diff --git a/docs/guide/ai.md b/docs/guide/ai.md
index aba223c15..0617b4940 100644
--- a/docs/guide/ai.md
+++ b/docs/guide/ai.md
@@ -133,7 +133,7 @@ const result = await ai.run('google/gemini-2.5-flash', {
 });
 ```
 
-Pass AI Gateway options as the third argument: `ai.run(model, inputs, { gateway: { skipCache: true } })`.
+Pass AI Gateway options as the third argument: `ai.run(model, inputs, { gateway: { skipCache: true } })`. On a team platform, the platform chooses the gateway and sets its metadata and logging; options such as `skipCache` and `cacheTtl` still apply.
 
 For provider-native requests on a direct deployment, configure [`ai.gateway`](../integrations/cloudflare.md#ai-self-host).
 
@@ -142,7 +142,9 @@ For provider-native requests on a direct deployment, configure [`ai.gateway`](..
 Use `ai.provider(provider).fetch(path, init)` for a provider-native API with your
 own provider key. The request goes through the configured Cloudflare AI Gateway
 and retains the provider's native HTTP shape. On a team platform, it also passes
-through that installation's proxy.
+through that installation's proxy. AI Gateway cache, timeout and retry headers,
+such as `cf-aig-cache-ttl` and `cf-aig-max-attempts`, still apply there; the
+platform ignores logging, metadata and cost headers.
 
 ### OpenAI
 
diff --git a/docs/guide/auth.md b/docs/guide/auth.md
index 77ada7a1c..40617b404 100644
--- a/docs/guide/auth.md
+++ b/docs/guide/auth.md
@@ -127,6 +127,42 @@ Auth sessions use the same database as your app. Void creates `BETTER_AUTH_SECRE
 
 Local development needs no secret setup. To preview a production build locally, provide `BETTER_AUTH_SECRET`.
 
+`POST`, `PUT`, `PATCH` and `DELETE` requests and WebSocket connections from another origin don't use the signed-in session unless that origin is in `trustedOrigins`. If a separate frontend calls your app, add its origin there (see [Customization](#customization)). If your routes use their own cookies, check the request `Origin` yourself, for example with Hono's [`csrf()`](https://hono.dev/docs/middleware/builtin/csrf) middleware.
+
+Deployed apps on Cloudflare limit auth requests per client IP with Better Auth's defaults, for example 3 sign-in attempts per 10 seconds. Each Worker instance keeps its own count. Change or turn off the limits with `rateLimit` in `auth.ts`. To share one count across instances, set `rateLimit: { storage: 'database' }`, then run `void db generate` for a direct Cloudflare deploy.
+
+### Proxies and end-to-end tests
+
+All requests from one IP share one count. Two common setups reach the limits:
+
+- A server calls your auth endpoints for your users, such as a backend-for-frontend, a rewrite from Vercel or nginx, or another Worker's `fetch`. All of those users share that server's IP.
+- End-to-end tests sign up or sign in many times against a deployed app.
+
+Don't read the client IP from `x-forwarded-for` instead: any client can send that header. Give the trusted caller a secret header, and skip the limits only for requests that carry it:
+
+```ts
+import { defineAuth } from 'void/auth';
+
+export default defineAuth(({ defaults, env }) => ({
+  ...defaults,
+  rateLimit: {
+    customRules: {
+      '/**': (request, rule) =>
+        env.AUTH_TRUSTED_KEY && request.headers.get('x-auth-trusted-key') === env.AUTH_TRUSTED_KEY
+          ? false
+          : rule,
+    },
+  },
+}));
+```
+
+`'/**'` matches every auth endpoint. Returning `false` skips the limit, and returning `rule` keeps the default limit for everyone else. Declare `AUTH_TRUSTED_KEY: string().optional()` in `env.ts` and set it with `void secret put AUTH_TRUSTED_KEY` (see [Environment variables](./env-vars.md#production-server-values)).
+
+Your app no longer limits requests that carry the key, so:
+
+- A proxy that sends it must limit every auth request it forwards for each of its users, including sign-up, password reset and verification emails.
+- A test runner should send it only to your app. Never put the key in code that runs in your users' browsers.
+
 ## Customization
 
 For advanced configuration, create `auth.ts` at the project root and export `defineAuth(...)`:
diff --git a/docs/guide/edge/revalidation.md b/docs/guide/edge/revalidation.md
index daf6812aa..e5f152987 100644
--- a/docs/guide/edge/revalidation.md
+++ b/docs/guide/edge/revalidation.md
@@ -108,7 +108,7 @@ Requests with `Cookie`, `Authorization`, or Cloudflare Access's `Cf-Access-Jwt-A
 
 For a dispatch rewrite, the cache key includes both the destination and original pathname. A direct request to `/en/docs/foo` therefore uses a different entry from `/docs/foo` rewritten to that destination.
 
-Query parameters are excluded by default. Add `routing.revalidateQueryAllowlist` when specific parameters should produce separate cached responses. Middleware `c.rewrite()` runs after the ISR lookup, so it doesn't create an additional cache variant.
+Query parameters are excluded by default. Add `routing.revalidateQueryAllowlist` when specific parameters should produce separate cached responses. Requests with other query parameters get the cached page. If nothing is cached yet, they render live and are not stored, so add every parameter a page reads to `routing.revalidateQueryAllowlist`. Middleware `c.rewrite()` runs after the ISR lookup, so it doesn't create an additional cache variant.
 
 Purge the destination pathname with `revalidate({ paths })`. Purging `/en/docs/foo` clears both direct and rewritten variants. Purging only `/docs/foo` won't clear them, because the entries are stored under the destination.
 
diff --git a/docs/guide/jobs.md b/docs/guide/jobs.md
index 67ae22dfe..205954673 100644
--- a/docs/guide/jobs.md
+++ b/docs/guide/jobs.md
@@ -75,3 +75,5 @@ The endpoint works in native Void apps and supported frameworks. Framework jobs
 ## Deployment behavior
 
 Native scheduled events do not require a manual HTTP token. For framework deployments, HTTP requests to `/__void/scheduled` require a matching `x-void-internal` token: the managed platform supplies its proxy token, or you can explicitly configure `CRON_SECRET` for manual calls. An absent or mismatched token returns `401` without running a job.
+
+On a Void platform, each project can use up to 100 different cron expressions and 1,000 schedules (each expression a job exports counts as one schedule). Jobs that share an expression count once toward the expression limit. When you deploy to your own Cloudflare account, Cloudflare's [Cron Trigger limits](https://developers.cloudflare.com/workers/platform/limits/) apply instead.
diff --git a/docs/guide/live.md b/docs/guide/live.md
index f89301623..f862face6 100644
--- a/docs/guide/live.md
+++ b/docs/guide/live.md
@@ -22,6 +22,8 @@ export const live = defineLiveStream({
 });
 ```
 
+This example accepts visitors who are not signed in. Without `onSubscribe`, any connection can subscribe to any topic, so read [Authorization](#authorization) before you publish private data.
+
 Void enables live streams when a [scanned file](../reference/resource-inference.md#scanned-directories) imports `void/live`, so keep this module in `src/` or another scanned directory. To keep it in an unscanned directory such as `lib/`, add that directory to [`inference.scanDirs`](../reference/resource-inference.md#custom-scan-directories) and list the default directories you still use, because `scanDirs` replaces them.
 
 Expose it from a normal route:
@@ -101,6 +103,8 @@ await live.withEnv(env).publish('post:12', { title: 'Updated title' });
 
 Only a connection's owner can change its subscriptions. The example above allows anonymous connections; authenticated streams use the current Void user by default.
 
+The owner decides who can change a connection's subscriptions, not which topics the connection can read.
+
 For authenticated streams, pass the same owner key to `connect()` and
 `control()`:
 
@@ -127,16 +131,17 @@ current authenticated user and uses `user:${user.id}` when the user has a string
 `id`. If neither path produces an owner and `allowAnonymousControl` is not set,
 the request is rejected with `403`.
 
-For stream-local subscription rules, use `onSubscribe`:
+Without `onSubscribe`, any connection that passes the owner check (any signed-in user, or any visitor when `allowAnonymousControl` is set) can subscribe to any topic and receives everything published to it. Topic names are easy to guess. Use `onSubscribe` to decide who can read each topic: return a `Response` to reject the subscription, or return nothing to allow it.
 
 ```ts
 export const live = defineLiveStream({
   id: 'app',
   async onSubscribe(ctx) {
-    const match = /^post:(.+)$/.exec(ctx.topic);
-    if (match && !(await canReadPost(ctx.env, ctx.user, match[1]))) {
-      return new Response('Forbidden', { status: 403 });
-    }
+    const post = /^post:(.+)$/.exec(ctx.topic);
+    if (post && (await canReadPost(ctx.env, ctx.user, post[1]))) return;
+    const inbox = /^user:(.+):inbox$/.exec(ctx.topic);
+    if (inbox && ctx.owner === `user:${inbox[1]}`) return;
+    return new Response('Forbidden', { status: 403 });
   },
 });
 ```
diff --git a/docs/guide/pages-routing/actions-and-forms.md b/docs/guide/pages-routing/actions-and-forms.md
index 0fef233dc..b7e0d6942 100644
--- a/docs/guide/pages-routing/actions-and-forms.md
+++ b/docs/guide/pages-routing/actions-and-forms.md
@@ -355,20 +355,32 @@ On the server, use `c.req.parseBody()` to access the uploaded file:
 
 ```ts
 // pages/photos.server.ts
-import { defineHandler } from 'void';
+import { defineHandler, ValidationError } from 'void/handler';
 import { storage } from 'void/storage';
 
+// file.name and file.type come from the browser. Don't use them as the key or trust the type.
+const imageTypes = new Map([
+  ['image/jpeg', 'jpg'],
+  ['image/png', 'png'],
+  ['image/webp', 'webp'],
+]);
+
 export const action = defineHandler(async (c) => {
   const body = await c.req.parseBody();
-  const file = body['photo'] as File;
-  if (file && file.size > 0) {
-    await storage.put(file.name, file.stream(), {
-      httpMetadata: { contentType: file.type },
-    });
+  const file = body['photo'];
+  if (!(file instanceof File) || file.size === 0) return;
+  const ext = imageTypes.get(file.type);
+  if (!ext) {
+    throw new ValidationError({ photo: 'Upload a JPEG, PNG, or WebP image.' });
   }
+  await storage.put(`uploads/${crypto.randomUUID()}.${ext}`, file.stream(), {
+    httpMetadata: { contentType: file.type },
+  });
 });
 ```
 
+Pick the storage key on the server and allow only the file types you expect. See [Serving Files](../storage.md#serving-files) to send them back safely.
+
 ## Choosing a Primitive
 
 | Primitive        | Page update | Form state                 | Framework-specific |
diff --git a/docs/guide/pages-routing/loaders.md b/docs/guide/pages-routing/loaders.md
index b9699af81..0509c2524 100644
--- a/docs/guide/pages-routing/loaders.md
+++ b/docs/guide/pages-routing/loaders.md
@@ -157,6 +157,10 @@ around the Suspense boundary when the page should render a custom failure state.
 For explicit React prop annotations, import `Deferred` from `@void/react`; the
 adapter export is typed as `Promise<T>`.
 
+In production, an unexpected error in a deferred prop reaches the page as
+`Internal Server Error`; throw an
+[`HTTPException`](../../integrations/hono.md#utilities) to show your own message.
+
 In Vue, Svelte, and Solid, `Deferred<T>` behaves as a [discriminated union](https://www.typescriptlang.org/docs/handbook/2/narrowing.html#discriminated-unions) with three states:
 
 ```ts
diff --git a/docs/guide/pages-routing/overview.md b/docs/guide/pages-routing/overview.md
index 19815346d..6155bd9ec 100644
--- a/docs/guide/pages-routing/overview.md
+++ b/docs/guide/pages-routing/overview.md
@@ -212,6 +212,8 @@ router.refresh(); // re-fetch current page props
 router.visit('/logout', { method: 'POST' }); // non-GET navigation
 ```
 
+`router.visit()` updates the page in place for same-origin URLs. `http(s)` URLs on another origin get a full page load, and other schemes such as `javascript:` are rejected.
+
 For dynamic route params, use `useParams()` from the same adapter package:
 
 ```tsx
diff --git a/docs/guide/platform/administration/access.md b/docs/guide/platform/administration/access.md
index a6988d10b..e9a7f7445 100644
--- a/docs/guide/platform/administration/access.md
+++ b/docs/guide/platform/administration/access.md
@@ -157,4 +157,4 @@ void platform invitation list
 Invitation history remains available after an involved account is removed. The stored actor ID
 remains visible when that account's login no longer exists.
 
-`void platform signup open` allows anyone to sign up. Use `void platform signup restrict` to require an allowlist match again. Disallowing an entry affects future signup; it does not suspend an existing account.
+`void platform signup open` allows anyone to sign up. Everyone who signs up can deploy apps on your application domain, so check how those apps [share cookies](/guide/platform/installation/domains#adding-a-domain) before opening signup. Use `void platform signup restrict` to require an allowlist match again. Disallowing an entry affects future signup; it does not suspend an existing account.
diff --git a/docs/guide/platform/installation/domains.md b/docs/guide/platform/installation/domains.md
index 50efaa7b3..8aed5719c 100644
--- a/docs/guide/platform/installation/domains.md
+++ b/docs/guide/platform/installation/domains.md
@@ -23,6 +23,8 @@ Choose an application domain whose wildcard leaves existing Worker Custom Domain
 
 Browser login sessions are specific to each origin. Apps using their own OAuth providers may need to register their new callback URLs. Void's built-in auth uses the request origin automatically unless the app overrides that configuration.
 
+Apps on one application domain can set cookies that the other apps there receive. With a nested domain such as `apps.example.com`, apps can also set cookies for `example.com` and its other subdomains. Apps on `workers.dev` testing URLs can set cookies that every Worker on your account's `workers.dev` subdomain receives. If people outside your team can deploy, use a domain that serves only Void apps. A platform that serves thousands of independent developers can also apply to list its application domain on the [Public Suffix List](https://github.com/publicsuffix/list/wiki/Guidelines).
+
 ### What Changes in Testing Mode?
 
 In testing mode, each app gets a `workers.dev` URL. These URLs continue working after you add a domain; new apps then use the domain.
diff --git a/docs/guide/storage.md b/docs/guide/storage.md
index 5dc659142..d0add4949 100644
--- a/docs/guide/storage.md
+++ b/docs/guide/storage.md
@@ -42,12 +42,12 @@ const head = await storage.head('uploads/photo.jpg');
 A common pattern is serving uploaded files from an API route:
 
 ```ts
+// routes/files/[key].ts
 import { defineHandler } from 'void';
 import { storage } from 'void/storage';
 
 export const GET = defineHandler(async (c) => {
-  const key = c.req.param('key');
-  const object = await storage.get(key);
+  const object = await storage.get(`uploads/${c.req.param('key')}`);
 
   if (!object) {
     return c.notFound();
@@ -56,11 +56,16 @@ export const GET = defineHandler(async (c) => {
   const headers = new Headers();
   object.writeHttpMetadata(headers);
   headers.set('etag', object.httpEtag);
+  // Don't let an uploaded HTML or SVG file run as a page on your site.
+  headers.set('X-Content-Type-Options', 'nosniff');
+  headers.set('Content-Disposition', 'attachment');
 
   return new Response(object.body, { headers });
 });
 ```
 
+Files your users upload can contain HTML or scripts. Store them under keys your server picks, and serve them with `nosniff` and `Content-Disposition: attachment`. `<img>` and `<video>` tags still display them; opening the URL directly downloads the file.
+
 ## Custom bindings
 
 Use `createStorage(bucket)` with your own R2 binding, or in tests:
diff --git a/docs/guide/websockets.md b/docs/guide/websockets.md
index 4f4cfd294..c33249960 100644
--- a/docs/guide/websockets.md
+++ b/docs/guide/websockets.md
@@ -151,6 +151,10 @@ Messages are JSON events. Raw string and binary messages are not supported.
 
 When Void auth is enabled, every WebSocket hook receives the current user as `ctx.user`, or `null` for an anonymous connection. Use `onBeforeConnect` to reject unauthenticated clients.
 
+Connections from another origin are anonymous unless that origin is in your auth `trustedOrigins`. If you read your own cookies from `ctx.request`, check its `Origin` header yourself.
+
+`ctx.user` is resolved when the socket connects and stays the same for that connection, even if the user later signs out or the session is revoked. For actions that must respect a ban or role change, re-check your own records in `onMessage` and close the connection with `ctx.connection.close()` in rooms or `ctx.socket.close()` in `defineWebSocket()`.
+
 ## Hooks
 
 Both `defineRoom()` and `defineWebSocket()` support:
diff --git a/docs/integrations/hono.md b/docs/integrations/hono.md
index 8bf70acde..3a2279e71 100644
--- a/docs/integrations/hono.md
+++ b/docs/integrations/hono.md
@@ -25,13 +25,21 @@ export default defineMiddleware(cors({ origin: 'https://example.com' }));
 ```
 
 ```ts
-// middleware/02.cache.ts
-import { defineMiddleware } from 'void';
+// routes/api/products.ts (per-route cache)
+import { defineHandler } from 'void';
 import { cache } from 'hono/cache';
+import { listProducts } from '../../lib/products';
 
-export default defineMiddleware(cache({ cacheName: 'my-app', cacheControl: 'max-age=3600' }));
+export const GET = defineHandler(
+  cache({ cacheName: 'products', cacheControl: 'max-age=3600' }),
+  async () => ({ products: await listProducts() }),
+);
 ```
 
+::: warning
+`cache()` stores one response per URL and returns it to every visitor. It skips requests with an `Authorization` header, but not cookies. Use it only on routes whose response is the same for everyone, never on a route that reads the signed-in user. To cache pages, use [revalidation](../guide/edge/revalidation.md), which skips requests that carry a cookie.
+:::
+
 ```ts
 // routes/api/webhooks/stripe.ts (per-route usage)
 import { defineHandler } from 'void';
diff --git a/docs/reference/api/handlers.md b/docs/reference/api/handlers.md
index 33e4279fb..d42fe7ca6 100644
--- a/docs/reference/api/handlers.md
+++ b/docs/reference/api/handlers.md
@@ -103,6 +103,8 @@ Void’s reserved `/__void` endpoints use their own authentication and are exclu
 
 When credentials come from `void/env`, wrap the reads in functions so they are resolved per request after Void has bound the runtime env.
 
+If `password` resolves to an empty value, requests fail with a server error instead of passing the gate.
+
 For app-specific bypasses such as health checks or public webhooks, compose that logic in your own middleware before calling `basicAuth()`.
 
 ```ts
diff --git a/docs/reference/cli/platform-users.md b/docs/reference/cli/platform-users.md
index 73bb0ec5c..a2138b074 100644
--- a/docs/reference/cli/platform-users.md
+++ b/docs/reference/cli/platform-users.md
@@ -22,7 +22,7 @@ void platform user restore <id>
 void platform user delete <id>
 ```
 
-Suspending a user blocks their applications. Deleting a user also deletes their project resources. A plan change updates resource limits while preserving any administrator suspension.
+Suspending a user blocks their applications, including scheduled jobs and queue consumers. While the account is suspended, each queue message is retried about once an hour, and each retry uses one of its queue's retries. Messages that run out of retries are dropped: after about 3 hours with the default of 3 retries, and at once for a queue with `maxRetries: 0`. Restore an account suspended by mistake promptly; queue delivery resumes within about an hour. Deleting a user also deletes their project resources. A plan change updates resource limits while preserving any administrator suspension.
 
 The last active administrator cannot be deleted or suspended. Both previews and
 actual mutations enforce this rule, including in the browser admin UI. Allowed
diff --git a/docs/reference/config.md b/docs/reference/config.md
index 4328b214b..119f539f0 100644
--- a/docs/reference/config.md
+++ b/docs/reference/config.md
@@ -434,7 +434,7 @@ ISR revalidation TTL in seconds, either globally or per path. See [Revalidation]
 
 #### `routing.revalidateQueryAllowlist`
 
-Query parameters that participate in ISR variant keys for dispatch rewrites. Keys are source URL patterns, values are query parameter names to keep. When omitted, rewritten ISR cache keys drop every incoming query parameter to avoid unbounded cache fanout.
+Query parameters to keep in ISR cache keys. Keys are source URL patterns, values are query parameter names to keep. The listed parameters are part of the cache key for every request to a matching path; all other query parameters are left out of the key. When omitted, ISR cache keys drop every incoming query parameter to avoid unbounded cache fanout.
 
 ```json
 {
diff --git a/packages/deploy-core/src/validate.ts b/packages/deploy-core/src/validate.ts
index 8d98d816b..19d97806c 100644
--- a/packages/deploy-core/src/validate.ts
+++ b/packages/deploy-core/src/validate.ts
@@ -13,6 +13,13 @@ export const MANIFEST_REDIRECT_RULE_STATUSES: ReadonlySet<number> = new Set([
 export const MAX_ROUTING_RULES = 2000;
 export const MAX_REVALIDATE_QUERY_ALLOWLIST_ENTRIES: number = MAX_ROUTING_RULES;
 const MAX_PAGES = 5000;
+// Each distinct cron expression becomes one message on the platform's shared
+// cron queue, and one user-worker call, every minute it matches. The scheduler
+// dedupes only identical strings. 100 matches Vercel's per-project cap and is
+// far above what real apps declare.
+const MAX_CRON_EXPRESSIONS = 100;
+// The scheduler parses every entry, shared expression or not, on each alarm.
+const MAX_SCHEDULES = 1000;
 
 /**
  * Strict literal-hostname regex used to validate `redirectRules[].host` /
@@ -115,6 +122,10 @@ export function validateManifestShape(parsed: unknown): string | null {
     if (!Array.isArray(manifest.schedules)) {
       return 'invalid manifest shape: schedules must be an array';
     }
+    if (manifest.schedules.length > MAX_SCHEDULES) {
+      return `invalid manifest shape: schedules has ${manifest.schedules.length} entries, exceeds the ${MAX_SCHEDULES} per-project limit`;
+    }
+    const cronExpressions = new Set<string>();
     for (const schedule of manifest.schedules) {
       if (!isRecord(schedule)) {
         return 'invalid manifest shape: schedules entries must be objects';
@@ -123,6 +134,10 @@ export function validateManifestShape(parsed: unknown): string | null {
       if (typeof scheduleObject.name !== 'string' || typeof scheduleObject.cron !== 'string') {
         return 'invalid manifest shape: schedules entries must have string name and cron';
       }
+      cronExpressions.add(scheduleObject.cron);
+    }
+    if (cronExpressions.size > MAX_CRON_EXPRESSIONS) {
+      return `invalid manifest shape: schedules has ${cronExpressions.size} distinct cron expressions, exceeds the ${MAX_CRON_EXPRESSIONS} per-project limit`;
     }
   }
 
diff --git a/packages/deploy-core/test/unit/validate.test.ts b/packages/deploy-core/test/unit/validate.test.ts
index ab86933a2..ed0763511 100644
--- a/packages/deploy-core/test/unit/validate.test.ts
+++ b/packages/deploy-core/test/unit/validate.test.ts
@@ -54,3 +54,55 @@ describe('managed email protocol', () => {
     }
   });
 });
+
+describe('cron expression cap', () => {
+  const distinctCron = (i: number) => `${i % 60} ${Math.floor(i / 60)} * * *`;
+  const withCrons = (crons: Array<string>) => ({
+    version: 3,
+    bindings: {},
+    schedules: crons.map((cron, i) => ({ name: `job${i}`, cron })),
+  });
+
+  it('accepts 100 distinct expressions', () => {
+    expect(
+      validateManifestShape(withCrons(Array.from({ length: 100 }, (_, i) => distinctCron(i)))),
+    ).toBeNull();
+  });
+
+  it('counts a shared expression once', () => {
+    expect(
+      validateManifestShape(withCrons(Array.from({ length: 500 }, (_, i) => distinctCron(i % 10)))),
+    ).toBeNull();
+  });
+
+  it('rejects 101 distinct expressions', () => {
+    const result = validateManifestShape(
+      withCrons(Array.from({ length: 101 }, (_, i) => distinctCron(i))),
+    );
+    expect(result).toContain('101 distinct cron expressions');
+    expect(result).toContain('100 per-project limit');
+  });
+
+  it('counts different spellings separately', () => {
+    const crons = [
+      ...Array.from({ length: 99 }, (_, i) => distinctCron(i)),
+      '* * * * *',
+      '*  * * * *',
+    ];
+    expect(validateManifestShape(withCrons(crons))).toContain('101 distinct');
+  });
+
+  it('accepts 1000 entries sharing one expression', () => {
+    expect(
+      validateManifestShape(withCrons(Array.from({ length: 1000 }, () => '* * * * *'))),
+    ).toBeNull();
+  });
+
+  it('rejects 1001 entries sharing one expression', () => {
+    const result = validateManifestShape(
+      withCrons(Array.from({ length: 1001 }, () => '* * * * *')),
+    );
+    expect(result).toContain('1001 entries');
+    expect(result).toContain('1000 per-project limit');
+  });
+});
diff --git a/packages/edge/src/pattern.ts b/packages/edge/src/pattern.ts
index a560230f6..1060fd48e 100644
--- a/packages/edge/src/pattern.ts
+++ b/packages/edge/src/pattern.ts
@@ -237,7 +237,12 @@ export function matchSegmentPattern(pattern: string, pathname: string): boolean
  * because `compilePattern` captures anonymous `*` as `splat`.
  */
 export function substituteParams(destination: string, params: Record<string, string>): string {
-  return destination.replace(/:([A-Za-z0-9_]+)\*?/g, (whole, name: string) => {
+  const result = destination.replace(/:([A-Za-z0-9_]+)\*?/g, (whole, name: string) => {
     return params[name] ?? whole;
   });
+  // A capture can start with '/', so a path destination must stay on this site.
+  if (/^[/\\]{2}/.test(result) && !/^[/\\]{2}/.test(destination)) {
+    return '/' + result.replace(/^[/\\]+/, '');
+  }
+  return result;
 }
diff --git a/packages/edge/test/unit/runtime.test.ts b/packages/edge/test/unit/runtime.test.ts
index 886ab3fec..b3f167ef0 100644
--- a/packages/edge/test/unit/runtime.test.ts
+++ b/packages/edge/test/unit/runtime.test.ts
@@ -54,6 +54,17 @@ describe('createStaticEdgeHandler', () => {
     expect(binding.fetch).not.toHaveBeenCalled();
   });
 
+  it('keeps catch-all redirects on the same site when the capture starts with a slash', async () => {
+    const binding = assets({});
+    const response = await createStaticEdgeHandler({
+      redirectRules: [{ source: '/en/*', destination: '/:splat', status: 301 }],
+    }).fetch(new Request('https://example.com/en//evil.com'), { ASSETS: binding });
+
+    expect(response.status).toBe(301);
+    expect(response.headers.get('location')).toBe('/evil.com');
+    expect(binding.fetch).not.toHaveBeenCalled();
+  });
+
   it('rewrites before assets and exposes the original URL', async () => {
     const binding = assets({ '/new': new Response('rewritten') });
     const response = await createStaticEdgeHandler({
diff --git a/packages/isr/src/core.ts b/packages/isr/src/core.ts
index 96f917da1..2f238d2ba 100644
--- a/packages/isr/src/core.ts
+++ b/packages/isr/src/core.ts
@@ -74,6 +74,29 @@ export function buildVariantOriginalUrl(
   return url.toString();
 }
 
+/**
+ * True when the request carries a query parameter that the cache key leaves
+ * out. A render made from such a URL may depend on that parameter, so it must
+ * not be stored under the shared key.
+ */
+export function hasUnlistedQueryParams(
+  requestUrl: string,
+  pathname: string,
+  allowlist: QueryAllowlist | undefined,
+): boolean {
+  const url = new URL(requestUrl);
+  if (!url.search) {
+    return false;
+  }
+  const allowed = resolveQueryAllowlist(allowlist, pathname);
+  for (const key of url.searchParams.keys()) {
+    if (!allowed.has(key)) {
+      return true;
+    }
+  }
+  return false;
+}
+
 /** Keep only exact allowlist patterns for uncapped static-cache consumers. */
 export function exactQueryAllowlist(
   allowlist: QueryAllowlist | undefined,
diff --git a/packages/isr/src/runtime.ts b/packages/isr/src/runtime.ts
index 58c7f3779..0c6e81787 100644
--- a/packages/isr/src/runtime.ts
+++ b/packages/isr/src/runtime.ts
@@ -5,6 +5,7 @@ import {
   extractPageDataFromHtml,
   hasCurrentSharedCachePolicy,
   hasSharedCacheOptOut,
+  hasUnlistedQueryParams,
   isFrameworkDocumentRequest,
   isSharedCacheableResponse,
   isrCacheResponse,
@@ -600,8 +601,9 @@ export async function handleFrameworkIsr(
  * Run the ISR caching ladder for a request.
  *
  * Returns a cached/rendered `Response` when ISR applies, or `null` when the
- * caller should render live itself (request not ISR-eligible, or a read/hit
- * cache op failed open).
+ * caller should render live itself (request not ISR-eligible, a read/hit
+ * cache op failed open, or a cache miss for a URL carrying query params
+ * outside the allowlist).
  *
  * Ladder:
  *   - Bail (`null`) if not GET, an API path, a Range request, `shouldBypassIsr`,
@@ -670,6 +672,9 @@ async function handleIsrInternal(
   const host = url.hostname;
   const normalizedVariantUrl = buildVariantOriginalUrl(request.url, pathname, queryAllowlist);
   const variantUrl = new URL(normalizedVariantUrl).search ? normalizedVariantUrl : null;
+  // The key drops these params, but a render may still read them. Never store
+  // such a render under the shared key.
+  const unlisted = hasUnlistedQueryParams(request.url, pathname, queryAllowlist);
   const cache = edgeCache();
   const htmlKey = htmlEdgeKey(host, pathname, deploymentId, variantUrl);
   const jsonKey = jsonEdgeKey(host, pathname, deploymentId, variantUrl);
@@ -736,7 +741,14 @@ async function handleIsrInternal(
         ctx.waitUntil(
           revalidateInBackground(
             env,
-            request,
+            // Refresh from the key's own URL, not the triggering one.
+            unlisted
+              ? new Request(normalizedVariantUrl, {
+                  method: request.method,
+                  headers: request.headers,
+                  cf: request.cf,
+                })
+              : request,
             host,
             pathname,
             isrTtl,
@@ -761,7 +773,11 @@ async function handleIsrInternal(
     }
   }
 
-  // Miss: render live, cache in the background (only when cacheable).
+  // Miss: render live, cache in the background (only when cacheable). A URL
+  // with params outside the allowlist renders live without filling the cache.
+  if (unlisted) {
+    return null;
+  }
   const response = await render(request);
   if (isEventStreamResponse(response)) {
     return response;
diff --git a/packages/isr/test/unit/variant-hash.test.ts b/packages/isr/test/unit/variant-hash.test.ts
index 02908ac93..ce8da9d1d 100644
--- a/packages/isr/test/unit/variant-hash.test.ts
+++ b/packages/isr/test/unit/variant-hash.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it } from 'vite-plus/test';
+import { hasUnlistedQueryParams } from '../../src/core.ts';
 import {
   isrCacheKey,
   isrCachePrefix,
@@ -152,3 +153,44 @@ describe('ISR variant token hashing', () => {
     expect(fromToken).toBe(fromUrl);
   });
 });
+
+describe('hasUnlistedQueryParams', () => {
+  const allowlist = { '/search': ['q'], '/products/*': ['variant'] };
+
+  it('is false without a query string', () => {
+    expect(hasUnlistedQueryParams('https://h/search', '/search', allowlist)).toBe(false);
+    expect(hasUnlistedQueryParams('https://h/page?', '/page', undefined)).toBe(false);
+  });
+
+  it('is false when every param is allowlisted for the path', () => {
+    expect(hasUnlistedQueryParams('https://h/search?q=a&q=b', '/search', allowlist)).toBe(false);
+  });
+
+  it('is true when any param is outside the allowlist', () => {
+    expect(hasUnlistedQueryParams('https://h/search?q=a&utm=x', '/search', allowlist)).toBe(true);
+    expect(hasUnlistedQueryParams('https://h/page?msg=x', '/page', undefined)).toBe(true);
+    expect(hasUnlistedQueryParams('https://h/page?q=a', '/page', allowlist)).toBe(true);
+  });
+
+  it('resolves wildcard allowlist patterns', () => {
+    expect(
+      hasUnlistedQueryParams('https://h/products/shoe?variant=red', '/products/shoe', allowlist),
+    ).toBe(false);
+    expect(
+      hasUnlistedQueryParams(
+        'https://h/products/shoe?variant=red&q=a',
+        '/products/shoe',
+        allowlist,
+      ),
+    ).toBe(true);
+  });
+
+  it('treats param names case-sensitively', () => {
+    expect(hasUnlistedQueryParams('https://h/search?Q=a', '/search', allowlist)).toBe(true);
+  });
+
+  it('ignores empty separators that carry no param', () => {
+    expect(hasUnlistedQueryParams('https://h/search?&', '/search', allowlist)).toBe(false);
+    expect(hasUnlistedQueryParams('https://h/search?&q=a&', '/search', allowlist)).toBe(false);
+  });
+});
diff --git a/packages/react/src/runtime/use-form.ts b/packages/react/src/runtime/use-form.ts
index d359e58ab..1b11862ae 100644
--- a/packages/react/src/runtime/use-form.ts
+++ b/packages/react/src/runtime/use-form.ts
@@ -10,6 +10,7 @@ import {
 import {
   VoidActionError,
   getValidationErrors,
+  interpolateRouteParams,
   isAbortError,
   isEqualFormValue,
   submitAction,
@@ -67,24 +68,6 @@ export function useForm(
   defaults: Record<string, unknown>,
   options?: { params?: Record<string, string> },
 ): UntypedForm {
-  let resolvedUrl = url;
-
-  // Strip ?action query before param resolution, then re-append
-  let actionQuery = '';
-  const qIdx = resolvedUrl.indexOf('?');
-  if (qIdx !== -1) {
-    actionQuery = resolvedUrl.slice(qIdx);
-    resolvedUrl = resolvedUrl.slice(0, qIdx);
-  }
-
-  if (options?.params) {
-    for (const [key, value] of Object.entries(options.params)) {
-      resolvedUrl = resolvedUrl.replace(`:${key}`, encodeURIComponent(value));
-    }
-  }
-
-  resolvedUrl = resolvedUrl + actionQuery;
-
   const router = useContext(RouterContext);
   const [data, setDataState] = useState<Record<string, unknown>>(() => ({ ...defaults }));
   const [defaultsState, setDefaultsState] = useState<Record<string, unknown>>(() => ({
@@ -160,7 +143,9 @@ export function useForm(
 
       let result;
       try {
-        result = await submitAction(router, resolvedUrl, {
+        // Params are filled in on submit, so a param that would change the
+        // request path (such as "..") fails this submit, not the page render.
+        result = await submitAction(router, interpolateRouteParams(url, options?.params), {
           method,
           data: { ...dataRef.current },
           _resolveOnShell: true,
diff --git a/packages/solid/src/runtime/use-form.ts b/packages/solid/src/runtime/use-form.ts
index ea2e090f9..59401fc57 100644
--- a/packages/solid/src/runtime/use-form.ts
+++ b/packages/solid/src/runtime/use-form.ts
@@ -3,6 +3,7 @@ import { createStore, reconcile } from 'solid-js/store';
 import {
   VoidActionError,
   getValidationErrors,
+  interpolateRouteParams,
   isAbortError,
   isEqualFormValue,
   submitAction,
@@ -63,24 +64,6 @@ export function useForm(
   defaults: Record<string, unknown>,
   options?: { params?: Record<string, string> },
 ): UntypedForm {
-  let resolvedUrl = url;
-
-  // Strip ?action query before param resolution, then re-append
-  let actionQuery = '';
-  const qIdx = resolvedUrl.indexOf('?');
-  if (qIdx !== -1) {
-    actionQuery = resolvedUrl.slice(qIdx);
-    resolvedUrl = resolvedUrl.slice(0, qIdx);
-  }
-
-  if (options?.params) {
-    for (const [key, value] of Object.entries(options.params)) {
-      resolvedUrl = resolvedUrl.replace(`:${key}`, encodeURIComponent(value));
-    }
-  }
-
-  resolvedUrl = resolvedUrl + actionQuery;
-
   const router = useContext(RouterContext);
   // ErrorsContext provides the errors signal accessor — a reactive function
   // that returns the current global errors object. This allows useForm to
@@ -164,7 +147,9 @@ export function useForm(
         throw new Error('useForm(): requires the Void Router.');
       }
 
-      const result = await submitAction(router, resolvedUrl, {
+      // Params are filled in on submit, so a param that would change the
+      // request path (such as "..") fails this submit, not the page render.
+      const result = await submitAction(router, interpolateRouteParams(url, options?.params), {
         method,
         data: { ...data },
         ...opts,
diff --git a/packages/solid/test/unit/use-form.test.ts b/packages/solid/test/unit/use-form.test.ts
new file mode 100644
index 000000000..cd4732c32
--- /dev/null
+++ b/packages/solid/test/unit/use-form.test.ts
@@ -0,0 +1,49 @@
+import { createComponent, createRoot } from 'solid-js';
+import { describe, expect, it } from 'vite-plus/test';
+import type { VoidRouter } from 'void/pages-client';
+import { RouterContext } from '../../src/runtime/context.ts';
+import { useForm as typedUseForm } from '../../src/runtime/use-form.ts';
+
+// The public overload only accepts generated action URLs; these tests use plain paths.
+const useForm = typedUseForm as unknown as (
+  url: string,
+  defaults: Record<string, unknown>,
+  options: { params: Record<string, string> },
+) => { post(): Promise<void>; readonly pending: boolean };
+
+function renderForm(url: string, params: Record<string, string>) {
+  const visits: Array<string> = [];
+  const router = {
+    visit: async (target: string) => {
+      visits.push(target);
+      return {};
+    },
+  } as unknown as VoidRouter;
+  let form!: ReturnType<typeof useForm>;
+  // Rendering stays possible whatever the param holds; only a submit resolves it.
+  createRoot(() =>
+    createComponent(RouterContext.Provider, {
+      value: router,
+      get children() {
+        form = useForm(url, {}, { params });
+        return null;
+      },
+    }),
+  );
+  return { form, visits };
+}
+
+describe('useForm params', () => {
+  it('fills in params and keeps the action query', async () => {
+    const { form, visits } = renderForm('/users/:name/follow?action=follow', { name: 'a b/c' });
+    await form.post();
+    expect(visits).toEqual(['/users/a%20b%2Fc/follow?action=follow']);
+  });
+
+  it.each(['.', '..'])('refuses to submit when a param is %j', async (name) => {
+    const { form, visits } = renderForm('/users/:name/follow', { name });
+    await expect(form.post()).rejects.toThrow(TypeError);
+    expect(visits).toEqual([]);
+    expect(form.pending).toBe(false);
+  });
+});
diff --git a/packages/svelte/src/plugin-islands.ts b/packages/svelte/src/plugin-islands.ts
index ae8156bf4..617e6fcc8 100644
--- a/packages/svelte/src/plugin-islands.ts
+++ b/packages/svelte/src/plugin-islands.ts
@@ -268,6 +268,10 @@ export function islandsPlugin(
     },
     {
       name: 'void-svelte:islands-style',
+      // Only the build's client entry imports `?island-style` (dev CSS comes
+      // from Void's dev CSS collector), so this raw file reader never needs
+      // to run on the dev server.
+      apply: 'build',
 
       resolveId: {
         filter: { id: /\?island-style&/ },
diff --git a/packages/svelte/src/runtime/use-form.svelte.ts b/packages/svelte/src/runtime/use-form.svelte.ts
index 0071a284b..b63ba4157 100644
--- a/packages/svelte/src/runtime/use-form.svelte.ts
+++ b/packages/svelte/src/runtime/use-form.svelte.ts
@@ -2,6 +2,7 @@ import { getContext } from 'svelte';
 import {
   VoidActionError,
   getValidationErrors,
+  interpolateRouteParams,
   isAbortError,
   isEqualFormValue,
   submitAction,
@@ -57,24 +58,6 @@ export function useForm(
   defaults: Record<string, unknown>,
   options?: { params?: Record<string, string> },
 ): UntypedForm {
-  let resolvedUrl = url;
-
-  // Strip ?action query before param resolution, then re-append
-  let actionQuery = '';
-  const qIdx = resolvedUrl.indexOf('?');
-  if (qIdx !== -1) {
-    actionQuery = resolvedUrl.slice(qIdx);
-    resolvedUrl = resolvedUrl.slice(0, qIdx);
-  }
-
-  if (options?.params) {
-    for (const [key, value] of Object.entries(options.params)) {
-      resolvedUrl = resolvedUrl.replace(`:${key}`, encodeURIComponent(value));
-    }
-  }
-
-  resolvedUrl = resolvedUrl + actionQuery;
-
   const router = getContext<VoidRouter>('__void_router');
 
   let data = $state({ ...defaults });
@@ -126,7 +109,9 @@ export function useForm(
     clearError();
 
     try {
-      const result = await submitAction(router, resolvedUrl, {
+      // Params are filled in on submit, so a param that would change the
+      // request path (such as "..") fails this submit, not the page render.
+      const result = await submitAction(router, interpolateRouteParams(url, options?.params), {
         method,
         data: { ...data },
         ...opts,
diff --git a/packages/svelte/test/unit/plugin-islands.test.ts b/packages/svelte/test/unit/plugin-islands.test.ts
index a9c10e3e7..84ccd1c31 100644
--- a/packages/svelte/test/unit/plugin-islands.test.ts
+++ b/packages/svelte/test/unit/plugin-islands.test.ts
@@ -170,3 +170,30 @@ import Sidebar from "./Sidebar.svelte" with { island: "load" }
     expect(clientEntry).not.toContain('Sidebar');
   });
 });
+
+describe('islandsPlugin — island style loader', () => {
+  beforeEach(() => {
+    mkdirSync(PAGES_DIR, { recursive: true });
+  });
+
+  afterEach(() => {
+    rmSync(TMP, { recursive: true, force: true });
+  });
+
+  it('island-style loader is build-only', () => {
+    const plugin = islandsPlugin(PAGES_DIR).find(
+      (candidate) => candidate.name === 'void-svelte:islands-style',
+    );
+    expect(plugin?.apply).toBe('build');
+
+    writeFile(
+      'Card.island.svelte',
+      `<p>Card</p>
+<style>p { color: red; }</style>
+<style lang="scss">.second { color: blue; }</style>`,
+    );
+    const load = plugin!.load as HookWithHandler<(id: string) => string>;
+    const file = join(PAGES_DIR, 'Card.island.svelte');
+    expect(load.handler(`${file}?island-style&index=1&lang.css`)).toBe('.second { color: blue; }');
+  });
+});
diff --git a/packages/void/AGENTS.md b/packages/void/AGENTS.md
index bef5ae964..088c4eca1 100644
--- a/packages/void/AGENTS.md
+++ b/packages/void/AGENTS.md
@@ -98,7 +98,7 @@ generated entries must preserve the module-boundary rules below.
 
 - **Installed runtime module identity**: Keep `void` server runtime subpaths out of Vite dependency optimization. Generated entries import runtime modules by resolved file path; prebundling a bare `void/kv` creates a second `envContext` and loses request bindings. Workspace symlinks can hide this defect. The shared runtime-optimizer plugin excludes the package in server environments on every target while preserving client optimization; packed-consumer checks exercise actual npm/pnpm installations.
 - **pnpm scaffold build policy**: Keep `create-void` and `void init` aligned with the repository: `better-sqlite3: false` uses version 13's bundled Node-API binaries; `esbuild`, `sharp`, and `workerd` have approved builds. Do not require an unnecessary node-gyp rebuild in fresh applications.
-- **Prerender discovery and environment validation**: Only `POST /__void/prerender-paths` bypasses whole-schema boot validation, because path discovery runs without remote production secrets. Preserve its existing token check, and keep validation on readiness, application requests, page rendering, and event handlers.
+- **Prerender discovery and environment validation**: Only `POST /__void/prerender-paths` bypasses whole-schema boot validation, because path discovery runs without remote production secrets. Discovery answers only when the build-time runner marks the request (the `__VOID_PRERENDER` Miniflare binding on Cloudflare, the Hono env argument on Node/Bun/Deno), never on a deployed app or dev server. Keep validation on readiness, application requests, page rendering, and event handlers.
 - **Pre-resolved paths in codegen**: Generated virtual module code uses absolute paths for `hono` and `void/response` (resolved via `import.meta.resolve()`). Virtual modules have no filesystem location, so bare specifiers can't resolve from them.
 - **CF plugin API**: Worker config (`main`, `d1_databases`, `kv_namespaces`, `r2_buckets`) goes inside the `config` option of `cloudflare()`, NOT as top-level properties. `persistState` takes `{ path: string }`, not a raw string. The `config` option uses a **function form** `(resolved: WorkerConfig) => Partial<WorkerConfig>` so that bindings from the user's `wrangler.json` (if present) take precedence over inferred placeholder bindings.
 - **Direct deploy package boundary**: target-neutral intents, artifacts, resources, migrations, and Durable Object plans live in public `@void/deploy-core`; root Wrangler config parsing and verified Cloudflare upload primitives live in public `@void/deploy-cloudflare`. The CLI consumes both packages directly. Hosted platform packages consume `@void/deploy-core` and must not be imported by public SDK packages.
@@ -198,6 +198,7 @@ production functions and real generated entries rather than copied code.
 - **Workers AI has no local emulator.** For a saved direct Cloudflare destination, `shouldBindWorkersAi()` injects the owner's remote AI binding during development and preview, using the same Cloudflare credentials as the CLI. Production builds use the normal AI binding. The root `ai.binding` takes precedence over `inference.bindings.ai`, with `AI` as the default name; `__VOID_AI_BINDING` records a custom runtime name. Managed and unsaved projects keep the Void proxy path during development. Apps without inferred AI usage must perform no AI authentication or entitlement probe.
 - **`mergeBindings` may remove a generated Cloudflare entry only under the name Void itself writes, gated on the matching `needs*` flag.** The Cloudflare plugin `defu`-merges the returned patch over `resolved` (arrays concatenate, `undefined` is skipped), so the only way to drop a key is to mutate `resolved` — and a mutation there is a change to the user's own config, which the CF-plugin-API rule above says takes precedence. The `send_email` serve-strip once deleted the whole field, so an app that drove Cloudflare's email API through its own `send_email: [{ name: "MAILER" }]` without ever importing `void/email` started `void dev` with `env.MAILER` undefined. It now filters out only the reserved `SEND_EMAIL` entry (`SEND_EMAIL_BINDING` from `cli/email-cloudflare.ts`, the name `void deploy --platform cloudflare` writes and the runtime reads), only when `bindings.needsEmail` — the same signal that arms the dev inbox — and drops the key only when nothing is left. `test/unit/plugin-email-config.test.ts` runs the real closure through a mocked `cloudflare()`.
 - **Every `/__void/inbox` route requires the dev-trigger token; the worker's capture POST carries it via a var.** Vite's host validation (`server.allowedHosts`, runs before plugin middlewares) only rejects DNS-rebinding hostnames — any IP-literal `Host` passes — and its default CORS reflects every `localhost` origin, so an unauthenticated inbox middleware hands every peer under `--host` (and every other local dev server) the raw MIME with Bcc and attachments, a DELETE, and a capture endpoint to plant messages. `plugin-email-dev-inbox.ts` therefore checks the same per-project token the cron/queue dev routes and the pages dev-CSS loopback use (`getOrCreateDevTriggerToken`, `.void/dev-trigger-token`), accepted as the `x-void-dev-trigger` header (worker, curl) or `?token=` (browser — the plugin prints the tokenized URL on `listening` and renders its own links with it; responses already send `Referrer-Policy: no-referrer`). Missing or wrong → `401` with a one-line body naming both forms and no ack header. The compiled router embeds the token as a module-local const that `runtime/email.ts` cannot import, so `mergeBindings` injects `__VOID_EMAIL_DEV_INBOX_TOKEN` next to `__VOID_EMAIL_DEV_INBOX` under the one `shouldInjectEmailDevInboxVar` gate (dev only — never in a build's `wrangler.json`); `sendEmail` sends it and, on a non-2xx, echoes the first line of the dev server's body so a missing token is diagnosable. Nothing on the worker side ever skips the inbox for a real transport because the token is absent. Because that file is now the inbox's whole credential and loopback needs no `--host`, `getOrCreateDevTriggerToken` creates it `0600` (`openSync(.., 'wx', 0o600)`) and best-effort `chmod`s a pre-existing file whose group/other bits are set, never rotating it (skipped on Windows, which has no such bits) — a default-umask `0644` file would hand every other account on a shared host the raw MIME, the DELETE, and the capture endpoint. `.void/dev-triggers.ts` (`plugin-framework-triggers.ts`) embeds the same token for Class A frameworks and is written `0600` the same way. `/__void/ping` stays open: it exposes no data. `/__void/restart` answers `403` unless the POST is same-origin (`Sec-Fetch-Site`, else `Origin`) and carries this server instance's random token in `x-void-restart` — browsers send no Fetch Metadata to plain-HTTP LAN origins (`--host`), so the token, embedded only in the `virtual:void/binding-hint` toast (which navigates with `&t=`; Vite's default CORS exposes it to localhost origins only, like the HMR token), is what stops a foreign page from opening `/__void/restarting` and riding its auto-POST. `/__void/restarting` refuses a navigation whose `Sec-Fetch-Site` is not `same-origin` or `none`, sends `Referrer-Policy: no-referrer`, and only navigates to a same-origin path from `?return=`, falling back to `/`.
+- **The dev server never serves the dev-trigger token or old database URLs.** Vite serves any root file not in `server.fs.deny`, and its CORS lets every localhost origin read the reply. `devTriggerSecretGuardPlugin` (`plugin-dev-config.ts`, registered in every serve plugin list) therefore answers 404 to `.void/dev-trigger*`, to Nitro dev bundles (`.nuxt/dev/`, `.nitro/dev/`, which inline the dispatch), to Astro's `.astro/dev.log` (background `astro dev` output, which includes the startup hint) and to `.void/drizzle.config.json` (older CLI versions left `db push` / `db studio` database URLs there; only drizzle-kit reads it) in any URL form, and `void:routing` refuses `virtual:void-routes` in the client environment. Do not switch to `server.fs.deny`: a plugin's list replaces Vite's defaults, and denying `.void/dev-triggers.ts` breaks the worker import.
 
 - **Sandbox SDK 1.0**: Keep the packaged Dockerfile helper version and the managed controller’s verified helper-layer digest in sync with `@cloudflare/sandbox`. Native execution uses Durable Object scheduling with named images; managed controller protocol 2 preserves admission, metering, and cleanup, including retained protocol 1 deployments. Cancellation crosses Workers RPC as a stream, not an AbortSignal. Run the Sandbox RPC and lifecycle tests when changing this boundary.
 
diff --git a/packages/void/schema.json b/packages/void/schema.json
index 69b95f699..3921f17e3 100644
--- a/packages/void/schema.json
+++ b/packages/void/schema.json
@@ -212,7 +212,7 @@
         },
         "revalidateQueryAllowlist": {
           "type": "object",
-          "description": "Query parameters that participate in ISR variant keys for dispatch rewrites. Keys are source URL patterns; values are arrays of query parameter names. When omitted, rewritten ISR drops every query parameter from the variant key.",
+          "description": "Query parameters that are part of the ISR cache key for every request to a matching path. Keys are source URL patterns; values are arrays of query parameter names. All other query parameters are left out of the key. When omitted, ISR drops every query parameter from the cache key.",
           "patternProperties": {
             "^(\\/|\\*$)": {
               "type": "array",
diff --git a/packages/void/src/cli/cloudflare-operation-process.ts b/packages/void/src/cli/cloudflare-operation-process.ts
index 5b6905611..f45e63ddd 100644
--- a/packages/void/src/cli/cloudflare-operation-process.ts
+++ b/packages/void/src/cli/cloudflare-operation-process.ts
@@ -18,6 +18,7 @@ import {
   printCloudflareLoginLink,
   printCloudflareLoginPrompt,
 } from './cloudflare-login-output.ts';
+import { sanitizeTerminalLogText } from './terminal-log-text.ts';
 
 type Result = {
   status: number;
@@ -1180,20 +1181,23 @@ async function tail(): Promise<Result> {
                   : typeof detail.mailFrom === 'string'
                     ? `Email from ${detail.mailFrom}`
                     : 'Worker event';
+            // Request URLs, log lines and exceptions carry data from app visitors,
+            // so terminal control sequences are dropped before printing.
             process.stdout.write(
-              `${prefix} - ${log.outcome ?? 'unknown'} @ ${new Date(Number(log.eventTimestamp)).toLocaleString()}\n`,
+              `${sanitizeTerminalLogText(prefix)} - ${log.outcome ?? 'unknown'} @ ${new Date(Number(log.eventTimestamp)).toLocaleString()}\n`,
             );
             if (Array.isArray(log.logs)) {
               for (const line of log.logs.map(object)) {
+                const message = Array.isArray(line.message) ? line.message.join(' ') : '';
                 process.stdout.write(
-                  `  (${line.level ?? 'log'}) ${Array.isArray(line.message) ? line.message.join(' ') : ''}\n`,
+                  `  (${line.level ?? 'log'}) ${sanitizeTerminalLogText(message)}\n`,
                 );
               }
             }
             if (Array.isArray(log.exceptions)) {
               for (const exception of log.exceptions.map(object)) {
                 process.stderr.write(
-                  `  ${exception.name ?? 'Error'}: ${exception.message ?? ''}\n`,
+                  `  ${sanitizeTerminalLogText(`${exception.name ?? 'Error'}: ${exception.message ?? ''}`)}\n`,
                 );
               }
             }
diff --git a/packages/void/src/cli/db.ts b/packages/void/src/cli/db.ts
index 72452b59e..3cee30a1a 100644
--- a/packages/void/src/cli/db.ts
+++ b/packages/void/src/cli/db.ts
@@ -78,6 +78,32 @@ function runDrizzleKit(root: string, args: Array<string>): void {
   });
 }
 
+/**
+ * Run a drizzle-kit command against a real database URL. The config holding
+ * the URL lives in a private temp directory outside the project and is
+ * removed afterwards. Exits with code 1 when drizzle-kit fails; it has
+ * already printed its own error.
+ */
+async function runDrizzleKitWithDatabaseUrl(
+  root: string,
+  url: string,
+  dialect: DatabaseDialect,
+  command: 'push' | 'studio',
+): Promise<void> {
+  const { withPrivateDrizzleConfig } = await import('../drizzle/config.ts');
+  const succeeded = withPrivateDrizzleConfig(root, url, dialect, (configPath) => {
+    try {
+      runDrizzleKit(root, [command, '--config', configPath]);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+  if (!succeeded) {
+    process.exit(1);
+  }
+}
+
 type SeedTarget = {
   displayPath: string;
   kind: 'module' | 'sql';
@@ -358,20 +384,20 @@ async function runConnect(
 }
 
 async function runPush(root: string, dialect: DatabaseDialect): Promise<void> {
-  const { writeDrizzleConfig } = await import('../drizzle/config.ts');
-
-  let configPath: string;
   if (dialect !== 'sqlite') {
     const url = dialect === 'mysql' ? getMySqlUrl(root) : getPgUrl(root);
-    configPath = writeDrizzleConfig(root, url, dialect);
-  } else {
-    const { mkdirSync } = await import('node:fs');
-    const { dirname } = await import('pathslash');
-    const { databasePath: dbPath } = getLocalD1Target(root);
-    mkdirSync(dirname(dbPath), { recursive: true });
-    configPath = writeDrizzleConfig(root, dbPath);
+    await runDrizzleKitWithDatabaseUrl(root, url, dialect, 'push');
+    printSuccess('Database schema pushed.');
+    return;
   }
 
+  const { writeDrizzleConfig } = await import('../drizzle/config.ts');
+  const { mkdirSync } = await import('node:fs');
+  const { dirname } = await import('pathslash');
+  const { databasePath: dbPath } = getLocalD1Target(root);
+  mkdirSync(dirname(dbPath), { recursive: true });
+  const configPath = writeDrizzleConfig(root, dbPath);
+
   try {
     runDrizzleKit(root, ['push', '--config', configPath]);
   } catch {
@@ -1370,29 +1396,16 @@ async function runStudio(root: string, dialect: DatabaseDialect, remote?: boolea
       dbUrl = await fetchRemoteDatabaseUrl(client, projectConfig.projectId);
     }
 
-    const { writeDrizzleConfig } = await import('../drizzle/config.ts');
-    const configPath = writeDrizzleConfig(root, dbUrl, dialect);
-
     log.info('Opening Drizzle Studio (remote)...');
-    try {
-      runDrizzleKit(root, ['studio', '--config', configPath]);
-    } catch {
-      process.exit(1);
-    }
+    await runDrizzleKitWithDatabaseUrl(root, dbUrl, dialect, 'studio');
     return;
   }
 
   if (dialect !== 'sqlite') {
-    const { writeDrizzleConfig } = await import('../drizzle/config.ts');
     const url = dialect === 'mysql' ? getMySqlUrl(root) : getPgUrl(root);
-    const configPath = writeDrizzleConfig(root, url, dialect);
 
     log.info('Opening Drizzle Studio...');
-    try {
-      runDrizzleKit(root, ['studio', '--config', configPath]);
-    } catch {
-      process.exit(1);
-    }
+    await runDrizzleKitWithDatabaseUrl(root, url, dialect, 'studio');
     return;
   }
 
diff --git a/packages/void/src/cli/logs.ts b/packages/void/src/cli/logs.ts
index c1f437a00..0dc9f0379 100644
--- a/packages/void/src/cli/logs.ts
+++ b/packages/void/src/cli/logs.ts
@@ -3,6 +3,7 @@ import { getToken } from './auth.ts';
 import { PlatformClient, type LogEntry } from './client.ts';
 import { dim, formatCount, pc } from './output.ts';
 import { readDeploymentPlatform, readProjectConfig } from './project.ts';
+import { sanitizeTerminalLogText } from './terminal-log-text.ts';
 
 export async function runLogsCommand(
   root: string,
@@ -83,11 +84,12 @@ export async function runLogsCommand(
   outro(dim(formatCount(entries.length, 'log entry', 'log entries')));
 }
 
+// Logs carry data from app visitors, so terminal control sequences are dropped before printing.
 function printEntry(entry: LogEntry): void {
   const time = formatTime(entry.timestamp);
-  const method = entry.method || '-';
-  const url = entry.url || '-';
-  const status = entry.status || '-';
+  const method = sanitizeTerminalLogText(entry.method || '-');
+  const url = sanitizeTerminalLogText(entry.url || '-');
+  const status = sanitizeTerminalLogText(entry.status || '-');
 
   const statusNum = parseInt(status, 10);
   const coloredStatus =
@@ -107,7 +109,7 @@ function printEntry(entry: LogEntry): void {
   );
 
   for (const l of entry.logs) {
-    const text = l.message.map(String).join(' ');
+    const text = sanitizeTerminalLogText(l.message.map(String).join(' '));
     const level = l.level ?? 'log';
     const marker =
       level === 'error'
@@ -124,7 +126,7 @@ function printEntry(entry: LogEntry): void {
     console.log(
       wrapTextWithPrefix(
         process.stdout,
-        `${ex.name}: ${ex.message}`,
+        sanitizeTerminalLogText(`${ex.name}: ${ex.message}`),
         ' '.repeat(14),
         `  ${pc.red('[exception]')} `,
       ),
diff --git a/packages/void/src/cli/operator-cmd.ts b/packages/void/src/cli/operator-cmd.ts
index 04ad43d29..15be1cc12 100644
--- a/packages/void/src/cli/operator-cmd.ts
+++ b/packages/void/src/cli/operator-cmd.ts
@@ -11,7 +11,7 @@ import {
   saveOperatorToken,
 } from './operator-auth.ts';
 import { OperatorClient, OperatorClientError } from './operator-client.ts';
-import { printSuccess } from './output.ts';
+import { printSuccess, sanitizeTerminalText } from './output.ts';
 
 const MAX_RUNTIME_FOLLOW_ROWS = 10_000;
 export const BUILD_LOG_DRAIN_TIMEOUT_MS: number = 2 * 60_000;
@@ -22,11 +22,11 @@ function printable(value: unknown): string {
   }
   if (typeof value === 'string') {
     // Tenant text must not execute terminal control sequences.
-    // eslint-disable-next-line no-control-regex
-    return value.replace(/[\u0000-\u001f\u007f]/g, ' ');
+    return sanitizeTerminalText(value);
   }
   if (typeof value === 'object') {
-    return JSON.stringify(value);
+    // JSON escapes C0 controls but leaves C1 controls such as U+009B (CSI) raw.
+    return sanitizeTerminalText(JSON.stringify(value));
   }
   return String(value);
 }
diff --git a/packages/void/src/cli/package.ts b/packages/void/src/cli/package.ts
index 6dd09bbcc..033fd503e 100644
--- a/packages/void/src/cli/package.ts
+++ b/packages/void/src/cli/package.ts
@@ -364,7 +364,7 @@ export type PackageOptions = {
   sandbox?: ResolvedSandboxConfig;
   /** Resolved void/live Durable Object binding and class names. */
   live?: LiveBindingConfig;
-  /** Query params that participate in ISR variant keys for dispatch rewrites. */
+  /** Query params kept in the ISR cache key for every request to a matching path; all others are left out. */
   revalidateQueryAllowlist?: Record<string, Array<string>>;
 };
 
diff --git a/packages/void/src/cli/terminal-log-text.ts b/packages/void/src/cli/terminal-log-text.ts
new file mode 100644
index 000000000..276f5baa2
--- /dev/null
+++ b/packages/void/src/cli/terminal-log-text.ts
@@ -0,0 +1,38 @@
+// A whole CSI sequence (ESC [, parameter bytes, intermediate bytes, final byte),
+// a whole OSC sequence of printable text ended by BEL or ESC \, or one C0/C1
+// control character other than tab and newline.
+const TERMINAL_CONTROL =
+  // eslint-disable-next-line no-control-regex -- matching control characters is the point
+  /\u001b\[[0-?]*[ -/]*[@-~]|\u001b\][^\u0000-\u001f\u007f-\u009f]*(?:\u0007|\u001b\\)|[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g;
+// eslint-disable-next-line no-control-regex -- matching control characters is the point
+const SGR = /^\u001b\[[0-9;:]*m$/;
+
+/**
+ * Make app log text safe to print to a terminal. App logs often echo request
+ * data from anonymous visitors, so escape sequences in them must not reach the
+ * terminal as commands (clipboard writes, hyperlinks, screen clears, cursor
+ * moves or carriage-return overwrites).
+ *
+ * SGR color codes, newlines and tabs are kept so ordinary colored or
+ * multi-line logs read the same. A text that keeps any SGR code ends with a
+ * reset, so styles such as conceal cannot hide the lines printed after it.
+ * Every other complete CSI or OSC sequence is removed whole, so a hyperlink
+ * shows only its visible text and a line clear leaves no stray "[K". Every
+ * other C0/C1 control character is dropped on its own; an escape sequence that
+ * is incomplete, such as an OSC with no terminator, loses only its control
+ * characters and the rest prints as plain text instead of being swallowed.
+ *
+ * Keep this module free of imports: the Cloudflare operation process is a
+ * separate bundle entry that must stay small.
+ */
+export function sanitizeTerminalLogText(value: string): string {
+  let keptStyle = false;
+  const text = value.replace(TERMINAL_CONTROL, (match) => {
+    if (!SGR.test(match)) {
+      return '';
+    }
+    keptStyle = true;
+    return match;
+  });
+  return keptStyle ? `${text}\u001b[0m` : text;
+}
diff --git a/packages/void/src/drizzle/config.ts b/packages/void/src/drizzle/config.ts
index d8043f8a6..02f773639 100644
--- a/packages/void/src/drizzle/config.ts
+++ b/packages/void/src/drizzle/config.ts
@@ -1,20 +1,27 @@
-import { mkdirSync, writeFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { join, relative } from 'pathslash';
 import { readProjectPaths } from '../project-paths.ts';
 import { discoverSchema, schemaSpecifier } from './discover.ts';
 
+type DrizzleDialect = 'sqlite' | 'postgresql' | 'mysql';
+
 /**
- * Write a temporary drizzle-kit config to `.void/drizzle.config.json`.
- * All paths are relative to the project root (drizzle-kit resolves
- * relative to `--config` file location, so we use project-root-relative).
+ * Write a temporary drizzle-kit config, by default to `.void/drizzle.config.json`.
+ * Schema and migration paths are relative to the project root: drizzle-kit
+ * resolves them against its working directory, and `void db` always runs it
+ * with `cwd` set to the project root, so the config file itself may live
+ * anywhere (see `outDir`).
  *
+ * @param options.outDir Directory for the config file. When set, the file is
+ *   written readable by the owner only.
  * @returns Absolute path to the written config file.
  */
 export function writeDrizzleConfig(
   root: string,
   dbPath: string,
-  dialect: 'sqlite' | 'postgresql' | 'mysql' = 'sqlite',
-  options?: { additionalSchemas?: Array<string> },
+  dialect: DrizzleDialect = 'sqlite',
+  options?: { additionalSchemas?: Array<string>; outDir?: string },
 ): string {
   const paths = readProjectPaths(root);
   const schema = discoverSchema(root, paths);
@@ -28,7 +35,7 @@ export function writeDrizzleConfig(
     );
   }
 
-  const outDir = join(root, '.void');
+  const outDir = options?.outDir ?? join(root, '.void');
   mkdirSync(outDir, { recursive: true });
 
   const config = {
@@ -40,6 +47,63 @@ export function writeDrizzleConfig(
   };
 
   const configPath = join(outDir, 'drizzle.config.json');
-  writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
+  writeFileSync(
+    configPath,
+    JSON.stringify(config, null, 2) + '\n',
+    options?.outDir ? { mode: 0o600 } : undefined,
+  );
   return configPath;
 }
+
+/**
+ * Run `run` with a drizzle-kit config that holds a real database URL, kept
+ * out of the project directory (the dev server can serve files under it).
+ * The config lives in a private temp directory that is removed afterwards.
+ *
+ * Older CLI versions wrote such URLs to `.void/drizzle.config.json`; a
+ * file left there with one is removed first.
+ *
+ * A no-op SIGINT listener stays installed while `run` executes: Drizzle
+ * Studio is stopped with Ctrl-C, and without a listener Node would exit on
+ * the signal before `finally` removes the directory.
+ */
+export function withPrivateDrizzleConfig<T>(
+  root: string,
+  dbUrl: string,
+  dialect: DrizzleDialect,
+  run: (configPath: string) => T,
+): T {
+  removeProjectDrizzleConfigWithUrl(root);
+  const dir = mkdtempSync(join(tmpdir(), 'void-drizzle-'));
+  const noop = () => {};
+  process.on('SIGINT', noop);
+  try {
+    const configPath = writeDrizzleConfig(root, dbUrl, dialect, { outDir: dir });
+    return run(configPath);
+  } finally {
+    process.off('SIGINT', noop);
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+/**
+ * The CLI now writes only local SQLite paths or placeholder URLs to
+ * `.void/drizzle.config.json`, so any other URL there is a real one.
+ */
+function removeProjectDrizzleConfigWithUrl(root: string): void {
+  const configPath = join(root, '.void', 'drizzle.config.json');
+  let url: unknown;
+  try {
+    url = JSON.parse(readFileSync(configPath, 'utf-8'))?.dbCredentials?.url;
+  } catch {
+    return;
+  }
+  if (
+    typeof url === 'string' &&
+    url.includes('://') &&
+    url !== 'postgresql://dummy' &&
+    url !== 'mysql://dummy'
+  ) {
+    rmSync(configPath, { force: true });
+  }
+}
diff --git a/packages/void/src/index.ts b/packages/void/src/index.ts
index dbd96412f..5277dec3c 100644
--- a/packages/void/src/index.ts
+++ b/packages/void/src/index.ts
@@ -39,6 +39,7 @@ import {
   warnIfPackageJsonIsNotEsm,
   isViteBuildOrPreview,
   getOrCreateDevTriggerToken,
+  devTriggerSecretGuardPlugin,
 } from './plugin-dev-config.ts';
 import { devTriggersHintPlugin } from './plugin-dev-triggers-hint.ts';
 import { drizzlePlugin } from './plugin-drizzle.ts';
@@ -797,6 +798,7 @@ export function voidPlugin(options?: {
         ...(viteEnvironment.childEnvironments ?? []),
       ]),
       createWranglerCompatPersistPlugin(root, config),
+      devTriggerSecretGuardPlugin(),
       restartPlugin(),
       bindingWatchPlugin,
       ...(bindings.needsEmail ? [emailDevInboxPlugin({ devTriggerToken })] : []),
@@ -884,6 +886,7 @@ export function voidPlugin(options?: {
     }
 
     return [
+      devTriggerSecretGuardPlugin(),
       restartPlugin(),
       envPlugin,
       serverRuntimeOptimizerPlugin,
@@ -1010,6 +1013,7 @@ export function voidPlugin(options?: {
     createDefaultWorkerEnvironmentPlugin(),
     createWorkerEnvironmentSanitizerPlugin([DEFAULT_WORKER_ENVIRONMENT_NAME]),
     createWranglerCompatPersistPlugin(root, config),
+    devTriggerSecretGuardPlugin(),
     restartPlugin(),
     bindingWatchPlugin,
     ...(bindings.needsEmail ? [emailDevInboxPlugin({ devTriggerToken })] : []),
diff --git a/packages/void/src/pages/client.ts b/packages/void/src/pages/client.ts
index 147effc04..57b011e87 100644
--- a/packages/void/src/pages/client.ts
+++ b/packages/void/src/pages/client.ts
@@ -26,6 +26,7 @@ export {
 } from './action-result.ts';
 export type { ActionErrorHandlingScope, ActionResult } from './action-result.ts';
 export { isEqualFormValue } from './form-value-equality.ts';
+export { interpolateRouteParams };
 export {
   createPageNavigationEngine,
   hasFiles,
diff --git a/packages/void/src/pages/navigation-engine.ts b/packages/void/src/pages/navigation-engine.ts
index c3319f13f..9275378b8 100644
--- a/packages/void/src/pages/navigation-engine.ts
+++ b/packages/void/src/pages/navigation-engine.ts
@@ -594,6 +594,21 @@ export async function createPageNavigationEngine(
     commitTarget: { fetchUrl: string; hash: string },
     deferredRegistry: DeferredRegistry,
   ): Promise<PageNavigationResult | undefined> {
+    // Page data only comes from this origin. Other http(s) URLs get a full page
+    // load; other schemes (javascript:, data:, ...) must never reach location.href.
+    // Check the scheme first: a blob: URL reports the origin that created it.
+    const target = new URL(url, window.location.origin);
+    if (target.protocol !== 'http:' && target.protocol !== 'https:') {
+      throw new Error(`Void Router: refusing to navigate to a ${target.protocol} URL.`);
+    }
+    if (target.origin !== window.location.origin) {
+      if (method !== 'GET') {
+        throw new Error('Void Router: non-GET visits must target the current origin.');
+      }
+      window.location.href = url;
+      return undefined;
+    }
+
     if (method !== 'GET') {
       _prefetchCache.flushAll();
     }
diff --git a/packages/void/src/pages/protocol.ts b/packages/void/src/pages/protocol.ts
index 69622f13f..ef3583090 100644
--- a/packages/void/src/pages/protocol.ts
+++ b/packages/void/src/pages/protocol.ts
@@ -63,6 +63,8 @@ type PageHeadHandler =
   | undefined;
 type PageRenderOptions = {
   renderMode?: PageRenderMode;
+  /** Dev server build: rejected deferred props keep their raw error message. */
+  dev?: boolean;
 };
 type AssetTags = {
   css: string;
@@ -341,12 +343,33 @@ function renderedResponse(
   });
 }
 
+/**
+ * Message sent to the browser for a rejected deferred prop. HTTPException
+ * messages are deliberate and pass through, as in the page error handler.
+ * Anything else is logged and, outside dev, replaced with a generic message so
+ * internal details (SQL, hostnames, URLs) do not reach the page.
+ */
+function deferredErrorMessage(err: unknown, dev: boolean): string {
+  const message = err instanceof Error ? err.message : String(err);
+  if (
+    err &&
+    typeof err === 'object' &&
+    'getResponse' in err &&
+    typeof err.getResponse === 'function'
+  ) {
+    return message;
+  }
+  console.error(err);
+  return dev ? message : 'Internal Server Error';
+}
+
 /** Build a streaming response that sends an initial chunk then streams deferred results. */
 function streamDeferredResponse(
   initialChunk: PageRenderResult,
   deferredMap: Record<string, ResolvedDeferredGroup>,
   c: CloudContext,
   contentType: string,
+  dev: boolean,
   formatResolved: (group: string, data: unknown) => string,
   formatRejected: (group: string, error: string) => string,
   assetTags?: AssetTags,
@@ -359,9 +382,7 @@ function streamDeferredResponse(
   const pendingChunks = entries.map(([group, { resolver }]) =>
     resolver(c)
       .then((data) => formatResolved(group, data))
-      .catch((err: unknown) =>
-        formatRejected(group, err instanceof Error ? err.message : String(err)),
-      ),
+      .catch((err: unknown) => formatRejected(group, deferredErrorMessage(err, dev))),
   );
 
   (async () => {
@@ -486,6 +507,7 @@ export async function handlePageGet(
       deferredMap,
       c,
       'application/x-ndjson',
+      options?.dev === true,
       (group, data) => JSON.stringify({ __deferred: group, data }) + '\n',
       (group, error) => JSON.stringify({ __deferred: group, error }) + '\n',
     );
@@ -510,6 +532,7 @@ export async function handlePageGet(
     deferredMap,
     c,
     'text/html; charset=utf-8',
+    options?.dev === true,
     (group, data) =>
       `\n<script>window.__resolveDeferred?window.__resolveDeferred(${safeJsonStringify(group)},${safeJsonStringify(data)}):(window.__deferredQueue??=[]).push([${safeJsonStringify(group)},${safeJsonStringify(data)}])</script>`,
     (group, error) =>
diff --git a/packages/void/src/plugin-dev-config.ts b/packages/void/src/plugin-dev-config.ts
index 81905ec19..2b98a75e9 100644
--- a/packages/void/src/plugin-dev-config.ts
+++ b/packages/void/src/plugin-dev-config.ts
@@ -9,7 +9,7 @@ import {
   writeSync,
 } from 'node:fs';
 import { join } from 'pathslash';
-import type { ViteDevServer } from 'vite';
+import type { Plugin, ViteDevServer } from 'vite';
 import { voidWarn } from './log.ts';
 
 /** Run `fn` shortly after Vite prints "ready" so dev messages stay visible. */
@@ -116,6 +116,65 @@ export function getOrCreateDevTriggerToken(root: string): string {
   }
 }
 
+// Request paths that would return the dev-trigger token: `.void/dev-trigger-token`,
+// the generated `.void/dev-triggers.ts`, Nitro's dev bundle (`.nuxt/dev/` for
+// Nuxt, `dist/.nitro/dev/` for Analog), which inlines that module, and Astro's
+// `.astro/dev.log`, which records the startup hint when `astro dev` runs in the
+// background (`--background`, or started by a coding agent). Also
+// `.void/drizzle.config.json`, where older CLI versions wrote database URLs.
+// Matched anywhere in the decoded, lower-cased path so `/@fs/<abs>/`, `/@id/`,
+// a base such as `/_nuxt/`, case-insensitive file systems, dot segments, `//`,
+// `%2e`, `\` and Windows trailing dots/spaces all hit.
+const DEV_TRIGGER_SECRET_PATH_RE =
+  /(?:^|\/)\.void[. ]*\/(?:.*\/)?(?:dev-trigger|drizzle\.config\.json)|(?:^|\/)\.(?:nuxt|nitro)[. ]*\/(?:.*\/)?dev\/|(?:^|\/)\.astro[. ]*\/(?:.*\/)?dev\.log/;
+
+export function isDevTriggerSecretRequest(url: string | undefined): boolean {
+  if (!url) {
+    return false;
+  }
+  let path = url.split(/[?#]/, 1)[0] ?? '';
+  for (let i = 0; i < 3; i++) {
+    let decoded: string;
+    try {
+      decoded = decodeURIComponent(path);
+    } catch {
+      break;
+    }
+    if (decoded === path) {
+      break;
+    }
+    path = decoded;
+  }
+  return DEV_TRIGGER_SECRET_PATH_RE.test(path.replaceAll('\\', '/').toLowerCase());
+}
+
+/**
+ * Vite serves every root file that `server.fs.deny` does not list, and its default
+ * CORS lets any localhost origin read the reply, so the files above would hand their
+ * secrets to `--host` peers, other local accounts and other local dev servers.
+ * `server.fs.deny` is not used: a plugin's list replaces Vite's defaults, and the
+ * Cloudflare worker environment applies the same check when it imports
+ * `.void/dev-triggers.ts`. The middleware is added in configureServer, so it runs
+ * before Vite's transform, /@fs/ and static middlewares.
+ */
+export function devTriggerSecretGuardPlugin(): Plugin {
+  return {
+    name: 'void:dev-trigger-secret-guard',
+    apply: 'serve',
+    enforce: 'pre',
+    configureServer(server) {
+      server.middlewares.use((req, res, next) => {
+        if (!isDevTriggerSecretRequest(req.url)) {
+          next();
+          return;
+        }
+        res.statusCode = 404;
+        res.end('Not Found');
+      });
+    },
+  };
+}
+
 /**
  * Warn when the project's `package.json` does not declare `"type": "module"`.
  *
diff --git a/packages/void/src/plugin-framework-triggers.ts b/packages/void/src/plugin-framework-triggers.ts
index c62d32bb9..4e506958c 100644
--- a/packages/void/src/plugin-framework-triggers.ts
+++ b/packages/void/src/plugin-framework-triggers.ts
@@ -471,6 +471,22 @@ export function analogDevTriggerInjectPlugin(root: string): Plugin {
           next();
           return;
         }
+        // Target the address this dev server is bound to. The request Host
+        // header comes from the client and must not choose where the proxy
+        // sends the request.
+        const address = server.httpServer?.address();
+        if (!address || typeof address !== 'object') {
+          next();
+          return;
+        }
+        const hostname =
+          address.address === '0.0.0.0'
+            ? '127.0.0.1'
+            : address.address === '::'
+              ? 'localhost'
+              : address.address.includes(':')
+                ? `[${address.address}]`
+                : address.address;
         try {
           const chunks: Array<Buffer> = [];
           for await (const chunk of req) {
@@ -485,12 +501,14 @@ export function analogDevTriggerInjectPlugin(root: string): Plugin {
               headers.set(key, value.join(', '));
             }
           }
-          const host = req.headers.host ?? 'localhost';
-          const upstream = await fetch(`http://${host}/api/__void/${match.file}`, {
-            method: 'POST',
-            headers,
-            body,
-          });
+          const upstream = await fetch(
+            `http://${hostname}:${address.port}/api/__void/${match.file}`,
+            {
+              method: 'POST',
+              headers,
+              body,
+            },
+          );
           res.statusCode = upstream.status;
           upstream.headers.forEach((value, key) => res.setHeader(key, value));
           res.end(Buffer.from(await upstream.arrayBuffer()));
diff --git a/packages/void/src/plugin-framework.ts b/packages/void/src/plugin-framework.ts
index f568f419d..7b35340bb 100644
--- a/packages/void/src/plugin-framework.ts
+++ b/packages/void/src/plugin-framework.ts
@@ -12,6 +12,7 @@ import { readConfig } from './config.ts';
 import { resolveLocalD1Target } from './local-d1.ts';
 import { voidLog } from './log.ts';
 import { bindingRuntimePlugin } from './plugin-binding-runtime.ts';
+import { devTriggerSecretGuardPlugin } from './plugin-dev-config.ts';
 import { devTriggersHintPlugin } from './plugin-dev-triggers-hint.ts';
 import { drizzlePlugin } from './plugin-drizzle.ts';
 import { envClientFoldPlugin } from './plugin-env-client-fold.ts';
@@ -200,6 +201,7 @@ export function createFrameworkPlugins(input: {
   };
 
   return [
+    devTriggerSecretGuardPlugin(),
     createCloudflareBuiltinsExternalPlugin(),
     wranglerCompatPlugin,
     wranglerSyncPlugin,
diff --git a/packages/void/src/plugin-routing.ts b/packages/void/src/plugin-routing.ts
index 511adc3c8..a374f1eb3 100644
--- a/packages/void/src/plugin-routing.ts
+++ b/packages/void/src/plugin-routing.ts
@@ -482,6 +482,7 @@ export function routingPlugin(root: string, options: RoutingPluginOptions): Plug
         hasEmail: hasEmailHandlers(),
         serveSpaFallback: shouldServeSpaFallback(),
         live: options.live,
+        dev: compileOptions.dev,
         isr,
         notFound: currentNotFoundHandling(),
         durableObjects: options.durableObjects,
@@ -714,6 +715,14 @@ export function routingPlugin(root: string, options: RoutingPluginOptions): Plug
         if (id !== VIRTUAL_ROUTES_ID) {
           return;
         }
+        // The route table embeds the dev-trigger token. Only server environments import
+        // it; refusing the client environment keeps `/@id/virtual:void-routes` from
+        // returning it, either as the module or as code on Vite's error page.
+        if (this?.environment?.name === 'client') {
+          throw new Error(
+            `${VIRTUAL_ROUTES_ID} is server-only and cannot be loaded by client code.`,
+          );
+        }
         if (!scan) {
           await rescan();
         }
diff --git a/packages/void/src/prerender-render.ts b/packages/void/src/prerender-render.ts
index 33b50ba07..c386b2f14 100644
--- a/packages/void/src/prerender-render.ts
+++ b/packages/void/src/prerender-render.ts
@@ -1,5 +1,5 @@
 import { mkdirSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'pathslash';
+import { dirname, isAbsolute, join, relative } from 'pathslash';
 
 export type PrerenderResult = {
   rendered: Array<string>;
@@ -14,6 +14,12 @@ function pageDataFileForPath(path: string): string {
   return path === '/' ? '_void/pages/index.json' : `_void/pages/${path.slice(1)}.json`;
 }
 
+/** Whether `path` resolves strictly inside `directory`. */
+function isInside(directory: string, path: string): boolean {
+  const child = relative(directory, path);
+  return child !== '' && child !== '..' && !child.startsWith('../') && !isAbsolute(child);
+}
+
 function normalizedFile(clientDir: string, path: string): string {
   return join(clientDir, path).normalize('NFC').toLowerCase();
 }
@@ -110,6 +116,19 @@ export async function renderPrerenderPaths(
           const path = paths[index]!;
           const result = results[index]!;
           const outputFile = outputFileForPath(path);
+          const outputPath = join(clientDir, outputFile);
+          const pageDataPath = join(clientDir, pageDataFileForPath(path));
+          // Paths come from getPrerenderPaths and may include unencoded user data
+          // such as '../', which must not write files outside the output directory.
+          if (
+            !isInside(clientDir, outputPath) ||
+            !isInside(join(clientDir, '_void/pages'), pageDataPath)
+          ) {
+            const error = 'prerender path resolves outside the output directory';
+            result.failed.push({ path, error });
+            onResult?.(path, outputFile, error);
+            continue;
+          }
           try {
             const response = await fetchPath(path);
             const html = await response.text();
@@ -119,14 +138,12 @@ export async function renderPrerenderPaths(
               onResult?.(path, outputFile, error);
               continue;
             }
-            const outputPath = join(clientDir, outputFile);
             mkdirSync(dirname(outputPath), { recursive: true });
             writeFileSync(outputPath, html);
             if (fetchPageData) {
               const pageDataResponse = await fetchPageData(path);
               if (pageDataResponse.headers.get('X-VoidPages')) {
                 const pageData = await pageDataResponse.json();
-                const pageDataPath = join(clientDir, pageDataFileForPath(path));
                 mkdirSync(dirname(pageDataPath), { recursive: true });
                 writeFileSync(pageDataPath, JSON.stringify(pageData));
               }
diff --git a/packages/void/src/prerender.ts b/packages/void/src/prerender.ts
index 54e861932..fd8f1a22e 100644
--- a/packages/void/src/prerender.ts
+++ b/packages/void/src/prerender.ts
@@ -270,7 +270,9 @@ async function createCloudflarePrerenderRunner(options: {
     modulesRoot: workerDir,
     compatibilityDate: wranglerCompat.compatibilityDate,
     compatibilityFlags: wranglerCompat.compatibilityFlags ?? [],
-    bindings,
+    // Marks this Worker as the build-time prerender runner, the only place the
+    // built app answers path discovery. Deployed Workers never carry it.
+    bindings: { ...bindings, __VOID_PRERENDER: '1' },
   };
   if (clientDir) {
     mfOptions.serviceBindings = {
@@ -328,20 +330,11 @@ async function createCloudflarePrerenderRunner(options: {
   }
 
   const mf = new Miniflare(convertV4MiniflareOptions(mfOptions));
-  const allBindings = mfOptions.bindings as Record<string, unknown> | undefined;
-  const proxyToken = allBindings?.__VOID_PROXY_TOKEN as string | undefined;
 
   return {
     async collectPaths(): Promise<Array<string>> {
-      const headers: Record<string, string> = {};
-      if (proxyToken) {
-        headers['x-void-internal'] = proxyToken;
-      }
       return readPrerenderPathsResponse(
-        await mf.dispatchFetch(`http://localhost${PRERENDER_PATHS_ENDPOINT}`, {
-          method: 'POST',
-          headers,
-        }),
+        await mf.dispatchFetch(`http://localhost${PRERENDER_PATHS_ENDPOINT}`, { method: 'POST' }),
       );
     },
     async fetchPath(path: string): Promise<Response> {
@@ -440,11 +433,12 @@ if (!fetch) {
   process.exit(1);
 }
 
+// The second argument is the Hono env. Its marker is what lets the built app
+// answer path discovery; HTTP servers never pass it.
 async function collectPaths() {
-  const headers = {};
-  if (process.env.__VOID_PROXY_TOKEN) headers["x-void-internal"] = process.env.__VOID_PROXY_TOKEN;
   const response = await fetch(
-    new Request("http://localhost${PRERENDER_PATHS_ENDPOINT}", { method: "POST", headers }),
+    new Request("http://localhost${PRERENDER_PATHS_ENDPOINT}", { method: "POST" }),
+    { __VOID_PRERENDER: "1" },
   );
   if (!response.ok) {
     throw new Error("prerender: Failed to collect prerender paths. HTTP " + response.status + ".");
diff --git a/packages/void/src/router/compile.ts b/packages/void/src/router/compile.ts
index 26e7f384e..c1817734a 100644
--- a/packages/void/src/router/compile.ts
+++ b/packages/void/src/router/compile.ts
@@ -1122,7 +1122,7 @@ function compilePageRoutes(
       page.renderMode === 'island' && pages.islandClientEntryId
         ? 'getIslandsAssetTags'
         : 'getPagesAssetTags';
-    const routeOptions = `{ ${serverImportPath ? 'load: _pload_' + safeId + ', ' : ''}${mdHeadRef ? 'head: ' + mdHeadRef + ', ' : ''}componentId: ${JSON.stringify(page.componentId)}, render: ${renderer}, assets: ${assetTags}, headConfig: __voidHeadConfig, renderOptions: ${JSON.stringify({ renderMode: page.renderMode })} }`;
+    const routeOptions = `{ ${serverImportPath ? 'load: _pload_' + safeId + ', ' : ''}${mdHeadRef ? 'head: ' + mdHeadRef + ', ' : ''}componentId: ${JSON.stringify(page.componentId)}, render: ${renderer}, assets: ${assetTags}, headConfig: __voidHeadConfig, renderOptions: ${JSON.stringify({ renderMode: page.renderMode, ...(options.dev === true ? { dev: true } : {}) })} }`;
     lines.push(
       `app.get(${JSON.stringify(page.pattern)}, __createPageGetHandler(${routeOptions}));`,
     );
@@ -1201,6 +1201,11 @@ export interface WorkerEntryOptions {
   /** Emit native email and authenticated receipt handlers. Requires `__emailHandler`. */
   hasEmail?: boolean;
   live?: boolean | { bindingName?: string; className?: string };
+  /**
+   * Whether the entry is compiled for the Vite dev server. Dev lets void/live
+   * send the real internal error message to the client; builds never set it.
+   */
+  dev?: boolean;
   /**
    * When present, wraps the render path with the self-host ISR cache ladder.
    * `runtimePath` is the import specifier for `handleIsr`. The deployment id is
@@ -1256,6 +1261,7 @@ export function compileWorkerEntry(options: WorkerEntryOptions = {}): string {
     serveSpaFallback = false,
     hasEmail = false,
     live,
+    dev = false,
     isr,
     notFound = 'none',
     durableObjects = [],
@@ -1291,11 +1297,15 @@ export function compileWorkerEntry(options: WorkerEntryOptions = {}): string {
       ? (live.className ?? 'VoidLiveStreamDurableObject')
       : 'VoidLiveStreamDurableObject';
   const liveRouteImport = hasLive ? ', VoidLiveStreamDurableObject' : '';
-  const liveRuntimeImport = hasLive ? `import { __setLiveBindingName } from "void/live";\n` : '';
+  const liveDev = hasLive && dev === true;
+  const liveRuntimeImport = hasLive
+    ? `import { __setLiveBindingName${liveDev ? ', __setLiveDev' : ''} } from "void/live";\n`
+    : '';
+  const liveDevCall = liveDev ? '__setLiveDev(true);\n' : '';
   const liveExport = hasLive
     ? liveClassName === 'VoidLiveStreamDurableObject'
-      ? `export { VoidLiveStreamDurableObject };\n__setLiveBindingName(${JSON.stringify(liveBindingName)});\n`
-      : `export { VoidLiveStreamDurableObject as ${liveClassName} };\n__setLiveBindingName(${JSON.stringify(liveBindingName)});\n`
+      ? `export { VoidLiveStreamDurableObject };\n__setLiveBindingName(${JSON.stringify(liveBindingName)});\n${liveDevCall}`
+      : `export { VoidLiveStreamDurableObject as ${liveClassName} };\n__setLiveBindingName(${JSON.stringify(liveBindingName)});\n${liveDevCall}`
     : '';
   const durableObjectImports = durableObjects
     .map(
@@ -1521,8 +1531,12 @@ export function compileNodeApp(
     ? `import ${JSON.stringify(envSchemaModule.importPath)};\nimport { _validateEnvOnce } from ${JSON.stringify(envSchemaModule.helperPath)};\n`
     : '';
   const envSource = target === 'deno' ? 'Deno.env.toObject()' : 'process.env';
+  // Path discovery answers only the build-time prerender runner, which passes
+  // `{ __VOID_PRERENDER: "1" }` as the Hono env. HTTP servers never do: Node
+  // passes `{ incoming, outgoing }`, Bun its Server and Deno its handler info.
+  const discoveryRequest = `c.req.method === "POST" && c.req.path === "/__void/prerender-paths" && c.env?.__VOID_PRERENDER === "1"`;
   const envMiddleware = envSchemaModule
-    ? `app.use("*", async (c, next) => { if (c.req.method !== "POST" || c.req.path !== "/__void/prerender-paths") await _validateEnvOnce(${envSource}); return next(); });\n`
+    ? `app.use("*", async (c, next) => { if (!(${discoveryRequest})) await _validateEnvOnce(${envSource}); return next(); });\n`
     : '';
 
   return `${staticImport}
@@ -1537,11 +1551,7 @@ assetApp.get("*", serveStatic({ root: clientRoot }));
 const assets = { fetch: (request) => assetApp.fetch(request) };
 const app = new Hono();
 ${envMiddleware}app.post("/__void/prerender-paths", async (c) => {
-  const __expected = c.env?.__VOID_PROXY_TOKEN;
-  if (__expected) {
-    const __token = c.req.header("x-void-internal");
-    if (!__token || __token !== __expected) return c.json({ error: "unauthorized" }, 401);
-  }
+  if (c.env?.__VOID_PRERENDER !== "1") return c.notFound();
   const paths = await __voidCollectPrerenderPaths(c.req.raw);
   return c.json({ paths });
 });
diff --git a/packages/void/src/runtime/better-auth-shared.ts b/packages/void/src/runtime/better-auth-shared.ts
index 973ecae8d..20007bb63 100644
--- a/packages/void/src/runtime/better-auth-shared.ts
+++ b/packages/void/src/runtime/better-auth-shared.ts
@@ -276,6 +276,130 @@ function resolveUserConfig(
   return mergeEmailAndPasswordDefaults({ ...defaults, ...userConfig });
 }
 
+const SESSION_SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+
+// An http page never counts for an https request. An https page counts for an
+// http request on the same host: Vite HTTPS dev and preview hand WebSocket
+// upgrades to the Worker with an http:// URL.
+function isRequestOrigin(origin: string, requestUrl: string): boolean {
+  try {
+    const from = new URL(origin);
+    const to = new URL(requestUrl);
+    return from.host === to.host && (from.protocol === to.protocol || from.protocol === 'https:');
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Headers used to look up the signed-in session for app routes and WebSockets.
+ *
+ * The session cookie is SameSite=Lax, so a page on another origin of the same
+ * site (for example a sibling subdomain) can still send it with a WebSocket
+ * handshake or a POST that needs no CORS preflight. For those requests the
+ * cookie only counts when the Origin is the request origin or one Better Auth
+ * trusts, following Better Auth's own origin check for its endpoints. The
+ * request is not rejected; it is resolved without a user.
+ */
+async function sessionHeaders(
+  request: Request,
+  auth: ReturnType<typeof betterAuth>,
+): Promise<Headers> {
+  const headers = request.headers;
+  if (!headers.has('cookie')) {
+    return headers;
+  }
+  if (
+    SESSION_SAFE_METHODS.has(request.method) &&
+    headers.get('upgrade')?.toLowerCase() !== 'websocket'
+  ) {
+    return headers;
+  }
+  const origin = headers.get('origin');
+  if (!origin || isRequestOrigin(origin, request.url)) {
+    return headers;
+  }
+  if (origin === 'null' && headers.get('sec-fetch-site') === 'same-origin') {
+    return headers;
+  }
+
+  // Better Auth skips its origin check when CSRF checks are off, and treats
+  // `disableOriginCheck: true` the same way while `disableCSRFCheck` is unset.
+  const advanced = auth.options.advanced;
+  if (
+    advanced?.disableCSRFCheck === true ||
+    (advanced?.disableOriginCheck === true && advanced.disableCSRFCheck === undefined)
+  ) {
+    return headers;
+  }
+
+  const context = await auth.$context;
+  if (context.isTrustedOrigin(origin, { allowRelativePaths: false })) {
+    return headers;
+  }
+  // The function form is evaluated per request by Better Auth, while the
+  // context list was built once without a request. `isTrustedOrigin` matches
+  // against `this.trustedOrigins`, so reuse it to keep wildcard patterns.
+  const trustedOrigins = auth.options.trustedOrigins;
+  if (typeof trustedOrigins === 'function') {
+    const requestOrigins = (await trustedOrigins(request)).filter((value): value is string =>
+      Boolean(value),
+    );
+    if (
+      context.isTrustedOrigin.call({ trustedOrigins: requestOrigins }, origin, {
+        allowRelativePaths: false,
+      })
+    ) {
+      return headers;
+    }
+  }
+
+  const withoutCookie = new Headers(headers);
+  withoutCookie.delete('cookie');
+  console.warn(
+    `auth: Ignored the session cookie on a ${request.method} request from ${origin}. Add this origin to auth trustedOrigins if it should use the signed-in session.`,
+  );
+  return withoutCookie;
+}
+
+const LOOPBACK_IP = /^(127\.|::1$|::ffff:127\.)/;
+
+/**
+ * The client IP set by Cloudflare's edge, or null outside a deployed Worker.
+ * `request.cf` keeps a client-supplied header from being trusted on Node, Bun
+ * or Deno, and local previews report a loopback address.
+ */
+function cloudflareClientIp(request: Request): string | null {
+  const cf = (request as { cf?: unknown }).cf;
+  if (typeof cf !== 'object' || cf === null) {
+    return null;
+  }
+  const ip = request.headers.get('cf-connecting-ip');
+  if (!ip || LOOPBACK_IP.test(ip)) {
+    return null;
+  }
+  return ip;
+}
+
+/**
+ * Better Auth enables rate limiting only when NODE_ENV is "production", which
+ * Workers never set. Turn it on for deployed Cloudflare requests and key it by
+ * Cloudflare's client IP header. Explicit user settings still win.
+ */
+function applyCloudflareRateLimitDefaults(options: BetterAuthOptions): BetterAuthOptions {
+  return {
+    ...options,
+    rateLimit: {
+      ...options.rateLimit,
+      enabled: options.rateLimit?.enabled ?? true,
+    },
+    advanced: {
+      ...options.advanced,
+      ipAddress: options.advanced?.ipAddress ?? { ipAddressHeaders: ['cf-connecting-ip'] },
+    },
+  };
+}
+
 export function assertRuntimeDialect(
   runtime: VoidAuthRuntimeOptions,
   dialect: VoidAuthDialect,
@@ -319,8 +443,12 @@ export function createVoidAuthRuntime(
       trustedOrigins: [origin],
     };
 
+    const resolved = resolveUserConfig(runtime.userConfig, defaults, request, env, dialect);
     return {
-      options: resolveUserConfig(runtime.userConfig, defaults, request, env, dialect),
+      options:
+        runtime.dev !== true && cloudflareClientIp(request)
+          ? applyCloudflareRateLimitDefaults(resolved)
+          : resolved,
       dispose,
     };
   }
@@ -362,7 +490,7 @@ export function createVoidAuthRuntime(
 
     try {
       const result = await auth.api.getSession({
-        headers: request.headers,
+        headers: await sessionHeaders(request, auth),
         asResponse: false,
         returnHeaders: true,
       });
@@ -400,7 +528,7 @@ export function createVoidAuthRuntime(
 
     try {
       const result = await auth.api.getSession({
-        headers: c.req.raw.headers,
+        headers: await sessionHeaders(c.req.raw, auth),
         asResponse: false,
         returnHeaders: true,
       });
diff --git a/packages/void/src/runtime/handler.ts b/packages/void/src/runtime/handler.ts
index 069fdc67e..192cebea7 100644
--- a/packages/void/src/runtime/handler.ts
+++ b/packages/void/src/runtime/handler.ts
@@ -378,6 +378,12 @@ export function basicAuth(options: BasicAuthOptions): MiddlewareHandler<CloudEnv
 
     const username = resolveBasicAuthOption(options.username, '');
     const password = resolveBasicAuthOption(options.password, '');
+    // An unset secret must not turn into a gate that accepts an empty password.
+    if (!password) {
+      throw new Error(
+        'basicAuth: the password resolved to an empty value. Set the credential before serving requests.',
+      );
+    }
     const credentials = parseBasicAuthHeader(c.req.raw.headers.get('Authorization'));
     const usernameMatches = credentials && timingSafeStringEqual(credentials.username, username);
     const passwordMatches = credentials && timingSafeStringEqual(credentials.password, password);
diff --git a/packages/void/src/runtime/live.ts b/packages/void/src/runtime/live.ts
index a5040f0f2..709ce941b 100644
--- a/packages/void/src/runtime/live.ts
+++ b/packages/void/src/runtime/live.ts
@@ -124,6 +124,7 @@ export type LiveStreamOptions = {
   allowAnonymousControl?: boolean;
   identifyConnection?: (ctx: LiveHookContext) => MaybePromise<string | null | undefined>;
   onConnect?: (ctx: LiveConnectHookContext) => MaybePromise<Response | void>;
+  /** Decides who can read each topic. Without it, any connection that passes the owner check can subscribe to any topic. Return a Response to reject. */
   onSubscribe?: (ctx: LiveSubscribeHookContext) => MaybePromise<Response | void>;
   limits?: Partial<LiveLimits>;
 };
@@ -145,6 +146,9 @@ export type LiveStream = {
 };
 
 let liveBindingName = 'VOID_LIVE';
+// Only the worker entry compiled by the Vite dev server turns this on. Builds
+// never call the setter, so production clients get a fixed internal error.
+let liveDev = false;
 const registeredStreamIds = new Set<string>();
 const DEFAULT_LIMITS: LiveLimits = {
   maxSubscriptionsPerConnection: 256,
@@ -164,6 +168,10 @@ export function __getLiveBindingName(): string {
   return liveBindingName;
 }
 
+export function __setLiveDev(dev: boolean): void {
+  liveDev = dev === true;
+}
+
 export function defineLiveStream(options: LiveStreamOptions): LiveStream {
   const streamId = assertStreamId(options.id);
   const limits = resolveLiveLimits(options.limits);
@@ -629,13 +637,18 @@ function errorToResponse(error: unknown): Response {
       { status: error.status },
     );
   }
+  // Hooks, bindings and the Durable Object can fail with internal details; log them
+  // on the server and send clients a fixed message. Dev keeps the real message.
+  console.error(error);
+  const message = liveDev
+    ? error instanceof Error
+      ? error.message
+      : String(error)
+    : 'live: internal error.';
   return Response.json(
     {
       accepted: false,
-      error: {
-        code: 'INTERNAL_ERROR',
-        message: error instanceof Error ? error.message : String(error),
-      },
+      error: { code: 'INTERNAL_ERROR', message },
     } satisfies LiveControlResponse,
     { status: 500 },
   );
diff --git a/packages/void/src/runtime/route-url.ts b/packages/void/src/runtime/route-url.ts
index 0603e1cf7..0c66a60b0 100644
--- a/packages/void/src/runtime/route-url.ts
+++ b/packages/void/src/runtime/route-url.ts
@@ -1,3 +1,17 @@
+/**
+ * Encode one path segment of a route param. `encodeURIComponent` keeps dots, and
+ * URL parsing resolves `.`/`..` (even as `%2e`), so such a segment would move the
+ * request to another path instead of reaching this route.
+ */
+function encodeSegment(name: string, segment: string): string {
+  if (segment === '.' || segment === '..') {
+    throw new TypeError(
+      `Route param "${name}" cannot be "${segment}"; it would change the request path.`,
+    );
+  }
+  return encodeURIComponent(segment);
+}
+
 /** Expand complete route tokens without changing query strings or fragments. */
 export function interpolateRouteParams(path: string, params?: Record<string, string>): string {
   if (!params) {
@@ -6,21 +20,33 @@ export function interpolateRouteParams(path: string, params?: Record<string, str
   const suffixIndex = path.search(/[?#]/);
   const pathname = suffixIndex === -1 ? path : path.slice(0, suffixIndex);
   const suffix = suffixIndex === -1 ? '' : path.slice(suffixIndex);
-  return (
-    pathname.replace(
-      /(^|\/):([^/{}]+)(\{\.\+\})?(?=\/|$)/g,
-      (token: string, prefix: string, name: string, catchAll: string | undefined) => {
-        if (!Object.hasOwn(params, name)) {
-          return token;
-        }
-        const value = params[name];
-        return (
-          prefix +
-          (catchAll
-            ? value.split('/').map(encodeURIComponent).join('/')
-            : encodeURIComponent(value))
-        );
-      },
-    ) + suffix
+  let leadingName: string | undefined;
+  const replaced = pathname.replace(
+    /(^|\/):([^/{}]+)(\{\.\+\})?(?=\/|$)/g,
+    (token: string, prefix: string, name: string, catchAll: string | undefined, offset: number) => {
+      if (!Object.hasOwn(params, name)) {
+        return token;
+      }
+      if (offset === 0) {
+        leadingName = name;
+      }
+      const value = params[name];
+      return (
+        prefix +
+        (catchAll
+          ? value
+              .split('/')
+              .map((segment) => encodeSegment(name, segment))
+              .join('/')
+          : encodeSegment(name, value))
+      );
+    },
   );
+  // A path that starts with `//` is read as another host by fetch() and URL parsing.
+  if (replaced.startsWith('//') && !pathname.startsWith('//')) {
+    throw new TypeError(
+      `Route param "${leadingName ?? ''}" would make the request path start with "//", which changes the request host.`,
+    );
+  }
+  return replaced + suffix;
 }
diff --git a/packages/void/src/runtime/routing-pages.ts b/packages/void/src/runtime/routing-pages.ts
index 020686854..99833f841 100644
--- a/packages/void/src/runtime/routing-pages.ts
+++ b/packages/void/src/runtime/routing-pages.ts
@@ -45,7 +45,16 @@ export function createPageMutationHandler(
     const actionName = options.namedActions
       ? new URL(context.req.url).searchParams.keys().next().value
       : undefined;
-    const handler = options.namedActions ? mod.actions?.[actionName || 'default'] : mod.action;
+    // The name comes from the query string, so only own function properties
+    // count; `?constructor` or `?valueOf` must not reach Object.prototype.
+    const name = actionName || 'default';
+    const named = mod.actions;
+    const candidate = named && Object.hasOwn(named, name) ? named[name] : undefined;
+    const handler = options.namedActions
+      ? typeof candidate === 'function'
+        ? candidate
+        : undefined
+      : mod.action;
     if (options.namedActions && !handler) {
       return new Response('Unknown action' + (actionName ? ': ' + actionName : ''), {
         status: 404,
diff --git a/packages/void/src/runtime/routing-worker.ts b/packages/void/src/runtime/routing-worker.ts
index ec5abb030..ad8f7975f 100644
--- a/packages/void/src/runtime/routing-worker.ts
+++ b/packages/void/src/runtime/routing-worker.ts
@@ -205,7 +205,12 @@ export function createWorkerFetch(
 ): (request: Request, env: RuntimeEnvironment, ctx: ExecutionContext) => Promise<Response> {
   return async (request, originalEnv, ctx) => {
     const url = new URL(request.url);
-    const discovery = request.method === 'POST' && url.pathname === '/__void/prerender-paths';
+    // Only the build-time prerender runner sets this binding. Without it the
+    // request is an ordinary app request, so env validation runs as usual.
+    const discovery =
+      request.method === 'POST' &&
+      url.pathname === '/__void/prerender-paths' &&
+      originalEnv.__VOID_PRERENDER === '1';
     if (options.validateEnv && !discovery) {
       await options.validateEnv(originalEnv);
     }
@@ -238,13 +243,6 @@ export function createWorkerFetch(
           return internal;
         }
         if (discovery) {
-          const expected = env.__VOID_PROXY_TOKEN;
-          if (expected) {
-            const token = request.headers.get('x-void-internal');
-            if (!token || token !== expected) {
-              return Response.json({ error: 'unauthorized' }, { status: 401 });
-            }
-          }
           return Response.json({ paths: await options.collectPrerenderPaths(request, env, ctx) });
         }
         const userEnv = options.filterBindings(env);
diff --git a/packages/void/test/integration/analog.test.ts b/packages/void/test/integration/analog.test.ts
index bbd94923a..316540f95 100644
--- a/packages/void/test/integration/analog.test.ts
+++ b/packages/void/test/integration/analog.test.ts
@@ -49,11 +49,16 @@ describe('playground/analog dev', () => {
     const pg = PLAYGROUND_ROOT;
     rmSync(join(pg, '.void'), { recursive: true, force: true });
     rmSync(join(pg, '.wrangler'), { recursive: true, force: true });
+    rmSync(join(pg, 'dist/.nitro'), { recursive: true, force: true });
     removeWranglerConfig(pg);
 
     DEV_PORT = await getPort();
     DEV_BASE = `http://127.0.0.1:${DEV_PORT}`;
 
+    // Analog skips its Nitro dev server when VITEST or NODE_ENV=test is set, so start
+    // the child the way `vp dev` runs for users.
+    const { VITEST: _vitest, NODE_ENV: _nodeEnv, ...userEnv } = process.env;
+
     child = spawn(
       'vp',
       [
@@ -70,7 +75,7 @@ describe('playground/analog dev', () => {
         cwd: ROOT,
         stdio: ['ignore', 'pipe', 'pipe'],
         env: {
-          ...process.env,
+          ...userEnv,
           VOID_INSPECTOR_PORT: 'false',
         },
       },
@@ -101,4 +106,20 @@ describe('playground/analog dev', () => {
     expect(wranglerConfig.kv_namespaces?.some((b) => b.binding === 'KV')).toBe(true);
     expect(existsSync(join(ROOT, `${PLAYGROUND}/wrangler.jsonc`))).toBe(false);
   });
+
+  it('does not serve the dev-trigger token', async () => {
+    const token = readFileSync(join(PLAYGROUND_ROOT, '.void/dev-trigger-token'), 'utf8').trim();
+    // Nitro's dev bundle inlines the trigger dispatch module. Analog builds it before listening.
+    expect(existsSync(join(PLAYGROUND_ROOT, 'dist/.nitro/dev/index.mjs'))).toBe(true);
+
+    for (const path of [
+      '/.void/dev-trigger-token',
+      '/.void/dev-triggers.ts',
+      '/dist/.nitro/dev/index.mjs',
+    ]) {
+      const response = await fetch(`${DEV_BASE}${path}`);
+      expect(response.status, path).toBe(404);
+      expect(await response.text(), path).not.toContain(token);
+    }
+  });
 });
diff --git a/packages/void/test/integration/auth-rate-limit.test.ts b/packages/void/test/integration/auth-rate-limit.test.ts
new file mode 100644
index 000000000..395331017
--- /dev/null
+++ b/packages/void/test/integration/auth-rate-limit.test.ts
@@ -0,0 +1,76 @@
+import { memoryAdapter } from 'better-auth/adapters/memory';
+import { Hono } from 'hono';
+import { describe, expect, it } from 'vite-plus/test';
+import { createVoidAuthRuntime } from '../../src/runtime/better-auth-shared.ts';
+
+const env = { BETTER_AUTH_SECRET: 'local-test-secret-with-at-least-32-characters' };
+const options = { dialect: 'sqlite' as const, providers: null };
+
+function fixture() {
+  const database = memoryAdapter({ user: [], session: [], account: [], verification: [] });
+  const runtime = createVoidAuthRuntime(
+    'sqlite',
+    async () => ({ database, dispose: async () => {} }),
+    async () => {},
+  );
+  const app = new Hono();
+  app.use(async (c, next) => runtime.runVoidAuthMiddleware(c, next, options));
+  app.on(['GET', 'POST'], '/api/auth/*', (c) => runtime.handleVoidAuthRequest(c, options));
+  return app;
+}
+
+// Better Auth keeps its in-memory limiter for the whole module, so every test
+// signs in from its own client address.
+function signIn(clientIp: string | null, cf: boolean): Request {
+  const request = new Request('https://app.test/api/auth/sign-in/email', {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      ...(clientIp ? { 'cf-connecting-ip': clientIp } : {}),
+    },
+    body: JSON.stringify({ email: 'nobody@example.test', password: 'wrong-password' }),
+  });
+  if (cf) {
+    Object.defineProperty(request, 'cf', { value: { colo: 'SJC' } });
+  }
+  return request;
+}
+
+async function statuses(app: Hono, requests: () => Request, count: number) {
+  const result: Array<number> = [];
+  for (let attempt = 0; attempt < count; attempt += 1) {
+    const response = await app.fetch(requests(), env);
+    result.push(response.status);
+  }
+  return result;
+}
+
+describe('auth rate limits on deployed Cloudflare requests', () => {
+  it('limits repeated sign-in attempts from one client IP', async () => {
+    const app = fixture();
+    const results = await statuses(app, () => signIn('203.0.113.10', true), 4);
+    expect(results.slice(0, 3)).not.toContain(429);
+    expect(results[3]).toBe(429);
+
+    const other = await app.fetch(signIn('203.0.113.11', true), env);
+    expect(other.status).not.toBe(429);
+  });
+
+  it('does not limit requests outside a deployed Worker', async () => {
+    const app = fixture();
+    const results = await statuses(app, () => signIn('203.0.113.12', false), 5);
+    expect(results).not.toContain(429);
+  });
+
+  it.each(['127.0.0.1', '::1'])('does not limit a local preview from %s', async (ip) => {
+    const app = fixture();
+    const results = await statuses(app, () => signIn(ip, true), 5);
+    expect(results).not.toContain(429);
+  });
+
+  it('does not limit Worker requests without a client IP', async () => {
+    const app = fixture();
+    const results = await statuses(app, () => signIn(null, true), 5);
+    expect(results).not.toContain(429);
+  });
+});
diff --git a/packages/void/test/integration/dev-trigger-secret-guard.test.ts b/packages/void/test/integration/dev-trigger-secret-guard.test.ts
new file mode 100644
index 000000000..349874868
--- /dev/null
+++ b/packages/void/test/integration/dev-trigger-secret-guard.test.ts
@@ -0,0 +1,103 @@
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { request } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createServer, type ViteDevServer } from 'vite';
+import { afterAll, beforeAll, describe, expect, it } from 'vite-plus/test';
+import { devTriggerSecretGuardPlugin } from '../../src/plugin-dev-config.ts';
+
+const TOKEN = 'dev-trigger-secret-0f3c9a';
+const DATABASE_URL = 'postgresql://app:db-secret-7e21b4@db.example.com/app';
+
+// node:http sends the path exactly as written; fetch would normalize dot segments.
+function get(port: number, path: string): Promise<{ status: number; body: string }> {
+  return new Promise((resolve, reject) => {
+    const req = request({ host: '127.0.0.1', port, path, method: 'GET' }, (res) => {
+      const chunks: Array<Buffer> = [];
+      res.on('data', (chunk: Buffer) => chunks.push(chunk));
+      res.on('end', () =>
+        resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks).toString('utf8') }),
+      );
+      res.on('error', reject);
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+describe('dev server with the dev-trigger secret guard', () => {
+  let root: string;
+  let server: ViteDevServer;
+  let port: number;
+
+  beforeAll(async () => {
+    root = realpathSync(mkdtempSync(join(tmpdir(), 'void-dev-secret-')));
+    mkdirSync(join(root, '.void'), { recursive: true });
+    writeFileSync(join(root, 'index.html'), '<!doctype html><title>app</title>');
+    writeFileSync(join(root, '.void', 'dev-trigger-token'), TOKEN);
+    writeFileSync(join(root, '.void', 'dev-triggers.ts'), `export const token = "${TOKEN}";\n`);
+    writeFileSync(join(root, '.void', 'routes.d.ts'), 'export {};\n');
+    // Astro writes its background dev server output, startup hint included, here.
+    mkdirSync(join(root, '.astro'), { recursive: true });
+    writeFileSync(join(root, '.astro', 'dev.log'), `x-void-dev-trigger: ${TOKEN}\n`);
+    // Older CLI versions left the database URL of `void db push` / `db studio` here.
+    writeFileSync(
+      join(root, '.void', 'drizzle.config.json'),
+      JSON.stringify({ dialect: 'postgresql', dbCredentials: { url: DATABASE_URL } }),
+    );
+
+    server = await createServer({
+      root,
+      configFile: false,
+      logLevel: 'silent',
+      server: { host: '127.0.0.1', port: 0 },
+      plugins: [devTriggerSecretGuardPlugin()],
+    });
+    await server.listen();
+    port = (server.httpServer!.address() as AddressInfo).port;
+  });
+
+  afterAll(async () => {
+    await server?.close();
+    if (root) {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  const fsRoot = () => {
+    const posix = root.replaceAll('\\', '/');
+    return posix.startsWith('/') ? posix : `/${posix}`;
+  };
+
+  it.each([
+    '/.void/dev-trigger-token',
+    '/.VOID/dev-trigger-token',
+    '/.void/./dev-trigger-token',
+    '/.void//dev-trigger-token',
+    '/%2evoid/dev-trigger-token',
+    '/.void/dev-trigger-token?raw',
+    '/.void/dev-trigger-token?import',
+    '/@fs<root>/.void/dev-trigger-token',
+    '/.void/dev-triggers.ts',
+    '/.void/dev-triggers.ts?import',
+    '/.void/dev-triggers.ts?raw',
+    '/.astro/dev.log',
+    '/.astro/dev.log?raw',
+  ])('does not serve the token at %s', async (path) => {
+    const response = await get(port, path.replace('<root>', fsRoot()));
+    expect(response.status).toBe(404);
+    expect(response.body).not.toContain(TOKEN);
+  });
+
+  it('does not serve a database URL left in .void/drizzle.config.json', async () => {
+    const response = await get(port, '/.void/drizzle.config.json');
+    expect(response.status).toBe(404);
+    expect(response.body).not.toContain('db-secret-7e21b4');
+  });
+
+  it('still serves other files under .void', async () => {
+    const response = await get(port, '/.void/routes.d.ts');
+    expect(response.status).toBe(200);
+  });
+});
diff --git a/packages/void/test/integration/nuxt.test.ts b/packages/void/test/integration/nuxt.test.ts
index 77ce75085..15d769444 100644
--- a/packages/void/test/integration/nuxt.test.ts
+++ b/packages/void/test/integration/nuxt.test.ts
@@ -98,6 +98,21 @@ describe(
       expect(html).toContain('Nuxt + Void');
     });
 
+    it('does not serve the dev-trigger token', async () => {
+      const pg = join(ROOT, PLAYGROUND);
+      const token = readFileSync(join(pg, '.void/dev-trigger-token'), 'utf8').trim();
+
+      const tokenFile = await fetch(`${DEV_BASE}/_nuxt/.void/dev-trigger-token`);
+      expect(tokenFile.status).toBe(404);
+      expect(await tokenFile.text()).not.toContain(token);
+
+      // Nitro's dev bundle inlines the trigger dispatch module.
+      expect(existsSync(join(pg, '.nuxt/dev/index.mjs'))).toBe(true);
+      const fsPath = pg.replaceAll('\\', '/').replace(/^\/+/, '');
+      const bundle = await fetch(`${DEV_BASE}/_nuxt/@fs/${fsPath}/.nuxt/dev/index.mjs`);
+      expect(await bundle.text()).not.toContain(token);
+    });
+
     it('navigates to smoke route via SPA from home page', async () => {
       const { chromium } = await import('playwright');
       const browser = await chromium.launch();
diff --git a/packages/void/test/integration/typed-routing-runtime.test.ts b/packages/void/test/integration/typed-routing-runtime.test.ts
index 4bb3d1b3d..7df10e30b 100644
--- a/packages/void/test/integration/typed-routing-runtime.test.ts
+++ b/packages/void/test/integration/typed-routing-runtime.test.ts
@@ -244,10 +244,17 @@ renderPage.preambleScript = ${JSON.stringify(preambleScript)};`;
       expect(await (await runtime.dispatchFetch('https://app.test/__void/ready')).json()).toEqual({
         ready: true,
       });
-      const unauthorized = await runtime.dispatchFetch('https://app.test/__void/prerender-paths', {
-        method: 'POST',
-      });
-      expect(unauthorized.status).toBe(401);
+      // Path discovery answers only the build-time prerender runner, so the
+      // deployed Worker treats it as an ordinary request, even with the proxy
+      // token. This fixture has no binding handler, so the pages fallback answers.
+      for (const headers of [{}, { 'x-void-internal': 'secret' }]) {
+        const discovery = await runtime.dispatchFetch('https://app.test/__void/prerender-paths', {
+          method: 'POST',
+          headers,
+        });
+        expect(discovery.status).toBe(404);
+        expect(await discovery.text()).not.toContain('"paths"');
+      }
     },
   );
 });
diff --git a/packages/void/test/unit/ai.test.ts b/packages/void/test/unit/ai.test.ts
index 645b774f9..7effdf489 100644
--- a/packages/void/test/unit/ai.test.ts
+++ b/packages/void/test/unit/ai.test.ts
@@ -215,6 +215,7 @@ describe('runtime ai', () => {
 
     expect(proxyFetch).toHaveBeenCalledOnce();
     const init = proxyFetch.mock.calls[0][1]!;
+    expect(proxyFetch.mock.calls[0][0]).toBe('https://ai-proxy/ai/provider');
     expect(JSON.parse(init.body as string)).toMatchObject({
       action: 'provider',
       provider: 'openai',
diff --git a/packages/void/test/unit/auth-middleware.test.ts b/packages/void/test/unit/auth-middleware.test.ts
index 7ab39b301..942cb973e 100644
--- a/packages/void/test/unit/auth-middleware.test.ts
+++ b/packages/void/test/unit/auth-middleware.test.ts
@@ -10,7 +10,7 @@ vi.mock('better-auth', () => ({
   betterAuth: mocks.betterAuth,
 }));
 
-import type { AuthState } from '../../src/runtime/auth.ts';
+import { requireAuth, type AuthState, type AuthUser } from '../../src/runtime/auth.ts';
 import {
   createVoidAuthRuntime,
   type VoidAuthRuntimeOptions,
@@ -179,3 +179,235 @@ describe('runVoidAuthMiddleware response headers', () => {
     expect(response.headers.getSetCookie()).toEqual(['session=rotated; Path=/; HttpOnly']);
   });
 });
+
+describe('cross-origin cookie sessions', () => {
+  const env = { BETTER_AUTH_SECRET: 'test-secret' };
+  const now = new Date();
+  const signedIn: AuthState = {
+    user: {
+      id: 'victim',
+      name: 'Victim',
+      email: 'victim@example.test',
+      emailVerified: true,
+      createdAt: now,
+      updatedAt: now,
+    },
+    session: {
+      id: 'victim-session',
+      userId: 'victim',
+      token: 'synthetic-token',
+      expiresAt: now,
+      createdAt: now,
+      updatedAt: now,
+    },
+  };
+
+  // Better Auth's context matches origins against `this.trustedOrigins`.
+  function mockAuth(
+    options: Record<string, unknown> = {},
+    trustedOrigins: Array<string> = ['https://app.void.app'],
+  ) {
+    mocks.getSession.mockImplementation(async ({ headers }: { headers: Headers }) => ({
+      response: headers.has('cookie') ? signedIn : null,
+      headers: new Headers(),
+    }));
+    mocks.betterAuth.mockReturnValue({
+      api: { getSession: mocks.getSession },
+      options,
+      $context: Promise.resolve({
+        trustedOrigins,
+        isTrustedOrigin(this: { trustedOrigins: Array<string> }, url: string) {
+          return this.trustedOrigins.includes(url);
+        },
+      }),
+    });
+  }
+
+  function upgradeRequest(headers: Record<string, string>): Request {
+    return new Request('https://app.void.app/chat/general', {
+      headers: { upgrade: 'websocket', cookie: 'session=victim', ...headers },
+    });
+  }
+
+  async function sessionCookieFor(request: Request): Promise<string | null> {
+    await runtime.resolveVoidAuthState(request, env, authRuntimeOptions, {} as never);
+    expect(mocks.getSession).toHaveBeenCalledOnce();
+    return (mocks.getSession.mock.calls[0]![0] as { headers: Headers }).headers.get('cookie');
+  }
+
+  function routeApp() {
+    const app = new Hono<{ Variables: { user: AuthUser | null } }>();
+    app.use(async (c, next) => {
+      await runtime.runVoidAuthMiddleware(c, next, authRuntimeOptions, {} as never);
+    });
+    return app;
+  }
+
+  it('ignores the cookie on a WebSocket upgrade from another origin', async () => {
+    mockAuth();
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    try {
+      await expect(
+        sessionCookieFor(upgradeRequest({ origin: 'https://evil.void.app' })),
+      ).resolves.toBeNull();
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  it('ignores the cookie on a WebSocket upgrade from a plain http page on the same host', async () => {
+    mockAuth();
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    try {
+      await expect(
+        sessionCookieFor(upgradeRequest({ origin: 'http://app.void.app' })),
+      ).resolves.toBeNull();
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  it('keeps the cookie when Vite HTTPS hands the upgrade over as http', async () => {
+    // The default base URL follows the request, so Better Auth trusts only http.
+    mockAuth({}, ['http://app.void.app']);
+    const request = new Request('http://app.void.app/chat/general', {
+      headers: { upgrade: 'websocket', cookie: 'session=victim', origin: 'https://app.void.app' },
+    });
+    await expect(sessionCookieFor(request)).resolves.toBe('session=victim');
+  });
+
+  it.each([
+    ['the same origin', { origin: 'https://app.void.app' }],
+    ['no origin', {}],
+    [
+      'an opaque origin the browser marks same-origin',
+      { origin: 'null', 'sec-fetch-site': 'same-origin' },
+    ],
+  ])('keeps the cookie on a WebSocket upgrade from %s', async (_label, headers) => {
+    mockAuth();
+    await expect(sessionCookieFor(upgradeRequest(headers))).resolves.toBe('session=victim');
+  });
+
+  it('keeps the cookie for an origin Better Auth trusts', async () => {
+    mockAuth({}, ['https://app.void.app', 'https://admin.example.com']);
+    await expect(
+      sessionCookieFor(upgradeRequest({ origin: 'https://admin.example.com' })),
+    ).resolves.toBe('session=victim');
+  });
+
+  it('evaluates function-form trustedOrigins with the request', async () => {
+    const trustedOrigins = vi.fn(async (request?: Request) =>
+      request?.headers.get('origin') === 'https://admin.example.com'
+        ? ['https://admin.example.com', null]
+        : [],
+    );
+    mockAuth({ trustedOrigins });
+    const request = upgradeRequest({ origin: 'https://admin.example.com' });
+    await expect(sessionCookieFor(request)).resolves.toBe('session=victim');
+    expect(trustedOrigins).toHaveBeenCalledWith(request);
+  });
+
+  it('follows the Better Auth CSRF opt-out options', async () => {
+    mockAuth({ advanced: { disableCSRFCheck: true } });
+    await expect(
+      sessionCookieFor(upgradeRequest({ origin: 'https://evil.void.app' })),
+    ).resolves.toBe('session=victim');
+
+    mocks.getSession.mockClear();
+    mockAuth({ advanced: { disableOriginCheck: true } });
+    await expect(
+      sessionCookieFor(upgradeRequest({ origin: 'https://evil.void.app' })),
+    ).resolves.toBe('session=victim');
+
+    mocks.getSession.mockClear();
+    mockAuth({ advanced: { disableOriginCheck: true, disableCSRFCheck: false } });
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    try {
+      await expect(
+        sessionCookieFor(upgradeRequest({ origin: 'https://evil.void.app' })),
+      ).resolves.toBeNull();
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  it('ignores the cookie for an opaque origin that is not same-origin', async () => {
+    mockAuth();
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    try {
+      await expect(
+        sessionCookieFor(upgradeRequest({ origin: 'null', 'sec-fetch-site': 'same-site' })),
+      ).resolves.toBeNull();
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  it('leaves a cross-origin WebSocket upgrade without a user in the middleware', async () => {
+    mockAuth();
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const app = routeApp();
+    app.get('/chat/general', (c) => c.json({ user: c.get('user') }));
+    try {
+      const response = await app.request(
+        upgradeRequest({ origin: 'https://evil.void.app' }),
+        undefined,
+        env,
+      );
+      await expect(response.json()).resolves.toEqual({ user: null });
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  it('does not sign in a cross-origin POST but keeps its raw cookies', async () => {
+    mockAuth();
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const app = routeApp();
+    app.post('/api/profile', (c) => {
+      const cookie = c.req.header('cookie');
+      return c.json({ id: requireAuth(c).id, cookie });
+    });
+    app.post('/api/whoami', (c) => c.json({ user: c.get('user'), cookie: c.req.header('cookie') }));
+    try {
+      const init = {
+        method: 'POST',
+        headers: { cookie: 'session=victim', origin: 'https://evil.void.app' },
+        body: '{}',
+      };
+      const denied = await app.request('https://app.void.app/api/profile', init, env);
+      expect(denied.status).toBe(401);
+
+      const whoami = await app.request('https://app.void.app/api/whoami', init, env);
+      await expect(whoami.json()).resolves.toEqual({ user: null, cookie: 'session=victim' });
+      expect(warn).toHaveBeenCalledTimes(2);
+      expect(String(warn.mock.calls[0]![0])).toContain('https://evil.void.app');
+      expect(String(warn.mock.calls[0]![0])).toContain('trustedOrigins');
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  it.each([
+    ['a same-origin POST', 'POST', { origin: 'https://app.void.app' }],
+    ['a POST without an Origin header', 'POST', {}],
+    ['a cross-origin GET', 'GET', { origin: 'https://evil.void.app' }],
+  ])('keeps the session for %s', async (_label, method, headers) => {
+    mockAuth();
+    const warn = vi.spyOn(console, 'warn');
+    const app = routeApp();
+    app.on(method, '/api/profile', (c) => c.json({ id: requireAuth(c).id }));
+    try {
+      const response = await app.request(
+        'https://app.void.app/api/profile',
+        { method, headers: { cookie: 'session=victim', ...headers } },
+        env,
+      );
+      expect(response.status).toBe(200);
+      await expect(response.json()).resolves.toEqual({ id: 'victim' });
+      expect(warn).not.toHaveBeenCalled();
+    } finally {
+      warn.mockRestore();
+    }
+  });
+});
diff --git a/packages/void/test/unit/basic-auth.test.ts b/packages/void/test/unit/basic-auth.test.ts
index 092e5e50e..0a297a8b3 100644
--- a/packages/void/test/unit/basic-auth.test.ts
+++ b/packages/void/test/unit/basic-auth.test.ts
@@ -1,5 +1,5 @@
 import { Hono } from 'hono';
-import { describe, expect, it } from 'vite-plus/test';
+import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
 import { env } from '../../src/runtime/env-public.ts';
 import { withRuntimeEnv } from '../../src/runtime/env.ts';
 import { basicAuth, type BasicAuthOptions, type CloudEnv } from '../../src/runtime/handler.ts';
@@ -10,16 +10,23 @@ function authorization(value: string) {
   return `Basic ${btoa(binary)}`;
 }
 
-function createApp(options: BasicAuthOptions) {
+function createApp(options: BasicAuthOptions, downstream = vi.fn()) {
   const app = new Hono<CloudEnv>();
 
   app.use('*', basicAuth(options));
-  app.all('*', (c) => c.text('ok'));
+  app.all('*', (c) => {
+    downstream();
+    return c.text('ok');
+  });
 
   return app;
 }
 
 describe('basicAuth', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
   it('challenges requests without credentials', async () => {
     const app = createApp({ username: 'guest', password: 'wedding', realm: 'Preview' });
 
@@ -129,6 +136,55 @@ describe('basicAuth', () => {
     expect(await res.text()).toBe('ok');
   });
 
+  it('skips Void internal endpoints when the password is empty', async () => {
+    const app = createApp({ username: 'guest', password: '' });
+
+    const res = await app.request('http://localhost/__void/migrate', { method: 'POST' });
+
+    expect(res.status).toBe(200);
+    expect(await res.text()).toBe('ok');
+  });
+
+  it.each([
+    ['an empty password', { username: '', password: '' }, ':'],
+    [
+      'a password callback that returns undefined',
+      { username: 'admin', password: () => undefined as unknown as string },
+      'admin:',
+    ],
+  ])('fails closed for %s', async (_label, options, credentials) => {
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {});
+    const downstream = vi.fn();
+    const app = createApp(options, downstream);
+
+    const res = await app.request('http://localhost/', {
+      headers: { Authorization: authorization(credentials) },
+    });
+
+    expect(res.status).toBe(500);
+    expect(downstream).not.toHaveBeenCalled();
+    expect(consoleError).toHaveBeenCalledWith(
+      expect.objectContaining({
+        message:
+          'basicAuth: the password resolved to an empty value. Set the credential before serving requests.',
+      }),
+    );
+  });
+
+  it.each([
+    ['an empty username', ''],
+    ['a username callback that returns undefined', () => undefined as unknown as string],
+  ])('allows password-only gates with %s', async (_label, username) => {
+    const app = createApp({ username, password: 'secret' });
+
+    const res = await app.request('http://localhost/', {
+      headers: { Authorization: authorization(':secret') },
+    });
+
+    expect(res.status).toBe(200);
+    expect(await res.text()).toBe('ok');
+  });
+
   it('does not trust x-void-internal on public paths', async () => {
     const app = createApp({ username: 'guest', password: 'wedding' });
 
diff --git a/packages/void/test/unit/better-auth.test.ts b/packages/void/test/unit/better-auth.test.ts
index 571e68761..3b505c8d8 100644
--- a/packages/void/test/unit/better-auth.test.ts
+++ b/packages/void/test/unit/better-auth.test.ts
@@ -271,3 +271,87 @@ describe('resolveVoidAuthOptions', () => {
     ).resolves.toBe(false);
   });
 });
+
+describe('resolveVoidAuthOptions auth rate limits', () => {
+  function plainRequest(headers: Record<string, string>): Request {
+    return new Request('https://example.com/api/auth/sign-in/email', { headers });
+  }
+
+  function edgeRequest(headers: Record<string, string>): Request {
+    const request = plainRequest(headers);
+    Object.defineProperty(request, 'cf', { value: { colo: 'SJC' } });
+    return request;
+  }
+
+  function resolve(
+    request: Request,
+    runtime: Partial<Parameters<typeof resolveVoidAuthOptions>[2]> = {},
+  ) {
+    return resolveVoidAuthOptions(
+      request,
+      { BETTER_AUTH_SECRET: 'secret' },
+      { dialect: 'sqlite', providers: null, ...runtime },
+      {} as never,
+    );
+  }
+
+  it('limits auth requests per Cloudflare client IP on a deployed Worker', async () => {
+    const { options } = await resolve(edgeRequest({ 'cf-connecting-ip': '203.0.113.7' }));
+    expect(options.rateLimit?.enabled).toBe(true);
+    expect(options.advanced?.ipAddress?.ipAddressHeaders).toEqual(['cf-connecting-ip']);
+  });
+
+  it('leaves the dev server unlimited', async () => {
+    const { options } = await resolve(edgeRequest({ 'cf-connecting-ip': '203.0.113.7' }), {
+      dev: true,
+    });
+    expect(options.rateLimit).toBeUndefined();
+  });
+
+  it('does not trust the Cloudflare IP header outside a Worker', async () => {
+    const { options } = await resolve(plainRequest({ 'cf-connecting-ip': '203.0.113.7' }));
+    expect(options.rateLimit).toBeUndefined();
+    expect(options.advanced).toBeUndefined();
+  });
+
+  it.each(['127.0.0.1', '::1', '::ffff:127.0.0.1'])(
+    'leaves a local preview from %s unlimited',
+    async (ip) => {
+      const { options } = await resolve(edgeRequest({ 'cf-connecting-ip': ip }));
+      expect(options.rateLimit).toBeUndefined();
+      expect(options.advanced).toBeUndefined();
+    },
+  );
+
+  it('does not share one bucket for requests without a client IP', async () => {
+    const { options } = await resolve(edgeRequest({}));
+    expect(options.rateLimit).toBeUndefined();
+    expect(options.advanced).toBeUndefined();
+  });
+
+  it('keeps an explicit rateLimit setting', async () => {
+    const { options } = await resolve(edgeRequest({ 'cf-connecting-ip': '203.0.113.7' }), {
+      userConfig: { rateLimit: { enabled: false, window: 60 } },
+    });
+    expect(options.rateLimit).toEqual({ enabled: false, window: 60 });
+  });
+
+  it('adds the client IP header next to other advanced settings', async () => {
+    const { options } = await resolve(edgeRequest({ 'cf-connecting-ip': '203.0.113.7' }), {
+      userConfig: { advanced: { cookiePrefix: 'x' } },
+    });
+    expect(options.advanced).toEqual({
+      cookiePrefix: 'x',
+      ipAddress: { ipAddressHeaders: ['cf-connecting-ip'] },
+    });
+  });
+
+  it('keeps an explicit ipAddress setting', async () => {
+    const ipAddress = { ipAddressHeaders: ['x-real-ip'], ipv6Subnet: 48 };
+    const { options } = await resolve(edgeRequest({ 'cf-connecting-ip': '203.0.113.7' }), {
+      userConfig: { advanced: { ipAddress } },
+    });
+    expect(options.advanced?.ipAddress).toBe(ipAddress);
+    expect(options.rateLimit?.enabled).toBe(true);
+  });
+});
diff --git a/packages/void/test/unit/cloudflare-operation-process.test.ts b/packages/void/test/unit/cloudflare-operation-process.test.ts
index 24355e4b8..8f88995af 100644
--- a/packages/void/test/unit/cloudflare-operation-process.test.ts
+++ b/packages/void/test/unit/cloudflare-operation-process.test.ts
@@ -1604,7 +1604,7 @@ it('renders binary and text frames from a real Node WebSocket in order and remov
               eventTimestamp: 1790000000000,
               outcome: 'ok',
               logs: [
-                { level: 'log', message: ['binary marker'] },
+                { level: 'log', message: ['binary marker \u001b]52;c;ZXZpbA==\u0007'] },
                 { level: 'error', message: ['error marker'] },
               ],
             },
@@ -1667,6 +1667,8 @@ it('renders binary and text frames from a real Node WebSocket in order and remov
     expect(output.stderr).not.toContain('malformed tail');
     expect(output.stdout).toContain('POST https://isolated.invalid/runtime - ok');
     expect(output.stdout).toContain('  (log) binary marker');
+    expect(output.stdout).not.toContain('\x1b]');
+    expect(output.stdout).not.toContain('\x07');
     expect(output.stdout).toContain('  (error) error marker');
     expect(output.stdout).toContain('Queue owned-queue - ok');
     expect(output.stdout.indexOf('binary marker')).toBeLessThan(
diff --git a/packages/void/test/unit/compile.test.ts b/packages/void/test/unit/compile.test.ts
index baf360da7..b9fc077c7 100644
--- a/packages/void/test/unit/compile.test.ts
+++ b/packages/void/test/unit/compile.test.ts
@@ -1767,6 +1767,30 @@ describe('compileWorkerEntry', () => {
     expect(code).toContain('__setLiveBindingName("VOID_LIVE_abcd1234");');
   });
 
+  it('turns on live dev error messages only in the dev entry', () => {
+    const options = {
+      hasQueues: false,
+      assetsDir: 'assets',
+      webSocketClasses: [],
+      runtimeEnvPath: 'void/_env',
+      sandbox: false,
+      serveSpaFallback: false,
+      live: true,
+    };
+
+    const devCode = compileWorkerEntry({ ...options, dev: true });
+    expect(devCode).toContain('import { __setLiveBindingName, __setLiveDev } from "void/live";');
+    expect(devCode).toContain('__setLiveDev(true);');
+
+    const prodCode = compileWorkerEntry(options);
+    expect(prodCode).toContain('__setLiveBindingName("VOID_LIVE");');
+    expect(prodCode).not.toContain('__setLiveDev');
+    expect(compileWorkerEntry({ ...options, dev: false })).not.toContain('__setLiveDev');
+    expect(compileWorkerEntry({ ...options, live: false, dev: true })).not.toContain(
+      '__setLiveDev',
+    );
+  });
+
   it('re-exports the VoidPlatformSandbox Durable Object class when enabled', () => {
     const code = compileWorkerEntry({
       hasQueues: false,
@@ -1979,6 +2003,10 @@ describe('compileNodeApp', () => {
       'import innerApp, { __voidCollectPrerenderPaths } from "virtual:void-routes"',
     );
     expect(code).toContain('app.post("/__void/prerender-paths"');
+    // Only the prerender runner passes the marker as the Hono env.
+    expect(code).toContain('if (c.env?.__VOID_PRERENDER !== "1") return c.notFound();');
+    expect(code).not.toContain('__VOID_PROXY_TOKEN');
+    expect(code).not.toContain('x-void-internal');
   });
 
   it('generates bun app with hono/bun serveStatic', () => {
@@ -2014,7 +2042,7 @@ describe('compileNodeApp', () => {
     expect(code).toContain('app.use("*", async (c, next)');
     expect(code).toContain('await _validateEnvOnce(process.env)');
     expect(code).toContain(
-      'if (c.req.method !== "POST" || c.req.path !== "/__void/prerender-paths")',
+      'if (!(c.req.method === "POST" && c.req.path === "/__void/prerender-paths" && c.env?.__VOID_PRERENDER === "1")) await _validateEnvOnce(process.env)',
     );
   });
 
diff --git a/packages/void/test/unit/db-studio-remote.test.ts b/packages/void/test/unit/db-studio-remote.test.ts
index fafd502b7..35659b0e4 100644
--- a/packages/void/test/unit/db-studio-remote.test.ts
+++ b/packages/void/test/unit/db-studio-remote.test.ts
@@ -1,6 +1,6 @@
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { join, relative } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test';
 
 // ---- hoisted mocks ---------------------------------------------------------
@@ -41,14 +41,20 @@ vi.mock('../../src/cli/client', () => ({
   },
 }));
 
-// Mock writeDrizzleConfig to avoid needing a real schema on disk.
+// Mock the drizzle config writers to avoid needing a real schema on disk.
 const mockWriteDrizzleConfig = vi.fn<(root: string, dbPath: string, dialect?: string) => string>(
   (root, _dbPath, _dialect) => join(root, '.void', 'drizzle.config.json'),
 );
+const mockWithPrivateDrizzleConfig = vi.fn(
+  (_root: string, _dbUrl: string, _dialect: string, run: (configPath: string) => unknown) =>
+    run(join(tmpdir(), 'void-drizzle-test', 'drizzle.config.json')),
+);
 
 vi.mock('../../src/drizzle/config.ts', () => ({
   writeDrizzleConfig: (...args: Array<unknown>) =>
     mockWriteDrizzleConfig(...(args as Parameters<typeof mockWriteDrizzleConfig>)),
+  withPrivateDrizzleConfig: (...args: Array<unknown>) =>
+    mockWithPrivateDrizzleConfig(...(args as Parameters<typeof mockWithPrivateDrizzleConfig>)),
 }));
 
 // Mock execFileSync (used by runDrizzleKit) so no child process is spawned.
@@ -79,6 +85,14 @@ vi.mock('@voidzero-dev/vite-plus-prompts', () => ({
 
 const roots: Array<string> = [];
 
+function expectConfigOutsideRoot(root: string): void {
+  expect(mockExecFileSync).toHaveBeenCalledTimes(1);
+  const cliArgs = (mockExecFileSync.mock.calls[0] as unknown as [string, Array<string>])[1];
+  const configPath = cliArgs[cliArgs.indexOf('--config') + 1];
+  expect(configPath).toBeDefined();
+  expect(relative(root, configPath!).startsWith('..')).toBe(true);
+}
+
 function createProjectRoot(options: { database?: 'pg' } = {}): string {
   const root = mkdtempSync(join(tmpdir(), 'void-db-studio-remote-'));
   roots.push(root);
@@ -127,7 +141,7 @@ describe('void db studio --remote (PostgreSQL)', () => {
     }
   });
 
-  it('fetches the database URL via getDatabaseUrl and calls writeDrizzleConfig with it', async () => {
+  it('fetches the database URL via getDatabaseUrl and keeps it out of the project directory', async () => {
     const root = createProjectRoot({ database: 'pg' });
     const dbUrl = 'postgres://user:pass@host:5432/mydb';
     mockGetDatabaseUrl.mockResolvedValue({ url: dbUrl });
@@ -135,7 +149,27 @@ describe('void db studio --remote (PostgreSQL)', () => {
     await runDbCommand(root, { action: 'studio', remote: true });
 
     expect(mockGetDatabaseUrl).toHaveBeenCalledTimes(1);
-    expect(mockWriteDrizzleConfig).toHaveBeenCalledWith(root, dbUrl, 'postgresql');
+    expect(mockWithPrivateDrizzleConfig).toHaveBeenCalledWith(
+      root,
+      dbUrl,
+      'postgresql',
+      expect.any(Function),
+    );
+    expect(mockWriteDrizzleConfig).not.toHaveBeenCalled();
+    expectConfigOutsideRoot(root);
+  });
+
+  it('exits with code 1 when drizzle-kit studio fails', async () => {
+    const root = createProjectRoot({ database: 'pg' });
+    mockGetDatabaseUrl.mockResolvedValue({ url: 'postgres://user:pass@host:5432/mydb' });
+    mockExecFileSync.mockImplementationOnce(() => {
+      throw new Error('Command failed');
+    });
+
+    await expect(runDbCommand(root, { action: 'studio', remote: true })).rejects.toThrow(
+      'process.exit:1',
+    );
+    expect(mockWithPrivateDrizzleConfig).toHaveBeenCalledTimes(1);
   });
 
   it('spawns drizzle-kit studio --config <configPath>', async () => {
@@ -173,8 +207,9 @@ describe('void db studio --remote (PostgreSQL)', () => {
       .map((c: Array<unknown>) => String(c[0]))
       .join('\n');
     expect(errorCalls).toContain('void db set-url');
-    // writeDrizzleConfig and execFileSync must NOT have been called
+    // No config may be written and drizzle-kit must NOT have been spawned
     expect(mockWriteDrizzleConfig).not.toHaveBeenCalled();
+    expect(mockWithPrivateDrizzleConfig).not.toHaveBeenCalled();
     expect(mockExecFileSync).not.toHaveBeenCalled();
   });
 
@@ -255,6 +290,7 @@ describe('void db studio --remote (D1)', () => {
     expect(errorCalls).toContain('void db execute --remote');
 
     expect(mockWriteDrizzleConfig).not.toHaveBeenCalled();
+    expect(mockWithPrivateDrizzleConfig).not.toHaveBeenCalled();
     expect(mockExecFileSync).not.toHaveBeenCalled();
     expect(mockGetDatabaseUrl).not.toHaveBeenCalled();
   });
@@ -294,6 +330,43 @@ describe('void db studio (local, regression)', () => {
     expect(mockGetDatabaseUrl).not.toHaveBeenCalled();
   });
 
+  it('local PG studio keeps the .env database URL out of the project directory', async () => {
+    const root = createProjectRoot({ database: 'pg' });
+    const dbUrl = 'postgres://local:pass@localhost:5432/dev';
+    writeFileSync(join(root, '.env'), `DATABASE_URL=${dbUrl}\n`);
+
+    await runDbCommand(root, { action: 'studio' });
+
+    expect(mockGetDatabaseUrl).not.toHaveBeenCalled();
+    expect(mockWithPrivateDrizzleConfig).toHaveBeenCalledWith(
+      root,
+      dbUrl,
+      'postgresql',
+      expect.any(Function),
+    );
+    expect(mockWriteDrizzleConfig).not.toHaveBeenCalled();
+    expectConfigOutsideRoot(root);
+  });
+
+  it('PG push keeps the .env database URL out of the project directory', async () => {
+    const root = createProjectRoot({ database: 'pg' });
+    const dbUrl = 'postgres://local:pass@localhost:5432/dev';
+    writeFileSync(join(root, '.env'), `DATABASE_URL=${dbUrl}\n`);
+
+    await runDbCommand(root, { action: 'push' });
+
+    expect(mockWithPrivateDrizzleConfig).toHaveBeenCalledWith(
+      root,
+      dbUrl,
+      'postgresql',
+      expect.any(Function),
+    );
+    expect(mockWriteDrizzleConfig).not.toHaveBeenCalled();
+    const cliArgs = (mockExecFileSync.mock.calls[0] as unknown as [string, Array<string>])[1];
+    expect(cliArgs).toContain('push');
+    expectConfigOutsideRoot(root);
+  });
+
   it('local PG studio does not call getDatabaseUrl (uses local URL path)', async () => {
     const root = createProjectRoot({ database: 'pg' });
 
diff --git a/packages/void/test/unit/drizzle-config.test.ts b/packages/void/test/unit/drizzle-config.test.ts
index 17cddc3c4..8d41a29b1 100644
--- a/packages/void/test/unit/drizzle-config.test.ts
+++ b/packages/void/test/unit/drizzle-config.test.ts
@@ -1,9 +1,9 @@
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { dirname, join, relative } from 'node:path';
 import { toSlash } from 'pathslash';
 import { describe, it, expect, beforeEach, afterEach } from 'vite-plus/test';
-import { writeDrizzleConfig } from '../../src/drizzle/config.ts';
+import { withPrivateDrizzleConfig, writeDrizzleConfig } from '../../src/drizzle/config.ts';
 
 describe('writeDrizzleConfig', () => {
   let root: string;
@@ -96,3 +96,99 @@ describe('writeDrizzleConfig', () => {
     expect(config.schema).toBe('./.void/better-auth-schema.ts');
   });
 });
+
+describe('withPrivateDrizzleConfig', () => {
+  let root: string;
+  const dbUrl = 'postgres://user:secret@db.example.com:5432/app';
+
+  beforeEach(() => {
+    root = join(tmpdir(), `void-drizzle-private-${Date.now()}`);
+    mkdirSync(join(root, 'db'), { recursive: true });
+    writeFileSync(join(root, 'db/schema.ts'), 'export const users = {};');
+  });
+
+  afterEach(() => {
+    rmSync(root, { recursive: true, force: true });
+  });
+
+  it('passes a config outside the project that holds the database URL', () => {
+    const result = withPrivateDrizzleConfig(root, dbUrl, 'postgresql', (configPath) => {
+      expect(relative(root, configPath).startsWith('..')).toBe(true);
+      const config = JSON.parse(readFileSync(configPath, 'utf-8'));
+      expect(config.dbCredentials.url).toBe(dbUrl);
+      expect(config.dialect).toBe('postgresql');
+      expect(config.schema).toBe('./db/schema.ts');
+      expect(config.out).toBe('./db/migrations');
+      return 'ran';
+    });
+    expect(result).toBe('ran');
+    expect(existsSync(join(root, '.void', 'drizzle.config.json'))).toBe(false);
+  });
+
+  it.skipIf(process.platform === 'win32')('writes the config readable by the owner only', () => {
+    withPrivateDrizzleConfig(root, dbUrl, 'postgresql', (configPath) => {
+      expect(statSync(configPath).mode & 0o777).toBe(0o600);
+      expect(statSync(dirname(configPath)).mode & 0o777).toBe(0o700);
+    });
+  });
+
+  it('removes the config after run returns', () => {
+    let seen = '';
+    withPrivateDrizzleConfig(root, dbUrl, 'postgresql', (configPath) => {
+      seen = configPath;
+    });
+    expect(seen).not.toBe('');
+    expect(existsSync(dirname(seen))).toBe(false);
+  });
+
+  it('removes the config after run throws', () => {
+    let seen = '';
+    expect(() =>
+      withPrivateDrizzleConfig(root, dbUrl, 'mysql', (configPath) => {
+        seen = configPath;
+        throw new Error('drizzle-kit failed');
+      }),
+    ).toThrow('drizzle-kit failed');
+    expect(seen).not.toBe('');
+    expect(existsSync(dirname(seen))).toBe(false);
+  });
+
+  it('keeps a SIGINT listener only while run executes', () => {
+    const before = process.listenerCount('SIGINT');
+    withPrivateDrizzleConfig(root, dbUrl, 'postgresql', () => {
+      expect(process.listenerCount('SIGINT')).toBe(before + 1);
+    });
+    expect(process.listenerCount('SIGINT')).toBe(before);
+  });
+
+  it('still reports a missing schema', () => {
+    rmSync(join(root, 'db', 'schema.ts'));
+    const before = process.listenerCount('SIGINT');
+    expect(() => withPrivateDrizzleConfig(root, dbUrl, 'postgresql', () => undefined)).toThrow(
+      'No Drizzle schema found',
+    );
+    expect(process.listenerCount('SIGINT')).toBe(before);
+  });
+
+  it('removes a project config that an older CLI left with a database URL', () => {
+    const leftover = join(root, '.void', 'drizzle.config.json');
+    mkdirSync(dirname(leftover), { recursive: true });
+    writeFileSync(
+      leftover,
+      JSON.stringify({ dialect: 'postgresql', dbCredentials: { url: 'postgres://u:old@db/app' } }),
+    );
+    withPrivateDrizzleConfig(root, dbUrl, 'postgresql', () => undefined);
+    expect(existsSync(leftover)).toBe(false);
+  });
+
+  it.each(['postgresql://dummy', 'mysql://dummy', ':memory:', '/project/.void/local.sqlite'])(
+    'keeps a project config whose URL is %j',
+    (url) => {
+      const config = join(root, '.void', 'drizzle.config.json');
+      mkdirSync(dirname(config), { recursive: true });
+      writeFileSync(config, JSON.stringify({ dbCredentials: { url } }));
+      withPrivateDrizzleConfig(root, dbUrl, 'postgresql', () => undefined);
+      expect(existsSync(config)).toBe(true);
+    },
+  );
+});
diff --git a/packages/void/test/unit/email-send.test.ts b/packages/void/test/unit/email-send.test.ts
index 9a37a58b9..c9f19f41a 100644
--- a/packages/void/test/unit/email-send.test.ts
+++ b/packages/void/test/unit/email-send.test.ts
@@ -688,7 +688,7 @@ describe('sendEmail (proxy round trip)', () => {
       }),
     );
     expect(calls).toHaveLength(1);
-    expect(calls[0].url).toContain('/email/send');
+    expect(calls[0].url).toBe('https://email-proxy/email/send');
     const body = calls[0].body as Record<string, unknown>;
     expect(body.projectId).toBe('p_test');
     expect(body.aiToken).toBe('tok');
diff --git a/packages/void/test/unit/isr-cache.test.ts b/packages/void/test/unit/isr-cache.test.ts
index 8eefc489d..019bcbbc5 100644
--- a/packages/void/test/unit/isr-cache.test.ts
+++ b/packages/void/test/unit/isr-cache.test.ts
@@ -569,7 +569,7 @@ describe('handleIsr', () => {
     };
 
     const first = createCtx();
-    await handleIsr(htmlRequest('/search?q=one&utm=a'), env, first.ctx, options, render);
+    await handleIsr(htmlRequest('/search?q=one'), env, first.ctx, options, render);
     await first.flush();
     const second = createCtx();
     const same = await handleIsr(
@@ -584,6 +584,7 @@ describe('handleIsr', () => {
     await handleIsr(htmlRequest('/search?q=two'), env, third.ctx, options, render);
     await third.flush();
 
+    expect(same!.headers.get('x-isr-cache')).toBe('HIT');
     expect(await same!.text()).toBe('<html>one</html>');
     expect(render).toHaveBeenCalledTimes(2);
     expect(store.has(isrKey(DPL, HOST, '/search', `https://${HOST}/search?q=one`))).toBe(true);
@@ -591,6 +592,74 @@ describe('handleIsr', () => {
     expect(store.has(isrKey(DPL, HOST, '/search'))).toBe(false);
   });
 
+  it('leaves a cold key empty when the request carries a query param outside the allowlist', async () => {
+    const { store, kv } = createKvMock();
+    const env = makeEnv(kv);
+    const render = vi.fn(async (request: Request) => {
+      const msg = new URL(request.url).searchParams.get('msg') ?? 'clean';
+      return new Response(`<html>${msg}</html>`, { headers: { 'content-type': 'text/html' } });
+    });
+
+    const poisoned = createCtx();
+    const response = await handleIsr(
+      htmlRequest('/blog/post?msg=evil'),
+      env,
+      poisoned.ctx,
+      OPTS,
+      render,
+    );
+    await poisoned.flush();
+    // The caller renders this request live; nothing reaches a shared cache.
+    expect(response).toBeNull();
+    expect(render).not.toHaveBeenCalled();
+    expect([...store.keys()].filter((k) => k.startsWith(isrPrefix(DPL)))).toEqual([]);
+    expect(edge.store.size).toBe(0);
+
+    const clean = createCtx();
+    const fresh = await handleIsr(htmlRequest('/blog/post'), env, clean.ctx, OPTS, render);
+    await clean.flush();
+    expect(fresh!.headers.get('x-isr-cache')).toBe('MISS');
+    expect(await fresh!.text()).toBe('<html>clean</html>');
+    const entry = await readIsrCache(env, HOST, '/blog/post');
+    expect(await new Response(entry!.body).text()).toBe('<html>clean</html>');
+    expect(
+      await edge.store
+        .get(htmlEdgeKey(HOST, '/blog/post', DPL))!
+        .clone()
+        .text(),
+    ).toBe('<html>clean</html>');
+  });
+
+  it('refreshes a stale entry from the cache key URL when the trigger carries an unlisted param', async () => {
+    const { kv, store } = createKvMock();
+    const env = makeEnv(kv);
+    seedEntry(store, '/blog/post', { body: '<html>stale</html>', createdAt: BASE, ttl: 60 });
+    vi.setSystemTime(BASE + 200_000);
+    const { render, requests } = createRender((request) => {
+      const msg = new URL(request.url).searchParams.get('msg') ?? 'clean';
+      return new Response(`<html>${msg}</html>`, { headers: { 'content-type': 'text/html' } });
+    });
+    const { ctx, flush } = createCtx();
+
+    const res = await handleIsr(
+      htmlRequest('/blog/post?msg=evil', { 'X-Test-Marker': 'keep' }),
+      env,
+      ctx,
+      OPTS,
+      render,
+    );
+    expect(res!.headers.get('x-isr-cache')).toBe('STALE');
+    expect(await res!.text()).toBe('<html>stale</html>');
+    await flush();
+
+    expect(requests).toHaveLength(1);
+    expect(requests[0]!.url).toBe(`https://${HOST}/blog/post`);
+    expect(requests[0]!.headers.get('X-Test-Marker')).toBe('keep');
+    const entry = await readIsrCache(env, HOST, '/blog/post');
+    expect(isStale(entry!)).toBe(false);
+    expect(await new Response(entry!.body).text()).toBe('<html>clean</html>');
+  });
+
   it('MISS → renders live, returns MISS, and writes KV + HTML edge in the background', async () => {
     const { store, kv } = createKvMock();
     const env = makeEnv(kv);
diff --git a/packages/void/test/unit/live-server.test.ts b/packages/void/test/unit/live-server.test.ts
index ad6a1789d..41e146617 100644
--- a/packages/void/test/unit/live-server.test.ts
+++ b/packages/void/test/unit/live-server.test.ts
@@ -1,7 +1,7 @@
 import { describe, expect, it, vi } from 'vite-plus/test';
 import type { CloudContext } from '../../src/runtime/handler.ts';
 import { createLiveDurableObject } from '../../src/runtime/live-server.ts';
-import { defineLiveStream, type LiveLimits } from '../../src/runtime/live.ts';
+import { __setLiveDev, defineLiveStream, type LiveLimits } from '../../src/runtime/live.ts';
 
 const LIMITS: LiveLimits = {
   maxSubscriptionsPerConnection: 256,
@@ -656,6 +656,130 @@ describe('live Durable Object runtime', () => {
     const topicName = `live:app:topic:${await topicDigest('app', 'post:12')}`;
     expect(await harness.subscriberCount(topicName)).toBe(0);
   });
+
+  it('hides internal error text when a subscribe hook throws', async () => {
+    const harness = createHarness();
+    const error = new Error('secret detail');
+    const stream = defineLiveStream({
+      id: `subscribe-error-${crypto.randomUUID()}`,
+      allowAnonymousControl: true,
+      onSubscribe() {
+        throw error;
+      },
+    });
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {});
+    try {
+      const response = await stream.control(
+        liveContext(harness.env, 'https://void.live/live', {
+          connectionId: 'connection-subscribe-error',
+          operations: [{ kind: 'subscribe', id: 'card', topic: 'post:12' }],
+        }),
+      );
+      const text = await response.text();
+
+      expect(response.status).toBe(500);
+      expect(JSON.parse(text)).toEqual({
+        accepted: false,
+        error: { code: 'INTERNAL_ERROR', message: 'live: internal error.' },
+      });
+      expect(text).not.toContain('secret detail');
+      expect(consoleError).toHaveBeenCalledWith(error);
+    } finally {
+      consoleError.mockRestore();
+    }
+  });
+
+  it('hides internal error text when a connect hook throws', async () => {
+    const harness = createHarness();
+    const stream = defineLiveStream({
+      id: `connect-error-${crypto.randomUUID()}`,
+      allowAnonymousControl: true,
+      onConnect() {
+        throw new Error('secret detail');
+      },
+    });
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {});
+    try {
+      const response = await stream.connect(
+        liveContext(harness.env, 'https://void.live/live?connectionId=connection-connect-error'),
+      );
+      const text = await response.text();
+
+      expect(response.status).toBe(500);
+      expect(JSON.parse(text)).toEqual({
+        accepted: false,
+        error: { code: 'INTERNAL_ERROR', message: 'live: internal error.' },
+      });
+      expect(text).not.toContain('secret detail');
+      expect(consoleError).toHaveBeenCalledTimes(1);
+    } finally {
+      consoleError.mockRestore();
+    }
+  });
+
+  it('sends the real hook error message in dev only', async () => {
+    const harness = createHarness();
+    const stream = defineLiveStream({
+      id: `dev-error-${crypto.randomUUID()}`,
+      allowAnonymousControl: true,
+      onSubscribe() {
+        throw new Error('hook detail');
+      },
+    });
+    const control = () =>
+      stream.control(
+        liveContext(harness.env, 'https://void.live/live', {
+          connectionId: 'connection-dev-error',
+          operations: [{ kind: 'subscribe', id: 'card', topic: 'post:12' }],
+        }),
+      );
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {});
+    try {
+      __setLiveDev(true);
+      const devResponse = await control();
+      expect(devResponse.status).toBe(500);
+      await expect(devResponse.json()).resolves.toEqual({
+        accepted: false,
+        error: { code: 'INTERNAL_ERROR', message: 'hook detail' },
+      });
+
+      __setLiveDev(false);
+      const prodResponse = await control();
+      expect(prodResponse.status).toBe(500);
+      await expect(prodResponse.json()).resolves.toEqual({
+        accepted: false,
+        error: { code: 'INTERNAL_ERROR', message: 'live: internal error.' },
+      });
+    } finally {
+      __setLiveDev(false);
+      consoleError.mockRestore();
+    }
+  });
+
+  it('keeps specific messages for invalid control requests', async () => {
+    const harness = createHarness();
+    const stream = defineLiveStream({
+      id: `control-json-${crypto.randomUUID()}`,
+      allowAnonymousControl: true,
+    });
+    const ctx = {
+      env: harness.env,
+      req: {
+        raw: new Request('https://void.live/live', { method: 'POST', body: 'not json' }),
+      },
+      get() {
+        return undefined;
+      },
+    } as unknown as CloudContext;
+
+    const response = await stream.control(ctx);
+
+    expect(response.status).toBe(400);
+    expect(await response.json()).toEqual({
+      accepted: false,
+      error: { code: 'BAD_REQUEST', message: 'live: control request body must be JSON.' },
+    });
+  });
 });
 
 function createHarness(options?: {
diff --git a/packages/void/test/unit/logs-rendering.test.ts b/packages/void/test/unit/logs-rendering.test.ts
index e4d9a6e29..01c066a0d 100644
--- a/packages/void/test/unit/logs-rendering.test.ts
+++ b/packages/void/test/unit/logs-rendering.test.ts
@@ -3,6 +3,9 @@ import { stripVTControlCharacters } from 'node:util';
 import { intro, outro } from '@voidzero-dev/vite-plus-prompts';
 import { afterEach, expect, it, vi } from 'vite-plus/test';
 import { runLogsCommand } from '../../src/cli/logs.ts';
+import { sanitizeTerminalLogText } from '../../src/cli/terminal-log-text.ts';
+
+const logsFixture = vi.hoisted(() => ({ entries: undefined as Array<unknown> | undefined }));
 
 vi.mock('../../src/cli/auth.ts', () => ({ getToken: () => 'fixture-token' }));
 vi.mock('../../src/cli/project.ts', () => ({
@@ -12,6 +15,9 @@ vi.mock('../../src/cli/project.ts', () => ({
 vi.mock('../../src/cli/client.ts', () => ({
   PlatformClient: class {
     async getLogs() {
+      if (logsFixture.entries) {
+        return logsFixture.entries;
+      }
       return [
         {
           timestamp: 0,
@@ -52,7 +58,10 @@ vi.mock('../../src/cli/output.ts', async (original) => {
   };
 });
 
-afterEach(() => vi.restoreAllMocks());
+afterEach(() => {
+  logsFixture.entries = undefined;
+  vi.restoreAllMocks();
+});
 
 it.each([40, 80])('aligns wrapped log messages and exceptions at %i columns', async (columns) => {
   const output = Object.assign(
@@ -86,3 +95,105 @@ it.each([40, 80])('aligns wrapped log messages and exceptions at %i columns', as
     expect(lines.slice(1).every((line) => line.startsWith(' '.repeat(indent)))).toBe(true);
   }
 });
+
+it('drops terminal control sequences from app log text but keeps colors and line breaks', async () => {
+  logsFixture.entries = [
+    {
+      timestamp: 0,
+      method: 'GET',
+      url: '/search?q=\x1b]52;c;ZXZpbA==\x07',
+      status: '500',
+      outcome: 'exception',
+      logs: [
+        {
+          level: 'error',
+          message: ['a\x1b]52;c;ZXZpbA==\x07b\x1b[2J\rc\n\x1b[31mred\x1b[0m'],
+        },
+      ],
+      exceptions: [
+        {
+          name: 'Error',
+          message: 'see \x1b]8;;https://evil.example\x07click\x1b]8;;\x07 then \u009b2J',
+        },
+      ],
+    },
+  ];
+  const output = Object.assign(
+    new Writable({
+      write(_chunk, _encoding, callback) {
+        callback();
+      },
+    }),
+    { columns: 120 },
+  );
+  vi.spyOn(process, 'stdout', 'get').mockReturnValue(output as typeof process.stdout);
+  const print = vi.spyOn(console, 'log').mockImplementation(() => {});
+  await runLogsCommand('/fixture', '', '1h');
+
+  const printed = print.mock.calls.map((args) => String(args[0] ?? '')).join('\n');
+  for (const unsafe of ['\x1b]', '\x1b[2J', '\r', '\x07', '\u009b']) {
+    expect(printed).not.toContain(unsafe);
+  }
+  expect(printed).toContain('\x1b[31mred');
+  expect(printed).not.toContain('evil.example');
+  expect(printed).toContain('Error: see click then 2J');
+  const error = print.mock.calls
+    .map((args) => String(args[0] ?? ''))
+    .find((line) => line.includes('[error]'))!;
+  expect(stripVTControlCharacters(error).split('\n')).toEqual(['  [error] abc', '          red']);
+});
+
+it('ends app log text with a reset so its styles cannot hide the next printed line', async () => {
+  logsFixture.entries = [
+    {
+      timestamp: 0,
+      method: 'GET',
+      url: '/search?q=\x1b[8m',
+      status: '200',
+      outcome: 'ok',
+      logs: [{ level: 'log', message: ['q=\x1b[8m'] }],
+      exceptions: [{ name: 'Error', message: 'x\x1b[7;30;40m' }],
+    },
+  ];
+  const output = Object.assign(
+    new Writable({
+      write(_chunk, _encoding, callback) {
+        callback();
+      },
+    }),
+    { columns: 120 },
+  );
+  vi.spyOn(process, 'stdout', 'get').mockReturnValue(output as typeof process.stdout);
+  const print = vi.spyOn(console, 'log').mockImplementation(() => {});
+  await runLogsCommand('/fixture', '', '1h');
+
+  const styled = print.mock.calls
+    .map((args) => String(args[0] ?? ''))
+    .filter((line) => line.includes('\x1b[8m') || line.includes('\x1b[7;30;40m'));
+  expect(styled).toHaveLength(3);
+  for (const line of styled) {
+    expect(line.lastIndexOf('\x1b[0m')).toBeGreaterThan(
+      Math.max(line.lastIndexOf('\x1b[8m'), line.lastIndexOf('\x1b[7;30;40m')),
+    );
+  }
+});
+
+it('keeps color codes, newlines and tabs, and removes other escape sequences whole', () => {
+  expect(sanitizeTerminalLogText('\x1b[1;38;2;255;0;0mbold\x1b[0m\tcol\nnext')).toBe(
+    '\x1b[1;38;2;255;0;0mbold\x1b[0m\tcol\nnext\x1b[0m',
+  );
+  expect(sanitizeTerminalLogText('q=\x1b[8m hidden')).toBe('q=\x1b[8m hidden\x1b[0m');
+  expect(sanitizeTerminalLogText('\x1b[38:2::255:0:0mred')).toBe('\x1b[38:2::255:0:0mred\x1b[0m');
+  expect(sanitizeTerminalLogText('a\x1b]52;c;ZXZpbA==\x07b')).toBe('ab');
+  expect(
+    sanitizeTerminalLogText('see \x1b]8;;https://evil.example/\x1b\\docs\x1b]8;;\x1b\\ now'),
+  ).toBe('see docs now');
+  expect(sanitizeTerminalLogText('a\x1b]52;c;ZXZpbA== b')).toBe('a]52;c;ZXZpbA== b');
+  expect(sanitizeTerminalLogText('a\x1b]0;title\nb\x1b[31mc')).toBe('a]0;title\nb\x1b[31mc\x1b[0m');
+  expect(sanitizeTerminalLogText('x\x1b[2J\x1b[?25l\x1b[1A\x1b[>4;1my')).toBe('xy');
+  expect(sanitizeTerminalLogText('a\x1b[2J\x1b[Hb')).toBe('ab');
+  expect(sanitizeTerminalLogText('progress 50%\x1b[K done')).toBe('progress 50% done');
+  expect(sanitizeTerminalLogText('over\rwrite')).toBe('overwrite');
+  expect(sanitizeTerminalLogText('\u009b2J\u0085\u007f\u0000\u0008end')).toBe('2Jend');
+  expect(sanitizeTerminalLogText('plain text, ünïcode ✓')).toBe('plain text, ünïcode ✓');
+});
diff --git a/packages/void/test/unit/operator-cli.test.ts b/packages/void/test/unit/operator-cli.test.ts
index 38c351220..42797cf57 100644
--- a/packages/void/test/unit/operator-cli.test.ts
+++ b/packages/void/test/unit/operator-cli.test.ts
@@ -1381,6 +1381,42 @@ describe('operator transport and execution', () => {
     ]);
   });
 
+  it('neutralizes C1 terminal controls in human operator output', async () => {
+    vi.stubEnv('VOID_API_URL', 'https://one.example');
+    vi.stubEnv('VOID_OPERATOR_TOKEN', 'operator');
+    const write = vi.spyOn(console, 'log').mockImplementation(() => {});
+    vi.stubGlobal(
+      'fetch',
+      vi.fn<typeof fetch>().mockResolvedValue(
+        Response.json({
+          data: [
+            {
+              timestamp: 1234,
+              method: 'GET',
+              url: '/x\u009b2J',
+              status: '503',
+              outcome: 'exception',
+              logs: [{ level: 'error', message: ['hi \u009b2J', '\u009d52;c;ZXZpbA==\u009c'] }],
+              exceptions: [{ name: 'Error\u009b', message: 'bad\u009b31m' }],
+            },
+          ],
+          nextCursor: null,
+          watermark: '1235',
+        }),
+      ),
+    );
+
+    await runOperatorCommand(parseOperatorArgs(['deployment', 'logs', 'deployment-1']));
+
+    const lines = write.mock.calls.map(([line]) => String(line));
+    expect(lines).toEqual([
+      '1234 GET /x 2J 503',
+      '  [error] ["hi  2J"," 52;c;ZXZpbA== "]',
+      '  Error : bad 31m',
+    ]);
+    expect(lines.some((line) => /[\u0080-\u009f]/.test(line))).toBe(false);
+  });
+
   it('renders every worker and audit event field without table-column truncation', async () => {
     vi.stubEnv('VOID_API_URL', 'https://one.example');
     vi.stubEnv('VOID_OPERATOR_TOKEN', 'operator');
diff --git a/packages/void/test/unit/pages-client.test.ts b/packages/void/test/unit/pages-client.test.ts
index 22a21068a..ef735fa9f 100644
--- a/packages/void/test/unit/pages-client.test.ts
+++ b/packages/void/test/unit/pages-client.test.ts
@@ -1,5 +1,6 @@
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
 import { createVoidRouter, ssrProxy } from '../../src/pages/client.ts';
+import { createPageNavigationEngine } from '../../src/pages/navigation-engine.ts';
 import { parseCacheFor } from '../../src/pages/prefetch.ts';
 
 type DeferredTestWindow = Window & {
@@ -1258,3 +1259,120 @@ describe('createVoidRouter prefetch', () => {
     expect(resolveDeferred).not.toHaveBeenCalled();
   });
 });
+
+describe('createVoidRouter other-origin visits', () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  async function createRouter() {
+    stubClientGlobals();
+    const fetchMock = vi.fn(async () =>
+      Response.json(
+        { component: 'users', props: { users: [] } },
+        { headers: { 'X-VoidPages': 'true' } },
+      ),
+    );
+    vi.stubGlobal('fetch', fetchMock);
+    const applyUpdate = vi.fn();
+    const { router } = await createVoidRouter({
+      adapter: {
+        applyUpdate,
+        createDeferred: vi.fn(() => ({})),
+        isLoading: vi.fn(() => false),
+        rejectDeferred: vi.fn((_ref, error) => error),
+        resolveDeferred: vi.fn((_ref, value) => value),
+      },
+      components: {
+        home: vi.fn(async () => ({ default: {} })),
+        users: vi.fn(async () => ({ default: {} })),
+      },
+      layoutTree: {},
+      matchRoute: vi.fn((url) => (url === '/users' ? 'users' : 'home')),
+      prefetchDefaultCacheFor: parseCacheFor('30s'),
+      prefetchHoverDelay: 75,
+      routeMeta: {},
+      viewTransitions: false,
+    });
+    return { router, fetchMock, applyUpdate };
+  }
+
+  it.each(['javascript:alert(1)', ' JaVaScRiPt:alert(1)', 'data:text/html,x'])(
+    'rejects %j without fetching or assigning location',
+    async (url) => {
+      const { router, fetchMock, applyUpdate } = await createRouter();
+
+      await expect(router.visit(url)).rejects.toThrow(/refusing to navigate/);
+      expect(fetchMock).not.toHaveBeenCalled();
+      expect(applyUpdate).not.toHaveBeenCalled();
+      expect(window.location.href).toBeUndefined();
+    },
+  );
+
+  it('rejects a same-origin blob URL passed straight to the navigation engine', async () => {
+    stubClientGlobals();
+    const fetchMock = vi.fn(
+      async () => new Response('<script></script>', { headers: { 'Content-Type': 'text/html' } }),
+    );
+    vi.stubGlobal('fetch', fetchMock);
+    const engine = await createPageNavigationEngine({
+      adapter: {
+        createDeferred: () => ({}),
+        resolveDeferred: (_ref, value) => value,
+        rejectDeferred: (_ref, error) => error,
+        isLoading: () => false,
+      },
+      components: { home: async () => ({ default: {} }) },
+      layoutTree: {},
+      routeMeta: {},
+      matchRoute: () => 'home',
+      viewTransitions: false,
+      prefetchHoverDelay: 75,
+      prefetchDefaultCacheFor: parseCacheFor('30s'),
+    });
+
+    const resource = engine.prepareVisit(
+      'blob:http://localhost/0b5e4c1a-7f0d-4f9e-9b52-1c3d2e4f5a6b',
+    );
+
+    await expect(resource.shell).rejects.toThrow('refusing to navigate to a blob: URL');
+    expect(fetchMock).not.toHaveBeenCalled();
+    expect(window.location.href).toBeUndefined();
+  });
+
+  it('sends other-origin http(s) GET visits to a full page load without fetching', async () => {
+    const { router, fetchMock, applyUpdate } = await createRouter();
+
+    await expect(router.visit('https://other.example/x?y=1#z')).resolves.toBeUndefined();
+    expect(fetchMock).not.toHaveBeenCalled();
+    expect(applyUpdate).not.toHaveBeenCalled();
+    expect(window.location.href).toBe('https://other.example/x?y=1#z');
+  });
+
+  it('rejects non-GET visits to another origin without sending them', async () => {
+    const { router, fetchMock } = await createRouter();
+
+    await expect(
+      router.visit('https://other.example/x', { method: 'POST', data: { a: 1 } }),
+    ).rejects.toThrow('Void Router: non-GET visits must target the current origin.');
+    expect(fetchMock).not.toHaveBeenCalled();
+    expect(window.location.href).toBeUndefined();
+  });
+
+  it('still loads absolute same-origin URLs in place', async () => {
+    const { router, fetchMock, applyUpdate } = await createRouter();
+
+    await router.visit('http://localhost/users');
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fetchMock).toHaveBeenCalledWith(
+      '/users',
+      expect.objectContaining({
+        method: 'GET',
+        headers: expect.objectContaining({ 'X-VoidPages': 'true' }),
+      }),
+    );
+    expect(applyUpdate).toHaveBeenCalledTimes(1);
+    expect(applyUpdate.mock.calls[0][0]).toMatchObject({ component: 'users' });
+    expect(window.location.href).toBeUndefined();
+  });
+});
diff --git a/packages/void/test/unit/pages-compile.test.ts b/packages/void/test/unit/pages-compile.test.ts
index afc1e76af..0ffc6091d 100644
--- a/packages/void/test/unit/pages-compile.test.ts
+++ b/packages/void/test/unit/pages-compile.test.ts
@@ -86,6 +86,12 @@ describe('Pages metadata wiring', () => {
     expect(code).toContain('namedActions: true');
     expect(code).not.toContain('handlePageMutation(handler');
   });
+  it('marks page render options as dev only in dev builds', () => {
+    expect(compile()).toContain('renderOptions: {"renderMode":"server","dev":true} }');
+    const prod = compile({ ...testOptions, dev: false });
+    expect(prod).toContain('renderOptions: {"renderMode":"server"} }');
+    expect(prod).not.toContain('"renderMode":"server","dev"');
+  });
   it('passes dev CSS metadata and a shared manifest loader to the runtime', () => {
     const code = compile();
     expect(code).toContain('getVoidPagesDevCss');
diff --git a/packages/void/test/unit/pages-protocol.test.ts b/packages/void/test/unit/pages-protocol.test.ts
index 4706c4849..2129e378c 100644
--- a/packages/void/test/unit/pages-protocol.test.ts
+++ b/packages/void/test/unit/pages-protocol.test.ts
@@ -1,4 +1,5 @@
 import { Hono, type Context } from 'hono';
+import { HTTPException } from 'hono/http-exception';
 import { describe, expect, it, vi } from 'vite-plus/test';
 import { defer } from '../../src/pages/defer.ts';
 import {
@@ -932,7 +933,8 @@ describe('handlePageGet with deferred props', () => {
     expect(deferredLine.data).toEqual({ requests: 100 });
   });
 
-  it('SPA — streams error for failed deferred resolver', async () => {
+  it('SPA — dev streams the raw error for a failed deferred resolver', async () => {
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {});
     const c = await createTestContext('GET', '/dashboard', {
       headers: { 'x-voidpages': 'true' },
     });
@@ -942,22 +944,112 @@ describe('handlePageGet with deferred props', () => {
       usage: defer(() => Promise.reject(new Error('timeout'))),
     }));
 
-    const response = await handlePageGet(
-      handler,
-      undefined,
-      c,
-      'dashboard',
-      mockRenderFn,
-      mockGetAssetTags,
-    );
+    try {
+      const response = await handlePageGet(
+        handler,
+        undefined,
+        c,
+        'dashboard',
+        mockRenderFn,
+        mockGetAssetTags,
+        undefined,
+        { dev: true },
+      );
 
-    const text = await response.text();
-    const lines = text.trim().split('\n');
-    expect(lines.length).toBe(2);
+      const text = await response.text();
+      const lines = text.trim().split('\n');
+      expect(lines.length).toBe(2);
 
-    const deferredLine = JSON.parse(lines[1]);
-    expect(deferredLine.__deferred).toBe('usage');
-    expect(deferredLine.error).toBe('timeout');
+      const deferredLine = JSON.parse(lines[1]);
+      expect(deferredLine.__deferred).toBe('usage');
+      expect(deferredLine.error).toBe('timeout');
+    } finally {
+      consoleError.mockRestore();
+    }
+  });
+
+  it('SPA — production streams a generic error and logs the original', async () => {
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {});
+    const c = await createTestContext('GET', '/dashboard', {
+      headers: { 'x-voidpages': 'true' },
+    });
+    const error = new Error('db 10.0.0.5 refused');
+
+    try {
+      const response = await handlePageGet(
+        () => ({ usage: defer(() => Promise.reject(error)) }),
+        undefined,
+        c,
+        'dashboard',
+        mockRenderFn,
+        mockGetAssetTags,
+      );
+
+      const text = await response.text();
+      expect(text).not.toContain('10.0.0.5');
+      expect(JSON.parse(text.trim().split('\n')[1])).toEqual({
+        __deferred: 'usage',
+        error: 'Internal Server Error',
+      });
+      expect(consoleError).toHaveBeenCalledWith(error);
+    } finally {
+      consoleError.mockRestore();
+    }
+  });
+
+  it('SSR — production rejects deferred props with a generic error', async () => {
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {});
+    const c = await createTestContext('GET', '/dashboard');
+    const error = new Error('db 10.0.0.5 refused');
+
+    try {
+      const response = await handlePageGet(
+        () => ({ usage: defer(() => Promise.reject(error)) }),
+        undefined,
+        c,
+        'dashboard',
+        mockRenderFn,
+        mockGetAssetTags,
+      );
+
+      const text = await response.text();
+      expect(text).not.toContain('10.0.0.5');
+      expect(text).toContain('window.__rejectDeferred("usage","Internal Server Error")');
+      expect(consoleError).toHaveBeenCalledWith(error);
+    } finally {
+      consoleError.mockRestore();
+    }
+  });
+
+  it('SPA — production keeps HTTPException messages for deferred props', async () => {
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {});
+    const c = await createTestContext('GET', '/dashboard', {
+      headers: { 'x-voidpages': 'true' },
+    });
+
+    try {
+      const response = await handlePageGet(
+        () => ({
+          usage: defer(() =>
+            Promise.reject(new HTTPException(403, { message: 'Upgrade required' })),
+          ),
+        }),
+        undefined,
+        c,
+        'dashboard',
+        mockRenderFn,
+        mockGetAssetTags,
+      );
+
+      const text = await response.text();
+      expect(JSON.parse(text.trim().split('\n')[1])).toEqual({
+        __deferred: 'usage',
+        error: 'Upgrade required',
+      });
+      expect(consoleError).not.toHaveBeenCalled();
+    } finally {
+      consoleError.mockRestore();
+    }
   });
 
   it('SPA — no deferred props returns normal JSON (not streaming)', async () => {
diff --git a/packages/void/test/unit/plugin-dev-config.test.ts b/packages/void/test/unit/plugin-dev-config.test.ts
new file mode 100644
index 000000000..701771886
--- /dev/null
+++ b/packages/void/test/unit/plugin-dev-config.test.ts
@@ -0,0 +1,114 @@
+import { describe, expect, it, vi } from 'vite-plus/test';
+import {
+  devTriggerSecretGuardPlugin,
+  isDevTriggerSecretRequest,
+} from '../../src/plugin-dev-config.ts';
+
+describe('isDevTriggerSecretRequest', () => {
+  it.each([
+    '/.void/dev-trigger-token',
+    '/.VOID/Dev-Trigger-Token',
+    '/.void/./dev-trigger-token',
+    '/.void//dev-trigger-token',
+    '/.void/x/../dev-trigger-token',
+    '/%2evoid/dev-trigger-token',
+    '/%252evoid/dev-trigger-token',
+    '/.void%2fdev-trigger-token',
+    '/.void%5cdev-trigger-token',
+    '/.void./dev-trigger-token',
+    '/.void/dev-trigger-token.',
+    '/.void/dev-trigger-token?raw',
+    '/.void/dev-trigger-token%',
+    '/@fs/Users/me/app/.void/dev-trigger-token',
+    '/_nuxt/.void/dev-trigger-token',
+    '/.void/dev-triggers.ts?import',
+    '/@id/.void/dev-triggers.ts',
+    '/_nuxt/@fs/Users/me/app/.nuxt/dev/index.mjs',
+    '/_nuxt/@fs/Users/me/app/.nuxt/dev/index.mjs.map',
+    '/dist/.nitro/dev/index.mjs',
+    '/@fs/Users/me/app/dist/.nitro/dev/index.mjs.map',
+    '\\.void\\dev-trigger-token',
+    '/.astro/dev.log',
+    '/.ASTRO/Dev.Log?raw',
+    '/@fs/Users/me/app/.astro/dev.log',
+    '/.void/drizzle.config.json',
+    '/.VOID/Drizzle.Config.json',
+    '/%2evoid/drizzle.config.json',
+    '/@fs/Users/me/app/.void/drizzle.config.json',
+    '/.void/drizzle.config.json?raw',
+  ])('refuses %s', (url) => {
+    expect(isDevTriggerSecretRequest(url)).toBe(true);
+  });
+
+  it.each([
+    undefined,
+    '',
+    '/',
+    '/src/main.ts',
+    '/.void/entry.ts',
+    '/.void/routes.d.ts',
+    '/__void/inbox?token=abc',
+    '/__void/scheduled',
+    '/api/__void/cron-trigger',
+    '/void/dev-trigger-token',
+    '/.voidx/dev-trigger-token',
+    '/_nuxt/.nuxt/components.plugin.mjs',
+    '/_nuxt/@fs/Users/me/app/.nuxt/devtools/x.mjs',
+    '/dist/.nitro/types/nitro.d.ts',
+    '/.astro/dev.json',
+    '/.astro/content.d.ts',
+    '/drizzle.config.json',
+    '/.void/drizzle.config.ts',
+    '/?q=/.void/dev-trigger-token',
+    '/@vite/client',
+  ])('allows %s', (url) => {
+    expect(isDevTriggerSecretRequest(url)).toBe(false);
+  });
+});
+
+describe('devTriggerSecretGuardPlugin', () => {
+  type Middleware = (req: { url?: string }, res: unknown, next: () => void) => void;
+
+  function installGuard(): Middleware {
+    const plugin = devTriggerSecretGuardPlugin();
+    let middleware: Middleware | undefined;
+    const server = {
+      middlewares: {
+        use(fn: Middleware) {
+          middleware = fn;
+        },
+      },
+    };
+    (plugin.configureServer as (this: unknown, s: unknown) => void).call(plugin, server);
+    if (!middleware) {
+      throw new Error('Expected the guard to register a middleware.');
+    }
+    return middleware;
+  }
+
+  it('runs before other dev server plugins and only in serve', () => {
+    const plugin = devTriggerSecretGuardPlugin();
+    expect(plugin.apply).toBe('serve');
+    expect(plugin.enforce).toBe('pre');
+  });
+
+  it('answers 404 for the token file without calling the next middleware', () => {
+    const guard = installGuard();
+    const res = { statusCode: 200, end: vi.fn() };
+    const next = vi.fn();
+    guard({ url: '/.void/dev-trigger-token' }, res, next);
+    expect(res.statusCode).toBe(404);
+    expect(res.end).toHaveBeenCalledTimes(1);
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('passes other requests through untouched', () => {
+    const guard = installGuard();
+    const res = { statusCode: 200, end: vi.fn() };
+    const next = vi.fn();
+    guard({ url: '/src/main.ts' }, res, next);
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(res.statusCode).toBe(200);
+    expect(res.end).not.toHaveBeenCalled();
+  });
+});
diff --git a/packages/void/test/unit/plugin-framework-triggers.test.ts b/packages/void/test/unit/plugin-framework-triggers.test.ts
index beeeee053..14674549e 100644
--- a/packages/void/test/unit/plugin-framework-triggers.test.ts
+++ b/packages/void/test/unit/plugin-framework-triggers.test.ts
@@ -622,4 +622,71 @@ describe('analogDevTriggerInjectPlugin', () => {
     });
     expect(registered).toBeGreaterThan(0);
   });
+
+  async function proxyTrigger(address: unknown) {
+    const root = createTempRoot();
+    const plugin = analogDevTriggerInjectPlugin(root);
+    let proxy: ((req: unknown, res: unknown, next: (err?: unknown) => void) => unknown) | undefined;
+    // The temp root is removed after each test, so skip the process exit cleanup hook.
+    const once = vi.spyOn(process, 'once').mockReturnValue(process);
+    callConfigureServer(plugin, {
+      httpServer: { once() {}, address: () => address },
+      middlewares: {
+        use(fn: typeof proxy) {
+          proxy = fn;
+        },
+      },
+    });
+    once.mockRestore();
+    const fetchSpy = vi
+      .spyOn(globalThis, 'fetch')
+      .mockImplementation(async () => new Response('ok', { status: 202 }));
+    const req = {
+      method: 'POST',
+      url: '/__void/scheduled',
+      headers: { host: 'evil.example/.localhost', 'content-type': 'application/json' },
+      async *[Symbol.asyncIterator]() {
+        yield Buffer.from('{"cron":"* * * * *"}');
+      },
+    };
+    const res = {
+      statusCode: 0,
+      body: undefined as Buffer | undefined,
+      setHeader() {},
+      end(body: Buffer) {
+        res.body = body;
+      },
+    };
+    const next = vi.fn();
+    await proxy!(req, res, next);
+    return { fetchSpy, res, next };
+  }
+
+  it('proxies to the bound dev server, not the request Host', async () => {
+    const { fetchSpy, res, next } = await proxyTrigger({
+      address: '::',
+      family: 'IPv6',
+      port: 51234,
+    });
+    expect(next).not.toHaveBeenCalled();
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+    expect(fetchSpy.mock.calls[0]![0]).toBe('http://localhost:51234/api/__void/cron-trigger');
+    expect(res.statusCode).toBe(202);
+    expect(res.body?.toString()).toBe('ok');
+  });
+
+  it.each([
+    ['0.0.0.0', 'IPv4', 'http://127.0.0.1:51234/api/__void/cron-trigger'],
+    ['127.0.0.1', 'IPv4', 'http://127.0.0.1:51234/api/__void/cron-trigger'],
+    ['::1', 'IPv6', 'http://[::1]:51234/api/__void/cron-trigger'],
+  ])('proxies to the dev server bound to %s', async (bound, family, expected) => {
+    const { fetchSpy } = await proxyTrigger({ address: bound, family, port: 51234 });
+    expect(fetchSpy.mock.calls[0]![0]).toBe(expected);
+  });
+
+  it('leaves trigger requests alone when the dev server is not listening', async () => {
+    const { fetchSpy, next } = await proxyTrigger(null);
+    expect(fetchSpy).not.toHaveBeenCalled();
+    expect(next).toHaveBeenCalledWith();
+  });
 });
diff --git a/packages/void/test/unit/plugin-routing.test.ts b/packages/void/test/unit/plugin-routing.test.ts
index 9bf99cf3f..34e51faf3 100644
--- a/packages/void/test/unit/plugin-routing.test.ts
+++ b/packages/void/test/unit/plugin-routing.test.ts
@@ -174,6 +174,41 @@ describe('routingPlugin', () => {
     expect(workerCode).toContain('cloudflare:workers');
   });
 
+  it('refuses to load the route table in the client environment', async () => {
+    const plugin = routingPlugin(createBareTempRoot(), {
+      isAuthEnabled: () => false,
+      devTriggerToken: 'secret-dev-token',
+    });
+    const config = getHookHandler(plugin.config) as (
+      config: import('vite').UserConfig,
+      env: import('vite').ConfigEnv,
+    ) => void;
+    const configResolved = getHookHandler(plugin.configResolved) as (
+      config: import('vite').ResolvedConfig,
+    ) => void;
+    const buildStart = getHookHandler(plugin.buildStart) as () => Promise<void>;
+    const load = getHookHandler(plugin.load) as (
+      this: { environment?: { name?: string } },
+      id: string,
+    ) => Promise<string | undefined>;
+
+    config({}, { command: 'serve', mode: 'development' });
+    configResolved({
+      build: { assetsDir: 'assets' },
+      command: 'serve',
+      mode: 'development',
+      plugins: [],
+    } as unknown as import('vite').ResolvedConfig);
+    await buildStart.call({} as never);
+
+    await expect(
+      load.call({ environment: { name: 'client' } }, 'virtual:void-routes'),
+    ).rejects.toThrow('server-only');
+    await expect(
+      load.call({ environment: { name: 'void_worker' } }, 'virtual:void-routes'),
+    ).resolves.toContain('secret-dev-token');
+  });
+
   it('restarts dev when a structural route change changes the asset routing policy', async () => {
     const root = createTempRoot();
     writeFileSync(join(root, 'routes', 'api.ts'), 'export const GET = () => new Response();\n');
@@ -518,4 +553,48 @@ describe('routingPlugin', () => {
       expect(code).toContain(`const __VOID_SERVE = ${serve};`);
     },
   );
+
+  // void/live sends the real error message only from the dev server's entry.
+  it.each([
+    { command: 'serve' as const, isPreview: false, dev: true },
+    { command: 'serve' as const, isPreview: true, dev: false },
+    { command: 'build' as const, isPreview: false, dev: false },
+  ])(
+    'writes the live dev flag for $command (preview: $isPreview) as $dev',
+    async ({ command, isPreview, dev }) => {
+      const root = createTempRoot();
+      const plugin = routingPlugin(root, {
+        isAuthEnabled: () => false,
+        live: { bindingName: 'VOID_LIVE', className: 'VoidLiveStreamDurableObject' },
+      });
+      const entryPath = join(root, '.void', 'entry.ts');
+      expect(readFileSync(entryPath, 'utf-8')).not.toContain('__setLiveDev');
+
+      const config = getHookHandler(plugin.config) as (
+        config: import('vite').UserConfig,
+        env: import('vite').ConfigEnv,
+      ) => unknown;
+      const configResolved = getHookHandler(plugin.configResolved) as (
+        config: import('vite').ResolvedConfig,
+      ) => void;
+      const buildStart = getHookHandler(plugin.buildStart) as () => Promise<void>;
+
+      config({}, { command, mode: 'development', isPreview });
+      configResolved({
+        build: { assetsDir: 'assets' },
+        command,
+        mode: 'development',
+        plugins: [],
+      } as unknown as import('vite').ResolvedConfig);
+      await buildStart.call({} as never);
+
+      const entry = readFileSync(entryPath, 'utf-8');
+      expect(entry).toContain('__setLiveBindingName("VOID_LIVE")');
+      if (dev) {
+        expect(entry).toContain('__setLiveDev(true);');
+      } else {
+        expect(entry).not.toContain('__setLiveDev');
+      }
+    },
+  );
 });
diff --git a/packages/void/test/unit/prerender-render.test.ts b/packages/void/test/unit/prerender-render.test.ts
index 8bd43ddbf..a2768233e 100644
--- a/packages/void/test/unit/prerender-render.test.ts
+++ b/packages/void/test/unit/prerender-render.test.ts
@@ -117,4 +117,37 @@ describe('prerender pool', () => {
       );
     },
   );
+
+  it('refuses prerender paths that escape the output directory', async () => {
+    const root = fixture();
+    const clientDir = join(root, 'client');
+    const fetched: Array<string> = [];
+    const outputs: Array<[string, string, string | undefined]> = [];
+    const result = await renderPrerenderPaths(
+      ['/blog/../../escape', '/ok', '/../client/data-escape'],
+      clientDir,
+      async (path) => {
+        fetched.push(path);
+        return new Response('<h1>page</h1>');
+      },
+      async (path) => Response.json({ path }, { headers: { 'X-VoidPages': 'true' } }),
+      (path, outputFile, error) => outputs.push([path, outputFile, error]),
+    );
+    const error = 'prerender path resolves outside the output directory';
+    expect(result.rendered).toEqual(['/ok']);
+    expect(result.failed).toEqual([
+      { path: '/blog/../../escape', error },
+      { path: '/../client/data-escape', error },
+    ]);
+    expect(fetched).toEqual(['/ok']);
+    expect(outputs).toContainEqual(['/blog/../../escape', 'blog/../../escape.html', error]);
+    expect(existsSync(join(root, 'escape.html'))).toBe(false);
+    expect(existsSync(join(clientDir, '_void/escape.json'))).toBe(false);
+    expect(existsSync(join(clientDir, 'data-escape.html'))).toBe(false);
+    expect(existsSync(join(clientDir, '_void/client/data-escape.json'))).toBe(false);
+    expect(readFileSync(join(clientDir, 'ok.html'), 'utf8')).toBe('<h1>page</h1>');
+    expect(JSON.parse(readFileSync(join(clientDir, '_void/pages/ok.json'), 'utf8'))).toEqual({
+      path: '/ok',
+    });
+  });
 });
diff --git a/packages/void/test/unit/prerender.test.ts b/packages/void/test/unit/prerender.test.ts
index 382fdb4e6..de8554a05 100644
--- a/packages/void/test/unit/prerender.test.ts
+++ b/packages/void/test/unit/prerender.test.ts
@@ -130,7 +130,8 @@ const sensitive = [
   'ACTIONS_ID_TOKEN_REQUEST_TOKEN',
 ];
 export default {
-  fetch() {
+  fetch(request, env) {
+    if (env?.__VOID_PRERENDER !== '1') return new Response('Not Found', { status: 404 });
     const paths = process.env.PUBLIC_VALUE === 'visible' ? ['/safe'] : ['/safe-missing'];
     if (sensitive.some((name) => process.env[name])) paths.push('/credential-leaked');
     return Response.json({ paths });
@@ -209,7 +210,7 @@ describe('collectPrerenderPaths (Cloudflare target)', () => {
 export default {
   async fetch(request, env) {
     const url = new URL(request.url);
-    if (url.pathname !== '/__void/prerender-paths') {
+    if (url.pathname !== '/__void/prerender-paths' || env.__VOID_PRERENDER !== '1') {
       return new Response('Not Found', { status: 404 });
     }
     const { results } = await env.DB.prepare('SELECT path FROM pages ORDER BY path').all();
diff --git a/packages/void/test/unit/route-url.test.ts b/packages/void/test/unit/route-url.test.ts
index 860f29463..7a828ecbd 100644
--- a/packages/void/test/unit/route-url.test.ts
+++ b/packages/void/test/unit/route-url.test.ts
@@ -21,4 +21,35 @@ describe('route URL interpolation', () => {
     expect(interpolateRouteParams('/:id', undefined)).toBe('/:id');
     expect(interpolateRouteParams('/:toString', {})).toBe('/:toString');
   });
+
+  it.each([
+    ['/api/posts/:id', { id: '..' }],
+    ['/api/posts/:id', { id: '.' }],
+    ['/files/:path{.+}', { path: 'a/../../admin' }],
+    ['/files/:path{.+}', { path: './x' }],
+  ])('rejects dot segments that would change the path of %s (%j)', (path, params) => {
+    expect(() => interpolateRouteParams(path, params)).toThrow(TypeError);
+    expect(() => interpolateRouteParams(path, params)).toThrow(/it would change the request path/);
+  });
+
+  it('rejects a leading param that would make the path start with //', () => {
+    expect(() => interpolateRouteParams('/:path{.+}', { path: '/evil.com/x' })).toThrow(
+      new TypeError(
+        'Route param "path" would make the request path start with "//", which changes the request host.',
+      ),
+    );
+  });
+
+  it('keeps values that only contain dots or encoded dots', () => {
+    expect(interpolateRouteParams('/api/posts/:id', { id: '...' })).toBe('/api/posts/...');
+    expect(interpolateRouteParams('/api/posts/:id', { id: '.hidden' })).toBe('/api/posts/.hidden');
+    expect(interpolateRouteParams('/api/posts/:id', { id: 'a..b' })).toBe('/api/posts/a..b');
+    expect(interpolateRouteParams('/api/posts/:id', { id: '%2e%2e' })).toBe(
+      '/api/posts/%252e%252e',
+    );
+    expect(interpolateRouteParams('/api/posts/:id', { id: '../admin' })).toBe(
+      '/api/posts/..%2Fadmin',
+    );
+    expect(interpolateRouteParams('/files/:path{.+}', { path: 'a//b' })).toBe('/files/a//b');
+  });
 });
diff --git a/packages/void/test/unit/routing-runtime.test.ts b/packages/void/test/unit/routing-runtime.test.ts
index a7364cf5a..018f0c224 100644
--- a/packages/void/test/unit/routing-runtime.test.ts
+++ b/packages/void/test/unit/routing-runtime.test.ts
@@ -94,6 +94,15 @@ describe('typed HTTP execution', () => {
       'redirect[/old/:id] -> /new/42?set=1 301 (config)',
     );
   });
+  it('keeps catch-all redirects on the same site when the capture starts with a slash', async () => {
+    const app = new Hono();
+    const runtime = createRoutingRuntime(app, { nodeTarget: true });
+    app.use(runtime.contextMiddleware);
+    app.use(runtime.routingMiddleware([{ source: '/en/*', destination: '/:splat', status: 301 }]));
+    const response = await app.fetch(new Request('https://app.test/en//evil.com'));
+    expect(response.status).toBe(301);
+    expect(response.headers.get('location')).toBe('/evil.com');
+  });
   it.each([true, false])('gates dynamic rewrite tracing on dev=%s', async (dev) => {
     const app = new Hono();
     const runtime = createRoutingRuntime(app, { nodeTarget: true, dev });
@@ -171,9 +180,10 @@ describe('typed Worker fetch execution', () => {
     expect(await missing.json()).toEqual({ ready: true });
     expect(missing.headers.get('cache-control')).toBe('no-store');
   });
-  it('validates readiness and app requests while discovery skips validation and checks its token', async () => {
+  it('validates readiness and app requests and answers discovery only for the prerender runner', async () => {
     const validateEnv = vi.fn(async () => {});
-    const fetch = worker({ validateEnv });
+    const collectPrerenderPaths = vi.fn(async () => ['/page']);
+    const fetch = worker({ validateEnv, collectPrerenderPaths });
     const env = { PUBLIC: 'yes', __VOID_PROXY_TOKEN: 'secret' };
     expect(
       await (await fetch(new Request('https://app.test/__void/ready'), env, context)).json(),
@@ -182,18 +192,22 @@ describe('typed Worker fetch execution', () => {
       public: 'yes',
       keys: ['PUBLIC'],
     });
-    const url = 'https://app.test/__void/prerender-paths';
-    expect((await fetch(new Request(url, { method: 'POST' }), env, context)).status).toBe(401);
-    expect(
-      await (
-        await fetch(
-          new Request(url, { method: 'POST', headers: { 'x-void-internal': 'secret' } }),
-          env,
-          context,
-        )
-      ).json(),
-    ).toEqual({ paths: ['/page'] });
     expect(validateEnv).toHaveBeenCalledTimes(2);
+    const url = 'https://app.test/__void/prerender-paths';
+    for (const headers of [{}, { 'x-void-internal': 'secret' }] as Array<Record<string, string>>) {
+      const response = await fetch(new Request(url, { method: 'POST', headers }), env, context);
+      expect(response.status).toBe(404);
+      expect(await response.text()).not.toContain('/page');
+    }
+    expect(collectPrerenderPaths).not.toHaveBeenCalled();
+    expect(validateEnv).toHaveBeenCalledTimes(4);
+    const runner = await fetch(
+      new Request(url, { method: 'POST' }),
+      { PUBLIC: 'yes', __VOID_PRERENDER: '1' },
+      context,
+    );
+    expect(await runner.json()).toEqual({ paths: ['/page'] });
+    expect(validateEnv).toHaveBeenCalledTimes(4);
   });
   it('resolves remote env after validating original bindings and enters scopes before internal routes', async () => {
     const original = { __VOID_REMOTE: '1' };
@@ -431,6 +445,10 @@ describe('typed Pages and SSR execution', () => {
       ['/named', 'default', 200],
       ['/named?save', 'save', 200],
       ['/named?missing', 'Unknown action: missing', 404],
+      ['/named?constructor', 'Unknown action: constructor', 404],
+      ['/named?__proto__', 'Unknown action: __proto__', 404],
+      ['/named?valueOf', 'Unknown action: valueOf', 404],
+      ['/named?toString', 'Unknown action: toString', 404],
       ['/single', 'single', 200],
     ] as const) {
       const response = await app.fetch(new Request('https://app.test' + path, { method: 'POST' }));
diff --git a/packages/vue/src/runtime/use-form.ts b/packages/vue/src/runtime/use-form.ts
index 822580795..9fff54bb0 100644
--- a/packages/vue/src/runtime/use-form.ts
+++ b/packages/vue/src/runtime/use-form.ts
@@ -1,6 +1,7 @@
 import {
   VoidActionError,
   getValidationErrors,
+  interpolateRouteParams,
   isAbortError,
   isEqualFormValue,
   submitAction,
@@ -56,25 +57,7 @@ export function useForm(
   defaults: Record<string, unknown>,
   options?: { params?: Record<string, string> },
 ): UntypedForm {
-  let resolvedUrl = url;
   const formDefaults = defaults;
-
-  // Strip ?action query before param resolution, then re-append
-  let actionQuery = '';
-  const qIdx = resolvedUrl.indexOf('?');
-  if (qIdx !== -1) {
-    actionQuery = resolvedUrl.slice(qIdx);
-    resolvedUrl = resolvedUrl.slice(0, qIdx);
-  }
-
-  if (options?.params) {
-    for (const [key, value] of Object.entries(options.params)) {
-      resolvedUrl = resolvedUrl.replace(`:${key}`, encodeURIComponent(value));
-    }
-  }
-
-  resolvedUrl = resolvedUrl + actionQuery;
-
   const router = inject<VoidRouter | null>('__void_router', null);
   const data = reactive({ ...formDefaults }) as Record<string, unknown>;
   const errors = reactive<Record<string, string>>({});
@@ -138,7 +121,9 @@ export function useForm(
         throw new Error('useForm(): requires the Void Router.');
       }
 
-      const result = await submitAction(router, resolvedUrl, {
+      // Params are filled in on submit, so a param that would change the
+      // request path (such as "..") fails this submit, not the page render.
+      const result = await submitAction(router, interpolateRouteParams(url, options?.params), {
         method,
         data: { ...data },
         ...opts,
diff --git a/packages/vue/test/unit/use-form.test.ts b/packages/vue/test/unit/use-form.test.ts
new file mode 100644
index 000000000..cd6e2577b
--- /dev/null
+++ b/packages/vue/test/unit/use-form.test.ts
@@ -0,0 +1,52 @@
+import { describe, expect, it } from 'vite-plus/test';
+import type { VoidRouter } from 'void/pages-client';
+import { createSSRApp, defineComponent, h } from 'vue';
+import { renderToString } from 'vue/server-renderer';
+import { useForm as typedUseForm } from '../../src/runtime/use-form.ts';
+
+// The public overload only accepts generated action URLs; these tests use plain paths.
+const useForm = typedUseForm as unknown as (
+  url: string,
+  defaults: Record<string, unknown>,
+  options: { params: Record<string, string> },
+) => { post(): Promise<void>; readonly pending: boolean };
+
+async function renderForm(url: string, params: Record<string, string>) {
+  const visits: Array<string> = [];
+  const router = {
+    visit: async (target: string) => {
+      visits.push(target);
+      return {};
+    },
+  } as unknown as VoidRouter;
+  let form!: ReturnType<typeof useForm>;
+  const app = createSSRApp(
+    defineComponent({
+      setup() {
+        form = useForm(url, {}, { params });
+        return () => h('form');
+      },
+    }),
+  );
+  app.provide('__void_router', router);
+  // Rendering stays possible whatever the param holds; only a submit resolves it.
+  await renderToString(app);
+  return { form, visits };
+}
+
+describe('useForm params', () => {
+  it('fills in params and keeps the action query', async () => {
+    const { form, visits } = await renderForm('/users/:name/follow?action=follow', {
+      name: 'a b/c',
+    });
+    await form.post();
+    expect(visits).toEqual(['/users/a%20b%2Fc/follow?action=follow']);
+  });
+
+  it.each(['.', '..'])('refuses to submit when a param is %j', async (name) => {
+    const { form, visits } = await renderForm('/users/:name/follow', { name });
+    await expect(form.post()).rejects.toThrow(TypeError);
+    expect(visits).toEqual([]);
+    expect(form.pending).toBe(false);
+  });
+});
diff --git a/platform/meta/design-docs/0073-custom-domain-http-dcv-migration.md b/platform/meta/design-docs/0073-custom-domain-http-dcv-migration.md
index 30e7c6d76..d9d02dfba 100644
--- a/platform/meta/design-docs/0073-custom-domain-http-dcv-migration.md
+++ b/platform/meta/design-docs/0073-custom-domain-http-dcv-migration.md
@@ -5,6 +5,6 @@ status: implemented
 
 # Custom domain HTTP certificate validation
 
-Custom domains use HTTP certificate validation and a separate DNS ownership check. The user publishes a traffic CNAME and a per-host _cf-custom-hostname TXT value. The platform activates routing only after Cloudflare reports the hostname and certificate active and no ownership challenge remains. The certificate method itself is not the ownership proof. This prevents an unrelated wildcard CNAME from authorizing someone else to attach the hostname.
+Custom domains use HTTP certificate validation and a separate DNS ownership check. The user publishes a traffic CNAME and a per-host _cf-custom-hostname TXT value. The platform activates routing only after Cloudflare reports the hostname and certificate active and no ownership challenge remains. The certificate method itself is not the ownership proof. Cloudflare also accepts the traffic CNAME as ownership proof, so a leftover or wildcard CNAME that points at the platform lets the first project that adds the hostname activate it. The platform accepts this, as other hosting platforms do, so setup needs only the CNAME.
 
 HTTP validation removes user-managed _acme-challenge records and lets Cloudflare renew certificates without new DNS tokens. Existing TXT-validated domains can still pass the method-independent activation gate. Pending registrations are cleaned up after seven days. The [domain routes](../../packages/api/src/routes/domains.ts), [Cloudflare API wrapper](../../packages/api/src/provisioning/cloudflare-api.ts), and [CLI reference](../../../docs/reference/cli.md) define the current flow.
diff --git a/platform/meta/operations.md b/platform/meta/operations.md
index 0eefc17cc..4dc61901b 100644
--- a/platform/meta/operations.md
+++ b/platform/meta/operations.md
@@ -24,7 +24,7 @@ vp run check
 vp test run
 ```
 
-The normal Void Cloud deployment script deploys the proxy first, then applies PostgreSQL migrations and deploys the API, followed by the email gateway, tail, dispatch, and dashboard Workers. The first email rollout uses the separate order in [Configure the shared mail zone](#configure-the-shared-mail-zone). The API hosts the build scheduler and build-container Durable Objects. The optional dashboard uses the API for authentication and is deployed after the API it depends on.
+The normal Void Cloud deployment script deploys the proxy first, then the email gateway, then applies PostgreSQL migrations and deploys the API, followed by the tail, dispatch, and dashboard Workers. The email gateway goes first so it can already relay requests from pages the new API serves, such as the email confirmation form. The first email rollout uses the separate order in [Configure the shared mail zone](#configure-the-shared-mail-zone). The API hosts the build scheduler and build-container Durable Objects. The optional dashboard uses the API for authentication and is deployed after the API it depends on.
 
 The `deploy` and `deploy:staging` scripts in `platform/package.json` target these existing hosted environments. Forks should use `void platform upgrade --runtime` as described in [source deployment](../../docs/guide/platform/development/runtime.md#deploying-source-builds-from-ci).
 
diff --git a/platform/package.json b/platform/package.json
index c21a0417d..51f084e63 100644
--- a/platform/package.json
+++ b/platform/package.json
@@ -5,13 +5,13 @@
   "scripts": {
     "build": "vp run --filter @voidcloud/dashboard build",
     "check": "vp run -r --parallel typecheck",
-    "deploy": "node scripts/wrangler-deploy.ts --preflight --env production && vp run deploy:proxy && vp run deploy:api && vp run deploy:email-gateway && vp run deploy:tail && vp run deploy:dispatch && vp run deploy:dashboard",
+    "deploy": "node scripts/wrangler-deploy.ts --preflight --env production && vp run deploy:proxy && vp run deploy:email-gateway && vp run deploy:api && vp run deploy:tail && vp run deploy:dispatch && vp run deploy:dashboard",
     "deploy:api": "node scripts/wrangler-deploy.ts --preflight --env production && vp run --filter @voidcloud/api migrate && vp run --filter @voidcloud/api deploy --env production",
     "deploy:dashboard": "vp run --filter @voidcloud/dashboard deploy --env production",
     "deploy:dispatch": "vp run --filter @voidcloud/dispatch deploy --env production",
     "deploy:email-gateway": "vp run --filter @voidcloud/email-gateway deploy --env production",
     "deploy:proxy": "vp run --filter @voidcloud/proxy deploy --env production",
-    "deploy:staging": "node scripts/wrangler-deploy.ts --preflight --env staging && vp run deploy:staging:proxy && vp run deploy:staging:api && vp run deploy:staging:email-gateway && vp run deploy:staging:tail && vp run deploy:staging:dispatch && vp run deploy:staging:dashboard",
+    "deploy:staging": "node scripts/wrangler-deploy.ts --preflight --env staging && vp run deploy:staging:proxy && vp run deploy:staging:email-gateway && vp run deploy:staging:api && vp run deploy:staging:tail && vp run deploy:staging:dispatch && vp run deploy:staging:dashboard",
     "deploy:staging:api": "node scripts/wrangler-deploy.ts --preflight --env staging && vp run --filter @voidcloud/api migrate:staging && vp run --filter @voidcloud/api deploy --env staging",
     "deploy:staging:dashboard": "vp run --filter @voidcloud/dashboard deploy --env staging",
     "deploy:staging:dispatch": "vp run --filter @voidcloud/dispatch deploy --env staging",
diff --git a/platform/packages/api/src/admin/react/views/UserDetailPage.tsx b/platform/packages/api/src/admin/react/views/UserDetailPage.tsx
index d557fd739..77c1efa3c 100644
--- a/platform/packages/api/src/admin/react/views/UserDetailPage.tsx
+++ b/platform/packages/api/src/admin/react/views/UserDetailPage.tsx
@@ -169,7 +169,11 @@ export function UserDetailPage({ path, platformName, username }: AdminPageProps)
           <Button type="submit" label="Unsuspend" />
         </form>
       ) : (
-        <form method="post" action={`/admin/users/${user.id}/suspend`}>
+        <form
+          method="post"
+          action={`/admin/users/${user.id}/suspend`}
+          data-confirm={`Suspend "${user.login}" and ${projects.length} project(s)? Requests, cron jobs and queue delivery stop. Queue messages are dropped when their retries run out, after about 3 hours by default. Restore does not bring them back.`}
+        >
           <FormTextInput
             label="Reason"
             name="reason"
diff --git a/platform/packages/api/src/admin/routes/login.ts b/platform/packages/api/src/admin/routes/login.ts
index 7e232a237..19a9d95e3 100644
--- a/platform/packages/api/src/admin/routes/login.ts
+++ b/platform/packages/api/src/admin/routes/login.ts
@@ -16,6 +16,7 @@ import {
   bootstrapPlatformAdmin,
   getUserByOAuthAccount,
   getUserByEmail,
+  getOAuthAccountIdForUser,
   updateUserProviderId,
   createOAuthAccount,
   storeOAuthNonce,
@@ -217,8 +218,13 @@ export async function handleAdminOAuthCallback(context: Context<ApiEnv>): Promis
   // Fall back to email lookup — handles first login after seeding by email
   if (!user && email && emailVerified) {
     const byEmail = await getUserByEmail(db, email);
-    if (byEmail && byEmail.provider === provider) {
-      // Backfill the real provider_id so future logins match directly
+    // Backfill only an account seeded by email that has never signed in with this
+    // provider. Never replace or add to an identity the account already linked.
+    if (
+      byEmail &&
+      byEmail.provider === provider &&
+      (await getOAuthAccountIdForUser(db, byEmail.id, provider)) === null
+    ) {
       await updateUserProviderId(db, byEmail.id, providerId);
       await createOAuthAccount(db, byEmail.id, provider, providerId);
       user = byEmail;
diff --git a/platform/packages/api/src/cron-scheduler.ts b/platform/packages/api/src/cron-scheduler.ts
index 24845fb94..32e6841a9 100644
--- a/platform/packages/api/src/cron-scheduler.ts
+++ b/platform/packages/api/src/cron-scheduler.ts
@@ -2,6 +2,7 @@ import { DurableObject } from 'cloudflare:workers';
 import { CronExpressionParser } from 'cron-parser';
 import type { CronSyncState as CronState } from './cron-scheduler-client.ts';
 import type { ApiEnv } from './env.ts';
+import { projectSuspensionKey } from './suspension.ts';
 
 /**
  * Convert a CF/Quartz-style cron expression to Unix-style for cron-parser.
@@ -229,6 +230,14 @@ export class CronScheduler extends DurableObject<ApiEnv['Bindings']> {
       return;
     }
 
+    if (await this.isProjectSuspended()) {
+      console.warn(
+        `CronScheduler: owner suspended by an administrator; skipping fire for ${state.workerName}`,
+      );
+      await this.scheduleNextAlarm();
+      return;
+    }
+
     // Hand off to the cron-fires queue: this DO cannot dispatch to the user
     // worker directly (see `CronFireMessage`).
     // The worker fans an expression out to every matching job. Deliver the
@@ -293,6 +302,23 @@ export class CronScheduler extends DurableObject<ApiEnv['Bindings']> {
     await this.scheduleNextAlarm();
   }
 
+  /** The DO is always addressed by idFromName(projectId) (cron-scheduler-client.ts). */
+  private async isProjectSuspended(): Promise<boolean> {
+    const projectId = this.ctx.id.name;
+    if (!projectId) {
+      // Alarms armed before the runtime stored names: fire as before until the next sync.
+      return false;
+    }
+    try {
+      return (
+        (await this.env.ROUTING.get(projectSuspensionKey(projectId), { cacheTtl: 60 })) !== null
+      );
+    } catch (error) {
+      console.error(`CronScheduler: suspension check failed for ${projectId}; firing`, error);
+      return false;
+    }
+  }
+
   private async scheduleNextAlarm(): Promise<void> {
     const state = await this.getState();
     if (!state || state.schedules.length === 0) {
diff --git a/platform/packages/api/src/db.ts b/platform/packages/api/src/db.ts
index 0fb1a4403..064aca994 100644
--- a/platform/packages/api/src/db.ts
+++ b/platform/packages/api/src/db.ts
@@ -19,6 +19,7 @@ export {
   updateUserPlan,
   countUserDeploymentsToday,
   getGitHubAccountIdForUser,
+  getOAuthAccountIdForUser,
 } from './db/users.ts';
 
 export {
diff --git a/platform/packages/api/src/db/users.ts b/platform/packages/api/src/db/users.ts
index d05e16ab5..056f8d143 100644
--- a/platform/packages/api/src/db/users.ts
+++ b/platform/packages/api/src/db/users.ts
@@ -339,10 +339,22 @@ export async function countUserDeploymentsToday(db: Db, userId: string): Promise
  * column on membership rows and the connect-authz caller-identity bind.
  */
 export async function getGitHubAccountIdForUser(db: Db, userId: string): Promise<string | null> {
+  return getOAuthAccountIdForUser(db, userId, 'github');
+}
+
+/**
+ * Resolve the provider id of a user's linked identity for `provider`, or null
+ * when the user has never signed in with that provider.
+ */
+export async function getOAuthAccountIdForUser(
+  db: Db,
+  userId: string,
+  provider: string,
+): Promise<string | null> {
   const existing = await db
     .select({ providerId: oauthAccounts.provider_id })
     .from(oauthAccounts)
-    .where(and(eq(oauthAccounts.user_id, userId), eq(oauthAccounts.provider, 'github')))
+    .where(and(eq(oauthAccounts.user_id, userId), eq(oauthAccounts.provider, provider)))
     .limit(1);
   return existing[0]?.providerId ?? null;
 }
diff --git a/platform/packages/api/src/email/send-verification.ts b/platform/packages/api/src/email/send-verification.ts
index 232ecfaa1..cd94d44b1 100644
--- a/platform/packages/api/src/email/send-verification.ts
+++ b/platform/packages/api/src/email/send-verification.ts
@@ -67,13 +67,13 @@ export async function sendPlatformVerificationEmail(
     `The Void project "${project.slug}" wants permission to send email to`,
     `${address}.`,
     '',
-    'Click to confirm:',
+    'Open this link and select Confirm:',
     link,
     '',
     'This link expires in 24 hours and can only be used once.',
     '',
     "If you didn't expect this email, ignore it — no permission is granted",
-    'until the link is clicked.',
+    'until you select Confirm.',
   ].join('\r\n');
 
   try {
diff --git a/platform/packages/api/src/index.ts b/platform/packages/api/src/index.ts
index cbc5f54c3..9d36f6ced 100644
--- a/platform/packages/api/src/index.ts
+++ b/platform/packages/api/src/index.ts
@@ -183,6 +183,15 @@ function isSandboxDrainMaintenanceRequest(request: Request): boolean {
 }
 
 const app = new Hono<ApiEnv>()
+  // No platform page is meant to be framed. Tenant apps can share a site with
+  // the API (e.g. on workers.dev), so a framing page would get the admin cookie.
+  .use('*', async (context, next) => {
+    await next();
+    if (context.res.headers.get('Content-Type')?.startsWith('text/html')) {
+      context.header('X-Frame-Options', 'DENY');
+      context.header('Content-Security-Policy', "frame-ancestors 'none'");
+    }
+  })
   .use('*', async (context, next) => {
     context.env = await resolvePlatformApplicationEnvironment(context.env);
     await next();
diff --git a/platform/packages/api/src/middleware/platform-access.ts b/platform/packages/api/src/middleware/platform-access.ts
index 796845e94..8a316bdb9 100644
--- a/platform/packages/api/src/middleware/platform-access.ts
+++ b/platform/packages/api/src/middleware/platform-access.ts
@@ -7,7 +7,7 @@ import type { ApiEnv } from '../env.ts';
 /** These service-binding routes independently validate purpose-bound credentials. */
 function internallyAuthenticated(method: string, path: string): boolean {
   return (
-    (method === 'GET' && path === '/email/destinations/confirm') ||
+    ((method === 'GET' || method === 'POST') && path === '/email/destinations/confirm') ||
     (method === 'POST' &&
       (/^\/internal\/(?:resolve-resource|resolve-worker|verify-owner|verify-prerender-build)\/[^/]+$/.test(
         path,
diff --git a/platform/packages/api/src/operator/platform-workers.ts b/platform/packages/api/src/operator/platform-workers.ts
index f05ceb46e..165d60ce5 100644
--- a/platform/packages/api/src/operator/platform-workers.ts
+++ b/platform/packages/api/src/operator/platform-workers.ts
@@ -18,6 +18,9 @@ export type PlatformWorker = PlatformWorkerDef & {
   dependedBy: ReadonlyArray<PlatformWorkerName>;
 };
 
+// `deployOrder` follows the platform deploy script; rollback-all runs it in
+// reverse. The API's confirmation page posts back through the email gateway,
+// so the gateway ships before the API and rolls back after it.
 const WORKER_DEFS: ReadonlyArray<PlatformWorkerDef> = [
   {
     name: 'proxy',
@@ -30,21 +33,21 @@ const WORKER_DEFS: ReadonlyArray<PlatformWorkerDef> = [
     name: 'email-gateway',
     prodScript: 'void-email-gateway',
     stagingScript: 'void-email-gateway-staging',
-    dependsOn: ['api'],
-    deployOrder: 4,
+    dependsOn: [],
+    deployOrder: 2,
   },
   {
     name: 'tail',
     prodScript: 'void-tail',
     stagingScript: 'void-tail-staging',
     dependsOn: [],
-    deployOrder: 2,
+    deployOrder: 4,
   },
   {
     name: 'api',
     prodScript: 'void-api',
     stagingScript: 'void-api-staging',
-    dependsOn: ['proxy'],
+    dependsOn: ['proxy', 'email-gateway'],
     deployOrder: 3,
   },
   {
@@ -52,7 +55,7 @@ const WORKER_DEFS: ReadonlyArray<PlatformWorkerDef> = [
     prodScript: 'void-dashboard',
     stagingScript: 'void-dashboard-staging',
     dependsOn: ['api'],
-    deployOrder: 4,
+    deployOrder: 6,
   },
   {
     name: 'dispatch',
diff --git a/platform/packages/api/src/operator/tenant-service.ts b/platform/packages/api/src/operator/tenant-service.ts
index 006aeabd7..6fc4a21f1 100644
--- a/platform/packages/api/src/operator/tenant-service.ts
+++ b/platform/packages/api/src/operator/tenant-service.ts
@@ -61,7 +61,7 @@ import {
   projects,
   users,
 } from '../schema.ts';
-import { isAdminSuspended, routingSuspensionReason } from '../suspension.ts';
+import { isAdminSuspended, projectSuspensionKey, routingSuspensionReason } from '../suspension.ts';
 import { getCurrentBillingPeriodStart } from '../tiers.ts';
 import type { DeployManifest, Project, User } from '../types.ts';
 import {
@@ -687,6 +687,18 @@ async function republishProjectOwnerState(
         }),
       );
     }
+    // Background runs (cron, queues) pause only for an administrator suspension;
+    // usage-limit suspensions keep them running.
+    const markerKey = projectSuspensionKey(project.id);
+    const marker = await context.env.ROUTING.get(markerKey);
+    const reason = owner.suspended_reason;
+    if (reason !== null && isAdminSuspended(reason)) {
+      if (marker !== reason) {
+        await context.env.ROUTING.put(markerKey, reason);
+      }
+    } else if (marker !== null) {
+      await context.env.ROUTING.delete(markerKey);
+    }
     return owner;
   });
 }
@@ -924,6 +936,8 @@ export async function suspendOperatorUser(
     return preview('user.suspend', target, {
       reason,
       projects: projects.map((p) => ({ id: p.id, slug: p.slug })),
+      effect:
+        'Requests, cron jobs and queue delivery stop for these projects. Queue messages are dropped when their retries run out: after about 3 hours by default, at once with maxRetries 0. Restore does not bring them back.',
     });
   }
   // Ordinary users remain edge-first. Administrators have already lost access
diff --git a/platform/packages/api/src/provisioning/activate-domain.ts b/platform/packages/api/src/provisioning/activate-domain.ts
index 50551bdf7..27b655663 100644
--- a/platform/packages/api/src/provisioning/activate-domain.ts
+++ b/platform/packages/api/src/provisioning/activate-domain.ts
@@ -59,27 +59,24 @@ export async function tryActivateDomain(
   const cf = await getCustomHostname(env.CF_ZONE_ID, env.CF_API_TOKEN, domain.cf_hostname_id);
 
   // Custom-hostname validation has two independent axes:
-  //   - Hostname OWNERSHIP — proven by the `_cf-custom-hostname` TXT, surfaced
-  //     as `ownership_verification`, and the input to the top-level `status`.
+  //   - Hostname OWNERSHIP — the input to the top-level `status`. CF accepts
+  //     the `_cf-custom-hostname` TXT (`ownership_verification`), the HTTP
+  //     token, or a CNAME to the SaaS zone (real-time validation).
   //   - Certificate DCV — `ssl.method` / `ssl.validation_records`, the input
   //     to `ssl.status`.
-  // The anti-wildcard-hijack lever is the OWNERSHIP gate, NOT the cert-DCV
-  // method: a wildcard CNAME (`*.victim → cname.void.app`) cannot forge a
-  // per-host `_cf-custom-hostname` TXT value, so ownership stays unsatisfied
-  // and `status` never reaches `active`. Cert DCV (HTTP-based, edge-validated,
-  // auto-renewing) is orthogonal and method-agnostic here, which also keeps
-  // pending domains still on `txt` DCV activatable.
+  // Because the CNAME alone proves ownership, a leftover or wildcard CNAME
+  // (`*.victim → cname.void.app`) lets whoever adds the hostname first
+  // activate it. Other hosting platforms accept the same trade-off; we keep
+  // it so setup needs only the traffic CNAME. Cert DCV (HTTP-based,
+  // edge-validated, auto-renewing) is orthogonal and method-agnostic here,
+  // which also keeps pending domains still on `txt` DCV activatable.
   //
-  // The primary signal is CF's own `status === 'active'`: for a hostname
-  // proxying through CF (which a custom domain always is), CF only flips
-  // `status` to `active` after DNS-based ownership completes. The absence of
+  // The primary signal is CF's own `status === 'active'`. The absence of
   // BOTH outstanding ownership challenges — the TXT `ownership_verification`
   // AND the HTTP `ownership_verification_http` — is defense-in-depth on top
   // of that (CF stops returning them once ownership is proven), so we refuse
   // to route even if CF ever surfaced `active` with an ownership challenge
-  // still outstanding. We deliberately do NOT add our own DNS re-check here:
-  // it would break a domain whenever a user removed the TXT after setup, for
-  // no real gain over CF's gate.
+  // still outstanding.
   const gateOk =
     cf.status === 'active' &&
     cf.ssl.status === 'active' &&
diff --git a/platform/packages/api/src/proxy-token.ts b/platform/packages/api/src/proxy-token.ts
index 541ad5fa6..6f7c0c5de 100644
--- a/platform/packages/api/src/proxy-token.ts
+++ b/platform/packages/api/src/proxy-token.ts
@@ -101,6 +101,7 @@ const encoder = new TextEncoder();
 const legacyKeys = new Map<string, Promise<CryptoKey>>();
 const proxyTokenKeys = new Map<string, Promise<CryptoKey>>();
 const proxyInternalKeys = new Map<string, Promise<CryptoKey>>();
+const aiUsageKeys = new Map<string, Promise<CryptoKey>>();
 
 function cachedKey(
   cache: Map<string, Promise<CryptoKey>>,
@@ -143,7 +144,7 @@ async function hkdfHmacKey(secret: string, salt: string, info: string): Promise<
 }
 
 // JWT_SECRET signs login JWTs, OAuth/link state and the legacy token as a raw
-// HMAC key. The two keys below are HKDF outputs with their own salt and info,
+// HMAC key. The keys below are HKDF outputs with their own salt and info,
 // so they differ from that raw key and from each other: a tenant token never
 // verifies as a proxy internal value, and neither verifies as any raw-key MAC.
 function proxyTokenKey(secret: string): Promise<CryptoKey> {
@@ -158,6 +159,10 @@ function proxyInternalKey(secret: string): Promise<CryptoKey> {
   );
 }
 
+function aiUsageKey(secret: string): Promise<CryptoKey> {
+  return cachedKey(aiUsageKeys, secret, () => hkdfHmacKey(secret, 'void-ai-usage', 'ai-usage'));
+}
+
 // --- Encoding ---
 
 const MAC = /^[A-Za-z0-9_-]{43}$/;
@@ -362,3 +367,20 @@ export async function verifyProxyInternalAuth(
   }
   return verify(proxyInternalKey(jwtSecret), proxyInternalMessage(route, projectId), value);
 }
+
+// --- AI usage tag ---
+
+/**
+ * The project value the proxy writes into AI Gateway metadata and the usage
+ * query filters on: `<projectId>.<22 base64url MAC characters>`. Only the
+ * platform can compute it, so gateway rows written by anyone else never count
+ * toward a project's AI usage.
+ *
+ * Platform only: never put it in a Worker binding or a response. Rotating
+ * JWT_SECRET changes every tag, so counted AI usage restarts for the current
+ * billing period. The project id is not validated here.
+ */
+export async function deriveAiUsageTag(jwtSecret: string, projectId: string): Promise<string> {
+  const mac = await sign(aiUsageKey(jwtSecret), `void-ai-usage\n${projectId}`);
+  return `${projectId}.${mac.slice(0, 22)}`;
+}
diff --git a/platform/packages/api/src/reserved-slugs.ts b/platform/packages/api/src/reserved-slugs.ts
index 830183859..e7d97b5e7 100644
--- a/platform/packages/api/src/reserved-slugs.ts
+++ b/platform/packages/api/src/reserved-slugs.ts
@@ -20,9 +20,10 @@
  * api rather than carrying a copy that can drift.
  *
  * The rest of `RESERVED_SLUGS` (`www`, `api`, `mail`, `smtp`, …) is NOT
- * here: that set has been reserved since the platform's first commit, so
- * no project can hold one of those, and a hostname collision is not a
- * mailbox.
+ * here: a hostname collision is not a mailbox. The certificate-authority
+ * validation mailboxes (`administrator`, `hostmaster`, `webmaster`) were
+ * added to that list later, on purpose for project creation only: an
+ * existing project with one of those names keeps its mail.
  */
 export const EMAIL_RESERVED_SLUGS: ReadonlySet<string> = new Set([
   'abuse',
diff --git a/platform/packages/api/src/routes/auth.ts b/platform/packages/api/src/routes/auth.ts
index 72e428cf9..d75797f5c 100644
--- a/platform/packages/api/src/routes/auth.ts
+++ b/platform/packages/api/src/routes/auth.ts
@@ -73,15 +73,19 @@ app.use('*', async (context, next) => {
       .clone()
       .json()
       .catch(() => null)) as { error?: string } | null;
-    const expired = body?.error === 'invalid or expired OAuth state';
-    context.res = platformBrowserError(
-      context,
-      expired ? 'Your sign-in link expired' : 'Login failed',
-      expired
-        ? 'Start a new sign-in to continue.'
-        : 'Login could not be completed. Start a new sign-in or contact your platform administrator.',
-      context.res.status as 400,
-    );
+    const [title, message] =
+      body?.error === 'invalid or expired OAuth state'
+        ? ['Your sign-in link expired', 'Start a new sign-in to continue.']
+        : body?.error === 'identity_link_required'
+          ? [
+              'This login is not linked',
+              'This email belongs to an existing account. Sign in again with the GitHub or Google account you used before.',
+            ]
+          : [
+              'Login failed',
+              'Login could not be completed. Start a new sign-in or contact your platform administrator.',
+            ];
+    context.res = platformBrowserError(context, title, message, context.res.status as 400);
   }
 });
 app.get('/test', (context) => startLoginTest(context));
@@ -392,6 +396,19 @@ app.get('/callback', async (context) => {
     // Link new provider to existing account with the same email.
     const existing = await getUserByEmail(db, email);
     if (existing) {
+      if (existing.role === 'admin') {
+        // An administrator's login token can open an operator session, so a matching
+        // email alone must not sign in to or link an administrator account.
+        // Administrators sign in with a login already linked to them. Managed login
+        // refuses email links for every account.
+        return context.json(
+          {
+            error: 'identity_link_required',
+            message: 'Sign in again with the GitHub or Google account you used before.',
+          },
+          409,
+        );
+      }
       if (resolvedProvider === 'github') {
         // Enforce RFC 0074's one-github-identity-per-account invariant on the login
         // path too (Vercel model: a Void account has a single GitHub login identity;
diff --git a/platform/packages/api/src/routes/email-confirm.ts b/platform/packages/api/src/routes/email-confirm.ts
index 003bb2ab1..aa0ae0004 100644
--- a/platform/packages/api/src/routes/email-confirm.ts
+++ b/platform/packages/api/src/routes/email-confirm.ts
@@ -2,8 +2,10 @@
  * Token-authenticated endpoint for the platform-side destination verification
  * link. The HMAC-signed token IS the auth — it
  * embeds (project_id, destination_id, address, exp) and is validated
- * against EMAIL_SIGNING_SECRET. Single-use is enforced by DB state: the click
- * flips the destination row to 'verified', so a second click finds an
+ * against EMAIL_SIGNING_SECRET. Opening the link (GET) only shows a Confirm
+ * button and never writes, because mail security scanners fetch every link
+ * in a message. The button's POST flips the destination row to
+ * 'verified'; single use is enforced by DB state, so a second POST finds an
  * already-verified row and returns idempotent success.
  *
  * The email gateway exposes the public URL and relays this exact route through
@@ -14,12 +16,13 @@
  */
 
 import { browserPageLead, browserPageStatus } from '@void/platform/browser-page';
-import { Hono } from 'hono';
+import { Hono, type Context } from 'hono';
 import { verifyConfirmToken } from '../auth/confirm-token.ts';
 import { platformBrowserPage } from '../browser-page.ts';
 import { getEmailDestinationById, getProject, updateEmailDestinationStatus } from '../db.ts';
 import { escapeHtml } from '../email.ts';
 import type { ApiEnv } from '../env.ts';
+import type { EmailDestination } from '../types.ts';
 
 const app = new Hono<ApiEnv>();
 
@@ -33,7 +36,14 @@ app.use('/destinations/confirm', async (context, next) => {
   context.res.headers.set('referrer-policy', 'no-referrer');
 });
 
-app.get('/destinations/confirm', async (context) => {
+type ConfirmTarget = Readonly<{
+  row: EmailDestination;
+  slug: string;
+  token: string;
+}>;
+
+/** Validates the token and loads the destination row it names. */
+async function loadConfirmTarget(context: Context<ApiEnv>): Promise<ConfirmTarget | Response> {
   const token = context.req.query('token');
   if (!token) {
     return platformBrowserPage(
@@ -75,7 +85,36 @@ app.get('/destinations/confirm', async (context) => {
   }
 
   const project = await getProject(context.get('db'), row.project_id);
-  const slug = project?.slug ?? row.project_id;
+  return { row, slug: project?.slug ?? row.project_id, token };
+}
+
+// Mail security scanners open every link in a message, so opening the link
+// only shows the Confirm button; consent is the POST that button sends.
+app.get('/destinations/confirm', async (context) => {
+  const target = await loadConfirmTarget(context);
+  if (target instanceof Response) {
+    return target;
+  }
+  if (target.row.status === 'verified') {
+    return platformBrowserPage(
+      context,
+      'Email confirmed',
+      successPage(target.slug, target.row.address, true),
+    );
+  }
+  return platformBrowserPage(
+    context,
+    'Confirm email permission',
+    consentPage(target.slug, target.row.address, target.token),
+  );
+});
+
+app.post('/destinations/confirm', async (context) => {
+  const target = await loadConfirmTarget(context);
+  if (target instanceof Response) {
+    return target;
+  }
+  const { row, slug } = target;
 
   if (row.status === 'verified') {
     return platformBrowserPage(context, 'Email confirmed', successPage(slug, row.address, true));
@@ -105,6 +144,13 @@ app.get('/destinations/confirm', async (context) => {
   return platformBrowserPage(context, 'Email confirmed', successPage(slug, row.address, false));
 });
 
+function consentPage(slug: string, address: string, token: string): string {
+  return `<div class="void-auth-lead"><h1 id="void-auth-title">Allow ${escapeHtml(slug)} to email ${escapeHtml(address)}?</h1>
+<p>The Void project <strong>${escapeHtml(slug)}</strong> wants permission to send email to <strong>${escapeHtml(address)}</strong>.</p></div>
+<form method="post" action="?token=${escapeHtml(token)}"><button class="void-auth-button void-auth-button-primary" type="submit">Confirm</button></form>
+<p class="void-auth-note">If you didn't expect this, close this page. No permission is granted until you select Confirm.</p>`;
+}
+
 function successPage(slug: string, address: string, alreadyVerified: boolean): string {
   const heading = alreadyVerified ? 'Already confirmed' : 'Email confirmed';
   const lead = alreadyVerified
diff --git a/platform/packages/api/src/routes/projects.ts b/platform/packages/api/src/routes/projects.ts
index 59ca82040..d930939e3 100644
--- a/platform/packages/api/src/routes/projects.ts
+++ b/platform/packages/api/src/routes/projects.ts
@@ -55,6 +55,7 @@ import {
   tryCreateEmailDestination,
   ACTIVE_BUILD_STATUSES,
 } from '../db.ts';
+import { databaseTimestampMs } from '../deploy/recovery.ts';
 import { type ApiEnv, isDevBypass } from '../env.ts';
 import { validateSubmittedExecutionPlans } from '../migrations/execution-plan.ts';
 import { ensureTrackingTable, queryD1, runRemoteMigrations } from '../migrations/remote-runner.ts';
@@ -113,7 +114,7 @@ import { requireProjectRouteCapability } from './project-access.ts';
 import { getRequestsDataset, queryAnalyticsEngine, queryProjectRequestOverview } from './usage.ts';
 
 /**
- * Slugs no project may claim. Two overlapping reasons:
+ * Slugs no project may claim. Three overlapping reasons:
  *
  *  - hostname collisions on `*.void.app` (`www`, `api`, `dash`, `cname`, …),
  *    including the hostname dispatch keeps for platform health probes;
@@ -123,12 +124,17 @@ import { getRequestsDataset, queryAnalyticsEngine, queryProjectRequestOverview }
  *    could send mail indistinguishable from the platform's own. That set
  *    is folded in here rather than listed twice: this check only reaches
  *    NEW projects, so the email path enforces the same set on its own
- *    against a project that registered the slug before it was reserved.
+ *    against a project that registered the slug before it was reserved;
+ *  - certificate-authority domain-validation mailboxes on the shared mail
+ *    domain (`admin`, `administrator`, `hostmaster`, `postmaster`,
+ *    `webmaster`): a project receiving one could pass a CA email check and
+ *    get a certificate for that domain. Reserved for new projects only.
  */
 export const RESERVED_SLUGS = new Set([
   ...EMAIL_RESERVED_SLUGS,
   PLATFORM_HEALTH_HOSTNAME_LABEL,
   'admin',
+  'administrator',
   'api',
   'app',
   'assets',
@@ -143,6 +149,7 @@ export const RESERVED_SLUGS = new Set([
   'ftp',
   'gateway',
   'help',
+  'hostmaster',
   'imap',
   'login',
   'mail',
@@ -161,6 +168,7 @@ export const RESERVED_SLUGS = new Set([
   'static',
   'status',
   'support',
+  'webmaster',
   'www',
 ]);
 
@@ -2663,7 +2671,11 @@ const app = new Hono<ApiEnv>()
     }
 
     const workerName = `user-${project.slug}`;
-    const sinceStr = new Date(Date.now() - sinceMs).toISOString().replace('T', ' ').slice(0, 19);
+    // A slug can be reused after deletion, so rows from before this project
+    // existed belong to an earlier owner.
+    const createdAtMs = databaseTimestampMs(project.created_at) ?? 0;
+    const startMs = Math.max(Date.now() - sinceMs, createdAtMs);
+    const sinceStr = new Date(startMs).toISOString().replace('T', ' ').slice(0, 19);
     const dataset = context.env.LOGS_DATASET ?? 'void_logs';
 
     const deployFilter = deploymentId ? `\n        AND blob7 = '${deploymentId}'` : '';
@@ -2677,6 +2689,10 @@ const app = new Hono<ApiEnv>()
       levelFilter = `\n        AND blob2 LIKE '%"level":"${level}"%'`;
     }
 
+    // `timestamp` is when the row was written, in whole seconds, and keeps the
+    // scan short. An earlier owner's invocation can start before this project
+    // was created and still be written after, so also bound its start time
+    // (`double1`, in ms).
     const query = `
       SELECT
         blob1 as outcome,
@@ -2690,7 +2706,8 @@ const app = new Hono<ApiEnv>()
         min(timestamp) as ingestedAt
       FROM ${dataset}
       WHERE index1 = '${workerName}'
-        AND timestamp >= toDateTime('${sinceStr}')${deployFilter}${levelFilter}
+        AND timestamp >= toDateTime('${sinceStr}')
+        AND double1 >= ${createdAtMs}${deployFilter}${levelFilter}
       ${LOG_ROW_GROUP_BY}
       ORDER BY ingestedAt DESC
       LIMIT ${limit}
diff --git a/platform/packages/api/src/routes/usage.ts b/platform/packages/api/src/routes/usage.ts
index e2cd0f634..7d4a48ed3 100644
--- a/platform/packages/api/src/routes/usage.ts
+++ b/platform/packages/api/src/routes/usage.ts
@@ -3,6 +3,7 @@ import { Hono } from 'hono';
 import { uploadPool } from '../concurrency.ts';
 import type { Db } from '../db.ts';
 import { type ApiEnv, isDevBypass } from '../env.ts';
+import { deriveAiUsageTag } from '../proxy-token.ts';
 import { projectOwnershipPeriods, projects as projectsTable } from '../schema.ts';
 import { getCurrentBillingPeriodStart } from '../tiers.ts';
 import type { Project } from '../types.ts';
@@ -46,6 +47,7 @@ const projectUsage = new Hono<ApiEnv>()
           context.env.CF_ACCOUNT_ID,
           context.env.CF_API_TOKEN,
           context.env.AI_GATEWAY_ID ?? 'void',
+          context.env.JWT_SECRET,
           projectId,
           since,
           undefined,
@@ -114,6 +116,7 @@ const accountUsage = new Hono<ApiEnv>()
           context.env.CF_ACCOUNT_ID,
           context.env.CF_API_TOKEN,
           context.env.AI_GATEWAY_ID ?? 'void',
+          context.env.JWT_SECRET,
           projectWindows.map(({ project, intervals }) => ({ projectId: project.id, intervals })),
         ),
       ]);
@@ -348,6 +351,7 @@ export async function sumAiUsageForWindows(
   accountId: string,
   apiToken: string,
   gatewayId: string,
+  jwtSecret: string,
   windows: ReadonlyArray<{ projectId: string; intervals: ReadonlyArray<AccountUsageInterval> }>,
 ): Promise<Array<number>> {
   const totals = windows.map(() => 0);
@@ -359,6 +363,7 @@ export async function sumAiUsageForWindows(
       accountId,
       apiToken,
       gatewayId,
+      jwtSecret,
       projectId,
       interval.start,
       interval.end,
@@ -580,18 +585,24 @@ async function queryProjectAiUsage(
   accountId: string,
   apiToken: string,
   gatewayId: string,
+  jwtSecret: string,
   projectId: string,
   since: Date,
   until?: Date,
   failOnError = false,
 ): Promise<{ neurons: number }> {
+  // The platform AI Gateway accepts requests from anyone who knows its URL, so
+  // anyone can write a log row with any metadata. The proxy tags its rows with
+  // a value signed under JWT_SECRET; filtering on that value means rows the
+  // platform did not write are never counted.
+  const usageTag = await deriveAiUsageTag(jwtSecret, projectId);
   const query = `query {
   viewer {
     accounts(filter: { accountTag: "${accountId}" }) {
       aiGatewayRequests(
         filter: {
           gatewayId: "${gatewayId}"
-          metadata_projectId: "${projectId}"
+          metadata_projectId: "${usageTag}"
           datetime_geq: "${since.toISOString()}"
           ${until ? `datetime_lt: "${until.toISOString()}"` : ''}
         }
diff --git a/platform/packages/api/src/suspension.ts b/platform/packages/api/src/suspension.ts
index f3d563709..518a9f798 100644
--- a/platform/packages/api/src/suspension.ts
+++ b/platform/packages/api/src/suspension.ts
@@ -17,3 +17,12 @@ export function routingSuspensionReason(suspendedReason: string | null): string
     ? suspendedReason
     : null;
 }
+
+/**
+ * ROUTING key present while a project's owner is suspended by an administrator.
+ * Cron firing (CronScheduler) and queue relay (dispatch) pause while it exists.
+ * Usage-limit suspensions never write it.
+ */
+export function projectSuspensionKey(projectId: string): string {
+  return `project-suspended:${projectId}`;
+}
diff --git a/platform/packages/api/src/usage-counter.ts b/platform/packages/api/src/usage-counter.ts
index c7c576217..f599bb38e 100644
--- a/platform/packages/api/src/usage-counter.ts
+++ b/platform/packages/api/src/usage-counter.ts
@@ -872,6 +872,7 @@ export class UsageCounter extends DurableObject<ApiEnv['Bindings']> {
         this.env.CF_ACCOUNT_ID,
         this.env.CF_API_TOKEN,
         this.env.AI_GATEWAY_ID ?? 'void',
+        this.env.JWT_SECRET,
         projectId,
         since,
       );
@@ -1019,6 +1020,7 @@ export class UsageCounter extends DurableObject<ApiEnv['Bindings']> {
         this.env.CF_ACCOUNT_ID,
         this.env.CF_API_TOKEN,
         this.env.AI_GATEWAY_ID ?? 'void',
+        this.env.JWT_SECRET,
         window.projectId,
         since,
         until,
diff --git a/platform/packages/api/test/integration/admin-bootstrap.test.ts b/platform/packages/api/test/integration/admin-bootstrap.test.ts
index ea91132fa..018141976 100644
--- a/platform/packages/api/test/integration/admin-bootstrap.test.ts
+++ b/platform/packages/api/test/integration/admin-bootstrap.test.ts
@@ -171,6 +171,40 @@ describe('first administrator dashboard login', () => {
     },
   );
 
+  it('does not replace a linked administrator identity on a matching email', async () => {
+    const owner = await createTestUser(env.db, 'owner', 'github', '5000', 'custom', 'admin');
+    await env.db.update(users).set({ email: 'owner@example.com' }).where(eq(users.id, owner.id));
+    github = { id: 9999, login: 'other', email: 'owner@example.com', verified: true };
+
+    const response = await login();
+
+    expect(response.status).toBe(403);
+    expect(response.headers.get('Set-Cookie')).not.toContain('admin_token=');
+    const [row] = await env.db.select().from(users).where(eq(users.id, owner.id));
+    expect(row?.provider_id).toBe('5000');
+    expect(
+      await env.db.select().from(oauthAccounts).where(eq(oauthAccounts.provider_id, '9999')),
+    ).toHaveLength(0);
+  });
+
+  it('links the first login of an administrator seeded by email', async () => {
+    const seeded = await createTestUser(env.db, 'owner', 'github', 'seeded', 'custom', 'admin');
+    await env.db.delete(oauthAccounts).where(eq(oauthAccounts.user_id, seeded.id));
+    await env.db.update(users).set({ email: 'owner@example.com' }).where(eq(users.id, seeded.id));
+    github = { id: 9998, login: 'owner', email: 'owner@example.com', verified: true };
+
+    const response = await login();
+
+    expect(response.status).toBe(302);
+    expect(response.headers.get('Location')).toBe('/admin/');
+    expect(response.headers.get('Set-Cookie')).toContain('admin_token=');
+    const [row] = await env.db.select().from(users).where(eq(users.id, seeded.id));
+    expect(row?.provider_id).toBe('9998');
+    expect(await env.db.select().from(oauthAccounts)).toEqual([
+      expect.objectContaining({ user_id: seeded.id, provider: 'github', provider_id: '9998' }),
+    ]);
+  });
+
   it('allows repeated and concurrent owner logins without duplicate users', async () => {
     const requests = [await startLogin(), await startLogin()];
     const responses = await Promise.all(requests.map((request) => app.fetch(request, env)));
diff --git a/platform/packages/api/test/integration/admin-dashboard.test.ts b/platform/packages/api/test/integration/admin-dashboard.test.ts
index 9c555df41..16d595a75 100644
--- a/platform/packages/api/test/integration/admin-dashboard.test.ts
+++ b/platform/packages/api/test/integration/admin-dashboard.test.ts
@@ -1084,6 +1084,7 @@ describe('GET /admin/users/:id', () => {
     expect(html).toContain('detailuser');
     expect(html).toContain('Plan');
     expect(html).toContain('Suspension');
+    expect(html).toContain('Queue messages are dropped when their retries run out');
   });
 
   test('renders plan limits card', async () => {
@@ -2252,6 +2253,20 @@ describe('GET /admin/login', () => {
     expect(html).toContain('Google');
   });
 
+  // A tenant app can share a site with the API, so a page that frames the
+  // admin UI would still be sent the admin cookie.
+  test('admin pages refuse framing', async () => {
+    const page = await app.fetch(new Request('http://localhost/admin/login'), env);
+    expect(page.headers.get('content-type')).toContain('text/html');
+    expect(page.headers.get('x-frame-options')).toBe('DENY');
+    expect(page.headers.get('content-security-policy')).toBe("frame-ancestors 'none'");
+
+    const health = await app.fetch(new Request('http://localhost/health'), env);
+    expect(health.headers.get('content-type')).toContain('application/json');
+    expect(health.headers.get('x-frame-options')).toBeNull();
+    expect(health.headers.get('content-security-policy')).toBeNull();
+  });
+
   test('shows only the authentication providers enabled by the platform', async () => {
     env.PLATFORM_CAPABILITIES = JSON.stringify({
       ai: true,
diff --git a/platform/packages/api/test/integration/api-delete-accounting.test.ts b/platform/packages/api/test/integration/api-delete-accounting.test.ts
index a8ed2223b..b07dc109e 100644
--- a/platform/packages/api/test/integration/api-delete-accounting.test.ts
+++ b/platform/packages/api/test/integration/api-delete-accounting.test.ts
@@ -1,6 +1,7 @@
 import { eq } from 'drizzle-orm';
 import { afterAll, afterEach, beforeAll, beforeEach, expect, it, vi } from 'vite-plus/test';
 import app from '../../src/index.ts';
+import { deriveAiUsageTag } from '../../src/proxy-token.ts';
 import { projects, projectOwnershipPeriods, users } from '../../src/schema.ts';
 import { getCurrentBillingPeriodStart } from '../../src/tiers.ts';
 import { UsageCounter, type CounterState } from '../../src/usage-counter.ts';
@@ -210,8 +211,9 @@ it.each(['fresh', 'initialized'] as const)(
     unavailable = false;
     await restarted.alarm();
     expect(queries).toHaveLength(2);
+    const usageTag = await deriveAiUsageTag(env.JWT_SECRET, project.id);
     for (const query of queries) {
-      expect(query).toContain(`projectId: "${project.id}"`);
+      expect(query).toContain(`metadata_projectId: "${usageTag}"`);
       expect(query).toContain(`datetime_geq: "${ownershipStartedAt}"`);
       expect(query).toContain(`datetime_lt: "${window!.ownershipEndedAt}"`);
     }
diff --git a/platform/packages/api/test/integration/api-email.test.ts b/platform/packages/api/test/integration/api-email.test.ts
index 8d8100d52..13d1808c3 100644
--- a/platform/packages/api/test/integration/api-email.test.ts
+++ b/platform/packages/api/test/integration/api-email.test.ts
@@ -7,7 +7,8 @@
  *   - `GET    /projects/:id/email/destinations`
  *   - `POST   /projects/:id/email/destinations`
  *   - `DELETE /projects/:id/email/destinations/:destId`
- *   - `GET    /email/destinations/confirm`  (public — the token IS the auth)
+ *   - `GET    /email/destinations/confirm`  (public — shows the Confirm button)
+ *   - `POST   /email/destinations/confirm`  (public — the token IS the auth)
  *
  * Two contracts run through the whole file and are worth stating once:
  *
@@ -1831,10 +1832,11 @@ describe('revokeOwnerVerifiedDestinationsForUserChange', () => {
 });
 
 // ---------------------------------------------------------------------------
-// GET /email/destinations/confirm — public; the HMAC-signed token IS the auth
+// /email/destinations/confirm — public; the HMAC-signed token IS the auth.
+// GET shows a Confirm button; the button's POST grants consent.
 // ---------------------------------------------------------------------------
 
-describe('GET /email/destinations/confirm', () => {
+describe('/email/destinations/confirm', () => {
   async function seedPlatformPending(
     address: string,
     project: { id: string },
@@ -1874,11 +1876,51 @@ describe('GET /email/destinations/confirm', () => {
 
   async function confirm(token: string): Promise<Response> {
     return app.fetch(
-      new Request(`http://localhost/email/destinations/confirm?token=${encodeURIComponent(token)}`),
+      new Request(
+        `http://localhost/email/destinations/confirm?token=${encodeURIComponent(token)}`,
+        {
+          method: 'POST',
+        },
+      ),
       env,
     );
   }
 
+  // Mail security scanners fetch every link in a message, so opening the
+  // link must not grant consent on its own.
+  it('opening the link shows a Confirm button and leaves the row pending', async () => {
+    const user = await createTestUser(env.db);
+    const project = await createTestProject(env.db, user.id);
+    const did = await seedPlatformPending('shared@example.com', project);
+    const token = await makeToken(project.id, did, 'shared@example.com');
+
+    const res = await app.fetch(
+      new Request(`http://localhost/email/destinations/confirm?token=${encodeURIComponent(token)}`),
+      env,
+    );
+    expect(res.status).toBe(200);
+    expect(res.headers.get('cache-control')).toBe('no-store');
+    expect(res.headers.get('referrer-policy')).toBe('no-referrer');
+    const html = await res.text();
+    expect(html).toContain('shared@example.com');
+    expect(html).toContain('<form method="post"');
+    expect(html).toContain(`action="?token=${token}"`);
+    expect(html).not.toContain('Email confirmed');
+
+    const [row] = await env.db
+      .select()
+      .from(emailDestinations)
+      .where(eq(emailDestinations.id, did));
+    expect(row?.status).toBe('pending');
+    expect(row?.verified_at).toBeNull();
+    expect(await readVerifiedDestinations(project.id)).toEqual([]);
+
+    expect(await (await confirm(token)).text()).toContain("You've authorized");
+    const again = await confirm(token);
+    expect(again.status).toBe(200);
+    expect(await again.text()).toContain('Already confirmed');
+  });
+
   it('flips the row to verified and renders the success page', async () => {
     const user = await createTestUser(env.db);
     const project = await createTestProject(env.db, user.id);
@@ -2414,7 +2456,12 @@ describe('email platform capability', () => {
     );
 
     const res = await app.fetch(
-      new Request(`http://localhost/email/destinations/confirm?token=${encodeURIComponent(token)}`),
+      new Request(
+        `http://localhost/email/destinations/confirm?token=${encodeURIComponent(token)}`,
+        {
+          method: 'POST',
+        },
+      ),
       capabilityEnv(false),
     );
     expect(res.status).toBe(501);
diff --git a/platform/packages/api/test/integration/api-internal-project-token.test.ts b/platform/packages/api/test/integration/api-internal-project-token.test.ts
index b5763fb8d..6483d9f1b 100644
--- a/platform/packages/api/test/integration/api-internal-project-token.test.ts
+++ b/platform/packages/api/test/integration/api-internal-project-token.test.ts
@@ -95,7 +95,7 @@ async function proxyRequest(projectId: string, aiToken: string) {
   ).default;
   const run = vi.fn(async () => ({ response: 'ok' }));
   const response = await proxyWorker.fetch(
-    new Request('https://proxy.example.com/ai/run', {
+    new Request('https://ai-proxy/ai/run', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ projectId, aiToken, model: 'test-model', inputs: {} }),
diff --git a/platform/packages/api/test/integration/api-project-access-routes.test.ts b/platform/packages/api/test/integration/api-project-access-routes.test.ts
index a7be9fb2a..37bc5ea5b 100644
--- a/platform/packages/api/test/integration/api-project-access-routes.test.ts
+++ b/platform/packages/api/test/integration/api-project-access-routes.test.ts
@@ -3,6 +3,7 @@ import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vite-
 import { verifyPrerenderToken } from '../../src/auth/deploy-token.ts';
 import app from '../../src/index.ts';
 import * as projectAccess from '../../src/project-access.ts';
+import { deriveAiUsageTag } from '../../src/proxy-token.ts';
 import {
   deployments,
   domains,
@@ -667,6 +668,9 @@ describe('ownership-period account usage', () => {
       transferredAt.toISOString().replace('T', ' ').slice(0, 19),
     );
     expect(graphqlQueries).toHaveLength(1);
+    expect(graphqlQueries[0]).toContain(
+      `metadata_projectId: "${await deriveAiUsageTag(JWT_SECRET, project.id)}"`,
+    );
     expect(graphqlQueries[0]).toContain(`datetime_geq: "${ownedFrom.toISOString()}"`);
     expect(graphqlQueries[0]).toContain(`datetime_lt: "${transferredAt.toISOString()}"`);
   });
diff --git a/platform/packages/api/test/integration/api-projects.test.ts b/platform/packages/api/test/integration/api-projects.test.ts
index a2b8b81e9..e0e82597f 100644
--- a/platform/packages/api/test/integration/api-projects.test.ts
+++ b/platform/packages/api/test/integration/api-projects.test.ts
@@ -2023,6 +2023,28 @@ describe('POST /projects', () => {
     });
   });
 
+  // `<slug>@<mail domain>` is the project's mailbox, and a certificate
+  // authority may prove control of that domain by mailing `hostmaster@`.
+  it('rejects CA domain-validation mailbox slugs', async () => {
+    const user = await createTestUser(env.db);
+
+    for (const slug of ['administrator', 'hostmaster', 'webmaster']) {
+      const res = await app.fetch(
+        new Request('http://localhost/projects', {
+          method: 'POST',
+          headers: {
+            Authorization: `Bearer ${user.jwt}`,
+            'Content-Type': 'application/json',
+          },
+          body: JSON.stringify({ slug }),
+        }),
+        env,
+      );
+      expect(res.status, slug).toBe(400);
+      expect(await res.json()).toEqual({ error: 'this name is reserved' });
+    }
+  });
+
   // The slug is the prefix of the project's email local-part
   // (`<slug>+noreply@<domain>`), which RFC 5321 caps at 64 octets. The runtime
   // refuses to build a default sender from a slug over 56, so a longer slug
@@ -3412,6 +3434,68 @@ describe('GET /projects/:id/logs', () => {
     expect(res.status).toBe(400);
   });
 
+  // Log rows are keyed by `user-<slug>`, and a deleted project's slug can be
+  // claimed again, so rows older than this project belong to an earlier owner.
+  it('does not return rows from before the project was created', async () => {
+    const user = await createTestUser(env.db);
+    const project = await createTestProject(env.db, user.id, 'reused-slug');
+    const createdAtMs = Math.floor((Date.now() - 60 * 60_000) / 1000) * 1000 + 250;
+    const createdAt = new Date(createdAtMs).toISOString().replace('T', ' ').slice(0, 23);
+    await env.db.update(projects).set({ created_at: createdAt }).where(eq(projects.id, project.id));
+
+    let capturedBody = '';
+    mockCfApi({
+      analyticsQuery: (_url, init) => {
+        capturedBody = typeof init?.body === 'string' ? init.body : '';
+        return Response.json({ data: [] });
+      },
+    });
+
+    const res = await app.fetch(
+      new Request(`http://localhost/projects/${project.id}/logs?since=7d`, {
+        headers: { Authorization: `Bearer ${user.jwt}` },
+      }),
+      env,
+    );
+    expect(res.status).toBe(200);
+    expect(capturedBody).toContain(`timestamp >= toDateTime('${createdAt.slice(0, 19)}')`);
+    // An earlier owner's invocation can start before creation and be written after it.
+    expect(capturedBody).toContain(`AND double1 >= ${createdAtMs}`);
+  });
+
+  it('uses the since bound when the project is older than it', async () => {
+    const user = await createTestUser(env.db);
+    const project = await createTestProject(env.db, user.id, 'old-project');
+    const createdAt = new Date(Date.now() - 30 * 24 * 60 * 60_000)
+      .toISOString()
+      .replace('T', ' ')
+      .slice(0, 19);
+    await env.db.update(projects).set({ created_at: createdAt }).where(eq(projects.id, project.id));
+
+    let capturedBody = '';
+    mockCfApi({
+      analyticsQuery: (_url, init) => {
+        capturedBody = typeof init?.body === 'string' ? init.body : '';
+        return Response.json({ data: [] });
+      },
+    });
+
+    const before = Date.now();
+    const res = await app.fetch(
+      new Request(`http://localhost/projects/${project.id}/logs?since=1h`, {
+        headers: { Authorization: `Bearer ${user.jwt}` },
+      }),
+      env,
+    );
+    const after = Date.now();
+    expect(res.status).toBe(200);
+    const bound = /timestamp >= toDateTime\('([^']+)'\)/.exec(capturedBody)?.[1];
+    expect(bound).toBeDefined();
+    const boundMs = Date.parse(`${bound!.replace(' ', 'T')}Z`);
+    expect(boundMs).toBeGreaterThanOrEqual(Math.floor((before - 60 * 60_000) / 1000) * 1000);
+    expect(boundMs).toBeLessThanOrEqual(after - 60 * 60_000);
+  });
+
   it('appends an error-level WHERE clause when level=error', async () => {
     const user = await createTestUser(env.db);
     const project = await createTestProject(env.db, user.id, 'lvl-error');
diff --git a/platform/packages/api/test/integration/auth-email-verification.test.ts b/platform/packages/api/test/integration/auth-email-verification.test.ts
index 5de96cbfa..a57a89da8 100644
--- a/platform/packages/api/test/integration/auth-email-verification.test.ts
+++ b/platform/packages/api/test/integration/auth-email-verification.test.ts
@@ -1108,3 +1108,143 @@ describe('email verification gating on account linking', () => {
     });
   });
 });
+
+describe('email match never reaches an administrator account', () => {
+  async function createAdminWithEmail(login: string, provider: string, providerId: string) {
+    const admin = await createTestUser(env.db, login, provider, providerId, 'custom', 'admin');
+    await env.db.update(users).set({ email: 'admin@example.com' }).where(eq(users.id, admin.id));
+    return admin;
+  }
+
+  async function callback(provider: string, accept?: string): Promise<Response> {
+    const state = await buildSignedState(provider);
+    await seedOAuthNonce(env.db, 'test-nonce');
+    return app.fetch(
+      new Request(`http://localhost/auth/callback?code=test-code&state=${state}`, {
+        headers: { Cookie: 'oauth_nonce=test-nonce', ...(accept ? { Accept: accept } : {}) },
+      }),
+      env,
+      executionCtx,
+    );
+  }
+
+  async function githubIdsFor(userId: string): Promise<Array<string>> {
+    const rows = await env.db
+      .select({ providerId: oauthAccounts.provider_id })
+      .from(oauthAccounts)
+      .where(and(eq(oauthAccounts.user_id, userId), eq(oauthAccounts.provider, 'github')));
+    return rows.map((row) => row.providerId);
+  }
+
+  it('refuses a new GitHub login whose verified email matches a Google-first administrator', async () => {
+    await createAdminWithEmail('admin-g', 'google', 'google-admin');
+    vi.stubGlobal(
+      'fetch',
+      mockGitHubApi({
+        id: 444001,
+        login: 'lookalike',
+        email: 'admin@example.com',
+        emailVerified: true,
+      }),
+    );
+
+    const res = await callback('github');
+
+    expect(res.status).toBe(409);
+    expect(await res.json()).toMatchObject({ error: 'identity_link_required' });
+    expect(await getUserByOAuthAccount(env.db, 'github', '444001')).toBeNull();
+    expect(await env.db.select().from(users)).toHaveLength(1);
+  });
+
+  it('refuses a second GitHub login whose verified email matches an administrator', async () => {
+    const admin = await createAdminWithEmail('admin-gh', 'github', '111');
+    vi.stubGlobal(
+      'fetch',
+      mockGitHubApi({
+        id: 222,
+        login: 'lookalike',
+        email: 'admin@example.com',
+        emailVerified: true,
+      }),
+    );
+
+    const res = await callback('github');
+
+    expect(res.status).toBe(409);
+    expect(await res.json()).toMatchObject({ error: 'identity_link_required' });
+    expect(await githubIdsFor(admin.id)).toEqual(['111']);
+    expect(await getUserByOAuthAccount(env.db, 'github', '222')).toBeNull();
+  });
+
+  it('tells an administrator in the browser to use the account they used before', async () => {
+    await createAdminWithEmail('admin-gh', 'github', '111');
+    vi.stubGlobal(
+      'fetch',
+      mockGitHubApi({
+        id: 222,
+        login: 'lookalike',
+        email: 'admin@example.com',
+        emailVerified: true,
+      }),
+    );
+
+    const res = await callback('github', 'text/html,application/xhtml+xml');
+
+    expect(res.status).toBe(409);
+    expect(res.headers.get('content-type')).toContain('text/html');
+    const html = await res.text();
+    expect(html).toContain('This login is not linked');
+    expect(html).toContain('Sign in again with the GitHub or Google account you used before.');
+    expect(html).not.toContain('contact your platform administrator');
+  });
+
+  it('refuses a new Google login whose verified email matches a GitHub-first administrator', async () => {
+    await createAdminWithEmail('admin-gh', 'github', '111');
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async (input: string | URL | Request): Promise<Response> => {
+        const url =
+          typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url;
+        if (url === 'https://oauth2.googleapis.com/token') {
+          return Response.json({ access_token: 't' });
+        }
+        if (url === 'https://www.googleapis.com/oauth2/v2/userinfo') {
+          return Response.json({
+            id: 'g-new',
+            email: 'admin@example.com',
+            name: 'x',
+            verified_email: true,
+          });
+        }
+        throw new Error(`Unmocked fetch: ${url}`);
+      }),
+    );
+
+    const res = await callback('google');
+
+    expect(res.status).toBe(409);
+    expect(await res.json()).toMatchObject({ error: 'identity_link_required' });
+    expect(await getUserByOAuthAccount(env.db, 'google', 'g-new')).toBeNull();
+  });
+
+  it('still signs an administrator in with an already linked login', async () => {
+    const admin = await createAdminWithEmail('admin-ok', 'github', '333');
+    vi.stubGlobal(
+      'fetch',
+      mockGitHubApi({
+        id: 333,
+        login: 'admin-ok',
+        email: 'admin@example.com',
+        emailVerified: true,
+      }),
+    );
+
+    const res = await callback('github');
+
+    expect(res.status).toBe(302);
+    const token = new URL(res.headers.get('Location')!).searchParams.get('token')!;
+    const { verifyJwt } = await import('../../src/auth/jwt.ts');
+    const payload = await verifyJwt(token, JWT_SECRET);
+    expect(payload?.sub).toBe(admin.id);
+  });
+});
diff --git a/platform/packages/api/test/integration/operator-audit.test.ts b/platform/packages/api/test/integration/operator-audit.test.ts
index dea2bd8bf..8f4708493 100644
--- a/platform/packages/api/test/integration/operator-audit.test.ts
+++ b/platform/packages/api/test/integration/operator-audit.test.ts
@@ -195,7 +195,7 @@ test('records complete and partial 207 mutation outcomes as failed', async () =>
   expect(await failed.json()).toMatchObject({ ok: false, partial: false });
 
   vi.restoreAllMocks();
-  cloudflareWorkerStub('void-dashboard-staging');
+  cloudflareWorkerStub('void-api-staging');
   const partial = await request('/workers/rollback-all', {
     environment: 'staging',
     versions: {
diff --git a/platform/packages/api/test/integration/operator-operations.test.ts b/platform/packages/api/test/integration/operator-operations.test.ts
index 558f94618..f3ee29e06 100644
--- a/platform/packages/api/test/integration/operator-operations.test.ts
+++ b/platform/packages/api/test/integration/operator-operations.test.ts
@@ -942,7 +942,7 @@ describe('operator installation-aware system and worker operations', () => {
     expect((await req('/workers/rollback-all', {})).status).toBe(400);
   });
   test('bulk rollback pins reviewed targets, stops after failure, and persists partial outcomes', async () => {
-    const fetch = cloudflareWorkerStub('void-dashboard-staging');
+    const fetch = cloudflareWorkerStub('void-api-staging');
     const versions = {
       dispatch: 'previous',
       'email-gateway': 'previous',
@@ -953,24 +953,28 @@ describe('operator installation-aware system and worker operations', () => {
     };
     const response = await req('/workers/rollback-all', { environment: 'staging', versions });
     expect(response.status).toBe(207);
-    const result = (await response.json()) as { events: Array<{ status: string }> };
+    const result = (await response.json()) as {
+      events: Array<{ worker_name: string; status: string }>;
+    };
     expect(result).toMatchObject({ ok: false, partial: true, environment: 'staging' });
-    expect(result.events.map((event) => event.status)).toEqual([
-      'success',
-      'success',
-      'failed',
-      'skipped',
-      'skipped',
-      'skipped',
+    // Rollback runs in reverse deploy order, so the email gateway, which the
+    // API's confirmation page posts back through, rolls back after the API.
+    expect(result.events.map((event) => [event.worker_name, event.status])).toEqual([
+      ['dashboard', 'success'],
+      ['dispatch', 'success'],
+      ['tail', 'success'],
+      ['api', 'failed'],
+      ['email-gateway', 'skipped'],
+      ['proxy', 'skipped'],
     ]);
     const writes = fetch.mock.calls.filter(([, init]) => init?.method === 'POST');
-    expect(writes).toHaveLength(3);
-    expect(writes[0][0]).toContain('void-dispatch-staging');
+    expect(writes).toHaveLength(4);
+    expect(writes[0][0]).toContain('void-dashboard-staging');
     expect(JSON.parse(String(writes[0][1]?.body))).toMatchObject({
       versions: [{ version_id: 'previous', percentage: 100 }],
     });
     const persisted = await env.db.select().from(platformEvents);
-    expect(persisted.filter((event) => event.status === 'skipped')).toHaveLength(3);
+    expect(persisted.filter((event) => event.status === 'skipped')).toHaveLength(2);
   });
   test('queue backfill preview reads all targets without writing or returning tokens', async () => {
     await env.ROUTING.put(
diff --git a/platform/packages/api/test/integration/operator-tenants.test.ts b/platform/packages/api/test/integration/operator-tenants.test.ts
index a1771fe5d..f251110c7 100644
--- a/platform/packages/api/test/integration/operator-tenants.test.ts
+++ b/platform/packages/api/test/integration/operator-tenants.test.ts
@@ -631,6 +631,7 @@ describe('operator tenant mutations', () => {
     expect(planCounterCalls.map((call) => call.path)).toEqual(['/init', '/reevaluate-limits']);
     expect(planCounterCalls[1]!.body).toEqual({ userId: target.id });
     expect(JSON.parse((await env.ROUTING.get(project.slug))!).suspended).toBeUndefined();
+    expect(await env.ROUTING.get(`project-suspended:${project.id}`)).toBeNull();
 
     resumeSuspendDb.resolve();
     const suspension = await suspensionPromise;
@@ -641,6 +642,7 @@ describe('operator tenant mutations', () => {
       suspended: 'operator_review',
       limits: { cpuMs: 50, subRequests: 1000 },
     });
+    expect(await env.ROUTING.get(`project-suspended:${project.id}`)).toBe('operator_review');
     expect(await env.ROUTING.get(`project:${project.id}`)).toBeNull();
 
     const retryDetachStarted = deferred();
@@ -666,6 +668,7 @@ describe('operator tenant mutations', () => {
     resumeRetry.resolve();
     expect((await retryPromise).status).toBe(200);
     expect(JSON.parse((await env.ROUTING.get(project.slug))!).suspended).toBe('operator_review');
+    expect(await env.ROUTING.get(`project-suspended:${project.id}`)).toBe('operator_review');
 
     resumeRestoreDb.resolve();
     const restore = await restorePromise;
@@ -676,6 +679,7 @@ describe('operator tenant mutations', () => {
       suspended_reason: null,
     });
     expect(JSON.parse((await env.ROUTING.get(project.slug))!).suspended).toBeUndefined();
+    expect(await env.ROUTING.get(`project-suspended:${project.id}`)).toBeNull();
   });
 
   test('rejects unknown owners and deleting, deploy, rollback, and build work', async () => {
@@ -955,6 +959,13 @@ describe('operator tenant mutations', () => {
         target: { id: path.includes('/projects/') ? project.id : user.id },
       });
     }
+    const suspendPreview = await req(`/users/${user.id}/suspend`, {
+      reason: 'review',
+      dryRun: true,
+    });
+    expect(await suspendPreview.json()).toMatchObject({
+      effect: expect.stringContaining('Restore does not bring them back.'),
+    });
     expect(await getUser(env.db, user.id)).toMatchObject({ plan: 'free', suspended_reason: null });
     expect(fetchSpy).not.toHaveBeenCalled();
     expect(putSpy).not.toHaveBeenCalled();
@@ -983,19 +994,45 @@ describe('operator tenant mutations', () => {
       project.slug,
       JSON.stringify({ workerName: 'worker', projectId: project.id }),
     );
+    const markerKey = `project-suspended:${project.id}`;
     expect((await req(`/users/${user.id}/suspend`, { reason: 'operator_review' })).status).toBe(
       200,
     );
     expect(JSON.parse((await env.ROUTING.get(project.slug))!).suspended).toBe('operator_review');
+    expect(await env.ROUTING.get(markerKey)).toBe('operator_review');
     expect((await req(`/users/${user.id}/plan`, { plan: 'pro' })).status).toBe(200);
     expect(await getUser(env.db, user.id)).toMatchObject({
       plan: 'pro',
       suspended_reason: 'operator_review',
     });
     expect(JSON.parse((await env.ROUTING.get(project.slug))!).suspended).toBe('operator_review');
+    expect(await env.ROUTING.get(markerKey)).toBe('operator_review');
     expect((await req(`/users/${user.id}/restore`, {})).status).toBe(200);
     expect(await getUser(env.db, user.id)).toMatchObject({ suspended_reason: null });
     expect(JSON.parse((await env.ROUTING.get(project.slug))!).suspended).toBeUndefined();
+    expect(await env.ROUTING.get(markerKey)).toBeNull();
+  });
+
+  test('keeps background runs going for usage-limit suspensions', async () => {
+    const user = await createTestUser(env.db, 'usage-suspended-user');
+    const project = await createTestProject(env.db, user.id, 'usage-suspended-project');
+    await env.ROUTING.put(
+      project.slug,
+      JSON.stringify({
+        workerName: 'worker',
+        projectId: project.id,
+        userId: user.id,
+        suspended: 'requests_exceeded',
+      }),
+    );
+    await env.db
+      .update(users)
+      .set({ suspended_reason: 'requests_exceeded' })
+      .where(eq(users.id, user.id));
+
+    expect((await req(`/users/${user.id}/plan`, { plan: 'pro' })).status).toBe(200);
+
+    expect(await env.ROUTING.get(`project-suspended:${project.id}`)).toBeNull();
   });
 
   test('queues proxy token rotations for a suspended administrator when routing fails', async () => {
diff --git a/platform/packages/api/test/integration/platform-access-protection.test.ts b/platform/packages/api/test/integration/platform-access-protection.test.ts
index b3466d939..32dfa0e29 100644
--- a/platform/packages/api/test/integration/platform-access-protection.test.ts
+++ b/platform/packages/api/test/integration/platform-access-protection.test.ts
@@ -193,6 +193,15 @@ describe('Access-protected platform requests', () => {
     expect(confirmation.status).toBe(400);
     expect(confirmation.headers.get('cache-control')).toBe('no-store');
     expect(confirmation.headers.get('referrer-policy')).toBe('no-referrer');
+    // The Confirm button on that page posts back to the same route.
+    const consent = await request(
+      '/email/destinations/confirm?token=invalid.signature',
+      undefined,
+      undefined,
+      {},
+    );
+    expect(consent.status).toBe(400);
+    expect(consent.headers.get('content-type')).toContain('text/html');
     expect(
       (await request('/email/destinations/confirm/extra?token=invalid.signature')).status,
     ).toBe(403);
diff --git a/platform/packages/api/test/unit/cron-scheduler.test.ts b/platform/packages/api/test/unit/cron-scheduler.test.ts
index e7b3519f2..7f5511979 100644
--- a/platform/packages/api/test/unit/cron-scheduler.test.ts
+++ b/platform/packages/api/test/unit/cron-scheduler.test.ts
@@ -213,10 +213,11 @@ describe('CronScheduler.alarm', () => {
 
   type StubCtx = ReturnType<typeof makeStubCtx>;
 
-  function makeStubCtx(initial: Record<string, unknown> = {}) {
+  function makeStubCtx(initial: Record<string, unknown> = {}, name?: string) {
     const store = new Map<string, unknown>(Object.entries(initial));
     let alarmTime: number | null = null;
     return {
+      id: { name },
       storage: {
         get: vi.fn(async (k: string) => store.get(k)),
         put: vi.fn(async (k: string, v: unknown) => {
@@ -237,7 +238,10 @@ describe('CronScheduler.alarm', () => {
 
   function makeScheduler(
     ctx: StubCtx,
-    env: { CRON_FIRES_QUEUE: { sendBatch: (batch?: unknown) => Promise<void> } },
+    env: {
+      CRON_FIRES_QUEUE: { sendBatch: (batch?: unknown) => Promise<void> };
+      ROUTING?: { get: (key: string, options?: unknown) => Promise<string | null> };
+    },
   ) {
     // Bypass the real DurableObject constructor wiring in the mock above
     return new CronScheduler(
@@ -437,4 +441,61 @@ describe('CronScheduler.alarm', () => {
     // for retry.
     expect(ctx.storage.setAlarm).not.toHaveBeenCalled();
   });
+
+  const everyMinute = () => ({
+    state: {
+      workerName: 'user-foo',
+      schedules: [{ name: 'job', cron: '* * * * *' }],
+      proxyToken: 'tok',
+    },
+  });
+
+  it('skips firing while an administrator has suspended the project', async () => {
+    const ctx = makeStubCtx(everyMinute(), 'proj_1');
+    const sendBatch = vi.fn(async () => {});
+    const get = vi.fn(async (key: string, _options?: unknown) =>
+      key === 'project-suspended:proj_1' ? 'operator_review' : null,
+    );
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    try {
+      const s = makeScheduler(ctx, { CRON_FIRES_QUEUE: { sendBatch }, ROUTING: { get } });
+      await expect(s.alarm()).resolves.toBeUndefined();
+    } finally {
+      warn.mockRestore();
+    }
+
+    expect(sendBatch).not.toHaveBeenCalled();
+    expect(get).toHaveBeenCalledWith('project-suspended:proj_1', { cacheTtl: 60 });
+    // The alarm stays armed so firing resumes after a restore.
+    expect(ctx.storage.setAlarm).toHaveBeenCalledOnce();
+  });
+
+  it('fires normally without a suspension marker', async () => {
+    const ctx = makeStubCtx(everyMinute(), 'proj_1');
+    const sendBatch = vi.fn(async () => {});
+    const get = vi.fn(async (_key: string, _options?: unknown) => null);
+    const s = makeScheduler(ctx, { CRON_FIRES_QUEUE: { sendBatch }, ROUTING: { get } });
+    await expect(s.alarm()).resolves.toBeUndefined();
+
+    expect(get).toHaveBeenCalledWith('project-suspended:proj_1', { cacheTtl: 60 });
+    expect(sendBatch).toHaveBeenCalledOnce();
+  });
+
+  it('keeps firing when the suspension marker cannot be read', async () => {
+    const ctx = makeStubCtx(everyMinute(), 'proj_1');
+    const sendBatch = vi.fn(async () => {});
+    const get = vi.fn(async (_key: string, _options?: unknown): Promise<string | null> => {
+      throw new Error('KV unavailable');
+    });
+    const error = vi.spyOn(console, 'error').mockImplementation(() => {});
+    try {
+      const s = makeScheduler(ctx, { CRON_FIRES_QUEUE: { sendBatch }, ROUTING: { get } });
+      await expect(s.alarm()).resolves.toBeUndefined();
+      expect(error).toHaveBeenCalled();
+    } finally {
+      error.mockRestore();
+    }
+
+    expect(sendBatch).toHaveBeenCalledOnce();
+  });
 });
diff --git a/platform/packages/api/test/unit/proxy-token.test.ts b/platform/packages/api/test/unit/proxy-token.test.ts
index ddff49e91..2ce347ca5 100644
--- a/platform/packages/api/test/unit/proxy-token.test.ts
+++ b/platform/packages/api/test/unit/proxy-token.test.ts
@@ -4,6 +4,7 @@ import { hmacSignState } from '../../src/auth/hmac.ts';
 import { signJwt } from '../../src/auth/jwt.ts';
 import {
   createProxyTokenStateCache,
+  deriveAiUsageTag,
   deriveProxyInternalAuth,
   deriveProxyToken,
   isAcceptedGeneration,
@@ -57,6 +58,12 @@ function nodeInternal(route: ProxyInternalRoute, projectId = PROJECT): string {
   );
 }
 
+function nodeAiUsageTag(projectId: string, secret = SECRET): string {
+  const key = Buffer.from(hkdfSync('sha256', secret, 'void-ai-usage', 'ai-usage', 32));
+  const mac = base64url(createHmac('sha256', key).update(`void-ai-usage\n${projectId}`).digest());
+  return `${projectId}.${mac.slice(0, 22)}`;
+}
+
 function kvStub(values: Record<string, string> = {}) {
   const get = vi.fn(async (key: string, _options?: unknown) => values[key] ?? null);
   return { routing: { get } as unknown as Pick<KVNamespace, 'get'>, get, values };
@@ -414,3 +421,34 @@ describe('verifyProxyInternalAuth', () => {
     );
   });
 });
+
+describe('deriveAiUsageTag', () => {
+  it('is the project id and a 22-character MAC under its own HKDF key', async () => {
+    const tag = await deriveAiUsageTag(SECRET, PROJECT);
+    expect(tag).toBe(nodeAiUsageTag(PROJECT));
+    expect(tag).toMatch(/^proj_000000000001\.[A-Za-z0-9_-]{22}$/);
+    expect(await deriveAiUsageTag(SECRET, PROJECT)).toBe(tag);
+  });
+
+  it('differs per project and per secret', async () => {
+    const tag = await deriveAiUsageTag(SECRET, PROJECT);
+    expect(await deriveAiUsageTag(SECRET, OTHER_PROJECT)).not.toBe(tag);
+    const otherSecret = await deriveAiUsageTag('other-secret', PROJECT);
+    expect(otherSecret).not.toBe(tag);
+    expect(otherSecret).toBe(nodeAiUsageTag(PROJECT, 'other-secret'));
+  });
+
+  it('shares no MAC with tenant tokens or proxy internal values', async () => {
+    const mac = (await deriveAiUsageTag(SECRET, PROJECT)).slice(`${PROJECT}.`.length);
+    for (const value of [TOK_0, TOK_1.slice('1.'.length), TOK_2.slice('2.'.length)]) {
+      expect(value.startsWith(mac)).toBe(false);
+    }
+    for (const route of ROUTES) {
+      expect((await deriveProxyInternalAuth(SECRET, route, PROJECT)).startsWith(mac)).toBe(false);
+    }
+  });
+
+  it('accepts ids that are not project ids', async () => {
+    await expect(deriveAiUsageTag(SECRET, 'project-1')).resolves.toBe(nodeAiUsageTag('project-1'));
+  });
+});
diff --git a/platform/packages/api/test/unit/reserved-slugs.test.ts b/platform/packages/api/test/unit/reserved-slugs.test.ts
index 85be4f4a2..97d257684 100644
--- a/platform/packages/api/test/unit/reserved-slugs.test.ts
+++ b/platform/packages/api/test/unit/reserved-slugs.test.ts
@@ -34,6 +34,19 @@ describe('reserved slugs (real implementation)', () => {
     }
   });
 
+  // A certificate authority may prove control of a domain by mailing one of
+  // these local-parts, and a project slug is a mailbox on the shared mail
+  // domain. The three newer names are refused only at create time, so an
+  // existing project that already holds one keeps receiving its mail.
+  it('blocks the CA domain-validation mailboxes', () => {
+    for (const slug of ['admin', 'administrator', 'hostmaster', 'postmaster', 'webmaster']) {
+      expect(RESERVED_SLUGS.has(slug)).toBe(true);
+    }
+    for (const slug of ['administrator', 'hostmaster', 'webmaster']) {
+      expect(isReservedEmailSlug(slug)).toBe(false);
+    }
+  });
+
   it('allows normal project slugs', () => {
     for (const slug of ['my-app', 'cool-project', 'hello-world', 'test123']) {
       expect(RESERVED_SLUGS.has(slug)).toBe(false);
diff --git a/platform/packages/api/test/unit/usage-ai-query.test.ts b/platform/packages/api/test/unit/usage-ai-query.test.ts
index 198f714ba..c69287d04 100644
--- a/platform/packages/api/test/unit/usage-ai-query.test.ts
+++ b/platform/packages/api/test/unit/usage-ai-query.test.ts
@@ -1,4 +1,5 @@
 import { afterEach, describe, expect, it, vi } from 'vite-plus/test';
+import { deriveAiUsageTag } from '../../src/proxy-token.ts';
 import {
   queryBatchProjectUsageWindows,
   queryProjectAiUsage,
@@ -6,6 +7,7 @@ import {
 } from '../../src/routes/usage.ts';
 
 const apiToken = 'private-cloudflare-token';
+const jwtSecret = 'test-jwt-secret';
 const since = new Date('2026-09-01T00:00:00.000Z');
 const until = new Date('2026-09-02T00:00:00.000Z');
 
@@ -18,7 +20,16 @@ function respond(body: unknown, status = 200): void {
 }
 
 function query(failOnError = true): Promise<{ neurons: number }> {
-  return queryProjectAiUsage('account-1', apiToken, 'void', 'project-1', since, until, failOnError);
+  return queryProjectAiUsage(
+    'account-1',
+    apiToken,
+    'void',
+    jwtSecret,
+    'project-1',
+    since,
+    until,
+    failOnError,
+  );
 }
 
 afterEach(() => vi.restoreAllMocks());
@@ -32,7 +43,10 @@ describe('queryProjectAiUsage strict accounting', () => {
     const [url, init] = vi.mocked(fetch).mock.calls[0];
     expect(url).toBe('https://api.cloudflare.com/client/v4/graphql');
     const request = JSON.parse(String(init?.body));
-    expect(request.query).toContain('metadata_projectId: "project-1"');
+    expect(request.query).toContain(
+      `metadata_projectId: "${await deriveAiUsageTag(jwtSecret, 'project-1')}"`,
+    );
+    expect(request.query).not.toContain('metadata_projectId: "project-1"');
     expect(request.query).toContain(`datetime_geq: "${since.toISOString()}"`);
     expect(request.query).toContain(`datetime_lt: "${until.toISOString()}"`);
   });
@@ -176,7 +190,7 @@ describe('account usage query bounds', () => {
     });
     const intervals = Array.from({ length: 12 }, () => ({ start: since, end: until }));
     await expect(
-      sumAiUsageForWindows('account-1', apiToken, 'void', [
+      sumAiUsageForWindows('account-1', apiToken, 'void', jwtSecret, [
         { projectId: 'one', intervals },
         { projectId: 'two', intervals: [intervals[0]!] },
       ]),
diff --git a/platform/packages/api/test/unit/usage-counter.test.ts b/platform/packages/api/test/unit/usage-counter.test.ts
index f1ffd6fc6..1afbe0f7f 100644
--- a/platform/packages/api/test/unit/usage-counter.test.ts
+++ b/platform/packages/api/test/unit/usage-counter.test.ts
@@ -362,6 +362,8 @@ function storedWatermarks(storage: ReturnType<typeof makeFakeStorage>): Map<stri
   );
 }
 
+const JWT_SECRET = 'usage-counter-secret';
+
 function makeCounter(initialState: Partial<CounterState> = {}) {
   const kv = makeFakeKV();
   const storage = makeFakeStorage();
@@ -372,6 +374,7 @@ function makeCounter(initialState: Partial<CounterState> = {}) {
   const env = {
     ROUTING: kv,
     HYPERDRIVE: { connectionString: 'postgres://mock' },
+    JWT_SECRET,
   };
   const ctx = { storage };
 
@@ -1479,6 +1482,7 @@ describe('UsageCounter ownership changes', () => {
       undefined,
       undefined,
       'void',
+      JWT_SECRET,
       'transferred',
       new Date(ownershipStartedAt),
       new Date(ownershipEndedAt),
@@ -1505,6 +1509,7 @@ describe('UsageCounter ownership changes', () => {
       undefined,
       undefined,
       'void',
+      JWT_SECRET,
       'transferred',
       new Date(ownershipStartedAt),
       new Date(extendedOwnershipEndedAt),
@@ -1526,6 +1531,7 @@ describe('UsageCounter ownership changes', () => {
       undefined,
       undefined,
       'void',
+      JWT_SECRET,
       'transferred',
       new Date(ownershipStartedAt),
       new Date(extendedOwnershipEndedAt),
@@ -1572,6 +1578,7 @@ describe('UsageCounter ownership changes', () => {
       undefined,
       undefined,
       'void',
+      JWT_SECRET,
       'transferred',
       new Date(ownershipStartedAt),
       new Date(ownershipEndedAt),
@@ -1650,6 +1657,7 @@ describe('UsageCounter ownership changes', () => {
       undefined,
       undefined,
       'void',
+      JWT_SECRET,
       'transferred',
       new Date(billingPeriodStart),
       new Date(ownershipEndedAt),
@@ -1769,6 +1777,7 @@ describe('UsageCounter ownership changes', () => {
       undefined,
       undefined,
       'void',
+      JWT_SECRET,
       'p1',
       new Date(ownershipStartedAt),
     );
@@ -1879,6 +1888,7 @@ describe('UsageCounter ownership changes', () => {
         undefined,
         undefined,
         'void',
+        JWT_SECRET,
         'deleted',
         new Date(billingPeriodStart),
         new Date(ownershipEndedAt),
@@ -1955,6 +1965,7 @@ describe('UsageCounter ownership changes', () => {
         undefined,
         undefined,
         'void',
+        JWT_SECRET,
         'retained',
         new Date('2026-02-01T00:00:00.000Z'),
       );
@@ -2010,6 +2021,7 @@ describe('UsageCounter ownership changes', () => {
       undefined,
       undefined,
       'void',
+      JWT_SECRET,
       'transferred',
       new Date(ownershipStartedAt),
       new Date(ownershipEndedAt),
diff --git a/platform/packages/dashboard/middleware/00.frame-protection.ts b/platform/packages/dashboard/middleware/00.frame-protection.ts
new file mode 100644
index 000000000..570f047d1
--- /dev/null
+++ b/platform/packages/dashboard/middleware/00.frame-protection.ts
@@ -0,0 +1,11 @@
+import { defineMiddleware } from 'void';
+
+// No dashboard page is meant to be framed. Only HTML is touched, so redirects,
+// WebSocket upgrades and other responses pass through unchanged.
+export default defineMiddleware(async (context, next) => {
+  await next();
+  if (context.res.headers.get('Content-Type')?.startsWith('text/html')) {
+    context.header('X-Frame-Options', 'DENY');
+    context.header('Content-Security-Policy', "frame-ancestors 'none'");
+  }
+});
diff --git a/platform/packages/dashboard/test/unit/frame-protection.test.ts b/platform/packages/dashboard/test/unit/frame-protection.test.ts
new file mode 100644
index 000000000..a60bacb81
--- /dev/null
+++ b/platform/packages/dashboard/test/unit/frame-protection.test.ts
@@ -0,0 +1,34 @@
+import { Hono } from 'hono';
+import { describe, expect, it } from 'vite-plus/test';
+import frameProtection from '../../middleware/00.frame-protection.ts';
+
+function createApp() {
+  const app = new Hono();
+  app.use('*', frameProtection as never);
+  app.get('/', (c) => c.html('<!doctype html><p>Projects</p>'));
+  app.get('/data', (c) => c.json({ ok: true }));
+  app.get('/elsewhere', (c) => c.redirect('/login'));
+  return app;
+}
+
+describe('dashboard frame protection', () => {
+  it('refuses framing of HTML pages', async () => {
+    const res = await createApp().request('/');
+    expect(res.status).toBe(200);
+    expect(await res.text()).toContain('Projects');
+    expect(res.headers.get('x-frame-options')).toBe('DENY');
+    expect(res.headers.get('content-security-policy')).toBe("frame-ancestors 'none'");
+  });
+
+  it('leaves non-HTML responses unchanged', async () => {
+    const app = createApp();
+    const json = await app.request('/data');
+    expect(await json.json()).toEqual({ ok: true });
+    expect(json.headers.get('x-frame-options')).toBeNull();
+    expect(json.headers.get('content-security-policy')).toBeNull();
+
+    const redirect = await app.request('/elsewhere');
+    expect(redirect.status).toBe(302);
+    expect(redirect.headers.get('x-frame-options')).toBeNull();
+  });
+});
diff --git a/platform/packages/dispatch/src/index.ts b/platform/packages/dispatch/src/index.ts
index ebbf94ce5..69f4a7778 100644
--- a/platform/packages/dispatch/src/index.ts
+++ b/platform/packages/dispatch/src/index.ts
@@ -48,6 +48,7 @@ import type { AssetConfig } from './static.ts';
 import {
   buildVariantOriginalUrl,
   exactQueryAllowlist,
+  hasUnlistedQueryParams,
   type QueryAllowlist,
 } from './variant-key.ts';
 import {
@@ -89,6 +90,17 @@ type RoutingEntry = Readonly<{
   zeroTrust?: ProjectZeroTrustRouting;
 }>;
 
+// Written by the API (suspension.ts projectSuspensionKey) while an administrator
+// has suspended the project's owner.
+async function isProjectSuspended(env: Env, projectId: string): Promise<boolean> {
+  try {
+    return (await env.ROUTING.get(`project-suspended:${projectId}`, { cacheTtl: 60 })) !== null;
+  } catch (error) {
+    console.error(`[queue-relay] suspension check failed project="${projectId}"; relaying`, error);
+    return false;
+  }
+}
+
 type QueueRoutingEntry = Readonly<{
   workerName: string;
   projectId: string;
@@ -103,6 +115,12 @@ type QueueRoutingEntry = Readonly<{
 const CLIENT_REVALIDATE_CACHE_CONTROL = 'public, max-age=0, must-revalidate';
 const STATIC_ASSET_HEDGE_DELAY_MS = 1000;
 const PLATFORM_QUEUE_RETRY_DELAY_SECONDS = 300;
+// Batches of a project whose owner an administrator suspended wait here. Each
+// retry uses one of the queue's max_retries (3 unless the app sets maxRetries),
+// so a message survives about one hour per retry, and a queue with maxRetries 0
+// drops it on the first suspended delivery. Delivery resumes within about an
+// hour of a restore.
+const SUSPENDED_PROJECT_QUEUE_RETRY_DELAY_SECONDS = 3600;
 // A relay the Worker rejects for its token is retried after the queue routing
 // entry (read with cacheTtl 60) has had time to catch up with a token rotation,
 // so one rotation costs a message about one attempt instead of all of them.
@@ -316,19 +334,25 @@ function buildFallbackOriginalUrlVariant(
   routing: RoutingEntry,
   originalUrlVariant: string | undefined,
 ): string | undefined {
-  // Fallback rewrites are discovered after the first worker/static miss, but
-  // ISR needs the read key before dispatching. If a fallback rule can handle
-  // this pathname, use the same original-URL variant a later fallback dispatch
-  // would expose via X-Void-Original-URL so query-allowlisted renders cannot
-  // collide with the direct ISR key.
-  if (originalUrlVariant || !routing.fallbackRules?.length) {
+  // ISR keys a request by its allowlisted query params. A redirect-rule rewrite
+  // already built that variant. Fallback rewrites are discovered after the
+  // first worker/static miss, but ISR needs the read key before dispatching: if
+  // a fallback rule can handle this pathname, use the same original-URL variant
+  // a later fallback dispatch would expose via X-Void-Original-URL so
+  // query-allowlisted renders cannot collide with the direct ISR key. A direct
+  // request keys on its allowlisted params too, and keeps the bare key when it
+  // has none.
+  if (originalUrlVariant) {
     return originalUrlVariant;
   }
-  const fallback = applyRoutingRules(pathname, routing.fallbackRules, requestHost);
-  if (fallback?.type !== 'rewrite') {
-    return undefined;
+  const variant = buildVariantOriginalUrl(requestUrl, pathname, routing.queryAllowlist);
+  const fallback = routing.fallbackRules?.length
+    ? applyRoutingRules(pathname, routing.fallbackRules, requestHost)
+    : undefined;
+  if (fallback?.type === 'rewrite') {
+    return variant;
   }
-  return buildVariantOriginalUrl(requestUrl, pathname, routing.queryAllowlist);
+  return new URL(variant).search ? variant : undefined;
 }
 
 function resolveCachedWfpFallbackPathname(
@@ -898,6 +922,8 @@ export default {
         // filenames are already content-addressed by their pathname.
         const cacheUrl = new URL(url.toString());
         cacheUrl.search = '';
+        // A host can move to another project; immutable entries must not carry over.
+        cacheUrl.searchParams.set('_p', routing.projectId);
         const cacheKey = new Request(cacheUrl.toString());
 
         // Hashed assets are served straight from the immutable edge cache. Apply
@@ -1144,6 +1170,14 @@ export default {
           routing,
           originalUrlVariant,
         );
+        // The key drops these params, but a render may still read them. Never
+        // store such a render under the shared key. Match the allowlist on the
+        // pre-rewrite path, as the rewrite variant does.
+        const unlisted = hasUnlistedQueryParams(
+          request.url,
+          new URL(request.url).pathname,
+          routing.queryAllowlist,
+        );
         const cacheKey = isrEdgeCacheKey(request, pathname, isrDeploymentId, isrOriginalUrlVariant);
         const jsonCacheKey = isrEdgeCacheKeyJson(
           request,
@@ -1239,11 +1273,22 @@ export default {
             }
             if (stale) {
               const staleCacheResponse = cacheResponse.clone();
+              // Refresh from the key's own URL, not the triggering one.
+              let revalidateRequest = workerRequest;
+              if (unlisted) {
+                const keyUrl = new URL(workerRequest.url);
+                keyUrl.search = isrOriginalUrlVariant ? new URL(isrOriginalUrlVariant).search : '';
+                revalidateRequest = rebuildRequest(workerRequest, keyUrl.toString(), (headers) => {
+                  if (originalUrlHeader && isrOriginalUrlVariant) {
+                    headers.set('X-Void-Original-URL', isrOriginalUrlVariant);
+                  }
+                });
+              }
               ctx.waitUntil(
                 revalidateInBackground(
                   env,
                   routing,
-                  workerRequest,
+                  revalidateRequest,
                   url.hostname,
                   pathname,
                   isrTtl,
@@ -1368,6 +1413,7 @@ export default {
           // user-configured rewrite to a private endpoint must not be able to poison
           // the page key just by omitting Cache-Control.
           if (
+            !unlisted &&
             ttl > 0 &&
             workerResponse.status === 200 &&
             (routing.type !== 'framework' || isHtmlResponse(workerResponse)) &&
@@ -1923,7 +1969,16 @@ export default {
       batch.retryAll();
       return;
     }
-    const { workerName, queueName, proxyToken } = JSON.parse(routingRaw) as QueueRoutingEntry;
+    const { workerName, projectId, queueName, proxyToken } = JSON.parse(
+      routingRaw,
+    ) as QueueRoutingEntry;
+    if (projectId && (await isProjectSuspended(env, projectId))) {
+      console.warn(
+        `[queue-relay] project suspended; retrying queue="${batch.queue}" in ${SUSPENDED_PROJECT_QUEUE_RETRY_DELAY_SECONDS}s`,
+      );
+      batch.retryAll({ delaySeconds: SUSPENDED_PROJECT_QUEUE_RETRY_DELAY_SECONDS });
+      return;
+    }
 
     // Serialize batch for relay
     const messages = Array.from(batch.messages, (message) => ({
diff --git a/platform/packages/dispatch/src/variant-key.ts b/platform/packages/dispatch/src/variant-key.ts
index 2fdf1d5c3..875010bc2 100644
--- a/platform/packages/dispatch/src/variant-key.ts
+++ b/platform/packages/dispatch/src/variant-key.ts
@@ -1 +1,6 @@
-export { buildVariantOriginalUrl, exactQueryAllowlist, type QueryAllowlist } from '@void/isr/core';
+export {
+  buildVariantOriginalUrl,
+  exactQueryAllowlist,
+  hasUnlistedQueryParams,
+  type QueryAllowlist,
+} from '@void/isr/core';
diff --git a/platform/packages/dispatch/test/unit/access-cache.test.ts b/platform/packages/dispatch/test/unit/access-cache.test.ts
index 12a3e69ec..491eaced1 100644
--- a/platform/packages/dispatch/test/unit/access-cache.test.ts
+++ b/platform/packages/dispatch/test/unit/access-cache.test.ts
@@ -155,9 +155,11 @@ describe.each(['hashed', 'isr'] as const)('Access assertion isolation for %s res
   });
 
   it('replaces edge responses admitted before Access assertions bypassed caching', async () => {
-    const { edgeEntries, origin, request, url } = createHarness(mode);
+    const { edgeEntries, origin, request, routing, url } = createHarness(mode);
     const key =
-      mode === 'hashed' ? url : isrEdgeCacheKey(new Request(url), '/profile', 'deployment').url;
+      mode === 'hashed'
+        ? `${url}?_p=${routing.projectId}`
+        : isrEdgeCacheKey(new Request(url), '/profile', 'deployment').url;
     edgeEntries.set(
       key,
       new Response('profile: alice', {
diff --git a/platform/packages/dispatch/test/unit/index.test.ts b/platform/packages/dispatch/test/unit/index.test.ts
index bdb5f32c5..c64b9991b 100644
--- a/platform/packages/dispatch/test/unit/index.test.ts
+++ b/platform/packages/dispatch/test/unit/index.test.ts
@@ -1415,13 +1415,13 @@ describe('ISR (stale-while-revalidate)', () => {
       }),
     });
 
-    for (let i = 0; i < 3; i++) {
+    for (const query of ['', '?cb=0', '?cb=1', '?cb=2']) {
       const ctx = createCtx();
-      await app.fetch(new Request(`https://my-app.void.app/docs?cb=${i}`), env, ctx);
+      await app.fetch(new Request(`https://my-app.void.app/docs${query}`), env, ctx);
       await Promise.all((ctx.waitUntil as ReturnType<typeof vi.fn>).mock.calls.map((c) => c[0]));
     }
 
-    // First request renders + writes; subsequent requests hit the same KV
+    // The clean request renders + writes; later requests hit the same KV
     // slot regardless of `?cb=` value, so the worker is invoked exactly once.
     expect(workerFetch).toHaveBeenCalledTimes(1);
     const variantKeys = [...kvStore.keys()].filter((k) => k.includes('#rw='));
@@ -1449,16 +1449,225 @@ describe('ISR (stale-while-revalidate)', () => {
       await Promise.all((ctx.waitUntil as ReturnType<typeof vi.fn>).mock.calls.map((c) => c[0]));
     };
 
-    await send('https://my-app.void.app/search?q=void&cb=1');
-    await send('https://my-app.void.app/search?q=void&cb=2'); // different cb → same slot (cb dropped)
+    await send('https://my-app.void.app/search?q=void');
+    await send('https://my-app.void.app/search?q=void&cb=1'); // cb dropped → same slot
+    await send('https://my-app.void.app/search?q=void&cb=2'); // different cb → same slot
     await send('https://my-app.void.app/search?q=cloud'); // different q → new slot
 
-    // Three requests, two distinct cache slots, two worker invocations.
+    // Four requests, two distinct cache slots, two worker invocations.
     expect(workerFetch).toHaveBeenCalledTimes(2);
     const variantKeys = [...kvStore.keys()].filter((k) => k.includes('#rw='));
     expect(variantKeys).toHaveLength(2);
   });
 
+  describe('query params outside the allowlist', () => {
+    const settle = async (ctx: ExecutionContext) => {
+      await Promise.all((ctx.waitUntil as ReturnType<typeof vi.fn>).mock.calls.map((c) => c[0]));
+    };
+    // The page reflects `msg`, which no allowlist names.
+    const renderMsg = async (request: Request) =>
+      new Response(`<html>${new URL(request.url).searchParams.get('msg') ?? 'clean'}</html>`, {
+        headers: { 'Content-Type': 'text/html' },
+      });
+    const rewriteRules = [{ source: '/old', destination: '/blog/post', status: 200 }];
+
+    it.each([
+      { label: 'a direct request', rewrite: false },
+      { label: 'a redirect-rule rewrite', rewrite: true },
+    ])('does not store a cold render for $label', async ({ rewrite }) => {
+      const source = rewrite ? '/old' : '/blog/post';
+      const { env, workerFetch, kvStore } = createEnv({
+        routing: {
+          workerName: 'user-app',
+          projectId: 'proj_1',
+          ssr: true,
+          revalidate: 60,
+          ...(rewrite ? { redirectRules: rewriteRules } : {}),
+        },
+      });
+      workerFetch.mockImplementation(renderMsg);
+
+      const poisonedCtx = createCtx();
+      const poisoned = await app.fetch(
+        new Request(`https://my-app.void.app${source}?msg=evil`),
+        env,
+        poisonedCtx,
+      );
+      await settle(poisonedCtx);
+      // Rendered live from the full URL for this visitor, but never shared.
+      expect(await poisoned.text()).toBe('<html>evil</html>');
+      expect(kvStore.size).toBe(0);
+      expect(edgeCacheStore.size).toBe(0);
+
+      const cleanCtx = createCtx();
+      const clean = await app.fetch(new Request(`https://my-app.void.app${source}`), env, cleanCtx);
+      await settle(cleanCtx);
+      expect(clean.headers.get('x-isr-cache')).toBe('MISS');
+      expect(await clean.text()).toBe('<html>clean</html>');
+      expect([...kvStore.keys()]).toEqual([
+        isrCacheKey(
+          'proj_1',
+          'legacy',
+          'my-app.void.app',
+          '/blog/post',
+          rewrite ? 'https://my-app.void.app/old' : undefined,
+        ),
+      ]);
+
+      // Once warm, the same unlisted param gets the shared page.
+      const later = await app.fetch(
+        new Request(`https://my-app.void.app${source}?msg=evil`),
+        env,
+        createCtx(),
+      );
+      expect(later.headers.get('x-isr-cache')).toBe('HIT');
+      expect(await later.text()).toBe('<html>clean</html>');
+      expect(workerFetch).toHaveBeenCalledTimes(2);
+    });
+
+    it.each([
+      { label: 'a direct request', rewrite: false, query: '' },
+      { label: 'a redirect-rule rewrite', rewrite: true, query: '' },
+      { label: 'a direct request with an allowlisted param', rewrite: false, query: 'q=a' },
+      { label: 'a redirect-rule rewrite with an allowlisted param', rewrite: true, query: 'q=a' },
+    ])('refreshes a stale entry from the cache key URL for $label', async ({ rewrite, query }) => {
+      const source = rewrite ? '/old' : '/blog/post';
+      const search = query ? `?${query}` : '';
+      const originalUrl =
+        rewrite || query ? `https://my-app.void.app${source}${search}` : undefined;
+      const key = isrCacheKey('proj_1', 'legacy', 'my-app.void.app', '/blog/post', originalUrl);
+      const { env, workerFetch, kvStore } = createEnv({
+        routing: {
+          workerName: 'user-app',
+          projectId: 'proj_1',
+          ssr: true,
+          revalidate: 60,
+          queryAllowlist: { '/blog/post': ['q'], '/old': ['q'] },
+          ...(rewrite ? { redirectRules: rewriteRules } : {}),
+        },
+        assets: {
+          [key]: {
+            body: '<html>stale</html>',
+            createdAt: Date.now() - 120_000,
+            ttl: 60,
+            headers: { 'Content-Type': 'text/html' },
+          },
+        },
+      });
+      workerFetch.mockImplementation(renderMsg);
+
+      const ctx = createCtx();
+      const response = await app.fetch(
+        new Request(`https://my-app.void.app${source}?${query ? `${query}&` : ''}msg=evil`, {
+          headers: { 'X-Test-Marker': 'keep' },
+        }),
+        env,
+        ctx,
+      );
+      expect(response.headers.get('x-isr-cache')).toBe('STALE');
+      expect(await response.text()).toBe('<html>stale</html>');
+      await settle(ctx);
+
+      expect(workerFetch).toHaveBeenCalledOnce();
+      const refresh = workerFetch.mock.calls[0]![0] as Request;
+      expect(refresh.url).toBe(`https://my-app.void.app/blog/post${search}`);
+      expect(refresh.headers.get('X-Test-Marker')).toBe('keep');
+      expect(refresh.headers.get('X-Void-Original-URL')).toBe(
+        rewrite ? `https://my-app.void.app/old${search}` : null,
+      );
+      const unpacked = unpackIsrValue(kvStore.get(key)!.value);
+      expect(new TextDecoder().decode(unpacked!.body)).toBe('<html>clean</html>');
+    });
+  });
+
+  describe('allowlisted query params on direct requests', () => {
+    const send = async (env: Env, path: string) => {
+      const ctx = createCtx();
+      const response = await app.fetch(new Request(`https://my-app.void.app${path}`), env, ctx);
+      await Promise.all((ctx.waitUntil as ReturnType<typeof vi.fn>).mock.calls.map((c) => c[0]));
+      return response;
+    };
+    // The page reflects `q`.
+    const renderQuery = async (request: Request) =>
+      new Response(`<html>${new URL(request.url).searchParams.get('q') ?? 'none'}</html>`, {
+        headers: { 'Content-Type': 'text/html' },
+      });
+    const bareKey = isrCacheKey('proj_1', 'legacy', 'my-app.void.app', '/search');
+
+    it('stores each allowlisted value under its own key', async () => {
+      const { env, workerFetch, kvStore } = createEnv({
+        routing: {
+          workerName: 'user-app',
+          projectId: 'proj_1',
+          ssr: true,
+          revalidate: 60,
+          queryAllowlist: { '/search': ['q'] },
+        },
+      });
+      workerFetch.mockImplementation(renderQuery);
+
+      expect(await (await send(env, '/search?q=a')).text()).toBe('<html>a</html>');
+      const b = await send(env, '/search?q=b');
+      expect(b.headers.get('x-isr-cache')).toBe('MISS');
+      expect(await b.text()).toBe('<html>b</html>');
+      const again = await send(env, '/search?q=a');
+      expect(again.headers.get('x-isr-cache')).toBe('HIT');
+      expect(await again.text()).toBe('<html>a</html>');
+      expect(workerFetch).toHaveBeenCalledTimes(2);
+      expect([...kvStore.keys()].filter((k) => k.includes('#rw='))).toHaveLength(2);
+      expect(kvStore.has(bareKey)).toBe(false);
+
+      // A request without allowlisted params keeps the bare key.
+      const plain = await send(env, '/search');
+      expect(plain.headers.get('x-isr-cache')).toBe('MISS');
+      expect(await plain.text()).toBe('<html>none</html>');
+      expect(kvStore.has(bareKey)).toBe(true);
+    });
+
+    it('shares the bare key across query values without an allowlist', async () => {
+      const { env, workerFetch, kvStore } = createEnv({
+        routing: { workerName: 'user-app', projectId: 'proj_1', ssr: true, revalidate: 60 },
+      });
+      workerFetch.mockImplementation(renderQuery);
+
+      expect((await send(env, '/search')).headers.get('x-isr-cache')).toBe('MISS');
+      for (const path of ['/search?q=a', '/search?q=b']) {
+        const response = await send(env, path);
+        expect(response.headers.get('x-isr-cache')).toBe('HIT');
+        expect(await response.text()).toBe('<html>none</html>');
+      }
+      expect(workerFetch).toHaveBeenCalledOnce();
+      expect([...kvStore.keys()]).toEqual([bareKey]);
+    });
+
+    it('keys allowlisted params when fallback rules cover other paths', async () => {
+      const { env, kvStore } = createEnv({
+        routing: {
+          workerName: 'user-app',
+          projectId: 'proj_1',
+          ssr: true,
+          revalidate: 60,
+          queryAllowlist: { '/search': ['q'] },
+          fallbackRules: [{ source: '/app/*', destination: '/index.html', status: 200 }],
+        },
+        workerResponse: new Response('<html>a</html>', {
+          headers: { 'Content-Type': 'text/html' },
+        }),
+      });
+
+      await send(env, '/search?q=a');
+      expect([...kvStore.keys()]).toEqual([
+        isrCacheKey(
+          'proj_1',
+          'legacy',
+          'my-app.void.app',
+          '/search',
+          'https://my-app.void.app/search?q=a',
+        ),
+      ]);
+    });
+  });
+
   it('isolates ISR KV keys between direct and rewritten requests to the same path', async () => {
     const { env, workerFetch, kvStore } = createEnv({
       routing: {
@@ -3556,9 +3765,33 @@ describe('hashed asset caching', () => {
     expect(workerFetch).toHaveBeenCalledTimes(1); // still 1
   });
 
+  it('does not serve one project cached asset to the next project on the same host', async () => {
+    const url = 'https://test.void.app/assets/main-abc123.js';
+    const previous = createEnv({
+      routing: { workerName: 'old-worker', projectId: 'proj-old', hashedAssetsPrefix: 'assets' },
+      workerResponse: new Response('evil'),
+    });
+    const previousCtx = createCtx();
+    expect(await (await app.fetch(new Request(url), previous.env, previousCtx)).text()).toBe(
+      'evil',
+    );
+    await Promise.all(
+      (previousCtx.waitUntil as ReturnType<typeof vi.fn>).mock.calls.map((c) => c[0]),
+    );
+    expect(edgeCacheStore.size).toBe(1);
+
+    const next = createEnv({
+      routing: { workerName: 'new-worker', projectId: 'proj-new', hashedAssetsPrefix: 'assets' },
+      workerResponse: new Response('fresh'),
+    });
+    const res = await app.fetch(new Request(url), next.env, createCtx());
+    expect(await res.text()).toBe('fresh');
+    expect(next.workerFetch).toHaveBeenCalledOnce();
+  });
+
   it('replaces an unmarked legacy hashed body instead of serving it', async () => {
     edgeCacheStore.set(
-      'https://test.void.app/assets/stale.js',
+      'https://test.void.app/assets/stale.js?_p=proj-1',
       new Response('user-alice', {
         headers: { 'Cache-Control': 'public, max-age=31536000, immutable' },
       }),
@@ -3579,7 +3812,7 @@ describe('hashed asset caching', () => {
     expect(res.headers.get('Cache-Control')).toBe('public, max-age=31536000, immutable');
     await Promise.all((ctx.waitUntil as ReturnType<typeof vi.fn>).mock.calls.map((c) => c[0]));
 
-    const replacement = edgeCacheStore.get('https://test.void.app/assets/stale.js');
+    const replacement = edgeCacheStore.get('https://test.void.app/assets/stale.js?_p=proj-1');
     expect(replacement?.headers.get(SHARED_CACHE_POLICY_HEADER)).toBe(
       String(SHARED_CACHE_POLICY_VERSION),
     );
@@ -3700,8 +3933,8 @@ describe('hashed asset caching', () => {
 
     await Promise.all((ctx.waitUntil as ReturnType<typeof vi.fn>).mock.calls.map((c) => c[0]));
 
-    expect(edgeCacheStore.has('https://test.void.app/assets/logo-abc123.png')).toBe(true);
-    expect(edgeCacheStore.has('https://test.void.app/logo')).toBe(false);
+    expect(edgeCacheStore.has('https://test.void.app/assets/logo-abc123.png?_p=proj-1')).toBe(true);
+    expect(edgeCacheStore.has('https://test.void.app/logo?_p=proj-1')).toBe(false);
   });
 
   it('normalizes query strings for cache key', async () => {
@@ -3762,7 +3995,7 @@ describe('hashed asset caching', () => {
     expect(await second.text()).toBe('user-2');
     expect(second.headers.get('Set-Cookie')).toContain('sid=user-2');
     expect(workerFetch).toHaveBeenCalledTimes(2);
-    expect(edgeCacheStore.has(url)).toBe(false);
+    expect(edgeCacheStore.has(`${url}?_p=proj-1`)).toBe(false);
   });
 
   it('keeps credentialed hashed-path responses private without response opt-out headers', async () => {
@@ -3796,7 +4029,7 @@ describe('hashed asset caching', () => {
     expect(workerFetch.mock.calls[0]?.[0].headers.get('Cookie')).toBe('session=alice');
     expect(workerFetch.mock.calls[1]?.[0].headers.get('Cookie')).toBe('session=bob');
     expect(workerFetch).toHaveBeenCalledTimes(2);
-    expect(edgeCacheStore.has(url)).toBe(false);
+    expect(edgeCacheStore.has(`${url}?_p=proj-1`)).toBe(false);
   });
 
   it.each([
@@ -3809,7 +4042,7 @@ describe('hashed asset caching', () => {
         headers: { 'Cache-Control': 'public, max-age=31536000, immutable' },
       }),
     );
-    edgeCacheStore.set(url, currentEntry);
+    edgeCacheStore.set(`${url}?_p=proj-1`, currentEntry);
     const { env, workerFetch } = createEnv({
       routing: {
         workerName: 'test-worker',
@@ -3827,7 +4060,7 @@ describe('hashed asset caching', () => {
 
     expect(await response.text()).toBe('live-user');
     expect(workerFetch).toHaveBeenCalledOnce();
-    expect(await edgeCacheStore.get(url)?.clone().text()).toBe('cached-user');
+    expect(await edgeCacheStore.get(`${url}?_p=proj-1`)?.clone().text()).toBe('cached-user');
   });
 
   it('returns 429 when worker exceeds CPU limit', async () => {
@@ -4158,6 +4391,8 @@ describe('queue relay', () => {
     trafficState?: string;
     lifecycleValue?: string | null;
     lifecycleError?: Error;
+    suspendedProjects?: Array<string>;
+    markerError?: Error;
   }) {
     const workerFetch = vi.fn(
       async (_req: Request) =>
@@ -4170,6 +4405,13 @@ describe('queue relay', () => {
         }
         return options.lifecycleValue ?? null;
       }
+      if (key.startsWith('project-suspended:')) {
+        if (options.markerError) {
+          throw options.markerError;
+        }
+        const projectId = key.slice('project-suspended:'.length);
+        return options.suspendedProjects?.includes(projectId) ? 'operator_review' : null;
+      }
       return options.routingRaw ?? null;
     });
     const dispatchGet = vi.fn(() => ({ fetch: workerFetch }));
@@ -4300,6 +4542,78 @@ describe('queue relay', () => {
     expect(batch.ackAll).not.toHaveBeenCalled();
   });
 
+  it("holds a suspended project's batch without invoking its worker", async () => {
+    const routing = JSON.stringify({
+      workerName: 'user-app',
+      projectId: 'p1',
+      queueName: 'emails',
+    });
+    const batch = createMockBatch('test-queue', [{ id: 'm1', body: 'hello' }]);
+    const { env, dispatchGet } = createQueueEnv({
+      routingRaw: routing,
+      suspendedProjects: ['p1'],
+    });
+    const warning = vi.spyOn(console, 'warn').mockImplementation(() => {});
+
+    try {
+      await app.queue(batch, env);
+    } finally {
+      warning.mockRestore();
+    }
+
+    expect(dispatchGet).not.toHaveBeenCalled();
+    expect(batch.retryAll).toHaveBeenCalledWith({ delaySeconds: 3600 });
+    expect(batch.ackAll).not.toHaveBeenCalled();
+  });
+
+  it('relays batches of projects without a suspension marker', async () => {
+    const routing = JSON.stringify({
+      workerName: 'user-app',
+      projectId: 'p2',
+      queueName: 'emails',
+    });
+    const batch = createMockBatch('test-queue', [{ id: 'm1', body: 'hello' }]);
+    const { env, routingGet, workerFetch } = createQueueEnv({
+      routingRaw: routing,
+      suspendedProjects: ['p1'],
+      workerResponse: Response.json({ ok: true }),
+    });
+
+    await app.queue(batch, env);
+
+    expect(routingGet).toHaveBeenCalledWith('project-suspended:p2', { cacheTtl: 60 });
+    expect(workerFetch).toHaveBeenCalledOnce();
+    expect(batch.ackAll).toHaveBeenCalledOnce();
+  });
+
+  it('relays when the suspension marker cannot be read', async () => {
+    const routing = JSON.stringify({
+      workerName: 'user-app',
+      projectId: 'p3',
+      queueName: 'emails',
+    });
+    const batch = createMockBatch('test-queue', [{ id: 'm1', body: 'hello' }]);
+    const { env, workerFetch } = createQueueEnv({
+      routingRaw: routing,
+      markerError: new Error('routing unavailable'),
+      workerResponse: Response.json({ ok: true }),
+    });
+    const error = vi.spyOn(console, 'error').mockImplementation(() => {});
+
+    try {
+      await app.queue(batch, env);
+      expect(error).toHaveBeenCalledWith(
+        expect.stringContaining('suspension check failed'),
+        expect.any(Error),
+      );
+    } finally {
+      error.mockRestore();
+    }
+
+    expect(workerFetch).toHaveBeenCalledOnce();
+    expect(batch.ackAll).toHaveBeenCalledOnce();
+  });
+
   it('acks all on legacy protocol (ok: true, no decisions)', async () => {
     const routing = JSON.stringify({ workerName: 'user-app', queueName: 'emails' });
     const batch = createMockBatch('test-queue', [{ id: 'm1', body: 'hello' }]);
@@ -4625,7 +4939,9 @@ describe('queue relay', () => {
       return Response.json({ ok: true });
     });
     const env = {
-      ROUTING: { get: async () => routing },
+      ROUTING: {
+        get: async (key: string) => (key.startsWith('project-suspended:') ? null : routing),
+      },
       DISPATCH: { get: () => ({ fetch: workerFetch }) },
       ISR_CACHE: { getWithMetadata: async () => ({ value: null, metadata: null }) },
       ANALYTICS: { writeDataPoint: () => {} },
diff --git a/platform/packages/dispatch/test/unit/pattern.test.ts b/platform/packages/dispatch/test/unit/pattern.test.ts
index 89f162e59..9bd7533a8 100644
--- a/platform/packages/dispatch/test/unit/pattern.test.ts
+++ b/platform/packages/dispatch/test/unit/pattern.test.ts
@@ -371,4 +371,19 @@ describe('substituteParams', () => {
   it('ignores extra params not referenced by destination', () => {
     expect(substituteParams('/articles/:slug', { slug: 'hi', extra: 'x' })).toBe('/articles/hi');
   });
+
+  it('keeps a path destination on the same site when a capture starts with a slash', () => {
+    expect(substituteParams('/:splat', { splat: '/evil.com' })).toBe('/evil.com');
+    expect(substituteParams('/:splat', { splat: '\\evil.com' })).toBe('/evil.com');
+    expect(substituteParams(':splat', { splat: '//evil.com' })).toBe('/evil.com');
+    expect(substituteParams('/:path*', { path: '//evil.com/x' })).toBe('/evil.com/x');
+  });
+
+  it('leaves protocol-relative, absolute and prefixed destinations unchanged', () => {
+    expect(substituteParams('//cdn.example.com/:splat', { splat: 'a' })).toBe(
+      '//cdn.example.com/a',
+    );
+    expect(substituteParams('https://x.com/:splat', { splat: '/a' })).toBe('https://x.com//a');
+    expect(substituteParams('/posts/:splat', { splat: '/x' })).toBe('/posts//x');
+  });
 });
diff --git a/platform/packages/dispatch/test/unit/wfp-asset-fallback.test.ts b/platform/packages/dispatch/test/unit/wfp-asset-fallback.test.ts
index 3f7b582ff..1c204bed7 100644
--- a/platform/packages/dispatch/test/unit/wfp-asset-fallback.test.ts
+++ b/platform/packages/dispatch/test/unit/wfp-asset-fallback.test.ts
@@ -788,7 +788,8 @@ describe('WfP asset fallback on CF stub', () => {
 
   it('repairs a pre-existing immutable poison entry without calling the worker', async () => {
     const request = new Request('https://my-app.void.app/assets/app-abc.js');
-    edgeCacheStore.set(request.url, cachedStubResponse('public, max-age=31536000, immutable'));
+    const cacheUrl = `${request.url}?_p=proj_1`;
+    edgeCacheStore.set(cacheUrl, cachedStubResponse('public, max-age=31536000, immutable'));
     const { env, workerFetch } = createEnv({
       routing: {
         workerName: 'user-app',
@@ -811,7 +812,7 @@ describe('WfP asset fallback on CF stub', () => {
     expect(workerFetch).not.toHaveBeenCalled();
     expect(res.status).toBe(200);
     expect(await res.text()).toBe('console.log(1)');
-    expect(await edgeCacheStore.get(request.url)?.clone().text()).toBe('console.log(1)');
+    expect(await edgeCacheStore.get(cacheUrl)?.clone().text()).toBe('console.log(1)');
   });
 
   it('repairs a pre-existing versioned static poison entry', async () => {
diff --git a/platform/packages/email-gateway/src/index.ts b/platform/packages/email-gateway/src/index.ts
index 143671038..3a27bccd6 100644
--- a/platform/packages/email-gateway/src/index.ts
+++ b/platform/packages/email-gateway/src/index.ts
@@ -591,10 +591,14 @@ function confirmationResponse(
   status: number,
   contentType?: string | null,
 ): Response {
+  // API response headers are not relayed, so the anti-framing headers are
+  // set here; another site must not frame the Confirm button.
   const headers = new Headers({
     'cache-control': 'no-store',
+    'content-security-policy': "frame-ancestors 'none'",
     'referrer-policy': 'no-referrer',
     'x-content-type-options': 'nosniff',
+    'x-frame-options': 'DENY',
   });
   if (contentType) {
     headers.set('content-type', contentType);
@@ -679,8 +683,10 @@ async function confirmDestination(request: Request, env: Env): Promise<Response>
   try {
     const target = new URL(`https://api${CONFIRMATION_PATH}`);
     target.searchParams.set('token', entries[0]![1]);
+    // GET shows the Confirm button and its POST grants consent. Only the
+    // method and the token are relayed; the request body is not.
     const serviceRequest = env.API.fetch(target.toString(), {
-      method: 'GET',
+      method: request.method,
       redirect: 'manual',
       signal: controller.signal,
     });
@@ -729,7 +735,10 @@ export default {
         emailProtocolVersion: 1,
       });
     }
-    if (request.method === 'GET' && url.pathname === CONFIRMATION_PATH) {
+    if (
+      (request.method === 'GET' || request.method === 'POST') &&
+      url.pathname === CONFIRMATION_PATH
+    ) {
       return confirmDestination(request, env);
     }
     if (request.method !== 'POST') {
diff --git a/platform/packages/email-gateway/test/unit/deploy-order.test.ts b/platform/packages/email-gateway/test/unit/deploy-order.test.ts
new file mode 100644
index 000000000..70c17e577
--- /dev/null
+++ b/platform/packages/email-gateway/test/unit/deploy-order.test.ts
@@ -0,0 +1,22 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { describe, expect, it } from 'vite-plus/test';
+
+const scripts: Record<string, string> = JSON.parse(
+  readFileSync(join(import.meta.dirname, '../../../../package.json'), 'utf-8'),
+).scripts;
+
+// The API's confirmation page posts back through the gateway, so the gateway
+// must relay that POST before the new API serves the page.
+describe('hosted deploy order', () => {
+  it.each([
+    ['deploy', 'deploy:email-gateway', 'deploy:api'],
+    ['deploy:staging', 'deploy:staging:email-gateway', 'deploy:staging:api'],
+  ])('%s deploys the email gateway before the API', (script, gateway, api) => {
+    const steps = scripts[script]!.split('&&').map((step) => step.trim());
+    const gatewayStep = steps.indexOf(`vp run ${gateway}`);
+    const apiStep = steps.indexOf(`vp run ${api}`);
+    expect(gatewayStep).toBeGreaterThan(-1);
+    expect(apiStep).toBeGreaterThan(gatewayStep);
+  });
+});
diff --git a/platform/packages/email-gateway/test/unit/gateway.test.ts b/platform/packages/email-gateway/test/unit/gateway.test.ts
index ad487a75d..4d54237f6 100644
--- a/platform/packages/email-gateway/test/unit/gateway.test.ts
+++ b/platform/packages/email-gateway/test/unit/gateway.test.ts
@@ -131,10 +131,55 @@ describe('dedicated email gateway', () => {
     expect(response.headers.get('content-type')).toBe('text/html; charset=UTF-8');
     expect(response.headers.get('cache-control')).toBe('no-store');
     expect(response.headers.get('referrer-policy')).toBe('no-referrer');
+    expect(response.headers.get('x-frame-options')).toBe('DENY');
+    expect(response.headers.get('content-security-policy')).toBe("frame-ancestors 'none'");
     expect(response.headers.get('set-cookie')).toBeNull();
     expect(apiFetch).toHaveBeenCalledTimes(1);
   });
 
+  // Opening the link shows a Confirm button; consent is the button's POST.
+  it('relays the Confirm button POST with the token and no request body', async () => {
+    const apiFetch = vi.fn(async (input: unknown, init?: RequestInit) => {
+      expect(String(input)).toBe('https://api/email/destinations/confirm?token=payload.signature');
+      expect(init?.body).toBeUndefined();
+      const forwarded = new Request(String(input), init);
+      expect(forwarded.method).toBe('POST');
+      expect([...forwarded.headers]).toEqual([]);
+      return new Response('<!doctype html><p>Confirmed</p>', {
+        headers: { 'content-type': 'text/html; charset=UTF-8' },
+      });
+    });
+    const response = await gateway.fetch(
+      new Request('https://gateway.example/email/destinations/confirm?token=payload.signature', {
+        method: 'POST',
+        headers: {
+          'content-type': 'application/x-www-form-urlencoded',
+          cookie: 'untrusted=1',
+        },
+        body: 'token=other.signature',
+      }),
+      env(apiFetch),
+      context,
+    );
+
+    expect(response.status).toBe(200);
+    expect(await response.text()).toContain('Confirmed');
+    expect(response.headers.get('cache-control')).toBe('no-store');
+    expect(response.headers.get('x-frame-options')).toBe('DENY');
+    expect(response.headers.get('content-security-policy')).toBe("frame-ancestors 'none'");
+    expect(apiFetch).toHaveBeenCalledTimes(1);
+
+    const put = await gateway.fetch(
+      new Request('https://gateway.example/email/destinations/confirm?token=payload.signature', {
+        method: 'PUT',
+      }),
+      env(apiFetch),
+      context,
+    );
+    expect(put.status).toBe(404);
+    expect(apiFetch).toHaveBeenCalledTimes(1);
+  });
+
   it.each([
     ['missing', ''],
     ['wrong key', '?other=payload.signature'],
diff --git a/platform/packages/proxy/README.md b/platform/packages/proxy/README.md
index 1a5c1c14d..735199614 100644
--- a/platform/packages/proxy/README.md
+++ b/platform/packages/proxy/README.md
@@ -24,11 +24,11 @@ Deployed user worker            Proxy                       Downstream
 
 Project requests use these authentication paths:
 
-| Path            | When               | Auth                                                                                                         |
-| --------------- | ------------------ | ------------------------------------------------------------------------------------------------------------ |
-| Service binding | Deployed Void apps | Project token (`aiToken`), checked against the project's accept floor; see [Project tokens](#project-tokens) |
-| HTTPS           | Local development  | `Authorization: Bearer <api-jwt>`                                                                            |
-| HTTPS           | Managed prerender  | Five-minute, project-scoped prerender JWT                                                                    |
+| Path            | When               | Auth                                                                                                                                                                                               |
+| --------------- | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Service binding | Deployed Void apps | Project token (`aiToken`), checked against the project's accept floor; see [Project tokens](#project-tokens); requests use bare hosts (`https://ai-proxy`, `https://proxy`, `https://email-proxy`) |
+| HTTPS           | Local development  | `Authorization: Bearer <api-jwt>`                                                                                                                                                                  |
+| HTTPS           | Managed prerender  | Five-minute, project-scoped prerender JWT                                                                                                                                                          |
 
 Project-scoped POST routes require `projectId` in the JSON body. The public
 `GET /health` route has no project body, and `/email/verify-receipt` checks a
@@ -36,11 +36,14 @@ separate internal proof. Prerender JWTs are accepted only when their signed
 project claim exactly matches `projectId`; they are not valid at deployment or
 project-management APIs.
 
-The proxy bounds JSON bodies before authentication: control routes accept up to
-1 MiB, while `/ai/run`, `/ai/provider`, `/ai/toMarkdown`, `/kv/put`, and R2 put
-routes accept up to 8 MiB. Email sends retain their 8 MiB envelope limit and
-receipt verification accepts up to 2 KiB. A stalled body times out after five
-seconds; non-email routes return 413 for oversized bodies and 408 for timeouts.
+HTTPS callers must send `Authorization: Bearer`; the proxy verifies it before
+reading the body, and a request to a public hostname without it gets 401 unread.
+Service-binding bodies are bounded before their project token is checked:
+control routes accept up to 1 MiB, while `/ai/run`, `/ai/provider`,
+`/ai/toMarkdown`, `/kv/put`, and R2 put routes accept up to 8 MiB. Email sends
+retain their 8 MiB envelope limit and receipt verification accepts up to 2 KiB.
+A stalled body times out after five seconds; non-email routes return 413 for
+oversized bodies and 408 for timeouts.
 
 ### Project tokens
 
@@ -92,12 +95,12 @@ the route and project. That value never leaves the platform.
 
 ### AI
 
-| Endpoint              | Body                                                                             | Notes                           |
-| --------------------- | -------------------------------------------------------------------------------- | ------------------------------- |
-| `POST /ai/run`        | `{ model, inputs?, options?, projectId, aiToken? }`                              | Cloudflare AI binding inference |
-| `POST /ai/provider`   | `{ provider, path, method?, headers?, body?, providerKey, projectId, aiToken? }` | Provider-native AI Gateway call |
-| `POST /ai/models`     | `{ inputs?, projectId, aiToken? }`                                               | List models                     |
-| `POST /ai/toMarkdown` | `{ inputs, options?, projectId, aiToken? }`                                      | `AI.toMarkdown()` passthrough   |
+| Endpoint              | Body                                                                             | Notes                                                |
+| --------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------- |
+| `POST /ai/run`        | `{ model, inputs?, options?, projectId, aiToken? }`                              | Cloudflare AI binding inference                      |
+| `POST /ai/provider`   | `{ provider, path, method?, headers?, body?, providerKey, projectId, aiToken? }` | Provider-native AI Gateway call                      |
+| `POST /ai/models`     | `{ inputs?, projectId, aiToken? }`                                               | List models                                          |
+| `POST /ai/toMarkdown` | `{ inputs, options?, projectId, aiToken? }`                                      | `AI.toMarkdown()` through the project-tagged gateway |
 
 `/ai/*` also checks `ROUTING` for `ai-block:{projectId}` before forwarding.
 
diff --git a/platform/packages/proxy/src/ai.ts b/platform/packages/proxy/src/ai.ts
index d6e6ad2dc..c3194f7ca 100644
--- a/platform/packages/proxy/src/ai.ts
+++ b/platform/packages/proxy/src/ai.ts
@@ -1,4 +1,5 @@
 import { isRecord } from '@void/deploy-core';
+import { deriveAiUsageTag } from '@voidcloud/api/proxy-token';
 import { Hono } from 'hono';
 import { asRecord, asString } from './body.ts';
 import type { ProxyEnv } from './types.ts';
@@ -162,26 +163,64 @@ function providerAuthDefaults(provider: string): { header: string; prefix: strin
   return PROVIDER_AUTH_DEFAULTS[provider] ?? { header: 'authorization', prefix: 'Bearer ' };
 }
 
+// AI usage is counted from the platform gateway's log rows by their
+// `projectId` metadata, which holds the signed project tag from
+// `deriveAiUsageTag`, so the platform owns the gateway id, its metadata and
+// logging. Cloudflare saves only the first five metadata entries, and
+// integer-like keys always sort first, so caller metadata could push the
+// project out; `collectLog: false` would drop the row.
+const PLATFORM_GATEWAY_KEYS = new Set(['id', 'metadata', 'collectLog']);
+// `cf-aig-*` request headers set the same metadata, logging and cost.
+const GATEWAY_CONTROL_HEADER = /^cf-aig-/i;
+// Provider-native calls keep the gateway headers that only shape their own
+// request: cache, timeout, retry and the trace id. A caller cache key is kept
+// inside its project; every other `cf-aig-*` header is dropped.
+const PROVIDER_GATEWAY_HEADERS = new Set([
+  'cf-aig-cache-ttl',
+  'cf-aig-skip-cache',
+  'cf-aig-request-timeout',
+  'cf-aig-max-attempts',
+  'cf-aig-retry-delay',
+  'cf-aig-backoff',
+  'cf-aig-event-id',
+]);
+const CACHE_KEY_HEADER = 'cf-aig-cache-key';
+
+/** A caller cache key only hits inside its own project. */
+function projectCacheKey(projectId: string, cacheKey: string): string {
+  return `${projectId}:${cacheKey}`;
+}
+
+function withoutKeys(
+  record: Record<string, unknown>,
+  drop: (key: string) => boolean,
+): Record<string, unknown> {
+  return Object.fromEntries(Object.entries(record).filter(([key]) => !drop(key)));
+}
+
+/** Options for an AI binding call that goes through the project-tagged platform gateway. */
 function gatewayOptions(
   value: unknown,
   projectId: string,
+  usageTag: string,
   gatewayId: string,
 ): Record<string, unknown> {
   const options = asRecord(value);
-  const gateway = asRecord(options.gateway);
-  const metadata = asRecord(gateway.metadata);
+  const gateway = withoutKeys(asRecord(options.gateway), (key) => PLATFORM_GATEWAY_KEYS.has(key));
+  if (typeof gateway.cacheKey === 'string') {
+    gateway.cacheKey = projectCacheKey(projectId, gateway.cacheKey);
+  }
 
-  return {
+  const result: Record<string, unknown> = {
     ...options,
-    gateway: {
-      ...gateway,
-      id: gatewayId,
-      metadata: {
-        ...metadata,
-        projectId,
-      },
-    },
+    gateway: { ...gateway, id: gatewayId, metadata: { projectId: usageTag } },
   };
+  if ('extraHeaders' in options) {
+    result.extraHeaders = withoutKeys(asRecord(options.extraHeaders), (key) =>
+      GATEWAY_CONTROL_HEADER.test(key),
+    );
+  }
+  return result;
 }
 
 function applyProviderHeaders({
@@ -206,7 +245,22 @@ function applyProviderHeaders({
   const keyPrefix = apiKeyPrefix ?? defaults.prefix;
 
   headers.set(keyHeader, `${keyPrefix}${providerKey}`);
-  headers.set('cf-aig-metadata-projectId', projectId);
+  // Provider-native calls bill to the app's own provider key, so they carry
+  // no usage tag and do not count toward the platform AI allowance. Caller
+  // gateway headers are filtered after the key header is set, so neither they
+  // nor a caller-chosen key header name can set gateway metadata, logging,
+  // cost or billing, or use a cache key outside the project.
+  const callerGatewayHeaders = [...headers.keys()].filter(
+    (name) => GATEWAY_CONTROL_HEADER.test(name) && !PROVIDER_GATEWAY_HEADERS.has(name),
+  );
+  for (const name of callerGatewayHeaders) {
+    const value = headers.get(name);
+    if (name === CACHE_KEY_HEADER && value !== null) {
+      headers.set(name, projectCacheKey(projectId, value));
+    } else {
+      headers.delete(name);
+    }
+  }
   if (contentType && !headers.has('content-type')) {
     headers.set('content-type', contentType);
   }
@@ -346,6 +400,7 @@ ai.post('/run', async (context) => {
   const options = gatewayOptions(
     body.options,
     projectId,
+    await deriveAiUsageTag(context.env.JWT_SECRET, projectId),
     context.env.AI_GATEWAY_ID ?? DEFAULT_GATEWAY_ID,
   );
 
@@ -438,8 +493,15 @@ ai.post('/models', async (context) => {
 
 ai.post('/toMarkdown', async (context) => {
   const body = context.get('body');
+  const projectId = context.get('projectId');
+  const options = gatewayOptions(
+    body.options,
+    projectId,
+    await deriveAiUsageTag(context.env.JWT_SECRET, projectId),
+    context.env.AI_GATEWAY_ID ?? DEFAULT_GATEWAY_ID,
+  );
   try {
-    const result = await context.env.AI.toMarkdown(body.inputs, body.options);
+    const result = await context.env.AI.toMarkdown(body.inputs, options);
     return context.json(result);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
diff --git a/platform/packages/proxy/src/index.ts b/platform/packages/proxy/src/index.ts
index f67c8e90c..7d66fc417 100644
--- a/platform/packages/proxy/src/index.ts
+++ b/platform/packages/proxy/src/index.ts
@@ -126,7 +126,36 @@ app.post('/email/relay', (context) => context.json({ error: 'not found' }, 404))
 
 // Auth middleware — parses body, authenticates, sets projectId
 app.post('/*', async (context, next) => {
-  const path = new URL(context.req.url).pathname;
+  const url = new URL(context.req.url);
+  const path = url.pathname;
+
+  // Check credentials before buffering up to 8 MiB of JSON. Header tokens are
+  // verified here. Body tokens (projectId + aiToken) come only from deployed
+  // Workers over the __VOID_PROXY service binding, which calls bare hosts
+  // (https://ai-proxy, https://proxy, https://email-proxy). Public hostnames
+  // always contain a dot, so a public request without a header is refused unread.
+  const authHeader = context.req.header('authorization');
+  const token = authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : '';
+  const payload = token ? await verifyJwt(token, context.env.JWT_SECRET) : null;
+  if (authHeader !== undefined && !payload) {
+    return context.json(
+      {
+        error: 'invalid or expired token',
+        message:
+          'This proxy credential is invalid or expired. Sign in to the connected platform again for remote development, or restart the build to obtain a fresh prerender token.',
+      },
+      401,
+    );
+  }
+  if (authHeader === undefined && url.hostname.includes('.')) {
+    return context.json(
+      {
+        error: 'authorization required',
+        message: 'Send a Void platform token in the Authorization header.',
+      },
+      401,
+    );
+  }
 
   let body: ProxyBody;
   try {
@@ -147,21 +176,8 @@ app.post('/*', async (context, next) => {
   context.set('body', body);
 
   let revalidateHuman: (() => Promise<boolean>) | undefined;
-  const authHeader = context.req.header('authorization');
-  if (authHeader?.startsWith('Bearer ')) {
-    // HTTPS path (local dev) — validate JWT
-    const token = authHeader.slice(7);
-    const payload = await verifyJwt(token, context.env.JWT_SECRET);
-    if (!payload) {
-      return context.json(
-        {
-          error: 'invalid or expired token',
-          message:
-            'This proxy credential is invalid or expired. Sign in to the connected platform again for remote development, or restart the build to obtain a fresh prerender token.',
-        },
-        401,
-      );
-    }
+  if (payload) {
+    // HTTPS path (local dev) — JWT verified above
     const projectId = asString(body.projectId);
     if (!projectId) {
       return context.json({ error: 'projectId required' }, 400);
diff --git a/platform/packages/proxy/test/unit/d1.test.ts b/platform/packages/proxy/test/unit/d1.test.ts
index 62b66686b..fcf084d60 100644
--- a/platform/packages/proxy/test/unit/d1.test.ts
+++ b/platform/packages/proxy/test/unit/d1.test.ts
@@ -71,7 +71,7 @@ function createEnv(apiResources: Record<string, string> = {}) {
 }
 
 function post(path: string, body: unknown): Request {
-  return new Request(`https://proxy.void.cloud${path}`, {
+  return new Request(`https://proxy${path}`, {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
     body: JSON.stringify(body),
diff --git a/platform/packages/proxy/test/unit/dispatch.test.ts b/platform/packages/proxy/test/unit/dispatch.test.ts
index f5affd7b6..99603aa50 100644
--- a/platform/packages/proxy/test/unit/dispatch.test.ts
+++ b/platform/packages/proxy/test/unit/dispatch.test.ts
@@ -82,7 +82,7 @@ function createEnv(
 }
 
 function post(path: string, body: unknown): Request {
-  return new Request(`https://proxy.void.cloud${path}`, {
+  return new Request(`https://proxy${path}`, {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
     body: JSON.stringify(body),
diff --git a/platform/packages/proxy/test/unit/email-custom-domain.test.ts b/platform/packages/proxy/test/unit/email-custom-domain.test.ts
index 6d3c26b09..a20bc7de4 100644
--- a/platform/packages/proxy/test/unit/email-custom-domain.test.ts
+++ b/platform/packages/proxy/test/unit/email-custom-domain.test.ts
@@ -154,7 +154,7 @@ async function postSend(
   body: Record<string, unknown>,
 ): Promise<Response> {
   return (worker.fetch as (req: Request, env: unknown) => Promise<Response>)(
-    new Request('https://proxy.void.cloud/email/send', {
+    new Request('https://email-proxy/email/send', {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
       body: JSON.stringify(body),
diff --git a/platform/packages/proxy/test/unit/email.test.ts b/platform/packages/proxy/test/unit/email.test.ts
index e7656b0be..118861e31 100644
--- a/platform/packages/proxy/test/unit/email.test.ts
+++ b/platform/packages/proxy/test/unit/email.test.ts
@@ -175,7 +175,7 @@ async function postSend(
   body: Record<string, unknown>,
 ): Promise<Response> {
   return (worker.fetch as (req: Request, env: unknown) => Promise<Response>)(
-    new Request('https://proxy.void.cloud/email/send', {
+    new Request('https://email-proxy/email/send', {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
       body: JSON.stringify(body),
diff --git a/platform/packages/proxy/test/unit/kv.test.ts b/platform/packages/proxy/test/unit/kv.test.ts
index 023f2efa9..b1d1a52e4 100644
--- a/platform/packages/proxy/test/unit/kv.test.ts
+++ b/platform/packages/proxy/test/unit/kv.test.ts
@@ -69,7 +69,7 @@ function createEnv(apiResources: Record<string, string> = {}) {
 }
 
 function post(path: string, body: unknown): Request {
-  return new Request(`https://proxy.void.cloud${path}`, {
+  return new Request(`https://proxy${path}`, {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
     body: JSON.stringify(body),
diff --git a/platform/packages/proxy/test/unit/proxy.test.ts b/platform/packages/proxy/test/unit/proxy.test.ts
index 6b1f7f048..3f6eec9a6 100644
--- a/platform/packages/proxy/test/unit/proxy.test.ts
+++ b/platform/packages/proxy/test/unit/proxy.test.ts
@@ -1,5 +1,5 @@
 import { signEmailReceipt } from '@void/platform/email-protocol';
-import { deriveProxyToken } from '@voidcloud/api/proxy-token';
+import { deriveAiUsageTag, deriveProxyToken } from '@voidcloud/api/proxy-token';
 import { describe, it, expect, vi, beforeAll, beforeEach, afterEach } from 'vite-plus/test';
 import worker from '../../src/index.ts';
 import { PLATFORM_DISABLED_KEY } from '../../src/platform-lifecycle.ts';
@@ -166,7 +166,10 @@ function createEnv(
 }
 
 function post(path: string, body: unknown, headers?: Record<string, string>): Request {
-  return new Request(`https://proxy.void.cloud${path}`, {
+  // Service-binding callers use bare hosts and no header; HTTPS callers send Bearer.
+  const origin =
+    headers?.authorization === undefined ? 'https://proxy' : 'https://proxy.void.cloud';
+  return new Request(`${origin}${path}`, {
     method: 'POST',
     headers: { 'content-type': 'application/json', ...headers },
     body: JSON.stringify(body),
@@ -178,6 +181,7 @@ function post(path: string, body: unknown, headers?: Record<string, string>): Re
 describe('proxy worker', () => {
   let validToken: string;
   const aiTokens: Record<string, string> = {};
+  const usageTags: Record<string, string> = {};
 
   beforeEach(clearProxyTokenStateCache);
 
@@ -195,6 +199,7 @@ describe('proxy worker', () => {
       'proj_000000000000',
     ]) {
       aiTokens[pid] = await signAiToken(pid, JWT_SECRET);
+      usageTags[pid] = await deriveAiUsageTag(JWT_SECRET, pid);
     }
   });
 
@@ -302,7 +307,7 @@ describe('proxy worker', () => {
         controller.close();
       });
       const cancel = vi.fn();
-      const request = new Request('https://proxy.void.cloud/ai/models', {
+      const request = new Request('https://ai-proxy/ai/models', {
         method: 'POST',
         headers: { 'content-length': String(1024 * 1024 + 1) },
         body: new ReadableStream({ pull, cancel }, { highWaterMark: 0 }),
@@ -317,7 +322,7 @@ describe('proxy worker', () => {
 
     it('enforces the byte cap when Content-Length is missing', async () => {
       const body = new TextEncoder().encode(JSON.stringify({ pad: 'x'.repeat(1024 * 1024) }));
-      const request = new Request('https://proxy.void.cloud/ai/models', {
+      const request = new Request('https://ai-proxy/ai/models', {
         method: 'POST',
         body: new ReadableStream({
           start(controller) {
@@ -337,7 +342,7 @@ describe('proxy worker', () => {
       vi.useFakeTimers();
       let controller: ReadableStreamDefaultController<Uint8Array> | undefined;
       let cancelled = false;
-      const request = new Request('https://proxy.void.cloud/ai/models', {
+      const request = new Request('https://ai-proxy/ai/models', {
         method: 'POST',
         body: new ReadableStream({
           start(value) {
@@ -456,7 +461,7 @@ describe('proxy worker', () => {
   describe('email send request bounds', () => {
     it('allows a maximum-size MIME envelope through to authentication', async () => {
       const response = await worker.fetch(
-        new Request('https://proxy.void.cloud/email/send', {
+        new Request('https://email-proxy/email/send', {
           method: 'POST',
           body: JSON.stringify({
             projectId: 'proj_000000000001',
@@ -477,7 +482,7 @@ describe('proxy worker', () => {
           controller.close();
         });
         const cancel = vi.fn();
-        const request = new Request(`https://proxy.void.cloud${path}`, {
+        const request = new Request(`https://email-proxy${path}`, {
           method: 'POST',
           headers: { 'content-length': String(8 * 1024 * 1024 + 1) },
           body: new ReadableStream({ pull, cancel }, { highWaterMark: 0 }),
@@ -493,7 +498,7 @@ describe('proxy worker', () => {
     it('ends a stalled unauthenticated send body without waiting for cancellation', async () => {
       vi.useFakeTimers();
       const cancel = vi.fn(() => new Promise<void>(() => {}));
-      const request = new Request('https://proxy.void.cloud/email/send', {
+      const request = new Request('https://email-proxy/email/send', {
         method: 'POST',
         body: new ReadableStream({ cancel }),
         duplex: 'half',
@@ -509,6 +514,79 @@ describe('proxy worker', () => {
     });
   });
 
+  describe('authentication before the body is read', () => {
+    function streamedPost(url: string, headers: Record<string, string> = {}) {
+      const pull = vi.fn((controller: ReadableStreamDefaultController<Uint8Array>) => {
+        controller.enqueue(new TextEncoder().encode('{}'));
+        controller.close();
+      });
+      const request = new Request(url, {
+        method: 'POST',
+        headers,
+        body: new ReadableStream({ pull, cancel: vi.fn() }, { highWaterMark: 0 }),
+        duplex: 'half',
+      } as RequestInit);
+      return { request, pull };
+    }
+
+    it.each(['https://proxy.void.cloud', 'https://void-proxy.example.workers.dev'])(
+      'refuses a request to %s without a header before reading its body',
+      async (host) => {
+        const { request, pull } = streamedPost(`${host}/ai/run`);
+        const response = await worker.fetch(request, createEnv());
+        expect(response.status).toBe(401);
+        expect(await response.json()).toMatchObject({ error: 'authorization required' });
+        expect(pull).not.toHaveBeenCalled();
+      },
+    );
+
+    it('refuses an invalid bearer token before reading the body', async () => {
+      const { request, pull } = streamedPost('https://proxy.void.cloud/ai/run', {
+        authorization: 'Bearer junk',
+      });
+      const response = await worker.fetch(request, createEnv());
+      expect(response.status).toBe(401);
+      expect(await response.json()).toMatchObject({ error: 'invalid or expired token' });
+      expect(pull).not.toHaveBeenCalled();
+    });
+
+    it('never accepts a body project token next to a non-bearer header', async () => {
+      const env = createEnv();
+      const response = await worker.fetch(
+        post(
+          '/ai/run',
+          {
+            model: 'm',
+            inputs: {},
+            projectId: 'proj_000000000001',
+            aiToken: aiTokens['proj_000000000001'],
+          },
+          { authorization: 'Basic x' },
+        ),
+        env,
+      );
+      expect(response.status).toBe(401);
+      expect(env.AI.run).not.toHaveBeenCalled();
+    });
+
+    it.each([
+      'https://ai-proxy/ai/run',
+      'https://proxy/revalidate',
+      'https://email-proxy/email/send',
+    ])('checks the body project token on the binding host %s', async (url) => {
+      const response = await worker.fetch(
+        new Request(url, {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ projectId: 'proj_000000000001', aiToken: 'invalid' }),
+        }),
+        createEnv(),
+      );
+      expect(response.status).toBe(403);
+      expect(await response.json()).toEqual({ error: 'invalid project token' });
+    });
+  });
+
   it('verifies email receipts independently of project login authentication', async () => {
     const claims = {
       version: 1 as const,
@@ -1341,7 +1419,7 @@ describe('proxy worker', () => {
         { prompt: 'hi' },
         {
           max_tokens: 100,
-          gateway: { id: 'void', metadata: { projectId: 'proj_000000000042' } },
+          gateway: { id: 'void', metadata: { projectId: usageTags['proj_000000000042'] } },
         },
       );
     });
@@ -1362,7 +1440,7 @@ describe('proxy worker', () => {
         'm',
         {},
         {
-          gateway: { id: 'void-team', metadata: { projectId: 'proj_000000000042' } },
+          gateway: { id: 'void-team', metadata: { projectId: usageTags['proj_000000000042'] } },
         },
       );
     });
@@ -1395,7 +1473,87 @@ describe('proxy worker', () => {
             id: 'void',
             skipCache: true,
             cacheTtl: 60,
-            metadata: { user: 'alice', projectId: 'proj_000000000042' },
+            metadata: { projectId: usageTags['proj_000000000042'] },
+          },
+        },
+      );
+    });
+
+    it.each([
+      { a: '1', b: '2', c: '3', d: '4', e: '5' },
+      { '0': '1', '1': '2', '2': '3', '3': '4', '4': '5' },
+    ])('keeps the project as the only gateway metadata entry %j', async (metadata) => {
+      const env = createEnv();
+      await worker.fetch(
+        post('/ai/run', {
+          model: 'm',
+          inputs: {},
+          options: { gateway: { metadata } },
+          projectId: 'proj_000000000042',
+          aiToken: aiTokens['proj_000000000042'],
+        }),
+        env,
+      );
+
+      const options = env.AI.run.mock.calls[0]![2] as { gateway: { metadata: unknown } };
+      expect(options.gateway.metadata).toStrictEqual({ projectId: usageTags['proj_000000000042'] });
+    });
+
+    it('keeps gateway logging on and drops caller gateway control headers', async () => {
+      const env = createEnv();
+      await worker.fetch(
+        post('/ai/run', {
+          model: 'm',
+          inputs: {},
+          options: {
+            gateway: { collectLog: false, eventId: 'event-1' },
+            extraHeaders: {
+              'cf-aig-metadata': '{"projectId":"proj_000000000001"}',
+              'CF-AIG-Custom-Cost': '{"total_cost":0}',
+              'x-keep': 'yes',
+            },
+          },
+          projectId: 'proj_000000000042',
+          aiToken: aiTokens['proj_000000000042'],
+        }),
+        env,
+      );
+
+      expect(env.AI.run).toHaveBeenCalledWith(
+        'm',
+        {},
+        {
+          gateway: {
+            id: 'void',
+            eventId: 'event-1',
+            metadata: { projectId: usageTags['proj_000000000042'] },
+          },
+          extraHeaders: { 'x-keep': 'yes' },
+        },
+      );
+    });
+
+    it('scopes a caller cache key to the project', async () => {
+      const env = createEnv();
+      await worker.fetch(
+        post('/ai/run', {
+          model: 'm',
+          inputs: {},
+          options: { gateway: { cacheKey: 'k' } },
+          projectId: 'proj_000000000042',
+          aiToken: aiTokens['proj_000000000042'],
+        }),
+        env,
+      );
+
+      expect(env.AI.run).toHaveBeenCalledWith(
+        'm',
+        {},
+        {
+          gateway: {
+            id: 'void',
+            cacheKey: 'proj_000000000042:k',
+            metadata: { projectId: usageTags['proj_000000000042'] },
           },
         },
       );
@@ -1517,10 +1675,31 @@ describe('proxy worker', () => {
         'm',
         {},
         {
-          gateway: { id: 'void', metadata: { projectId: 'proj_000000000099' } },
+          gateway: { id: 'void', metadata: { projectId: usageTags['proj_000000000099'] } },
         },
       );
     });
+
+    it('tags gateway metadata with the signed project value the usage query counts', async () => {
+      const env = createEnv();
+      await worker.fetch(
+        post('/ai/run', {
+          model: 'm',
+          inputs: {},
+          projectId: 'proj_000000000042',
+          aiToken: aiTokens['proj_000000000042'],
+        }),
+        env,
+      );
+
+      const options = env.AI.run.mock.calls[0]![2] as {
+        gateway: { metadata: { projectId: string } };
+      };
+      const tag = options.gateway.metadata.projectId;
+      expect(tag).toBe(await deriveAiUsageTag(env.JWT_SECRET, 'proj_000000000042'));
+      expect(tag).toMatch(/^proj_000000000042\.[A-Za-z0-9_-]{22}$/);
+      expect(tag).not.toBe(await deriveAiUsageTag('other-secret', 'proj_000000000042'));
+    });
   });
 
   describe('AI: /ai/models', () => {
@@ -1560,7 +1739,40 @@ describe('proxy worker', () => {
 
       expect(res.status).toBe(200);
       expect(await res.json()).toEqual(result);
-      expect(env.AI.toMarkdown).toHaveBeenCalledWith({ content: 'hello' }, { format: 'md' });
+      expect(env.AI.toMarkdown).toHaveBeenCalledWith(
+        { content: 'hello' },
+        {
+          format: 'md',
+          gateway: { id: 'void', metadata: { projectId: usageTags['proj_000000000000'] } },
+        },
+      );
+    });
+
+    it('converts through the installation gateway without caller gateway control', async () => {
+      const env = { ...createEnv(), AI_GATEWAY_ID: 'void-team' };
+
+      await worker.fetch(
+        post('/ai/toMarkdown', {
+          inputs: { content: 'hello' },
+          options: {
+            gateway: { id: 'other', collectLog: false, metadata: { projectId: 'x' } },
+            extraHeaders: { 'cf-aig-custom-cost': '{"total_cost":0}', 'x-keep': 'yes' },
+            conversionOptions: { image: { descriptionLanguage: 'en' } },
+          },
+          projectId: 'proj_000000000042',
+          aiToken: aiTokens['proj_000000000042'],
+        }),
+        env,
+      );
+
+      expect(env.AI.toMarkdown).toHaveBeenCalledWith(
+        { content: 'hello' },
+        {
+          gateway: { id: 'void-team', metadata: { projectId: usageTags['proj_000000000042'] } },
+          extraHeaders: { 'x-keep': 'yes' },
+          conversionOptions: { image: { descriptionLanguage: 'en' } },
+        },
+      );
     });
   });
 
@@ -1622,7 +1834,7 @@ describe('proxy worker', () => {
       expect(init.method).toBe('POST');
       const headers = new Headers(init.headers);
       expect(headers.get('authorization')).toBe('Bearer sk-test-key');
-      expect(headers.get('cf-aig-metadata-projectId')).toBe('proj_000000000001');
+      expect([...headers.keys()].filter((name) => name.startsWith('cf-aig-'))).toEqual([]);
       expect(headers.get('content-type')).toBe('application/json');
       expect(headers.get('openai-beta')).toBe('assistants=v2');
       expect(JSON.parse(init.body as string)).toEqual({
@@ -1681,7 +1893,120 @@ describe('proxy worker', () => {
       const headers = new Headers(fetchMock.mock.calls[0][1]!.headers);
       expect(headers.get('x-goog-api-key')).toBe('google-key');
       expect(headers.get('authorization')).toBeNull();
-      expect(headers.get('cf-aig-metadata-projectId')).toBe('proj_000000000001');
+      expect([...headers.keys()].filter((name) => name.startsWith('cf-aig-'))).toEqual([]);
+    });
+
+    function gatewayHeaders(headers: Headers): Array<[string, string]> {
+      return [...headers].filter(([name]) => name.startsWith('cf-aig-'));
+    }
+
+    it('drops caller gateway control headers on provider-native calls', async () => {
+      const fetchMock = mockProviderFetch('{}', {
+        headers: { 'content-type': 'application/json' },
+      });
+      const { gateway } = mockProviderGateway();
+      const env = createEnv({ gateway });
+
+      const callerHeaders = await worker.fetch(
+        post('/ai/provider', {
+          provider: 'openai',
+          path: '/chat/completions',
+          headers: {
+            'cf-aig-metadata': '{"projectId":"proj_000000000001"}',
+            'CF-AIG-Collect-Log': 'false',
+            'cf-aig-collect-log-payload': 'false',
+            'cf-aig-custom-cost': '{"total_cost":0}',
+            'cf-aig-authorization': 'Bearer platform-gateway-token',
+            'cf-aig-byok-alias': 'platform-key',
+            'cf-aig-future-control': 'on',
+            'x-keep': 'yes',
+          },
+          providerKey: 'sk-test',
+          projectId: 'proj_000000000001',
+          aiToken: aiTokens['proj_000000000001'],
+        }),
+        env,
+      );
+      expect(callerHeaders.status).toBe(200);
+      const forwarded = new Headers(fetchMock.mock.calls[0][1]!.headers);
+      expect(gatewayHeaders(forwarded)).toStrictEqual([]);
+      expect(forwarded.get('x-keep')).toBe('yes');
+      expect(forwarded.get('authorization')).toBe('Bearer sk-test');
+
+      const keyHeader = await worker.fetch(
+        post('/ai/provider', {
+          provider: 'openai',
+          path: '/chat/completions',
+          apiKeyHeader: 'cf-aig-collect-log',
+          apiKeyPrefix: '',
+          providerKey: 'false',
+          projectId: 'proj_000000000001',
+          aiToken: aiTokens['proj_000000000001'],
+        }),
+        env,
+      );
+      expect(keyHeader.status).toBe(200);
+      expect(gatewayHeaders(new Headers(fetchMock.mock.calls[1][1]!.headers))).toStrictEqual([]);
+    });
+
+    it('forwards cache, timeout and retry gateway headers on provider-native calls', async () => {
+      const fetchMock = mockProviderFetch('{}', {
+        headers: { 'content-type': 'application/json' },
+      });
+      const { gateway } = mockProviderGateway();
+      const env = createEnv({ gateway });
+
+      const callerHeaders = await worker.fetch(
+        post('/ai/provider', {
+          provider: 'openai',
+          path: '/chat/completions',
+          headers: {
+            'cf-aig-cache-ttl': '3600',
+            'CF-AIG-Skip-Cache': 'true',
+            'cf-aig-request-timeout': '5000',
+            'cf-aig-max-attempts': '3',
+            'cf-aig-retry-delay': '1000',
+            'cf-aig-backoff': 'exponential',
+            'cf-aig-event-id': 'evt_1',
+            'CF-AIG-Cache-Key': 'shared-key',
+            'cf-aig-metadata': '{"projectId":"proj_000000000001"}',
+          },
+          providerKey: 'sk-test',
+          projectId: 'proj_000000000001',
+          aiToken: aiTokens['proj_000000000001'],
+        }),
+        env,
+      );
+      expect(callerHeaders.status).toBe(200);
+      expect(
+        Object.fromEntries(gatewayHeaders(new Headers(fetchMock.mock.calls[0][1]!.headers))),
+      ).toStrictEqual({
+        'cf-aig-cache-ttl': '3600',
+        'cf-aig-skip-cache': 'true',
+        'cf-aig-request-timeout': '5000',
+        'cf-aig-max-attempts': '3',
+        'cf-aig-retry-delay': '1000',
+        'cf-aig-backoff': 'exponential',
+        'cf-aig-event-id': 'evt_1',
+        'cf-aig-cache-key': 'proj_000000000001:shared-key',
+      });
+
+      const keyHeader = await worker.fetch(
+        post('/ai/provider', {
+          provider: 'openai',
+          path: '/chat/completions',
+          apiKeyHeader: 'cf-aig-cache-key',
+          apiKeyPrefix: '',
+          providerKey: 'shared-key',
+          projectId: 'proj_000000000001',
+          aiToken: aiTokens['proj_000000000001'],
+        }),
+        env,
+      );
+      expect(keyHeader.status).toBe(200);
+      expect(gatewayHeaders(new Headers(fetchMock.mock.calls[1][1]!.headers))).toStrictEqual([
+        ['cf-aig-cache-key', 'proj_000000000001:shared-key'],
+      ]);
     });
 
     it('reconstructs multipart form data bodies', async () => {
diff --git a/platform/packages/proxy/test/unit/r2.test.ts b/platform/packages/proxy/test/unit/r2.test.ts
index c2962aea4..da2de26ea 100644
--- a/platform/packages/proxy/test/unit/r2.test.ts
+++ b/platform/packages/proxy/test/unit/r2.test.ts
@@ -69,7 +69,7 @@ function createEnv(apiResources: Record<string, string> = {}) {
 }
 
 function post(path: string, body: unknown): Request {
-  return new Request(`https://proxy.void.cloud${path}`, {
+  return new Request(`https://proxy${path}`, {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
     body: JSON.stringify(body),