff --git a/src/utils/redirect.rs b/src/utils/redirect.rs
index e1eac26a..c5db123d 100644
--- a/src/utils/redirect.rs
+++ b/src/utils/redirect.rs
@@ -43,7 +43,11 @@ fn hex_digit(nibble: u8) -> char {
 #[must_use]
 /// Return whether `path` has the minimum shape required for an internal URL.
 pub fn is_basic_safe_internal_path(path: &str) -> bool {
-    path.starts_with('/') && !path.starts_with("//") && !path.starts_with("/\\")
+    path.len() <= 8192
+        && path.starts_with('/')
+        && !path.starts_with("//")
+        && !path.contains('\\')
+        && !path.chars().any(char::is_control)
 }
 
 #[must_use]
@@ -69,3 +73,43 @@ pub fn strict_safe_internal_path_or<'a>(path: Option<&'a str>, fallback: &'a str
     path.filter(|value| is_strict_safe_internal_path(value))
         .unwrap_or(fallback)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn browser_normalization_and_header_control_bypasses_are_rejected() {
+        for path in [
+            "https://attacker.invalid/",
+            "//attacker.invalid/",
+            "/\\attacker.invalid/",
+            "/\t/attacker.invalid/",
+            "/\n/attacker.invalid/",
+            "/\r/attacker.invalid/",
+            "/path\u{007f}",
+            "/path?next=\\attacker",
+        ] {
+            assert!(
+                !is_basic_safe_internal_path(path),
+                "unsafe return path: {path:?}"
+            );
+            assert_eq!(safe_internal_path_or(Some(path), "/fallback"), "/fallback");
+        }
+        for path in [
+            "/b",
+            "/b/thread/1#p2",
+            "/b/search?q=%2F%2Fattacker.invalid",
+            "/?q=emoji%F0%9F%98%80",
+        ] {
+            assert!(
+                is_strict_safe_internal_path(path),
+                "valid internal path: {path:?}"
+            );
+        }
+        assert!(!is_basic_safe_internal_path(&format!(
+            "/{}",
+            "x".repeat(8192)
+        )));
+    }
+}
diff --git a/src/utils/sanitize.rs b/src/utils/sanitize.rs
index 3b2545d5..a3f69398 100644
--- a/src/utils/sanitize.rs
+++ b/src/utils/sanitize.rs
@@ -30,7 +30,7 @@ use formatting::{apply_dice, apply_emoji};
     reason = "the reply-reference regex is a source literal covered by sanitizer tests"
 )]
 static RE_REPLY: LazyLock<Regex> =
-    LazyLock::new(|| Regex::new(r"&gt;&gt;(\d+)").expect("RE_REPLY is valid"));
+    LazyLock::new(|| Regex::new(r"&gt;&gt;([0-9]+)").expect("RE_REPLY is valid"));
 
 /// Matches escaped cross-board links and optional thread identifiers.
 #[expect(
@@ -38,7 +38,7 @@ static RE_REPLY: LazyLock<Regex> =
     reason = "the cross-board-link regex is a source literal covered by sanitizer tests"
 )]
 static RE_CROSSLINK: LazyLock<Regex> = LazyLock::new(|| {
-    Regex::new(r"&gt;&gt;&gt;/([a-z0-9]+)/(\d+)?").expect("RE_CROSSLINK is valid")
+    Regex::new(r"&gt;&gt;&gt;/([a-z0-9]{1,8})/([0-9]+)?").expect("RE_CROSSLINK is valid")
 });
 
 /// Matches HTTP(S) URLs after HTML escaping.
@@ -163,7 +163,12 @@ pub fn render_post_body(escaped: &str, collapse_greentext: bool) -> String {
             // quote lines plainly so no collapse UI exists at all.
             if collapse_greentext && group.len() >= 3 {
                 let count = group.len();
-                crate::templates::append_html(&mut html, format_args!("<details open class=\"greentext-block\"><summary class=\"quote\">&gt; {count} lines</summary>"));
+                crate::templates::append_html(
+                    &mut html,
+                    format_args!(
+                        "<details open class=\"greentext-block\"><summary class=\"quote\">&gt; {count} lines</summary>"
+                    ),
+                );
                 for ql in &group {
                     crate::templates::append_html(
                         &mut html,
@@ -240,6 +245,15 @@ fn render_inline(text: &str) -> String {
     // Both handled in one pass by RE_CROSSLINK so there is no second-pass corruption.
     result = RE_CROSSLINK
         .replace_all(&result, |caps: &regex::Captures<'_>| {
+            let Some(whole) = caps.get(0) else {
+                return String::new();
+            };
+            let invalid_prefix = result.get(..whole.start()).is_some_and(|prefix| prefix.ends_with("&gt;"));
+            let invalid_suffix = result.get(whole.end()..).and_then(|suffix| suffix.chars().next())
+                .is_some_and(|next| next.is_alphanumeric() || next == '_' || (caps.get(2).is_none() && next == '-'));
+            if invalid_prefix || invalid_suffix {
+                return whole.as_str().to_owned();
+            }
             let Some(board) = caps.get(1).map(|value| value.as_str()) else {
                 return caps
                     .get(0)
@@ -247,8 +261,11 @@ fn render_inline(text: &str) -> String {
             };
             caps.get(2).map_or_else(
                 || format!(r#"<a href="/{board}" class="quotelink crosslink">&gt;&gt;&gt;/{board}/</a>"#),
-                |pid| {
-                    let pid = pid.as_str();
+                |post_match| {
+                    let raw_pid = post_match.as_str();
+                    let Some(pid) = raw_pid.parse::<i64>().ok().filter(|id| *id > 0) else {
+                        return whole.as_str().to_owned();
+                    };
                     format!(
                         r#"<a href="/{board}/post/{pid}" class="quotelink crosslink" data-crossboard="{board}" data-pid="{pid}">&gt;&gt;&gt;/{board}/{pid}</a>"#,
                     )
@@ -265,10 +282,41 @@ fn render_inline(text: &str) -> String {
                     .get(0)
                     .map_or_else(String::new, |value| value.as_str().to_owned());
             };
-            format!(r##"<a href="#p{n}" class="quotelink" data-pid="{n}">&gt;&gt;{n}</a>"##)
+            let Some(whole) = caps.get(0) else {
+                return String::new();
+            };
+            let valid_boundary = !result
+                .get(..whole.start())
+                .is_some_and(|prefix| prefix.ends_with("&gt;"))
+                && !result
+                    .get(whole.end()..)
+                    .and_then(|suffix| suffix.chars().next())
+                    .is_some_and(|next| next.is_alphanumeric() || next == '_');
+            let Some(pid) = n.parse::<i64>().ok().filter(|id| *id > 0 && valid_boundary) else {
+                return whole.as_str().to_owned();
+            };
+            format!(r##"<a href="#p{pid}" class="quotelink" data-pid="{pid}">&gt;&gt;{n}</a>"##)
+        })
+        .into_owned();
+
+    // Format escaped text before generating URL attributes. Applying markup to
+    // generated anchors could put markup's quotes inside a hostile href.
+    // [spoiler]…[/spoiler]
+    result = RE_SPOILER
+        .replace_all(&result, |caps: &regex::Captures<'_>| {
+            let spoiler = caps.get(1).map_or("", |value| value.as_str());
+            format!(r#"<span class="spoiler" data-action="toggle-spoiler">{spoiler}</span>"#)
         })
         .into_owned();
 
+    // **bold**
+    result = RE_BOLD
+        .replace_all(&result, "<strong>$1</strong>")
+        .into_owned();
+
+    // __italic__
+    result = RE_ITALIC.replace_all(&result, "<em>$1</em>").into_owned();
+
     // URLs — also append a video embed placeholder when the URL is a known video link.
     // The placeholder is an empty <span> with data attributes; the client-side embed
     // script replaces it with a thumbnail + iframe when embeds are enabled for the board.
@@ -312,22 +360,6 @@ fn render_inline(text: &str) -> String {
         })
         .into_owned();
 
-    // [spoiler]…[/spoiler]
-    result = RE_SPOILER
-        .replace_all(&result, |caps: &regex::Captures<'_>| {
-            let spoiler = caps.get(1).map_or("", |value| value.as_str());
-            format!(r#"<span class="spoiler" data-action="toggle-spoiler">{spoiler}</span>"#)
-        })
-        .into_owned();
-
-    // **bold**
-    result = RE_BOLD
-        .replace_all(&result, "<strong>$1</strong>")
-        .into_owned();
-
-    // __italic__
-    result = RE_ITALIC.replace_all(&result, "<em>$1</em>").into_owned();
-
     // Emoji shortcodes (applied last, after HTML transforms)
     result = apply_emoji(&result);
 
@@ -415,10 +447,76 @@ pub fn validate_subject(subject: &str) -> Option<String> {
     }
 }
 
+/// Safely render legacy markup that predates the attribute-context correction.
+/// Only malformed cached HTML falls back to escaped text, preserving valid dice rolls.
+#[must_use]
+pub fn safe_stored_post_html(body: &str, body_html: &str, collapse_greentext: bool) -> String {
+    let malformed_url = body_html.len() > 256 * 1024
+        || ["href=\"", "data-url=\""].iter().any(|attribute| {
+            body_html.split(attribute).skip(1).any(|suffix| {
+                suffix
+                    .split('"')
+                    .next()
+                    .is_some_and(|value| value.contains('<'))
+            })
+        });
+    if malformed_url {
+        escape_html(&body.chars().take(4096).collect::<String>()).replace('\n', "<br>")
+    } else {
+        normalize_greentext_blocks(body_html, collapse_greentext)
+    }
+}
+
+/// Keep in-page quotes local and route references outside the rendered window safely.
+#[must_use]
+pub fn route_missing_quote_links<S: std::hash::BuildHasher>(
+    html: &str,
+    board: &str,
+    visible: &std::collections::HashSet<i64, S>,
+) -> String {
+    static QUOTE_HREF: LazyLock<Option<Regex>> =
+        LazyLock::new(|| Regex::new(r##"href="#p([0-9]+)""##).ok());
+    let Some(regex) = QUOTE_HREF.as_ref() else {
+        return html.to_owned();
+    };
+    let board = escape_html(board);
+    regex
+        .replace_all(html, |caps: &regex::Captures<'_>| {
+            let Some(pid) = caps
+                .get(1)
+                .and_then(|value| value.as_str().parse::<i64>().ok())
+            else {
+                return caps
+                    .get(0)
+                    .map_or_else(String::new, |value| value.as_str().to_owned());
+            };
+            if visible.contains(&pid) {
+                format!(r##"href="#p{pid}""##)
+            } else {
+                format!(r#"href="/{board}/post/{pid}""#)
+            }
+        })
+        .into_owned()
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn legacy_malformed_url_markup_is_rendered_as_text_without_rerolling_valid_html() {
+        let legacy = r#"<a href="https://example.invalid/<span class="spoiler" data-action="toggle-spoiler">bad</span>">link</a>"#;
+        let safe = safe_stored_post_html(
+            "https://example.invalid/[spoiler]bad[/spoiler]<img>",
+            legacy,
+            false,
+        );
+        assert!(!safe.contains("<span") && !safe.contains("<img>"));
+        assert!(safe.contains("&lt;img&gt;"));
+        let valid = "<span class=\"dice-roll\">immutable roll 4</span>";
+        assert_eq!(safe_stored_post_html("[dice 1d6]", valid, false), valid);
+    }
+
     #[test]
     fn test_escape_html() {
         assert_eq!(
@@ -817,10 +915,10 @@ mod tests {
         // Extremely large post IDs should not cause integer overflow
         let escaped = escape_html(">>99999999999999999999");
         let html = render_post_body(&escaped, false);
-        // Must render as a link regardless of numeric size
+        // Invalid IDs remain readable text rather than broken numeric links
         assert!(
-            html.contains("quotelink"),
-            "large post ID should still produce a link"
+            !html.contains("quotelink"),
+            "an overflowing post ID must remain plain text"
         );
     }
 
@@ -882,4 +980,84 @@ mod tests {
         assert!(stripped.contains("class=\"quote\""));
         assert!(stripped.contains("line1"));
     }
+    #[test]
+    fn malformed_quote_identifiers_remain_safe_plain_text() {
+        for raw in [
+            ">>0",
+            ">>-1",
+            ">>１２３",
+            ">>123abc",
+            ">>>123",
+            ">>9223372036854775808",
+            ">>>/test/99999999999999999999999",
+            ">>>/toolongboard/7",
+            ">>>/test/123abc",
+            ">>>/test/-1",
+            ">>>/test/１２３",
+            ">>>>/test/123",
+        ] {
+            let html = render_post_body(&escape_html(raw), false);
+            assert!(
+                !html.contains("quotelink"),
+                "invalid reference was linkified: {raw}"
+            );
+        }
+        let valid = render_post_body(
+            &escape_html(">>00012 >>>/test/00012 >>9223372036854775807 <script>alert(1)</script>"),
+            false,
+        );
+        assert!(
+            valid.contains("data-pid=\"12\""),
+            "leading zeros must resolve to a canonical post ID"
+        );
+        assert!(
+            valid.contains("data-pid=\"9223372036854775807\""),
+            "largest supported post ID must remain representable"
+        );
+        assert!(
+            !valid.contains("<script>"),
+            "quote parsing must preserve escaping"
+        );
+    }
+    #[test]
+    fn markup_in_urls_cannot_rewrite_generated_attributes() {
+        for text in [
+            "https://example.invalid/[spoiler]payload[/spoiler]",
+            "https://example.invalid/**bold**",
+            "https://example.invalid/__italic__",
+            "[spoiler]https://example.invalid/a?x=1&y=2[/spoiler]",
+            "https://example.invalid/[spoiler]x[/spoiler]onmouseover=alert(1)",
+            "https://example.invalid/\"<img src=x onerror=alert(1)>",
+        ] {
+            let html = render_post_body(&escape_html(text), false);
+            for attribute in html.split("href=\"").skip(1) {
+                let value = attribute.split('"').next().unwrap_or_default();
+                assert!(
+                    !value.contains('<') && !value.contains('>'),
+                    "markup entered an href: {html}"
+                );
+            }
+            assert!(
+                !html.contains("<img"),
+                "hostile content became an image tag: {html}"
+            );
+        }
+    }
+
+    #[test]
+    fn unicode_and_many_quotes_remain_bounded_data() {
+        for body in [
+            "e\u{0301}".repeat(2000),
+            "\u{200d}\u{202e}😀".repeat(500),
+            ">>1 ".repeat(1000),
+            "[spoiler]".repeat(1000),
+        ] {
+            let html = render_post_body(&escape_html(&body), false);
+            assert!(
+                html.len() < 256 * 1024,
+                "markup expansion must stay bounded"
+            );
+            assert!(!html.contains("<script"));
+        }
+    }
 }
diff --git a/src/workers/mod.rs b/src/workers/mod.rs
index 7baf7a57..f666b4b7 100644
--- a/src/workers/mod.rs
+++ b/src/workers/mod.rs
@@ -2132,55 +2132,59 @@ fn sha256_file_hex(path: &std::path::Path) -> Result<String> {
 }
 
 // ThreadPrune
-#[expect(
-    clippy::cognitive_complexity,
-    reason = "archive, prune, and filesystem finalization remain one consistency operation"
-)]
 /// Applies one board's live and archived thread-retention limits.
 async fn prune_threads(board_id: i64, pool: DbPool) -> Result<()> {
     tokio::task::spawn_blocking(move || {
         let conn = pool.get()?;
-        let Some(policy) = load_board_retention_policy(&conn, board_id)? else {
-            warn!(
-                target: "workers",
-                board_id,
-                "thread-prune intent targeted a missing board; resolving safely"
-            );
+        // Policy and both retention transitions share one write lock. A concurrent
+        // board-settings edit cannot change the policy between read and deletion.
+        let tx =
+            rusqlite::Transaction::new_unchecked(&conn, rusqlite::TransactionBehavior::Immediate)?;
+        let Some(policy) = load_board_retention_policy(&tx, board_id)? else {
+            warn!(target: "workers", board_id,
+                "thread-prune intent targeted a missing board; resolving safely");
             return Ok(());
         };
-        // `archive_before_prune` is a global safety net: when true,
-        // overflow threads are always archived rather than hard-deleted, even
-        // on boards where allow_archive = false.  This closes the silent data
-        // loss gap where a thread could disappear simply because a board hit
-        // its thread limit while the admin had not opted into archiving.
         let do_archive = policy.allow_archive || CONFIG.archive_before_prune;
-        if do_archive {
-            let count = crate::db::archive_old_threads(&conn, board_id, policy.max_threads)?;
-            if count > 0 {
-                tracing::info!(target: "workers", count, board = %policy.board_short, board_id, "ThreadArchive: threads archived");
-            }
+        let (count, deleted) = if do_archive {
+            (
+                crate::db::threads::archive_old_threads_in_tx(&tx, board_id, policy.max_threads)?,
+                None,
+            )
         } else {
-            let deleted = crate::db::prune_old_threads(&conn, board_id, policy.max_threads)?;
-            let count = deleted.paths.len();
+            (
+                0,
+                Some(crate::db::threads::prune_old_threads_in_tx(
+                    &tx,
+                    board_id,
+                    policy.max_threads,
+                    false,
+                )?),
+            )
+        };
+        let archived = crate::db::threads::prune_old_threads_in_tx(
+            &tx,
+            board_id,
+            policy.max_archived_threads,
+            true,
+        )?;
+        tx.commit()?;
+        if count > 0 {
+            tracing::info!(target: "workers", count, board = %policy.board_short,
+                board_id, "ThreadArchive: threads archived");
+        }
+        if let Some(deleted) = deleted {
             finalize_thread_prune_cleanup(
                 &conn,
                 &policy,
                 &deleted,
                 "thread prune cleanup did not fully complete",
             );
-            if count > 0 {
-                tracing::info!(target: "workers", count, board = %policy.board_short, board_id, files_removed = deleted.paths.len(), "ThreadPrune: threads deleted");
+            if !deleted.paths.is_empty() {
+                tracing::info!(target: "workers", board = %policy.board_short, board_id,
+                    files_removed = deleted.paths.len(), "ThreadPrune: threads deleted");
             }
         }
-
-        // Archived retention remains authoritative even if archiving has since
-        // been disabled; disabling archive changes live overflow behavior but
-        // does not make already-archived content exempt from its current cap.
-        let archived = crate::db::prune_old_archived_threads(
-            &conn,
-            board_id,
-            policy.max_archived_threads,
-        )?;
         finalize_thread_prune_cleanup(
             &conn,
             &policy,
@@ -2188,7 +2192,9 @@ async fn prune_threads(board_id: i64, pool: DbPool) -> Result<()> {
             "archived prune cleanup did not fully complete",
         );
         if !archived.paths.is_empty() {
-            tracing::info!(target: "workers", archived_cap = policy.max_archived_threads, board = %policy.board_short, board_id, files_removed = archived.paths.len(), "ThreadArchivePrune: archived threads deleted");
+            tracing::info!(target: "workers", archived_cap = policy.max_archived_threads,
+                board = %policy.board_short, board_id, files_removed = archived.paths.len(),
+                "ThreadArchivePrune: archived threads deleted");
         }
 
         let (live_eligible, archived_count) = board_retention_counts(&conn, board_id)?;
@@ -3801,6 +3807,36 @@ mod tests {
             .is_some());
     }
 
+    #[tokio::test]
+    async fn archive_and_prune_worker_rolls_back_as_one_operation() -> anyhow::Result<()> {
+        let pool = crate::db::init_test_pool()?;
+        let board = seed_retention_board(&pool, "rollback", 1, 1, true)?;
+        seed_threads(&pool, board, 3, 2)?;
+        {
+            let conn = pool.get()?;
+            conn.execute_batch(
+                "CREATE TRIGGER injected_prune_failure BEFORE DELETE ON threads
+                BEGIN SELECT RAISE(ABORT, 'injected prune failure'); END;",
+            )?;
+        }
+        ensure!(prune_threads(board, pool.clone()).await.is_err());
+        let conn = pool.get()?;
+        ensure!(crate::db::count_threads_for_board(&conn, board)? == 3);
+        ensure!(crate::db::count_archived_threads_for_board(&conn, board)? == 2);
+        conn.execute_batch("DROP TRIGGER injected_prune_failure")?;
+        drop(conn);
+        let (first, second) = tokio::join!(
+            prune_threads(board, pool.clone()),
+            prune_threads(board, pool.clone())
+        );
+        first?;
+        second?;
+        let final_conn = pool.get()?;
+        ensure!(crate::db::count_threads_for_board(&final_conn, board)? == 1);
+        ensure!(crate::db::count_archived_threads_for_board(&final_conn, board)? == 1);
+        Ok(())
+    }
+
     #[tokio::test]
     async fn delayed_prune_uses_only_current_limits() -> anyhow::Result<()> {
         let pool = crate::db::init_test_pool()?;
diff --git a/static/admin.css b/static/admin.css
index 9d82d40a..973d96a8 100644
--- a/static/admin.css
+++ b/static/admin.css
@@ -3761,11 +3761,83 @@ html:not([data-theme]) .admin-login h1 {
   }
 }
 
-[data-theme="aero"] .admin-section {
-  backdrop-filter: blur(8px);
-  -webkit-backdrop-filter: blur(8px);
-  border-radius: 10px;
-  box-shadow: 0 2px 12px rgba(80,150,210,0.12), inset 0 1px 0 rgba(255,255,255,0.75);
+/* Frutiger Aero administration uses the same opaque glass and sky tabs. */
+html[data-theme="aero"] .admin-section {
+  background: var(--aero-surface);
+  border-color: var(--border);
+  border-radius: var(--radius-md);
+  box-shadow: var(--shadow-soft);
+}
+html[data-theme="aero"] .admin-section-index,
+html[data-theme="aero"] .admin-panel-header {
+  background: linear-gradient(#f7fdff, #dfeff6);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-md);
+  box-shadow: var(--shadow-soft);
+}
+html[data-theme="aero"] .admin-panel-header { padding: 12px; }
+html[data-theme="aero"] .admin-section-index a { border-radius: var(--radius-sm); }
+html[data-theme="aero"] .admin-panel .admin-section-index a[aria-current="location"] {
+  background: var(--aero-positive);
+  border-color: #699343;
+  color: #244b17;
+  text-decoration: underline;
+}
+html[data-theme="aero"] .admin-section h2 { color: #145b78; }
+html[data-theme="aero"] .admin-table th { background: #dfeff6; color: #244b60; }
+html[data-theme="aero"] .admin-table td { background: #f7fcfe; }
+html[data-theme="aero"] .admin-table tbody tr:hover td { background: #e7f4fa; }
+html[data-theme="aero"] .admin-flash.flash-ok { background: #e7f4d6; color: #30591d; border-color: #759c50; }
+html[data-theme="aero"] .admin-flash.flash-error { background: #fff0f1; color: #942337; border-color: #bd7d88; }
+html[data-theme="aero"] .admin-section input:not([type="checkbox"]):not([type="radio"]):disabled,
+html[data-theme="aero"] .admin-section select:disabled,
+html[data-theme="aero"] .admin-section textarea:disabled {
+  color: #4b6270;
+  background: #e3ebef;
+  border-color: #a4b4bd;
+}
+html[data-theme="aero"] .admin-section input:focus-visible,
+html[data-theme="aero"] .admin-section select:focus-visible,
+html[data-theme="aero"] .admin-section textarea:focus-visible {
+  outline: 2px solid #005d91;
+  outline-offset: 2px;
+}
+
+html[data-theme="aero"] .admin-panel :is(button, input[type="submit"], .admin-button-link, .admin-link-button, .admin-control-action) {
+  background: var(--aero-control);
+  color: var(--green);
+  border-color: #7daec4;
+  box-shadow: var(--glass-nav-control-shadow);
+}
+html[data-theme="aero"] .admin-panel :is(button, .admin-button-link, .admin-link-button):hover:not(:disabled) {
+  background: var(--aero-control-hover);
+  box-shadow: var(--glass-nav-control-shadow);
+}
+html[data-theme="aero"] .admin-panel :is(.admin-settings-save > button, .board-settings-actions button[type="submit"]:not(.btn-danger), #accounts form > button) {
+  background: var(--aero-positive);
+  color: #244b17;
+  border-color: #65923f;
+}
+html[data-theme="aero"] .admin-panel :is(.btn-danger, .backup-restore-upload-form button, .backup-primary-actions button[data-confirm], .backup-extract-actions button[data-confirm]):not(.btn-success) {
+  background: linear-gradient(#fff9f9 48%, #f8e5e7 49%, #efd1d5);
+  color: #942337;
+  border-color: #bd7d88;
+}
+html[data-theme="aero"] .admin-panel :is(.btn-danger, .backup-restore-upload-form button, .backup-primary-actions button[data-confirm], .backup-extract-actions button[data-confirm]):hover:not(:disabled) {
+  background: linear-gradient(#fff, #f0c4cb);
+  color: #7d1628;
+}
+html[data-theme="aero"] .admin-panel :is(.admin-settings-save > button, .board-settings-actions button[type="submit"], #accounts form > button, .btn-danger):disabled,
+html[data-theme="aero"] .admin-panel button:disabled {
+  background: #e3ebef;
+  color: #4b6270;
+  border-color: #a4b4bd;
+  box-shadow: none;
+}
+html[data-theme="aero"] .admin-panel input::file-selector-button { background: var(--aero-control); color: var(--green); }
+html[data-theme="aero"] .admin-panel :is(input, select, textarea, button, a, summary):focus-visible {
+  outline: 2px solid #005d91;
+  outline-offset: 2px;
 }
 
 [data-theme="dorfic"] .admin-section {
@@ -3783,8 +3855,8 @@ html:not([data-theme]) .admin-login h1 {
 [data-theme="forest"] .admin-section input:not([type="checkbox"]):not([type="radio"]),
 [data-theme="forest"] .admin-section select,
 [data-theme="forest"] .admin-section textarea {
-  background: #221810;
-  color: #d4c4a0;
+  background: var(--bg-input);
+  color: var(--text);
   border-color: var(--forest-input-border);
   box-shadow: inset 0 1px 2px rgba(0,0,0,0.45);
 }
@@ -3792,7 +3864,7 @@ html:not([data-theme]) .admin-login h1 {
 [data-theme="forest"] .admin-section input:not([type="checkbox"]):not([type="radio"]):focus,
 [data-theme="forest"] .admin-section select:focus,
 [data-theme="forest"] .admin-section textarea:focus {
-  border-color: var(--forest-surface-hover-border);
+  border-color: var(--forest-link-hover);
 }
 
 [data-theme="blue-sky"] .admin-section {
diff --git a/static/main.js b/static/main.js
index e4354e05..3e0879e7 100644
--- a/static/main.js
+++ b/static/main.js
@@ -2428,105 +2428,148 @@ function submitEditModalForm(form) {
   return true;
 }
 
+// One shared controller keeps hundreds of post controls inexpensive. The open
+// menu is temporarily portaled out of clipping/stacking ancestors.
+var _openThreadMenu = null;
+var _threadMenuFrame = 0;
+var _threadMenuObserver = typeof ResizeObserver === 'function'
+  ? new ResizeObserver(function () { repositionOpenThreadMenus(); }) : null;
+
 function closeThreadMenus(options) {
   options = options || {};
-  var focusTarget = null;
-  document.querySelectorAll('.catalog-thread-menu').forEach(function (menu) {
-    var actions = menu.closest('.catalog-card-actions');
-    var toggle = actions && actions.querySelector('.catalog-thread-menu-toggle');
-    var hadFocus = menu.contains(document.activeElement);
-    if (toggle) toggle.setAttribute('aria-expanded', 'false');
-    delete menu.dataset.direction;
-    menu.style.maxHeight = '';
-    menu.style.overflowY = '';
-    menu.hidden = true;
-    setElementAriaHidden(menu, true);
-    setElementInert(menu, true);
-    if (options.restoreFocus && hadFocus && toggle && !focusTarget) {
-      focusTarget = toggle;
-    }
-  });
-  document.querySelectorAll('.catalog-item.catalog-menu-open').forEach(function (card) {
-    card.classList.remove('catalog-menu-open');
-  });
-  if (focusTarget && typeof focusTarget.focus === 'function') {
-    focusTarget.focus();
-  }
-}
-
-function getThreadMenuBounds(gutter) {
-  var top = gutter;
-  var viewportHeight = window.visualViewport && window.visualViewport.height
-    ? window.visualViewport.height
-    : window.innerHeight;
-  var bottom = viewportHeight - gutter;
-  var footer = document.querySelector('.site-footer');
-
-  if (footer) {
-    var footerRect = footer.getBoundingClientRect();
-    if (footerRect.top < bottom && footerRect.bottom > top) {
-      bottom = Math.max(top, footerRect.top - gutter);
-    }
+  var current = _openThreadMenu;
+  if (!current) return;
+  _openThreadMenu = null;
+  if (_threadMenuFrame) window.cancelAnimationFrame(_threadMenuFrame);
+  _threadMenuFrame = 0;
+  if (_threadMenuObserver) _threadMenuObserver.disconnect();
+  var hadFocus = current.menu.contains(document.activeElement);
+  current.toggle.setAttribute('aria-expanded', 'false');
+  current.menu.hidden = true;
+  setElementAriaHidden(current.menu, true);
+  setElementInert(current.menu, true);
+  current.menu.removeAttribute('style');
+  delete current.menu.dataset.direction;
+  current.parent.insertBefore(current.menu, current.next && current.next.parentNode === current.parent ? current.next : null);
+  if (current.card) current.card.classList.remove('catalog-menu-open');
+  if (options.restoreFocus && (hadFocus || document.activeElement === current.toggle)) {
+    current.toggle.focus();
   }
-
-  return { top: top, bottom: bottom };
 }
 
 function positionThreadMenu(toggle, menu) {
   if (!toggle || !menu) return;
-  delete menu.dataset.direction;
-  menu.style.maxHeight = '';
-  menu.style.overflowY = '';
-
-  var toggleRect = toggle.getBoundingClientRect();
-  var menuRect = menu.getBoundingClientRect();
+  var rect = toggle.getBoundingClientRect();
+  var viewport = window.visualViewport;
   var gutter = 12;
   var offset = 6;
-  var bounds = getThreadMenuBounds(gutter);
-  var spaceBelow = Math.max(0, bounds.bottom - toggleRect.bottom - offset);
-  var spaceAbove = Math.max(0, toggleRect.top - bounds.top - offset);
-  var openUp = spaceBelow < menuRect.height && spaceAbove >= spaceBelow;
-  var availableSpace = openUp ? spaceAbove : spaceBelow;
-
-  if (openUp) {
-    menu.dataset.direction = 'up';
+  var leftEdge = (viewport ? viewport.offsetLeft : 0) + gutter;
+  var topEdge = (viewport ? viewport.offsetTop : 0) + gutter;
+  var rightEdge = leftEdge + (viewport ? viewport.width : window.innerWidth) - gutter * 2;
+  var bottomEdge = topEdge + (viewport ? viewport.height : window.innerHeight) - gutter * 2;
+  if (!toggle.isConnected || rect.bottom <= topEdge || rect.top >= bottomEdge ||
+      rect.right <= leftEdge || rect.left >= rightEdge) {
+    closeThreadMenus({ restoreFocus: true });
+    return;
   }
-
-  if (availableSpace > 0 && availableSpace < menuRect.height) {
-    menu.style.maxHeight = availableSpace + 'px';
-    menu.style.overflowY = 'auto';
+  menu.style.maxWidth = Math.max(1, rightEdge - leftEdge) + 'px';
+  menu.style.minWidth = Math.min(150, Math.max(1, rightEdge - leftEdge)) + 'px';
+  // Measure in viewport space before locking the width and anchoring the box.
+  if (!menu.style.left) {
+    menu.style.left = leftEdge + 'px';
+    menu.style.top = topEdge + 'px';
   }
-}
-
-function toggleThreadMenu(toggle) {
+  var menuRect = menu.getBoundingClientRect();
+  menu.style.width = menuRect.width + 'px';
+  var naturalHeight = menu.scrollHeight + menu.offsetHeight - menu.clientHeight;
+  var below = Math.max(0, bottomEdge - rect.bottom - offset);
+  var above = Math.max(0, rect.top - topEdge - offset);
+  var openUp = below < naturalHeight && above > below;
+  var available = openUp ? above : below;
+  menu.style.maxHeight = Math.max(1, available) + 'px';
+  menu.dataset.direction = openUp ? 'up' : 'down';
+  var height = Math.min(naturalHeight, Math.max(1, available));
+  menu.style.left = Math.max(leftEdge, Math.min(rect.right - menuRect.width, rightEdge - menuRect.width)) + 'px';
+  menu.style.top = (openUp ? rect.top - offset - height : rect.bottom + offset) + 'px';
+}
+
+function toggleThreadMenu(toggle, options) {
+  options = options || {};
   if (!toggle) return;
   var actions = toggle.closest('.catalog-card-actions');
   var menu = actions && actions.querySelector('.catalog-thread-menu');
+  // A second click finds the portaled menu through the controller.
+  if (_openThreadMenu && _openThreadMenu.toggle === toggle) {
+    closeThreadMenus({ restoreFocus: true });
+    return;
+  }
   if (!menu) return;
-  var card = toggle.closest('.catalog-item');
-  var opening = menu.hidden;
   closeThreadMenus();
-  menu.hidden = !opening;
-  setElementAriaHidden(menu, !opening);
-  setElementInert(menu, !opening);
-  toggle.setAttribute('aria-expanded', opening ? 'true' : 'false');
-  if (opening) {
-    if (card) {
-      card.classList.add('catalog-menu-open');
-    }
-    positionThreadMenu(toggle, menu);
+  _openThreadMenu = { toggle: toggle, menu: menu, parent: menu.parentNode,
+    next: menu.nextSibling, card: toggle.closest('.catalog-item') };
+  document.body.appendChild(menu);
+  menu.hidden = false;
+  setElementAriaHidden(menu, false);
+  setElementInert(menu, false);
+  toggle.setAttribute('aria-expanded', 'true');
+  if (_openThreadMenu.card) _openThreadMenu.card.classList.add('catalog-menu-open');
+  positionThreadMenu(toggle, menu);
+  if (_openThreadMenu && _threadMenuObserver) {
+    _threadMenuObserver.observe(document.body);
+    // A fixed header can move content via its offset without resizing the body
+    // or the trigger, especially when enlarged text still fits one screen.
+    var header = document.querySelector('.site-header');
+    if (header) _threadMenuObserver.observe(header);
+    _threadMenuObserver.observe(toggle);
+    _threadMenuObserver.observe(menu);
+  }
+  if (_openThreadMenu && options.focusFirst) {
+    var first = menu.querySelector('[role="menuitem"]');
+    if (first) first.focus();
   }
 }
 
-function repositionOpenThreadMenus() {
-  document.querySelectorAll('.catalog-thread-menu-toggle[aria-expanded="true"]').forEach(function (toggle) {
-    var actions = toggle.closest('.catalog-card-actions');
-    var menu = actions && actions.querySelector('.catalog-thread-menu');
-    if (!menu || menu.hidden) return;
-    positionThreadMenu(toggle, menu);
+function repositionOpenThreadMenus(event) {
+  if (!_openThreadMenu || _threadMenuFrame) return;
+  if (event && event.target && event.target.nodeType && _openThreadMenu.menu.contains(event.target)) return;
+  _threadMenuFrame = window.requestAnimationFrame(function () {
+    _threadMenuFrame = 0;
+    if (_openThreadMenu) positionThreadMenu(_openThreadMenu.toggle, _openThreadMenu.menu);
   });
 }
 
+// Menus follow native focus order when Tab leaves them; arrows stay within the
+// action list. No per-post listener or observer is required.
+document.addEventListener('keydown', function (event) {
+  var toggle = event.target.closest && event.target.closest('.catalog-thread-menu-toggle');
+  if (toggle && (event.key === 'ArrowDown' || event.key === 'ArrowUp')) {
+    event.preventDefault();
+    if (!_openThreadMenu || _openThreadMenu.toggle !== toggle) toggleThreadMenu(toggle);
+  } else if (!_openThreadMenu || !_openThreadMenu.menu.contains(event.target)) {
+    return;
+  }
+  if (!_openThreadMenu) return;
+  var current = _openThreadMenu;
+  if (event.key === 'Tab') {
+    closeThreadMenus({ restoreFocus: true });
+    return;
+  }
+  var items = Array.prototype.slice.call(current.menu.querySelectorAll('[role="menuitem"]:not(:disabled)'));
+  var index = items.indexOf(document.activeElement);
+  if (event.key === 'ArrowDown') index = (index + 1) % items.length;
+  else if (event.key === 'ArrowUp') index = index <= 0 ? items.length - 1 : index - 1;
+  else if (event.key === 'Home') index = 0;
+  else if (event.key === 'End') index = items.length - 1;
+  else return;
+  event.preventDefault();
+  if (items[index]) items[index].focus();
+});
+document.addEventListener('focusin', function (event) {
+  if (_openThreadMenu && event.target !== _openThreadMenu.toggle && !_openThreadMenu.menu.contains(event.target)) closeThreadMenus();
+});
+window.addEventListener('pagehide', function () { closeThreadMenus(); });
+window.addEventListener('pageshow', function () { closeThreadMenus(); });
+
 function clampPopupToViewport(anchor, popup) {
   var rect = anchor.getBoundingClientRect();
   var visualViewport = window.visualViewport || null;
@@ -3032,7 +3075,7 @@ function clampPopupToViewport(anchor, popup) {
   var autoOn = false;
   var consecutiveUpdateFailures = 0;
 
-  if (!container) return;
+  if (!container || container.dataset.archived === 'true' || container.dataset.historyPage === 'true') return;
 
   var board = container.dataset.board;
   var threadId = container.dataset.threadId;
@@ -3100,11 +3143,16 @@ function clampPopupToViewport(anchor, popup) {
   }
 
   function setUpdateButtonsBusy(busy) {
-    setButtonCollectionBusy(updateButtons, busy, {
-      labelKey: 'threadUpdateOriginalLabel',
-      busyLabel: updateButtons[0]
-        ? (updateButtons[0].dataset.busyLabel || '[ Updating… ]')
-        : '[ Updating… ]'
+    // Keep the focused control in the tab order while the shared request guard
+    // blocks both manual and automatic updates. Native disabled blurs buttons
+    // in some browsers and can move the reader's next keyboard action elsewhere.
+    rememberButtonLabels(updateButtons, 'threadUpdateOriginalLabel');
+    updateButtons.forEach(function (button) {
+      button.setAttribute('aria-disabled', String(busy));
+      button.setAttribute('aria-busy', String(busy));
+      button.textContent = busy
+        ? (button.dataset.busyLabel || '[ Updating… ]')
+        : button.dataset.threadUpdateOriginalLabel;
     });
   }
 
@@ -3581,6 +3629,7 @@ function clampPopupToViewport(anchor, popup) {
         if (e.button !== 0 || e.ctrlKey || e.metaKey || e.shiftKey || e.altKey) return;
         var target = document.getElementById('p' + pid);
         if (!target) {
+          if (link.getAttribute('href').charAt(0) !== '#') return;
           e.preventDefault();
           e.stopPropagation();
           showMissingPostPopup(link, pid);
@@ -3692,7 +3741,7 @@ function clampPopupToViewport(anchor, popup) {
         _cbCache[key] = { html: data.html || '', thread_id: data.thread_id || 0 };
         delete _cbInFlight[key];
         if (_cbCache[key].thread_id) {
-          var directHref = '/' + board + '/thread/' + _cbCache[key].thread_id + '#p' + pid;
+          var directHref = '/' + board + '/thread/' + _cbCache[key].thread_id + '?post=' + pid + '#p' + pid;
           document.querySelectorAll('a.crosslink[data-crossboard="' + board + '"][data-pid="' + pid + '"]')
             .forEach(function (a) { a.href = directHref; });
         }
@@ -3746,7 +3795,7 @@ function clampPopupToViewport(anchor, popup) {
         e.preventDefault();
         var key = board + ':' + pid;
         function navigate(threadId) {
-          window.location.href = '/' + board + '/thread/' + threadId + '#p' + pid;
+          window.location.href = '/' + board + '/thread/' + threadId + '?post=' + pid + '#p' + pid;
         }
         function showCbError(missing) {
           var cbPopup = getCbPopup();
@@ -3959,13 +4008,9 @@ function sortCatalog(mode) {
     var as_ = parseInt(a.dataset.sticky) || 0;
     var bs_ = parseInt(b.dataset.sticky) || 0;
     if (as_ !== bs_) return bs_ - as_;
-    if (mode === 'bump') {
-      return parseInt(b.dataset.bumped) - parseInt(a.dataset.bumped);
-    }
-    if (mode === 'replies') return parseInt(b.dataset.replies) - parseInt(a.dataset.replies);
-    if (mode === 'created') return parseInt(b.dataset.created) - parseInt(a.dataset.created);
-    if (mode === 'last_reply') return parseInt(b.dataset.lastReply) - parseInt(a.dataset.lastReply);
-    return 0;
+    var field = { bump: 'bumped', replies: 'replies', created: 'created', last_reply: 'lastReply' }[mode];
+    var difference = field ? (parseInt(b.dataset[field]) || 0) - (parseInt(a.dataset[field]) || 0) : 0;
+    return difference || (parseInt(b.dataset.threadId) || 0) - (parseInt(a.dataset.threadId) || 0);
   });
   var frag = document.createDocumentFragment();
   items.forEach(function (item) { frag.appendChild(item); });
@@ -4074,7 +4119,7 @@ document.addEventListener('click', function (e) {
       case 'toggle-thread-menu':
         e.preventDefault();
         e.stopPropagation();
-        toggleThreadMenu(t);
+        toggleThreadMenu(t, { focusFirst: e.detail === 0 });
         break;
       case 'remove-poll-option':  removePollOption(t); break;
       case 'add-poll-option':     addPollOption(); break;
@@ -4093,7 +4138,7 @@ document.addEventListener('click', function (e) {
       case 'fetch-updates':       window.fetchUpdates && window.fetchUpdates(); break;
       case 'open-report':
         e.preventDefault();
-        var reportTrigger = t;
+        var reportTrigger = _openThreadMenu && _openThreadMenu.menu.contains(t) ? _openThreadMenu.toggle : t;
         var catalogActions = t.closest('.catalog-card-actions');
         if (catalogActions) {
           reportTrigger = catalogActions.querySelector('.catalog-thread-menu-toggle') || t;
@@ -4132,7 +4177,7 @@ document.addEventListener('click', function (e) {
     }
   }
 
-  if (!e.target.closest('.catalog-card-actions')) {
+  if (!e.target.closest('.catalog-card-actions, .catalog-thread-menu')) {
     closeThreadMenus();
   }
 
diff --git a/static/style.css b/static/style.css
index 352be488..6f86ab23 100644
--- a/static/style.css
+++ b/static/style.css
@@ -2480,6 +2480,10 @@ html.no-js .post-controls .report-fallback-form {
   z-index: 5;
 }
 
+.catalog-item.catalog-menu-open .catalog-card-actions {
+  opacity: 1;
+}
+
 .catalog-item.sticky { border-color: var(--amber); }
 .catalog-item.is-pinned {
   border-color: var(--amber);
@@ -2643,26 +2647,45 @@ html.no-js .post-controls .report-fallback-form {
 }
 
 .catalog-thread-menu {
-  position: absolute;
-  right: 0;
-  top: calc(100% + 6px);
-  bottom: auto;
+  position: fixed;
   min-width: 150px;
   max-width: min(18rem, calc(100vw - 24px));
-  background: var(--bg-panel);
+  background: linear-gradient(var(--bg-panel), var(--bg-panel)), var(--bg);
   border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
   box-shadow: 0 10px 24px rgba(0, 0, 0, 0.35);
   padding: 4px;
   text-align: left;
   overflow-x: hidden;
+  overflow-y: auto;
   overscroll-behavior: contain;
-  z-index: 6;
+  z-index: 1000;
+}
+
+/* Index/thread controls share the catalog menu without changing post/media layout. */
+.thread-list-entry { position: relative; }
+.thread-list-entry > .catalog-card-actions { top: 8px; right: 8px; transform: none; opacity: 1; }
+.thread-list-entry > .catalog-card-actions .catalog-thread-menu-toggle,
+.thread-actions-row .catalog-thread-menu-toggle { opacity: 1; transform: none; }
+.thread-list-entry .op > .post-meta { padding-right: 40px; }
+.thread-actions-row { position: relative; min-height: 38px; margin: 6px 0; padding-right: 44px; }
+.thread-actions-row > .catalog-card-actions { opacity: 1; transform: none; top: 0; }
+html.no-js .thread-actions-row,
+html.no-js .thread-list-entry .op > .post-meta { padding-right: 0; }
+.catalog-thread-menu-toggle[aria-expanded="true"] {
+  opacity: 1;
+  color: var(--green-bright);
+  border-color: var(--border);
+  background: color-mix(in srgb, var(--green) 14%, transparent);
 }
-
-.catalog-thread-menu[data-direction="up"] {
-  top: auto;
-  bottom: calc(100% + 6px);
+.catalog-thread-menu-toggle:focus-visible,
+.catalog-thread-menu-item:focus-visible {
+  outline: 2px solid var(--green-bright);
+  outline-offset: -2px;
 }
+.catalog-thread-menu-item:not(:disabled):active { background: color-mix(in srgb, var(--green) 24%, transparent); }
+
+.catalog-thread-menu-item:disabled { color: var(--text-dim); cursor: default; }
 
 .catalog-thread-menu form {
   margin: 0;
@@ -2689,8 +2712,10 @@ html.no-js .post-controls .report-fallback-form {
   text-align: left;
 }
 
-.catalog-thread-menu-item:hover,
-.catalog-thread-menu-item:focus-visible {
+.catalog-thread-menu .catalog-thread-menu-item:not(:disabled) { color: var(--text); }
+
+.catalog-thread-menu .catalog-thread-menu-item:not(:disabled):hover,
+.catalog-thread-menu .catalog-thread-menu-item:focus-visible {
   background: color-mix(in srgb, var(--green) 14%, transparent);
   color: var(--green-bright);
 }
@@ -3491,36 +3516,20 @@ html:not([data-theme]) .error-page h1 { text-shadow: 0 0 14px rgba(255,34,68,0.5
 }
 
 [data-theme="forest"] .post-toggle-btn,
-[data-theme="forest"] .thread-nav-btn,
-[data-theme="forest"] .thread-nav a,
 [data-theme="forest"] .board-nav-link,
 [data-theme="blue-sky"] .post-toggle-btn,
-[data-theme="blue-sky"] .thread-nav-btn,
-[data-theme="blue-sky"] .thread-nav a,
 [data-theme="blue-sky"] .board-nav-link,
 [data-theme="deep-orbit"] .post-toggle-btn,
-[data-theme="deep-orbit"] .thread-nav-btn,
-[data-theme="deep-orbit"] .thread-nav a,
 [data-theme="deep-orbit"] .board-nav-link,
 [data-theme="terminal"] .post-toggle-btn,
-[data-theme="terminal"] .thread-nav-btn,
-[data-theme="terminal"] .thread-nav a,
 [data-theme="terminal"] .board-nav-link,
 [data-theme="aero"] .post-toggle-btn,
-[data-theme="aero"] .thread-nav-btn,
-[data-theme="aero"] .thread-nav a,
 [data-theme="aero"] .board-nav-link,
 [data-theme="neoncubicle"] .post-toggle-btn,
-[data-theme="neoncubicle"] .thread-nav-btn,
-[data-theme="neoncubicle"] .thread-nav a,
 [data-theme="neoncubicle"] .board-nav-link,
 [data-theme="fluorogrid"] .post-toggle-btn,
-[data-theme="fluorogrid"] .thread-nav-btn,
-[data-theme="fluorogrid"] .thread-nav a,
 [data-theme="fluorogrid"] .board-nav-link,
 [data-theme="dorfic"] .post-toggle-btn,
-[data-theme="dorfic"] .thread-nav-btn,
-[data-theme="dorfic"] .thread-nav a,
 [data-theme="dorfic"] .board-nav-link {
   background: transparent;
   border: none;
@@ -3529,50 +3538,34 @@ html:not([data-theme]) .error-page h1 { text-shadow: 0 0 14px rgba(255,34,68,0.5
 
 [data-theme="forest"] .post-toggle-btn:hover,
 [data-theme="forest"] .post-toggle-btn.active,
-[data-theme="forest"] .thread-nav-btn:hover,
-[data-theme="forest"] .thread-nav a:hover,
 [data-theme="forest"] .board-nav-link:hover,
 [data-theme="forest"] .board-nav-link.active,
 [data-theme="blue-sky"] .post-toggle-btn:hover,
 [data-theme="blue-sky"] .post-toggle-btn.active,
-[data-theme="blue-sky"] .thread-nav-btn:hover,
-[data-theme="blue-sky"] .thread-nav a:hover,
 [data-theme="blue-sky"] .board-nav-link:hover,
 [data-theme="blue-sky"] .board-nav-link.active,
 [data-theme="deep-orbit"] .post-toggle-btn:hover,
 [data-theme="deep-orbit"] .post-toggle-btn.active,
-[data-theme="deep-orbit"] .thread-nav-btn:hover,
-[data-theme="deep-orbit"] .thread-nav a:hover,
 [data-theme="deep-orbit"] .board-nav-link:hover,
 [data-theme="deep-orbit"] .board-nav-link.active,
 [data-theme="terminal"] .post-toggle-btn:hover,
 [data-theme="terminal"] .post-toggle-btn.active,
-[data-theme="terminal"] .thread-nav-btn:hover,
-[data-theme="terminal"] .thread-nav a:hover,
 [data-theme="terminal"] .board-nav-link:hover,
 [data-theme="terminal"] .board-nav-link.active,
 [data-theme="aero"] .post-toggle-btn:hover,
 [data-theme="aero"] .post-toggle-btn.active,
-[data-theme="aero"] .thread-nav-btn:hover,
-[data-theme="aero"] .thread-nav a:hover,
 [data-theme="aero"] .board-nav-link:hover,
 [data-theme="aero"] .board-nav-link.active,
 [data-theme="neoncubicle"] .post-toggle-btn:hover,
 [data-theme="neoncubicle"] .post-toggle-btn.active,
-[data-theme="neoncubicle"] .thread-nav-btn:hover,
-[data-theme="neoncubicle"] .thread-nav a:hover,
 [data-theme="neoncubicle"] .board-nav-link:hover,
 [data-theme="neoncubicle"] .board-nav-link.active,
 [data-theme="fluorogrid"] .post-toggle-btn:hover,
 [data-theme="fluorogrid"] .post-toggle-btn.active,
-[data-theme="fluorogrid"] .thread-nav-btn:hover,
-[data-theme="fluorogrid"] .thread-nav a:hover,
 [data-theme="fluorogrid"] .board-nav-link:hover,
 [data-theme="fluorogrid"] .board-nav-link.active,
 [data-theme="dorfic"] .post-toggle-btn:hover,
 [data-theme="dorfic"] .post-toggle-btn.active,
-[data-theme="dorfic"] .thread-nav-btn:hover,
-[data-theme="dorfic"] .thread-nav a:hover,
 [data-theme="dorfic"] .board-nav-link:hover,
 [data-theme="dorfic"] .board-nav-link.active {
   background: transparent;
@@ -3584,7 +3577,6 @@ html:not([data-theme]) .error-page h1 { text-shadow: 0 0 14px rgba(255,34,68,0.5
    Theme blocks set the variables so structure stays in one place. */
 html:is([data-theme="aero"], [data-theme="neoncubicle"]) .home-btn,
 html:is([data-theme="aero"], [data-theme="neoncubicle"]) .mobile-board-menu-btn,
-html:is([data-theme="aero"], [data-theme="neoncubicle"]) .thread-nav-btn,
 html:is([data-theme="aero"], [data-theme="neoncubicle"]) .post-toggle-btn,
 html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-list a {
   border-radius: var(--glass-nav-radius, 999px);
@@ -3592,7 +3584,6 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-list a {
 
 html:is([data-theme="aero"], [data-theme="neoncubicle"]) .home-btn,
 html:is([data-theme="aero"], [data-theme="neoncubicle"]) .mobile-board-menu-btn,
-html:is([data-theme="aero"], [data-theme="neoncubicle"]) .thread-nav-btn,
 html:is([data-theme="aero"], [data-theme="neoncubicle"]) .post-toggle-btn {
   border-color: var(--glass-nav-control-border);
   background: var(--glass-nav-control-bg);
@@ -3613,18 +3604,13 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .post-toggle-btn {
 html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-list a:hover,
 html:is([data-theme="aero"], [data-theme="neoncubicle"]) .home-btn:hover,
 html:is([data-theme="aero"], [data-theme="neoncubicle"]) .mobile-board-menu-btn:hover,
-html:is([data-theme="aero"], [data-theme="neoncubicle"]) .thread-nav-btn:hover,
 html:is([data-theme="aero"], [data-theme="neoncubicle"]) .post-toggle-btn:hover {
   background: var(--glass-nav-hover-bg);
 }
 
 html:not([data-theme]) .post-toggle-btn,
-html:not([data-theme]) .thread-nav-btn,
-html:not([data-theme]) .thread-nav a,
 html:not([data-theme]) .board-nav-link,
 html:is([data-theme="aero"], [data-theme="neoncubicle"]) .post-toggle-btn,
-html:is([data-theme="aero"], [data-theme="neoncubicle"]) .thread-nav-btn,
-html:is([data-theme="aero"], [data-theme="neoncubicle"]) .thread-nav a,
 html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link {
   background: transparent;
   border: none;
@@ -3633,14 +3619,10 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link {
 
 html:not([data-theme]) .post-toggle-btn:hover,
 html:not([data-theme]) .post-toggle-btn.active,
-html:not([data-theme]) .thread-nav-btn:hover,
-html:not([data-theme]) .thread-nav a:hover,
 html:not([data-theme]) .board-nav-link:hover,
 html:not([data-theme]) .board-nav-link.active,
 html:is([data-theme="aero"], [data-theme="neoncubicle"]) .post-toggle-btn:hover,
 html:is([data-theme="aero"], [data-theme="neoncubicle"]) .post-toggle-btn.active,
-html:is([data-theme="aero"], [data-theme="neoncubicle"]) .thread-nav-btn:hover,
-html:is([data-theme="aero"], [data-theme="neoncubicle"]) .thread-nav a:hover,
 html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link:hover,
 html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link.active {
   background: transparent;
@@ -3748,85 +3730,391 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link.active
 
 /* Themes selected through data-theme on <html>; Forest is the fallback default. */
 
-/* Frutiger Aero */
-[data-theme="aero"] {
+/* Frutiger Aero — sky, meadow and water; all rules are theme-local.
+   Original inline SVG scales without raster downloads or new asset routes.
+   Reading surfaces stay near-opaque; glass highlights never need live blur. */
+html[data-theme="aero"] {
   color-scheme: light;
-  --bg:           #deeef7;
-  --bg-panel:     rgba(255,255,255,0.62);
-  --bg-post:      rgba(255,255,255,0.50);
-  --bg-op:        rgba(255,255,255,0.68);
-  --bg-input:     rgba(255,255,255,0.78);
-  --border:       rgba(90,155,200,0.30);
-  --border-glow:  #6aaed6;
-  --green:        #1a6fa8;
-  --green-dim:    #5a9ec0;
-  --green-bright: #0d5a8a;
-  --green-pale:   #2882b8;
-  --amber:        #c96f00;
-  --red:          #b82840;
-  --gray:         #b8cedd;
-  --gray-light:   #daeaf4;
-  --text:         #1a2836;
-  --text-dim:     #486070;
-  --font:         'Segoe UI', 'Helvetica Neue', Arial, sans-serif;
-  --font-display: 'Segoe UI', 'Helvetica Neue', Arial, sans-serif;
-  --glass-nav-radius: 999px;
-  --theme-picker-radius: var(--glass-nav-radius);
-  --theme-picker-panel-radius: 14px;
-  --glass-nav-control-border: rgba(90,155,200,0.32);
-  --glass-nav-control-bg: rgba(255,255,255,0.42);
-  --glass-nav-control-shadow: inset 0 1px 0 rgba(255,255,255,0.68);
-  --glass-nav-link-bg: rgba(255,255,255,0.28);
-  --glass-nav-hover-bg: rgba(255,255,255,0.56);
-}
-[data-theme="aero"] body {
-  background: #deeef7;
-  background-image: linear-gradient(160deg, #d0e8f4 0%, #eef6fb 45%, #d8eef6 100%);
+  --bg:           #d7eff7;
+  --bg-panel:     #f4fbfe;
+  --bg-post:      #f7fcfe;
+  --bg-op:        #edf8fc;
+  --bg-input:     #ffffff;
+  --border:       #99bfd0;
+  --border-glow:  #267ca8;
+  --green:        #075b85;
+  --green-dim:    #375c70;
+  --green-bright: #08476b;
+  --green-pale:   #145b78;
+  --amber:        #775007;
+  --red:          #a32237;
+  --red-bright:   #a32237;
+  --yellow:       #775007;
+  --gray:         #557184;
+  --gray-light:   #435d70;
+  --text:         #19394b;
+  --text-dim:     #355568;
+  --font:         'Segoe UI', Tahoma, Arial, sans-serif;
+  --font-display: 'Segoe UI', Tahoma, Arial, sans-serif;
+  --radius-sm:    4px;
+  --radius-md:    7px;
+  --glass-nav-radius: 4px;
+  --theme-picker-radius: 5px;
+  --theme-picker-panel-radius: 8px;
+  --shadow-soft: 0 2px 5px rgba(20, 76, 106, 0.12), inset 0 1px 0 #fff;
+  --shadow-panel: 0 5px 16px rgba(20, 76, 106, 0.18);
+  --aero-surface: linear-gradient(180deg, rgba(255,255,255,0.98), rgba(240,249,253,0.97)) #f4fbfe;
+  --aero-control: linear-gradient(#fff 0%, #edfaff 48%, #d7eef8 49%, #c4e4f2 100%) #c4e4f2;
+  --aero-control-hover: linear-gradient(#fff 0%, #e9faff 48%, #c6eaf8 49%, #a9d9ee 100%) #a9d9ee;
+  --aero-positive: linear-gradient(#fbfff4 0%, #e9f6d5 48%, #d4ebae 49%, #bfdc91 100%) #bfdc91;
+  --aero-leaf:    #32631e;
+  --post-highlight-outline: #1678a3;
+  --post-highlight-bg: #e0f4ff;
+  --accept-btn-bg: #dbefbb;
+  --accept-btn-fg: #244b17;
+  --accept-btn-accent: #65923f;
+  --glass-nav-control-border: #6bacc7;
+  --glass-nav-control-bg: var(--aero-control);
+  --glass-nav-control-shadow: inset 0 1px 0 #fff, 0 1px 2px rgba(20,76,106,0.12);
+  --glass-nav-link-bg: var(--aero-control);
+  --glass-nav-hover-bg: var(--aero-control-hover);
+}
+html[data-theme="aero"] body {
+  background-color: var(--bg);
+  background-image: url("data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%201600%201000%22%20preserveAspectRatio%3D%22xMidYMid%20slice%22%3E%3Cdefs%3E%3ClinearGradient%20id%3D%22sky%22%20x2%3D%220%22%20y2%3D%221%22%3E%3Cstop%20stop-color%3D%22%2362b9e6%22%2F%3E%3Cstop%20offset%3D%22.55%22%20stop-color%3D%22%23c9eef9%22%2F%3E%3Cstop%20offset%3D%221%22%20stop-color%3D%22%23f2fcff%22%2F%3E%3C%2FlinearGradient%3E%3CradialGradient%20id%3D%22sun%22%3E%3Cstop%20stop-color%3D%22%23fff%22%20stop-opacity%3D%22.85%22%2F%3E%3Cstop%20offset%3D%221%22%20stop-color%3D%22%23fff%22%20stop-opacity%3D%220%22%2F%3E%3C%2FradialGradient%3E%3ClinearGradient%20id%3D%22hill%22%20x2%3D%220%22%20y2%3D%221%22%3E%3Cstop%20stop-color%3D%22%23b4dd65%22%2F%3E%3Cstop%20offset%3D%221%22%20stop-color%3D%22%23529837%22%2F%3E%3C%2FlinearGradient%3E%3ClinearGradient%20id%3D%22water%22%20x2%3D%220%22%20y2%3D%221%22%3E%3Cstop%20stop-color%3D%22%23a4e4e7%22%2F%3E%3Cstop%20offset%3D%221%22%20stop-color%3D%22%2355bbd4%22%2F%3E%3C%2FlinearGradient%3E%3ClinearGradient%20id%3D%22leaf%22%20x2%3D%221%22%20y2%3D%221%22%3E%3Cstop%20stop-color%3D%22%23e5f7ad%22%2F%3E%3Cstop%20offset%3D%22.5%22%20stop-color%3D%22%2391c855%22%2F%3E%3Cstop%20offset%3D%221%22%20stop-color%3D%22%23438b3d%22%2F%3E%3C%2FlinearGradient%3E%3C%2Fdefs%3E%3Cpath%20fill%3D%22url%28%23sky%29%22%20d%3D%22M0%200h1600v1000H0z%22%2F%3E%3Cellipse%20cx%3D%221230%22%20cy%3D%22175%22%20rx%3D%22390%22%20ry%3D%22300%22%20fill%3D%22url%28%23sun%29%22%2F%3E%3Cg%20fill%3D%22%23fff%22%20opacity%3D%22.52%22%3E%3Cpath%20d%3D%22M-80%20205c55-50%20123-53%20163-17%2028-74%20159-99%20215-20%2061-20%20124%204%20151%2041-163%2020-371%2027-529-4z%22%2F%3E%3Cpath%20d%3D%22M960%20340c50-43%20103-43%20133-23%2035-56%20126-62%20165-3%2053-23%20126-5%20155%2026-162%2019-300%2017-453%200z%22%2F%3E%3Cpath%20d%3D%22M475%20116c45-28%2092-30%20122-5%2028-45%2087-39%20110-1%2044-10%2095%200%20120%2019-131%209-230%207-352-13z%22%2F%3E%3C%2Fg%3E%3Cpath%20d%3D%22M0%20738Q270%20585%20596%20720T1180%20716T1600%20662V1000H0z%22%20fill%3D%22%238dc683%22%20opacity%3D%22.65%22%2F%3E%3Cpath%20d%3D%22M0%20770Q235%20664%20520%20762T1030%20755T1600%20709V1000H0z%22%20fill%3D%22url%28%23hill%29%22%2F%3E%3Cpath%20d%3D%22M0%20857Q430%20808%20791%20847T1600%20803V1000H0z%22%20fill%3D%22url%28%23water%29%22%2F%3E%3Cg%20fill%3D%22none%22%20stroke%3D%22%23efffff%22%20stroke-opacity%3D%22.32%22%3E%3Cpath%20d%3D%22M0%20880Q380%20847%20760%20880T1600%20860%22%2F%3E%3Cpath%20d%3D%22M0%20934Q480%20900%20860%20938T1600%20917%22%2F%3E%3Cpath%20d%3D%22M770%20900h235m95%2030h180M170%20959h320%22%2F%3E%3C%2Fg%3E%3Cg%20fill%3D%22url%28%23leaf%29%22%20stroke%3D%22%2368a04c%22%20stroke-width%3D%221%22%3E%3Cpath%20d%3D%22M0%201000C5%20913%2045%20846%20109%20828%20119%20897%2076%20966%200%201000z%22%2F%3E%3Cpath%20d%3D%22M0%201000C52%20935%20137%20916%20201%20947%20152%201000%2075%201020%200%201000z%22%2F%3E%3C%2Fg%3E%3Cpath%20d%3D%22M0%201000l98-155M0%201000l178-48%22%20fill%3D%22none%22%20stroke%3D%22%23eefbc9%22%20stroke-opacity%3D%22.6%22%20stroke-width%3D%222%22%2F%3E%3Cg%20fill%3D%22%23f4ffff%22%20fill-opacity%3D%22.16%22%20stroke%3D%22%23fff%22%20stroke-opacity%3D%22.48%22%3E%3Ccircle%20cx%3D%221430%22%20cy%3D%22682%22%20r%3D%2227%22%2F%3E%3Ccircle%20cx%3D%221490%22%20cy%3D%22616%22%20r%3D%2212%22%2F%3E%3Ccircle%20cx%3D%221370%22%20cy%3D%22746%22%20r%3D%228%22%2F%3E%3C%2Fg%3E%3Cg%20fill%3D%22none%22%20stroke%3D%22%23fff%22%20stroke-opacity%3D%22.8%22%20stroke-width%3D%223%22%20stroke-linecap%3D%22round%22%3E%3Cpath%20d%3D%22M1413%20674q1-12%2013-15%22%2F%3E%3Cpath%20d%3D%22M1483%20612q2-5%206-5%22%2F%3E%3C%2Fg%3E%3C%2Fsvg%3E");
+  background-size: cover;
+  background-position: center;
   background-attachment: fixed;
 }
-[data-theme="aero"] .op,
-[data-theme="aero"] .reply,
-[data-theme="aero"] .page-box,
-[data-theme="aero"] .post-form-container {
-  backdrop-filter: blur(8px);
-  -webkit-backdrop-filter: blur(8px);
-  border-radius: 10px;
-  box-shadow: 0 2px 12px rgba(80,150,210,0.12), inset 0 1px 0 rgba(255,255,255,0.75);
-}
-[data-theme="aero"] .site-header {
-  background: rgba(210,232,246,0.82);
-  backdrop-filter: blur(12px);
-  -webkit-backdrop-filter: blur(12px);
-  border-bottom: 1px solid rgba(90,155,200,0.30);
-  box-shadow: 0 2px 14px rgba(40,130,190,0.10);
-}
-[data-theme="aero"] .site-header::before { display: none; }
-[data-theme="aero"] a { color: #1a6fa8; }
-[data-theme="aero"] a:hover { color: #0d5a8a; text-shadow: none; }
-[data-theme="aero"] button,
-[data-theme="aero"] .btn,
-[data-theme="aero"] input[type="submit"] {
-  border-color: rgba(90,155,200,0.45); color: #1a6fa8;
-}
-[data-theme="aero"] button:hover {
-  border-color: #6aaed6; color: #0d5a8a;
-  background: rgba(106,174,214,0.10);
+
+/* A light veil protects metadata and other text between the individual panels. */
+html[data-theme="aero"] main {
+  background: linear-gradient(rgba(244,251,254,0.76), rgba(244,251,254,0.88));
+  border-radius: 0 0 var(--radius-md) var(--radius-md);
+}
+
+/* A glossy sky ribbon; compact tabs keep the imageboard navigation rhythm. */
+html[data-theme="aero"] .site-header {
+  background: linear-gradient(#effcff 0%, #c4eafa 48%, #9fd6ed 49%, #b9e5f4 100%);
+  border-bottom: 1px solid #609fbe;
+  box-shadow: inset 0 1px 0 #fff, 0 2px 5px rgba(20,76,106,0.18);
+}
+html[data-theme="aero"] .site-header::before { display: none; }
+html[data-theme="aero"] .site-name {
+  color: #144d6e;
+  text-shadow: 0 1px 0 #fff;
+  letter-spacing: 0.02em;
+}
+html[data-theme="aero"] .board-list a {
+  border: 1px solid #76adc3;
+  box-shadow: inset 0 1px 0 #fff;
+  margin-block: 2px;
+}
+html[data-theme="aero"] .board-nav,
+html[data-theme="aero"] .thread-nav {
+  background: linear-gradient(#f5fcff, #dfeff6);
+  border-bottom: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+}
+html[data-theme="aero"] .thread-nav { padding-inline: 6px; }
+html[data-theme="aero"] .board-nav-link,
+html[data-theme="aero"] .post-toggle-btn,
+html[data-theme="aero"] .thread-nav .thread-nav-control,
+html[data-theme="aero"] .pagination a {
+  color: var(--green);
+  border: 1px solid #7daec4;
+  background: var(--aero-control);
+  box-shadow: var(--glass-nav-control-shadow);
+  border-radius: var(--radius-sm);
+  text-decoration: none;
+}
+html[data-theme="aero"] .board-nav-link:hover,
+html[data-theme="aero"] .post-toggle-btn:hover,
+html[data-theme="aero"] .thread-nav .thread-nav-control:hover:not([aria-disabled="true"]),
+html[data-theme="aero"] .pagination a:hover {
+  background: var(--aero-control-hover);
+  color: var(--green-bright);
+  text-decoration: underline;
+}
+html[data-theme="aero"] .board-nav-link.active,
+html[data-theme="aero"] .post-toggle-btn.active,
+html[data-theme="aero"] .pagination .current {
+  background: var(--aero-positive);
+  color: #244b17;
+  border-color: #699343;
+  box-shadow: inset 0 1px 0 #fff, inset 0 -2px 0 #7ca34c;
+  font-weight: bold;
+  text-decoration: underline;
+}
+
+/* Three surfaces: environmental title glass, quiet reading paper, framed cards. */
+html[data-theme="aero"] .board-header,
+html[data-theme="aero"] .index-hero,
+html[data-theme="aero"] .board-thread-header {
+  background:
+    radial-gradient(circle at 95% 22%, rgba(255,255,255,0.7) 0 7px, rgba(104,177,201,0.25) 8px, transparent 9px),
+    radial-gradient(circle at 91% 70%, rgba(255,255,255,0.5) 0 15px, rgba(104,177,201,0.25) 16px, transparent 17px),
+    linear-gradient(110deg, rgba(255,255,255,0.97), rgba(226,246,251,0.94) 65%, rgba(221,241,206,0.94));
+  border: 1px solid var(--border);
+  border-bottom: 3px solid #79a949;
+  border-radius: var(--radius-md);
+  box-shadow: var(--shadow-soft);
+  padding-inline: 12px;
+}
+html[data-theme="aero"] .board-thread-header { padding-block: 8px; }
+html[data-theme="aero"] .index-title { letter-spacing: 0.04em; }
+html[data-theme="aero"] .op,
+html[data-theme="aero"] .reply,
+html[data-theme="aero"] .page-box,
+html[data-theme="aero"] .post-form-container,
+html[data-theme="aero"] .board-card,
+html[data-theme="aero"] .catalog-item {
+  background: var(--aero-surface);
+  border-color: var(--border);
+  box-shadow: var(--shadow-soft);
+  border-radius: var(--radius-md);
+}
+html[data-theme="aero"] .op {
+  background: linear-gradient(#fafdff, #eaf5fb);
+  border-left-color: #3298bf;
+}
+html[data-theme="aero"] .reply { border-radius: var(--radius-sm); }
+html[data-theme="aero"] .post-form-container,
+html[data-theme="aero"] .board-card { border-left-color: #6e9c42; }
+html[data-theme="aero"] .reply:hover { border-color: #689fb8; }
+html[data-theme="aero"] .board-card:hover,
+html[data-theme="aero"] .board-card:focus-within,
+html[data-theme="aero"] .catalog-item:hover,
+html[data-theme="aero"] .catalog-item:focus-within {
+  background: linear-gradient(#fff, #e3f5fc);
+  border-color: #3784a9;
+  box-shadow: inset 0 1px 0 #fff, 0 3px 7px rgba(20,76,106,0.18);
+}
+html[data-theme="aero"] .catalog-item.is-pinned,
+html[data-theme="aero"] .catalog-item.sticky {
+  border-color: #8e6b22;
+  box-shadow: inset 0 3px 0 #d7b758, var(--shadow-soft);
+}
+html[data-theme="aero"] .catalog-no-image {
+  background: linear-gradient(#e7f7fc, #d2eaf4);
+  border-style: solid;
+}
+html[data-theme="aero"] .catalog-thumb,
+html[data-theme="aero"] .thumb {
+  border-color: #81aabd;
+  border-radius: var(--radius-sm);
+  box-shadow: 0 1px 3px rgba(20,76,106,0.16);
+}
+html[data-theme="aero"] .catalog-replies,
+html[data-theme="aero"] .catalog-control-group {
+  background: #edf7fb;
+  border-color: var(--border);
+}
+html[data-theme="aero"] .catalog-card-actions { opacity: 1; }
+html[data-theme="aero"] .catalog-thread-menu-toggle,
+html[data-theme="aero"] .board-reorder-toggle { opacity: 1; transform: none; }
+
+/* Readable ink, familiar green quotes, and an aquatic link hierarchy. */
+html[data-theme="aero"] a { color: var(--green); }
+html[data-theme="aero"] .post-body a { text-decoration: underline; }
+html[data-theme="aero"] .post-body a:visited { color: #65468a; }
+html[data-theme="aero"] a:hover { color: #073e60; text-shadow: none; text-decoration: underline; }
+html[data-theme="aero"] a:active { color: #254c16; }
+html[data-theme="aero"] .name,
+html[data-theme="aero"] .post-body .quote { color: var(--aero-leaf); }
+html[data-theme="aero"] .subject strong,
+html[data-theme="aero"] .subject a { color: #085a72; }
+html[data-theme="aero"] .subject::after { content: none; }
+html[data-theme="aero"] .post-body code { background: #e7f1f5; color: #25485b; }
+html[data-theme="aero"] .post-body .spoiler { background: #25485b; color: #25485b; transition: none; }
+html[data-theme="aero"] .post-body .spoiler:hover,
+html[data-theme="aero"] .post-body .spoiler.revealed { background: #dfedf4; color: var(--text); }
+html[data-theme="aero"] .post-body .missing-post-ref,
+html[data-theme="aero"] .backrefs .missing-post-ref { color: var(--red); }
+html[data-theme="aero"] .post-same-poster-highlighted { background: #fff6d9 !important; }
+html[data-theme="aero"] .thread-state-badge,
+html[data-theme="aero"] .thread-state-badge-archive { background: #edf7fc; color: #275574; border-color: #81aabd; }
+html[data-theme="aero"] .thread-state-badge-pin { background: #fff5d3; color: #775007; border-color: #ab8b40; }
+html[data-theme="aero"] .thread-state-badge-lock { background: #fff0f1; color: var(--red); border-color: #bf7781; }
+
+/* Dimensional controls retain their existing dimensions and native semantics. */
+html[data-theme="aero"] button,
+html[data-theme="aero"] .btn,
+html[data-theme="aero"] input[type="submit"],
+html[data-theme="aero"] #theme-picker-btn,
+html[data-theme="aero"] .post-controls .edit-btn,
+html[data-theme="aero"] .post-controls .report-btn,
+html[data-theme="aero"] .report-fallback-summary,
+html[data-theme="aero"] .catalog-thread-fallback-summary {
+  color: var(--green);
+  background: var(--aero-control);
+  border-color: #7daec4;
+  border-radius: var(--radius-sm);
+  box-shadow: var(--glass-nav-control-shadow);
+  text-shadow: none;
+  backdrop-filter: none;
+  -webkit-backdrop-filter: none;
+}
+html[data-theme="aero"] button:hover,
+html[data-theme="aero"] .btn:hover,
+html[data-theme="aero"] input[type="submit"]:hover,
+html[data-theme="aero"] .post-controls .edit-btn:hover,
+html[data-theme="aero"] .post-controls .report-btn:hover,
+html[data-theme="aero"] #theme-picker-btn:hover {
+  color: var(--green-bright);
+  background: var(--aero-control-hover);
+  border-color: #397e9e;
+  box-shadow: inset 0 1px 0 #fff, 0 1px 3px rgba(20,76,106,0.18);
+}
+html[data-theme="aero"] .post-form button[type="submit"],
+html[data-theme="aero"] .btn-success,
+html[data-theme="aero"] .compress-modal .compress-do-btn:not(.btn-danger) {
+  background: var(--aero-positive);
+  border-color: #65923f;
+  color: #244b17;
+}
+html[data-theme="aero"] .post-form button[type="submit"]:hover,
+html[data-theme="aero"] .btn-success:hover,
+html[data-theme="aero"] .compress-modal .compress-do-btn:not(.btn-danger):hover { background: linear-gradient(#fff, #c7e5a0); }
+html[data-theme="aero"] .compress-modal .compress-do-btn.btn-danger,
+html[data-theme="aero"] .btn-danger,
+html[data-theme="aero"] .media-close-btn,
+html[data-theme="aero"] .admin-del-btn,
+html[data-theme="aero"] .post-controls .del-btn {
+  color: #942337;
+  border-color: #bd7d88;
+  background: linear-gradient(#fff9f9 48%, #f8e5e7 49%, #efd1d5);
+}
+html[data-theme="aero"] .compress-modal .compress-do-btn.btn-danger:hover,
+html[data-theme="aero"] .btn-danger:hover,
+html[data-theme="aero"] .media-close-btn:hover,
+html[data-theme="aero"] .admin-del-btn:hover,
+html[data-theme="aero"] .post-controls .del-btn:hover { background: linear-gradient(#fff, #f0c4cb); color: #7d1628; }
+html[data-theme="aero"] :is(button, .btn, input[type="submit"], .board-nav-link, .post-toggle-btn, .thread-nav-control):not(:disabled):active {
+  box-shadow: inset 0 2px 3px rgba(20,76,106,0.22);
+  filter: brightness(0.96);
+}
+html[data-theme="aero"] :is(.post-form button[type="submit"], .compress-modal .compress-do-btn, .post-controls button, .btn):disabled,
+html[data-theme="aero"] :is(button, input, select, textarea):disabled,
+html[data-theme="aero"] [aria-disabled="true"] {
+  color: #4b6270;
+  background: #e3ebef;
+  border-color: #a4b4bd;
   box-shadow: none;
+  opacity: 1;
+  cursor: not-allowed;
 }
-[data-theme="aero"] .board-card { border-radius: 8px; }
-[data-theme="aero"] .catalog-item { border-radius: 8px; }
-[data-theme="aero"] .subject {
-  gap: 0.5rem;
+html[data-theme="aero"] input:not([type="checkbox"]):not([type="radio"]):where(:not([type="submit"]):not([type="button"]):not([type="hidden"])),
+html[data-theme="aero"] textarea,
+html[data-theme="aero"] select {
+  background-color: #fff;
+  border-color: #88aebf;
+  border-radius: var(--radius-sm);
+  color: var(--text);
+  box-shadow: inset 0 1px 3px rgba(20,76,106,0.12);
 }
-[data-theme="aero"] .subject strong,
-[data-theme="aero"] .subject a {
-  color: #0f7a86;
+html[data-theme="aero"] input:not([type="checkbox"]):not([type="radio"]):disabled,
+html[data-theme="aero"] textarea:disabled,
+html[data-theme="aero"] select:disabled {
+  background: #e3ebef;
+  color: #4b6270;
+  box-shadow: none;
 }
-[data-theme="aero"] .subject::after {
-  content: "•";
-  color: rgba(40,130,184,0.7);
-  font-size: 0.9rem;
-  letter-spacing: 0;
+html[data-theme="aero"] input::placeholder,
+html[data-theme="aero"] textarea::placeholder { color: #536c7b; opacity: 1; }
+html[data-theme="aero"] input::file-selector-button {
+  background: var(--aero-control);
+  color: var(--green);
+  border: 1px solid #7daec4;
+  border-radius: 3px;
+  padding: 4px 8px;
+  cursor: pointer;
+}
+html[data-theme="aero"] .catalog-sort-select {
+  background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='10' height='6'%3E%3Cpath d='M0 0l5 6 5-6z' fill='%23075b85'/%3E%3C/svg%3E");
+}
+html[data-theme="aero"] input[type="checkbox"],
+html[data-theme="aero"] input[type="radio"] { accent-color: #326f28; }
+html[data-theme="aero"] :is(a, button, summary, input, select, textarea, .btn):focus-visible {
+  outline: 2px solid #005d91;
+  outline-offset: 2px;
+  box-shadow: 0 0 0 4px rgba(255,255,255,0.9);
+}
+html[data-theme="aero"] ::selection { background: #b8dfef; color: #14364b; }
+
+/* Media keeps its natural colors; preview controls use the sky palette. */
+html[data-theme="aero"] .video-container .media-preview,
+html[data-theme="aero"] .pdf-container .media-preview {
+  background: #e4f2f8;
+  box-shadow: inset 0 0 0 1px rgba(255,255,255,0.7);
+}
+html[data-theme="aero"] .media-expand-overlay {
+  color: #fff;
+  text-shadow: 0 1px 2px #133e55;
+  background: rgba(19,64,87,0.65);
+}
+html[data-theme="aero"] .video-container .media-expand-overlay {
+  background: linear-gradient(rgba(19,64,87,0.5), rgba(19,64,87,0.8));
+}
+html[data-theme="aero"] .pdf-container .media-preview::after {
+  background: var(--aero-control);
+  border-color: #7daec4;
+  color: var(--green);
+}
+html[data-theme="aero"] .media-expanded { box-shadow: var(--shadow-panel); }
+html[data-theme="aero"] .thumb:hover {
+  border-color: #3784a9;
+  box-shadow: 0 2px 5px rgba(20,76,106,0.2);
+}
+html[data-theme="aero"] .media-thumb-fallback { background: #e4f2f8; }
+html[data-theme="aero"] .media-close-btn,
+html[data-theme="aero"] .media-close-btn:hover { box-shadow: inset 0 1px 0 #fff; }
+
+/* Menus and dialogs are opaque: the landscape never shows through small text. */
+html[data-theme="aero"] .mobile-board-menu-panel,
+html[data-theme="aero"] .catalog-thread-menu,
+html[data-theme="aero"] .board-reorder-controls,
+html[data-theme="aero"] .quotelink-popup,
+html[data-theme="aero"] .user-preferences-form,
+html[data-theme="aero"] .user-preferences-noscript,
+html[data-theme="aero"] .compress-modal-box,
+html[data-theme="aero"] .edit-modal-box {
+  background: #edf7fc linear-gradient(#fff, #edf7fc);
+  border-color: #5a95b1;
+  border-radius: var(--radius-md);
+  box-shadow: inset 0 1px 0 #fff, var(--shadow-panel);
+}
+html[data-theme="aero"] .compress-modal,
+html[data-theme="aero"] .edit-modal-backdrop { background: rgba(18,55,76,0.5); }
+html[data-theme="aero"] .catalog-thread-menu .catalog-thread-menu-item { background: transparent; box-shadow: none; }
+html[data-theme="aero"] .catalog-thread-menu .catalog-thread-menu-item:hover,
+html[data-theme="aero"] .catalog-thread-menu .catalog-thread-menu-item:focus-visible { background: #d8edf7; color: #143e57; }
+html[data-theme="aero"] .quotelink-popup .post { background: transparent; box-shadow: none; }
+html[data-theme="aero"] .post-success-banner,
+html[data-theme="aero"] .new-replies-pill { background: #e7f4d6; color: #30591d; border-color: #759c50; }
+html[data-theme="aero"] .notice { background: #edf7fc; color: var(--text-dim); }
+html[data-theme="aero"] .locked-notice,
+html[data-theme="aero"] .error,
+html[data-theme="aero"] .post-error-banner { background: #fff0f1; color: #942337; border-color: #bd7d88; }
+html[data-theme="aero"] .poll-container { background: linear-gradient(#f9fff1, #eaf5dc); border-color: #9ab879; border-radius: var(--radius-sm); }
+html[data-theme="aero"] .site-footer { background: linear-gradient(#f8fdff, #d9edf5); box-shadow: inset 0 1px 0 #fff; }
+
+@media (max-width: 700px) {
+  /* Shared mobile rules remove this padding with !important. Keep the
+     compact gloss away from the label, without changing other themes. */
+  html[data-theme="aero"] :is(.post-toggle-bar.reply, .catalog-toggle-bar) .post-toggle-btn { padding-inline: 10px !important; }
+  html[data-theme="aero"] .post-meta { gap: 4px 7px; }
+  html[data-theme="aero"] .site-name { white-space: normal; overflow-wrap: anywhere; }
+  html[data-theme="aero"] .post-controls { flex-wrap: wrap; }
+  html[data-theme="aero"] .user-preferences-panel[open] .user-preferences-form { border-radius: 8px 8px 0 0; }
+  html[data-theme="aero"] .compress-modal-box { padding-inline: 14px; max-height: calc(100svh - 24px); overflow-y: auto; }
+}
+@media (prefers-reduced-motion: reduce) {
+  html[data-theme="aero"] *, html[data-theme="aero"] *::before, html[data-theme="aero"] *::after {
+    animation: none !important;
+    transition: none !important;
+    scroll-behavior: auto !important;
+  }
 }
 
 /* DORFic Aero */
@@ -3969,16 +4257,16 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link.active
   --bg-input:     #221810;
   --border:       #5c3d1e;
   --border-glow:  #7a5230;
-  --green:        #6fa84a;
-  --green-dim:    #4e7a35;
+  --green:        #7ab84e;
+  --green-dim:    #8cb571;
   --green-bright: #93cc65;
   --green-pale:   #7ab84e;
   --amber:        #e8d8b0;
-  --red:          #d07852;
+  --red:          #e39672;
   --gray:         #3f2b14;
   --gray-light:   #4a3728;
   --text:         #d4c4a0;
-  --text-dim:     #b09a7a;
+  --text-dim:     #b9a586;
   --font:         Georgia, 'Palatino Linotype', 'Book Antiqua', serif;
   --font-display: Georgia, 'Palatino Linotype', 'Book Antiqua', serif;
   --forest-header-bg: #111a0e;
@@ -3987,8 +4275,8 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link.active
   --forest-panel-shadow: 0 2px 8px rgba(0,0,0,0.5);
   --forest-surface-border: #5c3d1e;
   --forest-surface-hover-border: #7a5230;
-  --forest-link: #6fa84a;
-  --forest-link-visited: #4e7a35;
+  --forest-link: var(--green);
+  --forest-link-visited: var(--green-dim);
   --forest-link-hover: #93cc65;
   --forest-nav-text: #d4c4a0;
   --forest-nav-hover-bg: rgba(122, 82, 48, 0.16);
@@ -4000,12 +4288,12 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link.active
   --forest-success-hover-bg: #4b7333;
   --forest-success-hover-border: #93cc65;
   --forest-danger-bg: #4a2210;
-  --forest-danger-border: #7a3b20;
+  --forest-danger-border: #b9704f;
   --forest-danger-hover-bg: #5e2b14;
-  --forest-danger-hover-border: #9b5232;
-  --forest-input-border: #3f2b14;
+  --forest-danger-hover-border: #e39672;
+  --forest-input-border: #ac875f;
   --forest-pinned-border: #5f7c45;
-  --forest-muted: #b09a7a;
+  --forest-muted: var(--text-dim);
   --post-highlight-outline: #93cc65;
   --post-highlight-bg: rgba(111, 168, 74, 0.14);
   --accept-btn-bg: #3a5c28;
@@ -4107,7 +4395,6 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link.active
 }
 [data-theme="forest"] .home-btn,
 [data-theme="forest"] .mobile-board-menu-btn,
-[data-theme="forest"] .thread-nav-btn,
 [data-theme="forest"] .post-toggle-btn,
 [data-theme="forest"] .board-list a {
   border-color: var(--forest-surface-border);
@@ -4115,28 +4402,28 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link.active
 }
 [data-theme="forest"] .home-btn:hover,
 [data-theme="forest"] .mobile-board-menu-btn:hover,
-[data-theme="forest"] .thread-nav-btn:hover,
 [data-theme="forest"] .post-toggle-btn:hover,
 [data-theme="forest"] .board-list a:hover {
   background: var(--forest-nav-hover-bg);
-  color: var(--forest-nav-hover-text) !important;
+  color: var(--forest-nav-hover-text);
 }
 [data-theme="forest"] button,
 [data-theme="forest"] .btn,
 [data-theme="forest"] input[type="submit"] {
   background: var(--forest-button-bg);
-  border-color: var(--forest-surface-border);
+  border-color: var(--forest-input-border);
   color: #e8d8b0;
 }
 [data-theme="forest"] button:hover,
 [data-theme="forest"] .btn:hover,
 [data-theme="forest"] input[type="submit"]:hover {
   background: var(--forest-button-hover-bg);
-  border-color: var(--forest-surface-hover-border);
+  border-color: var(--forest-link-hover);
   color: #f1e6c8;
   box-shadow: none;
 }
 [data-theme="forest"] .post-form button[type="submit"],
+[data-theme="forest"] .btn-success,
 [data-theme="forest"] .compress-do-btn,
 [data-theme="forest"] .poll-vote-submit {
   background: var(--forest-success-bg);
@@ -4144,6 +4431,7 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link.active
   color: #d4e8c0;
 }
 [data-theme="forest"] .post-form button[type="submit"]:hover,
+[data-theme="forest"] .btn-success:hover,
 [data-theme="forest"] .compress-do-btn:hover,
 [data-theme="forest"] .poll-vote-submit:hover {
   background: var(--forest-success-hover-bg);
@@ -4151,35 +4439,86 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link.active
   color: #eff8e3;
 }
 [data-theme="forest"] .btn-danger,
-[data-theme="forest"] .compress-cancel-btn {
+[data-theme="forest"] .compress-do-btn.btn-danger,
+[data-theme="forest"] .post-controls .del-btn,
+[data-theme="forest"] .admin-del-btn[data-confirm] {
   background: var(--forest-danger-bg);
   border-color: var(--forest-danger-border);
   color: #e8c0b0;
 }
 [data-theme="forest"] .btn-danger:hover,
-[data-theme="forest"] .compress-cancel-btn:hover {
+[data-theme="forest"] .compress-do-btn.btn-danger:hover,
+[data-theme="forest"] .post-controls .del-btn:hover,
+[data-theme="forest"] .admin-del-btn[data-confirm]:hover {
   background: var(--forest-danger-hover-bg);
   border-color: var(--forest-danger-hover-border);
   color: #f0d3c7;
 }
 [data-theme="forest"] .header-search input,
+[data-theme="forest"] .search-form input,
 [data-theme="forest"] .post-form input[type="text"],
+[data-theme="forest"] .post-form input[type="password"],
+[data-theme="forest"] .post-form input[type="file"],
 [data-theme="forest"] .post-form textarea,
+[data-theme="forest"] select,
 [data-theme="forest"] .board-settings-grid input,
 [data-theme="forest"] .poll-creator-row input,
 [data-theme="forest"] .poll-option-row input {
-  background: #221810;
-  color: #d4c4a0;
+  background: var(--bg-input);
+  color: var(--text);
   border-color: var(--forest-input-border);
   box-shadow: inset 0 1px 2px rgba(0,0,0,0.45);
 }
 [data-theme="forest"] .header-search input:focus,
+[data-theme="forest"] .search-form input:focus,
 [data-theme="forest"] .post-form input[type="text"]:focus,
+[data-theme="forest"] .post-form input[type="password"]:focus,
+[data-theme="forest"] .post-form input[type="file"]:focus,
 [data-theme="forest"] .post-form textarea:focus,
+[data-theme="forest"] select:focus,
 [data-theme="forest"] .board-settings-grid input:focus,
 [data-theme="forest"] .poll-creator-row input:focus,
 [data-theme="forest"] .poll-option-row input:focus {
-  border-color: var(--forest-surface-hover-border);
+  border-color: var(--forest-link-hover);
+}
+[data-theme="forest"] input::placeholder,
+[data-theme="forest"] textarea::placeholder {
+  color: var(--forest-muted);
+  opacity: 1;
+}
+[data-theme="forest"] input::file-selector-button {
+  background: var(--forest-button-bg);
+  color: var(--forest-nav-text);
+  border: 1px solid var(--forest-input-border);
+  border-radius: var(--radius-sm);
+  padding: 3px 6px;
+  font: inherit;
+  cursor: pointer;
+}
+[data-theme="forest"] input::file-selector-button:hover {
+  background: var(--forest-button-hover-bg);
+}
+[data-theme="forest"] input:is([type="checkbox"], [type="radio"]) {
+  accent-color: var(--green);
+}
+html[data-theme="forest"] :is(a, button, summary, input, select, textarea, .btn):focus-visible {
+  outline: 2px solid var(--forest-link-hover);
+  outline-offset: 2px;
+}
+/* Keep pressed and disabled controls distinct without dimming their labels. */
+html[data-theme="forest"] :is(button, .btn, input[type="submit"]):not(:disabled):active {
+  border-color: var(--forest-link-hover);
+  box-shadow: inset 0 1px 3px rgba(0,0,0,0.5);
+}
+html[data-theme="forest"] :is(button, input, select, textarea):disabled,
+html[data-theme="forest"] [aria-disabled="true"] {
+  color: var(--forest-muted);
+  background: var(--bg-input);
+  border-color: var(--forest-input-border);
+  border-style: dashed;
+  box-shadow: none;
+  opacity: 1;
+  cursor: not-allowed;
 }
 [data-theme="forest"] .name {
   color: #e8d8b0;
@@ -4229,6 +4568,16 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link.active
 [data-theme="forest"] .error {
   background: rgba(122, 34, 16, 0.16);
 }
+[data-theme="forest"] .post-controls :is(.edit-btn, .report-btn) {
+  border-color: var(--forest-input-border);
+}
+[data-theme="forest"] .post-controls :is(.edit-btn, .report-btn):hover {
+  border-color: var(--forest-link-hover);
+}
+[data-theme="forest"] :is(.compress-modal-box, .edit-modal-box) {
+  background: var(--forest-elevated-bg);
+  box-shadow: var(--forest-panel-shadow);
+}
 
 /* Blue Sky */
 [data-theme="blue-sky"] {
@@ -4379,7 +4728,6 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link.active
 }
 [data-theme="blue-sky"] .home-btn,
 [data-theme="blue-sky"] .mobile-board-menu-btn,
-[data-theme="blue-sky"] .thread-nav-btn,
 [data-theme="blue-sky"] .post-toggle-btn,
 [data-theme="blue-sky"] .board-list a {
   border-color: var(--blue-sky-surface-border);
@@ -4387,7 +4735,6 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link.active
 }
 [data-theme="blue-sky"] .home-btn:hover,
 [data-theme="blue-sky"] .mobile-board-menu-btn:hover,
-[data-theme="blue-sky"] .thread-nav-btn:hover,
 [data-theme="blue-sky"] .post-toggle-btn:hover,
 [data-theme="blue-sky"] .board-list a:hover {
   background: var(--blue-sky-nav-hover-bg);
@@ -4703,7 +5050,6 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link.active
 }
 [data-theme="deep-orbit"] .home-btn,
 [data-theme="deep-orbit"] .mobile-board-menu-btn,
-[data-theme="deep-orbit"] .thread-nav-btn,
 [data-theme="deep-orbit"] .post-toggle-btn,
 [data-theme="deep-orbit"] .board-list a {
   border-color: var(--deep-orbit-surface-border);
@@ -4711,7 +5057,6 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link.active
 }
 [data-theme="deep-orbit"] .home-btn:hover,
 [data-theme="deep-orbit"] .mobile-board-menu-btn:hover,
-[data-theme="deep-orbit"] .thread-nav-btn:hover,
 [data-theme="deep-orbit"] .post-toggle-btn:hover,
 [data-theme="deep-orbit"] .board-list a:hover {
   background: var(--deep-orbit-nav-hover-bg);
@@ -5086,8 +5431,6 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link.active
 [data-theme="chanclassic"] .board-list a,
 [data-theme="chanclassic"] .board-nav-link,
 [data-theme="chanclassic"] .home-btn,
-[data-theme="chanclassic"] .thread-nav a,
-[data-theme="chanclassic"] .thread-nav-btn,
 [data-theme="chanclassic"] .post-toggle-btn,
 [data-theme="chanclassic"] .post-num a,
 [data-theme="chanclassic"] .poster-id-btn,
@@ -5096,8 +5439,6 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link.active
   text-decoration: none;
   text-shadow: none;
 }
-[data-theme="chanclassic"] .thread-nav a:hover,
-[data-theme="chanclassic"] .thread-nav-btn:hover,
 [data-theme="chanclassic"] .board-list a:hover,
 [data-theme="chanclassic"] .board-nav-link:hover,
 [data-theme="chanclassic"] .home-btn:hover,
@@ -5155,7 +5496,6 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link.active
   color: #000000;
   border-radius: 2px;
 }
-[data-theme="chanclassic"] .thread-nav-btn,
 [data-theme="chanclassic"] .post-toggle-btn,
 [data-theme="chanclassic"] .site-header button,
 [data-theme="chanclassic"] .board-list a,
@@ -5186,7 +5526,6 @@ html:is([data-theme="aero"], [data-theme="neoncubicle"]) .board-nav-link.active
   color: #800000;
   box-shadow: none;
 }
-[data-theme="chanclassic"] .thread-nav-btn:hover,
 [data-theme="chanclassic"] .post-toggle-btn:hover,
 [data-theme="chanclassic"] .board-list a:hover,
 [data-theme="chanclassic"] .board-nav-link:hover,
@@ -6528,6 +6867,7 @@ html:not([data-theme]) .compress-do-btn {
 
 /* Thread board banner & nav bar */
 .thread-board-banner {
+  overflow-wrap: anywhere;
   text-align: center;
   font-size: 1.1rem;
   font-weight: bold;
@@ -6538,23 +6878,27 @@ html:not([data-theme]) .compress-do-btn {
 html:not([data-theme]) .thread-board-banner { text-shadow: 0 0 10px rgba(0,255,65,0.35); }
 
 .thread-nav {
+  --thread-control-color: var(--green);
   display: flex;
   flex-wrap: wrap;
   align-items: center;
-  gap: 4px 6px;
+  gap: 6px 12px;
   padding: 4px 0 8px;
+  scroll-margin-top: calc(var(--header-offset, 58px) + 10px);
 }
 
 .thread-nav-group {
   display: inline-flex;
   align-items: center;
   flex-wrap: wrap;
-  gap: 2px;
+  gap: 4px;
   min-width: 0;
 }
 
 .thread-nav-refresh {
-  gap: 5px;
+  gap: 8px;
+  padding-inline-start: 12px;
+  border-inline-start: 1px solid var(--border);
 }
 
 html.no-js .thread-nav-refresh > button,
@@ -6575,74 +6919,131 @@ html.no-js .poll-add-btn {
   padding-top: 10px;
 }
 
-.thread-nav a,
-.thread-nav-btn {
-  color: var(--green-bright);
+.thread-nav .thread-nav-control {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  flex-shrink: 0;
+  color: var(--thread-control-color);
   font-family: var(--font);
   font-size: 0.88rem;
+  font-weight: normal;
+  line-height: 1.4;
+  letter-spacing: normal;
+  white-space: nowrap;
   background: transparent;
   border: 1px solid transparent;
-  border-radius: var(--radius-sm);
+  border-radius: min(var(--radius-sm), 3px);
   min-height: 30px;
   padding: 3px 6px;
   cursor: pointer;
   text-decoration: none;
+  text-shadow: none;
+  box-shadow: none;
+  transition: none;
+  touch-action: manipulation;
 }
 
-.thread-reply-stat {
+[data-theme="chanclassic"] .thread-nav {
+  --thread-control-color: var(--green-bright);
+}
+
+.thread-nav .thread-nav-update {
+  /* Reserve the action's width for its busy label as well as its idle label. */
+  min-width: calc(14ch + 16px);
+}
+
+.thread-nav .autoupdate-label {
+  min-height: 30px;
+  padding: 3px 6px;
+  color: var(--text);
+  line-height: 1.4;
+  letter-spacing: normal;
+  white-space: nowrap;
+}
+
+.thread-nav .autoupdate-label input[type="checkbox"] {
+  border-color: var(--thread-control-color);
+  transition: none;
+}
+
+.thread-nav .autoupdate-label input[type="checkbox"]:checked {
+  background: var(--thread-control-color);
+}
+
+.thread-nav .autoupdate-label input[type="checkbox"]:checked::after {
+  border-color: var(--bg);
+}
+
+.thread-nav .thread-reply-stat {
   display: inline-flex;
   align-items: center;
   min-height: 26px;
   padding: 2px 6px;
   border: 1px solid color-mix(in srgb, var(--border) 70%, transparent);
   background: color-mix(in srgb, var(--bg-input) 56%, transparent);
-  color: var(--text-dim);
+  color: var(--text);
   font-size: 0.76rem;
   line-height: 1.1;
+  gap: 0.25em;
   border-radius: var(--radius-sm);
 }
 
-.thread-nav a:hover,
-.thread-nav-btn:hover {
-  color: var(--green-bright);
-  border-color: color-mix(in srgb, var(--border) 78%, transparent);
+.thread-nav .thread-nav-control:hover:not([aria-disabled="true"]) {
+  color: var(--thread-control-color);
+  border-color: var(--border);
   background: color-mix(in srgb, var(--green) 8%, transparent);
   text-decoration: underline;
 }
 
-.thread-nav-btn:disabled {
+.thread-nav .thread-nav-control:focus-visible,
+.thread-nav .autoupdate-label input:focus-visible {
+  outline: 2px solid var(--thread-control-color);
+  outline-offset: 2px;
+}
+
+.thread-nav .thread-nav-control:active:not([aria-disabled="true"]) {
+  border-color: var(--thread-control-color);
+  background: color-mix(in srgb, var(--green) 16%, transparent);
+}
+
+.thread-nav .thread-nav-control[aria-disabled="true"] {
   cursor: wait;
-  opacity: 0.7;
+  color: var(--text);
+  background: color-mix(in srgb, var(--bg-input) 70%, transparent);
+  border-color: var(--border);
   text-decoration: none;
 }
 
-.thread-nav-btn.active {
-  color: var(--green-bright);
+.thread-nav .thread-nav-control:visited {
+  color: var(--thread-control-color);
 }
-html:not([data-theme]) .thread-nav-btn.active { text-shadow: 0 0 8px rgba(0,255,65,0.6); }
 
-.autoupdate-status {
-  color: var(--green-bright);
+.thread-nav .autoupdate-status {
+  color: var(--thread-control-color);
   font-size: 0.75rem;
-  opacity: 0.8;
-  margin-left: 4px;
+  overflow-wrap: anywhere;
+  max-width: 100%;
 }
 
-.autoupdate-status[data-state="working"] {
-  color: var(--text-dim);
+.thread-nav .autoupdate-status[data-state="working"] {
+  color: var(--text);
 }
 
-.autoupdate-status[data-state="success"] {
-  color: var(--green-bright);
+.thread-nav .autoupdate-status[data-state="success"] {
+  color: var(--thread-control-color);
 }
 
-.autoupdate-status[data-state="error"] {
-  color: var(--red, #f55);
+.thread-nav .autoupdate-status[data-state="error"] {
+  color: var(--text);
+  border-inline-start: 2px solid var(--red);
+  padding-inline-start: 6px;
 }
 
 @media (max-width: 700px) {
   .thread-nav {
     justify-content: center;
+    max-width: calc(100vw - 16px);
     gap: 7px;
     padding: 6px 0 10px;
   }
@@ -6662,21 +7063,9 @@ html:not([data-theme]) .thread-nav-btn.active { text-shadow: 0 0 8px rgba(0,255,
     margin-left: 0;
   }
 
-  .thread-nav a,
-  .thread-nav-btn {
-    display: inline-flex;
-    align-items: center;
-    justify-content: center;
-    min-height: 40px;
-    padding: 6px 9px;
-  }
-
-  .autoupdate-label {
-    min-height: 40px;
-    padding: 6px 9px;
-    border: 1px solid color-mix(in srgb, var(--border) 72%, transparent);
-    background: color-mix(in srgb, var(--bg-input) 54%, transparent);
-    border-radius: var(--radius-sm);
+  .thread-nav-refresh {
+    border-inline-start: none;
+    padding-inline-start: 0;
   }
 
   .thread-reply-stat,
@@ -6691,6 +7080,14 @@ html:not([data-theme]) .thread-nav-btn.active { text-shadow: 0 0 8px rgba(0,255,
   }
 }
 
+@media (max-width: 700px), (pointer: coarse) {
+  .thread-nav .thread-nav-control,
+  .thread-nav .autoupdate-label {
+    min-height: 44px;
+    padding: 6px;
+  }
+}
+
 /* Dice roll display */
 .dice-roll {
   display: inline-block;
@@ -6756,6 +7153,10 @@ html:not([data-theme]) .thread-nav-btn.active { text-shadow: 0 0 8px rgba(0,255,
   font-size: 0.82rem;
   word-break: break-word;
 }
+.archive-thread-link:focus-visible {
+  outline: 2px solid var(--green-bright, #00c840);
+  outline-offset: 3px;
+}
 .archive-thread-link:hover {
   color: var(--green-bright, #00c840);
 }
@@ -6865,3 +7266,165 @@ html:not([data-theme]) .thread-nav-btn.active { text-shadow: 0 0 8px rgba(0,255,
   vertical-align: middle;
   pointer-events: none;
 }
+
+/* Small readability corrections; retain each theme's original visual design. */
+html[data-theme="neoncubicle"] :is(.subject strong, .subject a) {
+  color: #1c5f6e;
+}
+html[data-theme="fluorogrid"] :is(.subject strong, .subject a) {
+  color: #1b686a;
+}
+html[data-theme="neoncubicle"] :is(.name, .catalog-subject, .compress-modal-title, .modal-field-label),
+html[data-theme="neoncubicle"] .board-nav-link.active {
+  color: #8a2a6a;
+}
+html[data-theme="neoncubicle"] :is(a, .post-toggle-btn):hover {
+  color: #8a2a6a;
+}
+html[data-theme="fluorogrid"] :is(.name, .compress-modal-title),
+html[data-theme="fluorogrid"] .board-nav-link.active {
+  color: #7722aa;
+}
+html[data-theme="fluorogrid"] :is(a, .post-toggle-btn):hover {
+  color: #7722aa;
+}
+html:is([data-theme="neoncubicle"], [data-theme="fluorogrid"]) .post-body .quote {
+  color: #465c14;
+}
+html[data-theme="neoncubicle"] :is(a, button, summary, input, textarea, select):focus-visible {
+  outline: 2px solid #8a2a6a;
+  outline-offset: 2px;
+}
+html[data-theme="fluorogrid"] :is(a, button, summary, input, textarea, select):focus-visible {
+  outline: 2px solid #7722aa;
+  outline-offset: 2px;
+}
+html[data-theme="fluorogrid"] .locked-notice {
+  color: #bb1f4e;
+}
+html[data-theme="dorfic"] :is(.file-info, .catalog-replies) {
+  color: #c9ab77;
+}
+html[data-theme="dorfic"] :is(.post-error-banner, .locked-notice) {
+  color: #ee9e82;
+}
+html[data-theme="blue-sky"] .name {
+  color: #326387;
+}
+html[data-theme="blue-sky"] .post-body .quote {
+  color: #496742;
+}
+html[data-theme="blue-sky"] .locked-notice {
+  color: #7a4550;
+}
+@media (prefers-reduced-motion: reduce) {
+  html:is([data-theme="neoncubicle"], [data-theme="fluorogrid"], [data-theme="dorfic"], [data-theme="deep-orbit"], [data-theme="blue-sky"]) *,
+  html:is([data-theme="neoncubicle"], [data-theme="fluorogrid"], [data-theme="dorfic"], [data-theme="deep-orbit"], [data-theme="blue-sky"]) *::before,
+  html:is([data-theme="neoncubicle"], [data-theme="fluorogrid"], [data-theme="dorfic"], [data-theme="deep-orbit"], [data-theme="blue-sky"]) *::after {
+    animation: none !important;
+    transition: none !important;
+    scroll-behavior: auto !important;
+  }
+}
+
+/* Terminal refinements use the explicit active theme, leaving the unmarked
+   fallback and other themes' shared rules intact. */
+html[data-active-theme="terminal"] {
+  --terminal-danger: #ff6680;
+  --red: var(--terminal-danger);
+  --red-bright: var(--terminal-danger);
+}
+html[data-active-theme="terminal"] a:visited {
+  color: var(--green-pale);
+}
+html[data-active-theme="terminal"] .post-body a:hover {
+  text-decoration: underline;
+}
+html[data-active-theme="terminal"] :is(.catalog-thread-menu-toggle, .catalog-thread-menu, .mobile-board-menu-panel, .board-reorder-controls, .user-preferences-mobile-close, .compress-modal-box, .edit-modal-box, .poster-id-btn, .admin-section-index a),
+html[data-active-theme="terminal"] .user-preferences-panel[open] .user-preferences-form {
+  border-radius: 0;
+}
+html[data-active-theme="terminal"] :is(.catalog-thread-menu-toggle, .search-form button, .post-controls .edit-btn, .post-controls .report-btn) {
+  border-color: var(--green-dim);
+}
+html[data-active-theme="terminal"] :is(.post-form, .search-form, .header-search, .user-preferences-form, .board-access-form, .admin-section) :is(input, select, textarea) {
+  border-color: var(--green-dim);
+  caret-color: var(--green-bright);
+}
+html[data-active-theme="terminal"] input::placeholder,
+html[data-active-theme="terminal"] textarea::placeholder {
+  color: var(--text-dim);
+  opacity: 1;
+}
+html[data-active-theme="terminal"] input::file-selector-button {
+  background: var(--bg-input);
+  color: var(--green-pale);
+  border: 1px solid var(--green-dim);
+  border-radius: 0;
+  padding: 3px 6px;
+  font: inherit;
+  cursor: pointer;
+}
+html[data-active-theme="terminal"] input::file-selector-button:hover {
+  border-color: var(--green-bright);
+}
+html[data-active-theme="terminal"] .post-form button[type="submit"],
+html[data-active-theme="terminal"] :is(.compress-do-btn, .btn-success, .poll-vote-submit) {
+  background: #133019;
+  color: var(--text);
+  border-color: var(--green);
+}
+html[data-active-theme="terminal"] .post-form button[type="submit"]:hover,
+html[data-active-theme="terminal"] :is(.compress-do-btn, .btn-success, .poll-vote-submit):hover {
+  background: #1f4a27;
+  color: var(--text);
+  border-color: var(--green-bright);
+}
+html[data-active-theme="terminal"] form[action="/admin/thread/action"] .admin-del-btn {
+  background: var(--bg-input);
+  color: var(--green-pale);
+  border-color: var(--green-dim);
+}
+html[data-active-theme="terminal"] form[action="/admin/thread/action"] .admin-del-btn:hover {
+  color: var(--green-bright);
+  border-color: var(--green-bright);
+}
+html[data-active-theme="terminal"] :is(.btn-danger, .admin-del-btn[data-confirm], .post-controls .del-btn),
+html[data-active-theme="terminal"] .compress-do-btn.btn-danger {
+  background: color-mix(in srgb, var(--terminal-danger) 8%, var(--bg-input));
+  color: var(--terminal-danger);
+  border-color: var(--terminal-danger);
+}
+html[data-active-theme="terminal"] :is(.btn-danger, .admin-del-btn[data-confirm], .post-controls .del-btn):hover,
+html[data-active-theme="terminal"] .compress-do-btn.btn-danger:hover {
+  background: color-mix(in srgb, var(--terminal-danger) 14%, var(--bg-input));
+  color: var(--terminal-danger);
+  border-color: var(--terminal-danger);
+  box-shadow: none;
+}
+html[data-active-theme="terminal"] .thread-nav .thread-nav-control:hover:not([aria-disabled="true"]):not(:disabled) {
+  background: transparent;
+  color: var(--green-bright);
+  border-color: transparent;
+  text-shadow: 0 0 6px var(--green-bright);
+}
+html[data-active-theme="terminal"] .thread-nav .thread-nav-control:active:not([aria-disabled="true"]):not(:disabled) {
+  background: transparent;
+  color: var(--green-pale);
+  border-color: var(--green-dim);
+  text-shadow: 0 0 3px var(--green-pale);
+}
+html[data-active-theme="terminal"] :is(a, button, summary, input, select, textarea, .btn):focus-visible {
+  outline: 2px solid var(--green-bright);
+  outline-offset: 2px;
+}
+html[data-active-theme="terminal"] :is(button, input, select, textarea):disabled,
+html[data-active-theme="terminal"] [aria-disabled="true"] {
+  color: var(--text-dim);
+  background: var(--bg-input);
+  border-color: var(--green-dim);
+  border-style: dashed;
+  box-shadow: none;
+  opacity: 1;
+  cursor: not-allowed;
+}