diff --git a/AGENTS.md b/AGENTS.md
index 2ffa19cfe..26a533a45 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -4953,17 +4953,17 @@ the spec, target a 1920px viewport, not 1440px.
 | Edit a template                        | `web/themes/default/*.tpl`                               |
 | Reuse the moderation-queue card layout (admin submissions / protests, mobile-stacked summary rows) | `web/themes/default/css/theme.css` (`.queue-row`, `.queue-row__body`, `.queue-row__date` — #1207 PUB-2). Apply by adding `class="queue-row …"` to the outer `<details>` and dropping the inline `flex` / `flex-shrink:0` styles from the summary children. |
 | Add visible row actions to a table-rendered admin list (Edit / Unmute / Remove buttons + responsive mobile-card mirror) | `web/themes/default/page_admin_admins_list.tpl` is the density reference: icon-only `<a class="btn btn--ghost btn--icon btn--sm">` / `<button class="btn btn--secondary btn--icon btn--sm">` inside `.row-actions.row-actions--icons`, with `data-tooltip` + `aria-label` (themed tooltip via `sb.js`). Public banlist / commslist (`page_bans.tpl` / `page_comms.tpl`) follow the same chrome on `table table--compact` desktop tables (tighter cell padding + 22px avatars + 1.75rem icon buttons via `.table.table--compact .row-actions--icons .btn--icon.btn--sm`), plus `.ban-card__actions` mobile rows. Wire destructive / state-changing buttons via `data-action="…"` + `data-bid` + `data-fallback-href`; the inline page-tail JS calls `sb.api.call(Actions.PascalName)` and falls back to the GET URL if the JSON dispatcher is absent. Banlist Remove points at the legacy GET handler (`?p=banlist&a=delete&id=…&key=…`) because no JSON `bans.delete` action exists yet. |
-| Wire a comment-delete trash icon on any of the four comment-rendering surfaces (banlist, commslist, admin.bans protests, admin.bans submissions) | `web/scripts/comment-actions.js` (#1402). Single document-level dispatcher loaded from `core/footer.tpl` (`<script src="./scripts/comment-actions.js" defer>`) that picks up every `[data-action="comment-delete"]` click, opens a shared `#comment-delete-dialog` `<dialog>` (injected once by the script), then `sb.api.call(Actions.BansRemoveComment, { cid, ctype, page })`. The four call sites emit the trigger with `data-cid="<int>"` + `data-ctype="<B|C|S|P>"` + `data-page="<int>"` (the page number for client-side row-hide / paginator-aware redirect; `data-page="-1"` is the sentinel for unpaginated moderation queues). The `ctype` letter matches `:prefix_comments.type` (B=ban, C=comm-block, S=submission, P=protest); `api_bans_remove_comment`'s `ctype` arm consumes all four. Don't duplicate the dispatcher inline per page — the single mount point is the contract, otherwise a future bug-fix has to land in four places. Do NOT reintroduce `window.confirm()` for this surface. |
+| Wire a comment-delete trash icon on any of the four comment-rendering surfaces (banlist, commslist, admin.bans protests, admin.bans submissions) | `web/scripts/comment-actions.js` (#1402). Single document-level dispatcher loaded from `core/footer.tpl` (`<script src="./scripts/comment-actions.js" defer>`) that picks up every `[data-action="comment-delete"]` click, opens a shared `#comment-delete-dialog` `<dialog>` (injected once by the script), then `sb.api.call(Actions.BansRemoveComment, { cid, ctype, page })`. The four call sites emit the trigger with `data-cid="<int>"` + `data-ctype="<B|C|S|P>"` + `data-page="<int>"`. Banlist / commslist (`B` / `C`) stay on the current page: the dispatcher emits `sbpp:comment-deleted` and `theme.js` removes the comment `<li>` in place (scroll, pagination, and open disclosures survive). Protest / submission queues (`P` / `S`) still honour `message.redir` / reload (`data-page="-1"` is the unpaginated-queue sentinel). The `ctype` letter matches `:prefix_comments.type`; `api_bans_remove_comment`'s `ctype` arm consumes all four. Don't duplicate the dispatcher inline per page. Do NOT reintroduce `window.confirm()` for this surface. |
 | Open a simple confirm dialog (yes/no, no reason field) | `window.SBPP.confirm({ title, body?, confirmLabel?, cancelLabel?, danger? })` in `web/themes/default/js/theme.js` — returns `Promise<boolean>`. Injects a shared `<dialog data-testid="sbpp-confirm-dialog">` once; `danger: true` paints the confirm button as `btn--danger`. Do **not** fall back to `window.confirm` / `window.alert` when `SBPP` is missing (no-op). Informational feedback uses `SBPP.showToast`, not a modal. Native `dialog::backdrop` is styled in `theme.css` to match `.drawer-backdrop` (blur + darken). Regression: `web/tests/integration/NativeConfirmRegressionTest.php` + `admin-groups-delete.spec.ts`. For reason-required destructive actions use the dedicated modal row below. |
 | Add a confirm + reason modal for an irreversible row-level action (unban, lift comm block, delete admin, delete mod, …) | `web/themes/default/page_bans.tpl` (`#bans-unban-dialog`, `Actions.BansUnban`) and `web/themes/default/page_comms.tpl` (`#comms-unblock-dialog`, `Actions.CommsUnblock`) are the canonical reference (#1301), with `web/themes/default/page_admin_admins_list.tpl` (`#admins-delete-dialog`, `Actions.AdminsRemove`, #1352) and `web/themes/default/page_admin_mods_list.tpl` (`#mod-delete-dialog`, `Actions.ModsRemove`, #1397) as the third and fourth references for the optional-reason variant. Confirm-only delete (no reason field): `#bans-delete-dialog` (legacy GET navigate), `#comms-delete-dialog` (`Actions.CommsDelete`), and `#comment-delete-dialog` (injected by `comment-actions.js`). Never use `window.confirm()` / `alert()` for these row actions. Shape: a `<dialog hidden>` with a `<form method="dialog">` carrying a `<textarea aria-required="true">` (or `aria-required="false"` for the optional-reason variant — see admins-delete / mod-delete; omit the textarea for confirm-only deletes) (NOT the native `required` — that lets the browser block the form submit before our handler runs, swallowing the inline-error UX), a Cancel button, and a Confirm submit button. The page-tail JS opens the dialog via `showModal()` on `[data-action]` clicks, validates the trimmed reason on submit (load-bearing gate is server-side), forwards `ureason` to the JSON action, and on success flips the row in place via the same `flipRowToUnbanned`/`flipRowToUnmuted` helper the legacy single-click flow used (or removes the row outright + decrements the count badge for the admins-delete / mod-delete / comms-delete variants where there's no "now-unbanned" state to render). The legacy GET fallback (`?p=banlist&a=unban&id=…&key=…&ureason=…` / `?p=commslist&a=ungag…&ureason=…`) is the no-JS / hand-edited-URL path; both halves now reject empty `ureason` server-side so the audit log carries the *why*. The admins-delete and mod-delete variants have no legacy GET handler — `RemoveAdmin()` / `RemoveMod()` always went through the JSON dispatcher pre-#1123 D1 — so their `data-fallback-href` lands the operator back at the list page as a graceful no-op when the JSON dispatcher is missing entirely (third-party theme stripping `api.js`); the audit-log "Reason: …" suffix is only emitted when `ureason` is non-empty (vs always-emitted on the bans / comms variants where reason is required). **Do not** put `onclick="event.stopPropagation()"` on the trigger button — `document.addEventListener('click')` is how the dialog opener picks the click up, and stopPropagation would silently swallow it (the action button isn't inside any `[data-drawer-href]` ancestor anyway, so the defensiveness was a copy-paste from the row-name anchor that doesn't apply here). The submit button MUST flip through `setBusy(submitBtn, true)` BEFORE `sb.api.call(...)` leaves the page and clear via `setBusy(submitBtn, false)` on every non-navigating response branch — see "Loading state on action buttons" in Conventions for the contract, the inline-script local wrapper shape, and the regression guard. |
 | Emit a toast from a server-side branch (lostpassword reset success, banlist GET-fallback unban result, admin.edit.* not-found guard, …) | `\Sbpp\View\Toast::emit($kind, $title, $body, ?$redirect, ?$duration_ms)` (`web/includes/View/Toast.php`). Stashes the payload in a `<script type="application/json" class="sbpp-pending-toast">…</script>` block that `theme.js`'s `flushPendingToasts` picks up on `DOMContentLoaded`. Always FQN at call sites (no `use Sbpp\View\Toast;` shim). The chrome JS renders the body through `escapeHtml`; the PHP JSON encoder uses `JSON_HEX_TAG \| JSON_HEX_AMP \| JSON_HEX_APOS \| JSON_HEX_QUOT \| JSON_INVALID_UTF8_SUBSTITUTE \| JSON_THROW_ON_ERROR` so a `</script>` in body cannot break out AND malformed UTF-8 in player names (the #1108 / #765 Latin-1-on-utf8 shape) substitutes to U+FFFD instead of throwing. Multi-toast safe: emit calls stack cleanly; the first non-empty `$redirect` wins (chrome navigates ~1500ms after the toast paints so the user can read it). The optional 5th arg `$duration_ms` (#1409) overrides the chrome's `SHOWTOAST_DEFAULT_DURATION` (~6000ms post-#1444; was ~4000ms in the v2 RC chrome) — `null` (default) keeps the chrome timing, `0` makes the toast persistent (no auto-dismiss; user must click the X button), `> 0` is an explicit ms override. The 5 NOT-* destructive-action-failed branches in `page.banlist.php` / `page.commslist.php` ("Player NOT Unbanned", "Ban NOT Deleted", "Player NOT UnGagged" × 2, "Ban NOT Deleted") pass `0` so severe-error confirmations don't auto-dismiss before the operator finishes reading. Negative `$duration_ms` throws `\InvalidArgumentException` (Fail closed; see "Duration semantics" in Conventions). Persistent + redirect are mutually exclusive (#1409): pass `null` for `$redirect` when emitting `duration_ms: 0` — the chrome's auto-redirect would otherwise navigate ~1500ms after paint, tearing down the persistent toast before the operator can acknowledge it. The chrome ALSO carries a whole-drain inhibit (`flushPendingToasts` skips the redirect setTimeout entirely when any block had `duration_ms: 0`) as defence-in-depth, but the call-site half (`$redirect=null`) is the primary contract pinned by `testNotStarBranchesPassPersistentDurationMs`'s strict regex (which disambiguates the two `Player NOT UnGagged` sites in `page.commslist.php` by body substring + asserts each site's call shape with `assertSame($expected_count, …)`). Painted ARIA role is kind-aware (#1409 review): `role="alert"` for `kind === 'error'` (assertive — screen readers interrupt to surface), `role="status"` for every other kind (polite). Persistent error toasts especially benefit from `alert` because the screen-reader user is the population least likely to notice a visual change without an auditory cue. Pair with `PageDie()` (or `exit`) whenever the handler's "render the page body" path is no longer meaningful — pre-#1403 the legacy `<script>ShowBox(...)</script>` shape carried its own `window.location` and beat the page render to the user; the lifted helper relies on the explicit redirect + the 1500ms settle. See "Server-side toast emission" in Conventions for the full contract (the "ARIA role contract" subsection covers the kind-aware role rationale). Pinned by `web/tests/integration/ToastEmitRegressionTest.php` (static grep + wire-format + JSON-escape + UTF-8-substitute + FIRST-wins-redirect + `duration_ms` omitted/set/negative/escape contracts + the 5 NOT-* call sites pass `duration_ms: 0` AND `$redirect=null` + call-site contract) and the six marquee E2E specs (`lostpassword-toast.spec.ts`, `protest-toast.spec.ts`, `banlist-getfallback-toast.spec.ts`, `commslist-getfallback-toast.spec.ts`, `admin-edit-comms-toast.spec.ts`, `toast-persistent-duration.spec.ts`). The lostpassword spec seeds the dev stack's mailpit and asserts the password-reset email lands at the right address — the marquee user-reported regression from the audit. The persistent-duration spec (#1409, thresholds updated in #1444) drives a NOT-* branch payload and asserts the toast is STILL visible past the default ~6000ms window; its sister regression-guard test drives `window.SBPP.showToast(...)` directly (no page-flow / redirect dependency, post-review reshape) and asserts a routine toast auto-dismisses inside the ~6000-8000ms window so a regression bumping or zeroing the default duration fails loudly. |
-| Add a loading indicator to an action button that fires `sb.api.call(...)` without a page refresh | `window.SBPP.setBusy(btn, busy)` (`web/themes/default/js/theme.js`) writes the `data-loading="true"` + `aria-busy="true"` + `disabled` triple atomically; the CSS spinner lives in `web/themes/default/css/theme.css` under `.btn[data-loading="true"]` + the `sbpp-btn-spin` keyframe. Inline page-tail scripts inside `.tpl` files define a local `setBusy(btn, busy)` wrapper that delegates to `window.SBPP.setBusy` when present and falls back to `btn.disabled = busy` so third-party themes that strip `theme.js` still gate against double-clicks. Canonical reference shapes: the three confirm-dialog flows (`page_comms.tpl` / `page_bans.tpl` / `page_admin_admins_list.tpl`), the form-submit flows (`page_admin_groups_list.tpl` / `page_admin_groups_add.tpl` / `page_admin_bans_add.tpl` / `page_admin_bans_email.tpl` / `page_youraccount.tpl` / `page_lostpassword.tpl` / `page_login.tpl`), the row-action flows (`page_admin_servers_list.tpl` / `page_admin_bans_protests.tpl` / `page_admin_bans_protests_archiv.tpl` / `page_admin_bans_submissions.tpl` / `page_admin_bans_submissions_archiv.tpl`), and the drawer Notes paths (`theme.js`'s `submitNoteForm` / `deleteNote`). Comment edit on the banlist (`web/scripts/banlist.js`) carries the same pattern for the `sb.api.call(BansEditComment)` round-trip. Regression guards: `web/tests/e2e/specs/flows/action-loading-indicator.spec.ts` (stalls `Actions.CommsUnblock` via `page.route`, asserts the busy-attribute triple on the submit button while in flight, releases the route, and confirms the row flips in-place; the second test counts requests to prove the disabled gate blocks a double-click) **plus** `web/tests/e2e/specs/flows/loading-animations.spec.ts` (#1362 — samples `getComputedStyle(::after).transform` at multiple frame boundaries under both `reducedMotion: 'reduce'` AND `'no-preference'`, asserts the matrix values change across samples; catches the v2.0 RC1 regression where the global `prefers-reduced-motion: reduce` reset froze the spinner under reduced motion). |
+| Add a loading indicator to an action button that fires `sb.api.call(...)` without a page refresh | `window.SBPP.setBusy(btn, busy)` (`web/themes/default/js/theme.js`) writes the `data-loading="true"` + `aria-busy="true"` + `disabled` triple atomically; the CSS spinner lives in `web/themes/default/css/theme.css` under `.btn[data-loading="true"]` + the `sbpp-btn-spin` keyframe. Inline page-tail scripts inside `.tpl` files define a local `setBusy(btn, busy)` wrapper that delegates to `window.SBPP.setBusy` when present and falls back to `btn.disabled = busy` so third-party themes that strip `theme.js` still gate against double-clicks. Canonical reference shapes: the three confirm-dialog flows (`page_comms.tpl` / `page_bans.tpl` / `page_admin_admins_list.tpl`), the form-submit flows (`page_admin_groups_list.tpl` / `page_admin_groups_add.tpl` / `page_admin_bans_add.tpl` / `page_admin_bans_email.tpl` / `page_youraccount.tpl` / `page_lostpassword.tpl` / `page_login.tpl`), the row-action flows (`page_admin_servers_list.tpl` / `page_admin_bans_protests.tpl` / `page_admin_bans_protests_archiv.tpl` / `page_admin_bans_submissions.tpl` / `page_admin_bans_submissions_archiv.tpl`), and the drawer Notes paths (`theme.js`'s `submitNoteForm` / `deleteNote`). Comment save in the drawer (`theme.js`'s `submitCommentForm`) and on queue cards (`comment-actions.js`) carries the same pattern for the `sb.api.call(BansAddComment / BansEditComment)` round-trip. Regression guards: `web/tests/e2e/specs/flows/action-loading-indicator.spec.ts` (stalls `Actions.CommsUnblock` via `page.route`, asserts the busy-attribute triple on the submit button while in flight, releases the route, and confirms the row flips in-place; the second test counts requests to prove the disabled gate blocks a double-click) **plus** `web/tests/e2e/specs/flows/loading-animations.spec.ts` (#1362 — samples `getComputedStyle(::after).transform` at multiple frame boundaries under both `reducedMotion: 'reduce'` AND `'no-preference'`, asserts the matrix values change across samples; catches the v2.0 RC1 regression where the global `prefers-reduced-motion: reduce` reset froze the spinner under reduced motion). |
 | Add a loading indicator to the player drawer or one of its lazy panes (so the chrome doesn't read as blank while the JSON action is in flight) | `renderDrawerLoading()` (header skeleton for the in-flight `bans.detail`) and `renderPaneSkeleton()` (placeholder for History / Comms / Notes activation) in `web/themes/default/js/theme.js`. Both lean on the `.skel` CSS rule in `theme.css` (linear-gradient + `shimmer` keyframe + dark-mode override + the `@media (prefers-reduced-motion: reduce)` per-rule override that keeps the shimmer sliding even under reduced motion, #1362). The header skeleton carries `[data-testid="drawer-loading"]` + `aria-busy="true"` + per-block `[data-skeleton]` (terminal markers under `#drawer-root[data-loading="true"]`); the lazy-pane skeleton carries `[data-pane-empty]` + `aria-busy="true"` and deliberately omits `[data-skeleton]` because the panel parent's `hidden` attribute doesn't compose into `[data-skeleton]:not([hidden])` and a nested marker would stall every page-load waiter that runs after the drawer opens. Class name is `.skel` (singular) — NOT `.skeleton`; the pre-fix `class="skeleton"` typo had no matching rule and the shimmer rows rendered as transparent zero-background divs (the user-visible "drawer is blank" regression). Regression guards: `web/tests/e2e/specs/flows/drawer-loading-indicator.spec.ts` (stalls `bans.detail` then `bans.player_history` via `page.route`, asserts the skeleton header is visible + the `.skel` block paints a `linear-gradient` background via `getComputedStyle(el).backgroundImage`, releases the routes, and confirms the drawer flips to `renderDrawerBody` / the pane fills with content) **plus** `web/tests/e2e/specs/flows/loading-animations.spec.ts` (#1362 — samples `getComputedStyle(.skel).backgroundPositionX` at multiple frame boundaries under both `reducedMotion: 'reduce'` AND `'no-preference'`, asserts the values change across samples; catches the v2.0 RC1 regression where the global reset froze the shimmer alongside the spinner). |
 | Surface unban-reason / removed-by inline on a public-list row (admin-lifted bans / comms — banlist-ureason or commslist-ureason inline) | `web/themes/default/page_bans.tpl` + `web/themes/default/page_comms.tpl` (#1315). Reason cell on the desktop table emits a `<div class="text-xs text-faint mt-1" data-testid="ban-unban-meta">` (or `comm-unban-meta` for comms) with "Unbanned by `<admin>`: `<reason>`" when `$ban.state == 'unbanned'` (or `$comm.state == 'unmuted'`); mobile cards mirror with the `-mobile` testid suffix. Always gated on `!$hideadminname` so anonymous viewers under a hidden-admins config don't get the admin name leaked. The `ureason` / `removedby` row fields come from the page handler's existing data path (`page.banlist.php` lines 635-643, `page.commslist.php` lines 626-635) — read-only render, no write-side overlap with #1301 / #1323's unban-reason flow. The commslist surface is higher-priority than the banlist (no drawer fallback on `<tr data-testid="comm-row">`); banlist users have the drawer as the canonical detail view. |
 | Re-apply (Reban) affordance on the public banlist for expired / unbanned rows | `web/themes/default/page_bans.tpl`. The desktop row-actions cell emits `<a class="btn btn--secondary btn--sm" data-testid="row-action-reapply" href="index.php?p=admin&c=bans&section=add-ban&rebanid={$ban.bid}&key={$admin_postkey}">…<i data-lucide="rotate-ccw">…Re-apply</a>` when `$can_add_ban && ($ban.state == 'expired' \|\| $ban.state == 'unbanned')`. The smart-default block on `admin.bans.php`'s `add-ban` section detects `?rebanid=…` and pre-populates the form via `BansPrepareReban`. Mobile parity (this PR) — the mobile card was restructured from a single wrapping `<a>` to the `page_comms.tpl` shape (`<div data-testid="ban-card">` wrapping `<a class="ban-card__summary" data-testid="drawer-trigger">` + a sibling `<div class="row-actions ban-card__actions">`), so the same Re-apply button surfaces under `data-testid="row-action-reapply-mobile"`. The drawer trigger stays the inner anchor's `data-drawer-href` + `data-testid="drawer-trigger"` so the existing responsive spec selector keeps working. |
 | Fan rcon kick / block commands out to every enabled server after a successful `Actions.BansAdd` / `Actions.CommsAdd` (the hidden `<iframe id="srvkicker">` pattern) | `web/themes/default/page_admin_bans_add.tpl` (#1441 — `Actions.BansAdd .then(r => ...)` handler reads `r.data.kickit` and spawns the iframe pointing at `pages/admin.kickit.php?check=<check>&type=<type>`) + `web/themes/default/page_admin_comms_add.tpl` (the older sibling — `Actions.CommsAdd .then(r => ...)` reads `r.data.block` and spawns the iframe pointing at `pages/admin.blockit.php?check=<steam>&type=<type>&length=<length>`). The URL parameter `check=` is symmetric across both surfaces; the JS envelope field names are NOT — bans.add returns `r.data.kickit.check` while comms.add returns `r.data.block.steam`, because `api_bans_add` and `api_comms_add` chose different envelope shapes when the kickit/blockit envelopes were originally added. Always read the server-side envelope shape (`web/api/handlers/bans.php::api_bans_add` / `web/api/handlers/comms.php::api_comms_add`) FIRST when porting between the two branches. The iframe template (`web/themes/default/page_kickit.tpl` / `page_blockit.tpl`) auto-fires `Actions.KickitLoadServers` (or `Actions.BlockitLoadServers`) on `window.addEventListener('load', ...)` which enumerates enabled servers and fans out per-server `Actions.KickitKickPlayer` / `Actions.BlockitBlockPlayer` rcon calls. The iframe is `display: none` — the operator never sees it, but the panel can spawn it from any surface that needs server-side rcon side-effects (the right-click context menu's "Kick player" item navigates to the same `pages/admin.kickit.php` URL as a top-level document instead — see "Add or extend the server-player right-click context menu" row). Don't reach for `setBusy(submitBtn, false)` after spawning the iframe — the success branch keeps the button busy through the 2s `setTimeout` that reloads the parent page (matching `page_admin_comms_add.tpl`'s shape), preventing operators from queuing a second submit while rcon fans out. Regression guards: `web/tests/e2e/specs/flows/ban-kickit-iframe.spec.ts` (#1441 — stubs both `Actions.BansAdd` and `pages/admin.kickit.php` at the network layer; asserts the iframe is spawned exactly once with `toBe(1)` on the request count so a future double-mount regression — e.g. a `.then()` chain that resolves twice, a `dispatchEvent` re-firing the submit handler, a `setBusy` gap — surfaces immediately) + `web/tests/e2e/specs/flows/kickit-iframe.spec.ts` (#1433 — exercises the deeper rcon round-trip via the context-menu path) + `web/tests/api/KickitTest.php` (PHPUnit — handler permission gate + malformed-input envelopes). Pre-#1441 the bans-add side carried a `typeof window.ShowKickBox === 'function'` guard pointing at a v1.x helper that was deleted at #1123 D1; the `if` body silently never ran and operators reported "banning doesn't kick" (the canonical "chrome reads as success while the load-bearing action never fired" UI regression — see the matching anti-pattern entry under Anti-patterns). |
 | Wrap a public-list legacy advanced-search form (banlist / commslist) in a default-collapsed `<details class="filters-details">` disclosure | `web/themes/default/page_bans.tpl` + `web/themes/default/page_comms.tpl` (#1315). The same `.filters-details` rules in `web/themes/default/css/theme.css` cover the chrome (summary chevron, `[open]` state, hover bg, focus ring, count badge); the public-list usage adds a `.filters-details__body > form.card` rule that suppresses the inner card framing because the disclosure body wraps a `{load_template file="admin.bans.search"}` (or `…comms.search`) — i.e. a sibling page-render that emits its own `<form class="card">`. The View DTO (`Sbpp\View\BanListView` / `Sbpp\View\CommsListView`) carries a `bool $is_advanced_search_open` set by the page handler from `isset($_GET['advSearch']) && (string) $_GET['advSearch'] !== ''` so the legacy `?advSearch=…&advType=…` URL shim auto-opens the disclosure. Bare `?p=banlist` / `?p=commslist` and simple-bar filters (`?searchText=` / `?server=` / `?time=`) leave it closed so the unfiltered list reaches above the fold. Selectors anchor on `[data-testid="banlist-advsearch-disclosure"]` / `[data-testid="commslist-advsearch-disclosure"]` (the `<details>`) + the `…-toggle` (the `<summary>`) + the `…-active` count badge. The same `.filters-details` chrome was introduced for admin-admins by #1303 — both surfaces share the CSS so a future tweak is single-source. |
-| Surface admin-authored per-ban / per-comm comments inline on the public banlist + commslist (`<details data-testid="ban-comments-inline">` / `comm-comments-inline`) | `web/themes/default/page_bans.tpl` + `web/themes/default/page_comms.tpl` (#BANLIST-COMMENTS). Both desktop tables wrap the player-name anchor + comment chip in `.ban-player-cell__head` so the collapsed chip sits on the SAME line as the name (icon + tabular-nums count only; `title` / `aria-label` carry "N comment(s)"). The name uses `.ban-player-cell__name` (ellipsis truncate) so the chip never wraps alone; opened details take `flex-basis: 100%` and the body lists each comment below. CSS lives under `.ban-comments-inline*` in `theme.css`. The `nofilter` on comment text is load-bearing (`encodePreservingBr` + URL-wrap). Mobile cards keep a non-interactive count indicator (`ban-comments-count-mobile`). Gate: `$view_comments`. **#1500** also hides comment author/editor when `banlist.hideadminname` is on. Regression: `BanlistCommentsVisibilityTest` + `banlist-comments-visibility.spec.ts`. |
+| Surface admin-authored per-ban / per-comm comments inline on the public banlist + commslist (`<details data-testid="ban-comments-inline">` / `comm-comments-inline`) | `web/themes/default/page_bans.tpl` + `web/themes/default/page_comms.tpl` (#BANLIST-COMMENTS). Both desktop tables wrap the player-name anchor + comment chip in `.ban-player-cell__head` so the collapsed chip sits on the SAME line as the name (icon + tabular-nums count only; `title` / `aria-label` carry "N comment(s)"). The name uses `.ban-player-cell__name` (ellipsis truncate) so the chip never wraps alone; opened details take `flex-basis: 100%` and the body lists each comment below. CSS lives under `.ban-comments-inline*` in `theme.css`. The `nofilter` on comment text is load-bearing (`encodePreservingBr` + URL-wrap). Mobile cards keep a non-interactive count indicator (`ban-comments-count-mobile`). Gate: `$view_comments`. **#1500** also hides comment author/editor when `banlist.hideadminname` is on. Add / Edit on banlist and commslist open the player drawer composer (`data-comment-compose` + `[data-testid="drawer-comment-form"]` in `theme.js`). After add/edit in the drawer, `loadDrawer` patches the matching inline disclosure (chip count + list items) and the mobile ban-card count chip from the detail envelope. Delete on the banlist / commslist (table or drawer) does **not** reload: `comment-actions.js` emits `sbpp:comment-deleted` and `theme.js` removes the `<li>` in place so scroll, pagination, and open disclosures survive. Protests / submissions use an inline card composer (`data-action="comment-compose"` + `[data-comment-composer]` in `comment-actions.js`). `?comment=` is not an editor: the list still renders. Regression: `BanlistCommentsVisibilityTest` + `banlist-comments-visibility.spec.ts`. |
 | Filter the public banlist by ban state (`?p=banlist&state=permanent\|active\|expired\|unbanned`) — server-side rowset narrowing for a chip strip | `web/pages/page.banlist.php` (#1352). The `?state=` value is allowlisted (`['permanent','active','expired','unbanned']`, anything else falls through to "All"), composed into the existing `$publicFilterAnd` / `$publicFilterWheren` SQL fragments via the per-state predicates documented inline. **Symmetric defensive shape across the four arms**: `permanent` / `active` BOTH require `RemovedOn IS NULL` (otherwise a pre-2.0 admin-lifted row with `ends > now` would match BOTH `?state=active` AND `?state=unbanned`); `expired` carries THREE arms (`RemoveType = 'E'` post-migration shape + `RemoveType IS NULL AND length > 0 AND ends < now AND RemovedOn IS NULL` for pre-475 installs the prune writer never touched + `RemoveType IS NULL AND RemovedOn IS NOT NULL AND length > 0 AND (RemovedBy IS NULL OR RemovedBy = 0)` for the fork-divergence shape `810.php` pass 2 backfills); `unbanned` carries TWO arms (`RemoveType IN ('D', 'U')` post-migration shape + `RemovedOn IS NOT NULL AND RemoveType IS NULL AND RemovedBy IS NOT NULL AND RemovedBy > 0` for pre-2.0 admin-lifts that `810.php` pass 1 backfills). The `RemovedBy > 0` vs `RemovedBy IS NULL OR = 0` split between unbanned / expired is the **load-bearing distinction** — natural expiry sets `RemovedBy = 0` (PruneBans) or NULL (pre-475); admin lifts set `RemovedBy = <aid>`. The View DTO (`Sbpp\View\BanListView`) carries `string $active_state` + `string $chip_base_link`; the chip strip in `web/themes/default/page_bans.tpl` renders as real `<a href="index.php?p=banlist{$chip_base_link}&state=…">` anchors with `aria-current="true"` (NOT `aria-pressed` — only valid on role=button; axe rejects it on `<a>` as `aria-allowed-attr`) and `data-active="true"` server-rendered on the matching chip — never `<button onclick=…>` (the legacy `web/scripts/banlist.js applyStateFilter` row-hide layer was a client-side filter on top of server-side pagination, so on installs with thousands of bans the unbanned chip silently rendered an empty page 1). The "Hide inactive" toggle is suppressed in the template when `$active_state !== ''` so the two predicates (`hideinactive` is `RemoveType IS NULL`; `?state=expired` / `unbanned` ask for the OPPOSITE) don't visually fight. Pagination URLs preserve `&state=` via `$stateFilterLink`; the per-row state classifier in the same file mirrors the SQL filter (a row pulled in by `?state=unbanned` renders the Unbanned pill, never the legacy mis-classified "Active" pill). The JSON API parity surface is `api_bans_detail` + `api_bans_player_history` in `web/api/handlers/bans.php` — same `isPre2AdminLift` defensive branch so the drawer's detail view + the history pane don't visibly contradict the SQL filter. Regression guards: `web/tests/integration/BanListStateFilterTest.php` (per-state row inclusion / exclusion + chip render contract + suppressed Hide-inactive toggle + symmetric `expired` arm 3 contract), `web/tests/integration/UpdaterBackfillRemoveTypeTest.php` (the migration's idempotency + two-pass cross-contamination contract), `web/tests/api/BansTest.php::testDetailReportsUnbannedForPre2AdminLiftWithRemoveTypeNull` (API parity), `web/tests/e2e/specs/responsive/banlist.spec.ts` + `web/tests/e2e/specs/responsive/filters.spec.ts` (mobile chip click navigates + asserts `aria-current` rather than `history.replaceState` + `aria-pressed`'ing). |
 | Edit the player-detail drawer (open trigger, tabs, panes, lazy loaders) | `web/themes/default/js/theme.js` (`renderDrawerBody` / `loadPaneIfNeeded`). The drawer handles two focal kinds via `drawerKind` (`'ban'` / `'comm'`): the bans list ships `data-drawer-bid` / `data-drawer-href` on row anchors, the comms list ships `data-drawer-cid`. `loadDrawer({kind, id})` dispatches to `Actions.BansDetail` (bid → `bans.detail`) or `Actions.CommsDetail` (cid → `comms.detail`) and stamps the response into `drawerDetail`. `loadPaneIfNeeded` then keys lazy panes off the focal kind: bans-focal History sends `{bid}` (handler excludes the focal via `BA.bid <> ?`); comm-focal History sends `{authid: drawerDetail.player.steam_id}` (no focal to exclude — different table); bans-focal Comms sends `{bid}` (resolves to authid; no comm to exclude); comm-focal Comms sends `{cid}` (handler excludes the focal cid via `C.bid <> ?` — sister contract to the bans-focal History exclusion so the Overview pane and the Comms tab don't render the same record twice). The Notes tab is admin-only and shared across both focal kinds (keys off `player.steam_id`). |
 | Add a comms-list player drawer parity surface (mirror the banlist's `data-drawer-href` row anchor with a comm-focal equivalent) | The desktop `<tr data-testid="comm-row">` and mobile `<div data-testid="comm-card">` rows in `web/themes/default/page_comms.tpl` carry a player-name anchor with `data-drawer-cid="{$comm.cid}"` + `data-testid="drawer-trigger"`. The `href` falls back to a useful no-JS surface (`?p=commslist&id=…` desktop / `?p=commslist&searchText=…` mobile) so the affordance still leads somewhere when JS is off / `theme.js` is stripped by a third-party theme. The drawer JS (`theme.js`'s document `click` delegate at `[data-drawer-bid], [data-drawer-cid], [data-drawer-href]`) routes the click through `keyFromTrigger(trigger)` which returns `{kind: 'comm', id}` for cid triggers; downstream `loadDrawer` dispatches `Actions.CommsDetail` and the renderer branches on `drawerKind === 'comm'` for the header chip ("Comm #N") and the Overview pane's focal-block grid (`[data-testid="drawer-block"]` with `Type` / `Reason` / `Started` / `Ends` rows — vs `[data-testid="drawer-ban"]` on the bans-focal path). The handler is `api_comms_detail` in `web/api/handlers/comms.php` (sister to `api_bans_detail`, same envelope shape modulo `cid` instead of `bid` / `block` instead of `ban` / `'unmuted'` instead of `'unbanned'` in the state vocab — both `api_comms_detail` AND `api_comms_player_history` use `'unmuted'` for `RemoveType IN ('U', 'D')` rows so the drawer's Overview pane and Comms tab don't render contradictory state labels for the same player). Public action; field-level hide-* gating mirrors `bans.detail`. Pill CSS lives next to `.pill--unbanned` in `theme.css` (`.pill--unmuted` carries the same success-bg + emerald colour treatment because admin-lifted is admin-lifted regardless of the focal kind). The drawer JS's `stateLabel()` switch in `theme.js` carries the matching `'unmuted' → 'Unmuted'` arm. Regression guards: `web/tests/api/CommsTest.php` (snapshot + state vocab + lifted-block branch + permanent-block branch + `comms.player_history` cid path with focal exclusion + 404 on unknown cid + lone-focal empty-feed shape) and `web/tests/e2e/specs/flows/ui/comms-drawer.spec.ts` (desktop) + `web/tests/e2e/specs/responsive/drawer.spec.ts` (mobile — clicking a `.ban-cards [data-testid="drawer-trigger"]` opens the comm-focal drawer, header reads "Comm #N", Type row in Overview pane). The desktop spec mirrors `player-drawer.spec.ts`'s isolation strategy — NO `truncateE2eDb` between tests, unique authids per (subtest × project × worker), and `seedCommOrAccept` / `seedBanOrAccept` helpers that tolerate `already_blocked` / `already_banned` so a Playwright retry on the same worker reuses the existing row. Adding a per-test truncate would only widen the cross-file race window where a concurrent worker's API call lands during another worker's truncate→reseed gap and gets a `forbidden` cascade; the comms-drawer tests are read-shaped (open the drawer, assert the chrome) so authid-namespacing is enough. |
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index a7d6ffa15..6b793473e 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -361,7 +361,8 @@ honours `config.enablepubliccomments` and `banlist.hideadminname`;
 anonymous GET of comm comments is 404 when `config.enablecomms` is off,
 matching `/comms`; POST /
 PATCH reuse `bans.add_comment` / `bans.edit_comment`, and PATCH is author
-or Owner on both REST and the RPC handler; DELETE is Owner via
+or Owner on both REST and the RPC handler; RPC add/edit of `ctype` S/P
+also requires BanSubmissions / BanProtests; DELETE is Owner via
 `bans.remove_comment`), `/settings` GET+PATCH (dedicated; never
 `smtp.pass` or `telemetry.instance_id`).
 
diff --git a/web/api/handlers/bans.php b/web/api/handlers/bans.php
index a7f9814e1..de79d3d0f 100644
--- a/web/api/handlers/bans.php
+++ b/web/api/handlers/bans.php
@@ -19,6 +19,48 @@ function _api_bans_steam_api_key(): string
     return $key;
 }
 
+/**
+ * Validate the upload callback pair before linking a demo to a new ban.
+ *
+ * @return bool True when a complete, valid attachment should be inserted.
+ */
+function _api_bans_validate_demo_attachment(string $filename, string $originalName): bool
+{
+    // The add-ban form has historically sent numeric `0` when no upload
+    // was selected. Preserve that wire sentinel as the empty state.
+    $hasFilename = $filename !== '' && $filename !== '0';
+    $hasOriginalName = $originalName !== '';
+    if (!$hasFilename && !$hasOriginalName) {
+        return false;
+    }
+    if (!$hasFilename || !$hasOriginalName) {
+        throw new ApiError('validation', 'The demo upload is incomplete.', 'dfile');
+    }
+    if (!preg_match('/^[a-f0-9]{32}$/D', $filename)) {
+        throw new ApiError('validation', 'The demo upload reference is invalid.', 'dfile');
+    }
+    // `:prefix_demos.origname` is VARCHAR(128); reject over-width input
+    // before MariaDB strict mode turns the INSERT into a generic 500.
+    if (!mb_check_encoding($originalName, 'UTF-8') || mb_strlen($originalName, 'UTF-8') > 128) {
+        throw new ApiError('validation', 'The demo filename is invalid.', 'dname');
+    }
+
+    // SECURITY-REVIEW: `$filename` is API input. Require the exact
+    // uploader-generated hash shape, reject links, and contain the resolved
+    // regular file inside SB_DEMOS before persisting a public download row.
+    $demoRoot = realpath(SB_DEMOS);
+    $path = rtrim(SB_DEMOS, '/\\') . DIRECTORY_SEPARATOR . $filename;
+    $resolvedPath = realpath($path);
+    $insideDemoRoot = $demoRoot !== false
+        && $resolvedPath !== false
+        && str_starts_with($resolvedPath, $demoRoot . DIRECTORY_SEPARATOR);
+    if ($resolvedPath === false || !$insideDemoRoot || is_link($path) || !is_file($resolvedPath)) {
+        throw new ApiError('validation', 'The uploaded demo is no longer available.', 'dfile');
+    }
+
+    return true;
+}
+
 function api_bans_add(array $params): array
 {
     global $userbank;
@@ -158,6 +200,8 @@ function api_bans_add(array $params): array
         }
     }
 
+    $attachDemo = _api_bans_validate_demo_attachment($dfile, $dname);
+
     $GLOBALS['PDO']->query(
         "INSERT INTO `:prefix_bans`(created,type,ip,authid,name,ends,length,reason,aid,adminIp,admin_name) VALUES
         (UNIX_TIMESTAMP(),?,?,?,?,(UNIX_TIMESTAMP() + ?),?,?,?,?,?)"
@@ -175,7 +219,7 @@ function api_bans_add(array $params): array
     ]);
     $newId = (int)$GLOBALS['PDO']->lastInsertId();
 
-    if ($dname && $dfile && preg_match('/^[a-z0-9]*$/i', $dfile)) {
+    if ($attachDemo) {
         $GLOBALS['PDO']->query("INSERT INTO `:prefix_demos`(demid,demtype,filename,origname) VALUES(?,'B',?,?)")
             ->execute([$newId, $dfile, $dname]);
     }
@@ -288,6 +332,52 @@ function api_bans_paste(array $params): array
     throw new ApiError('player_not_found', "Can't get player info for " . htmlspecialchars($name) . '. Player is not on the server anymore!');
 }
 
+function _api_bans_comment_parent_exists(string $ctype, int $id): bool
+{
+    return match ($ctype) {
+        'B' => $GLOBALS['PDO']->query('SELECT bid FROM `:prefix_bans` WHERE bid = ?')->single([$id]) !== false,
+        'C' => $GLOBALS['PDO']->query('SELECT bid FROM `:prefix_comms` WHERE bid = ?')->single([$id]) !== false,
+        'S' => $GLOBALS['PDO']->query('SELECT subid FROM `:prefix_submissions` WHERE subid = ?')->single([$id]) !== false,
+        'P' => $GLOBALS['PDO']->query('SELECT pid FROM `:prefix_protests` WHERE pid = ?')->single([$id]) !== false,
+        default => false,
+    };
+}
+
+/**
+ * Enforce the parent surface's authorization before reading or mutating
+ * moderation-queue comments.
+ */
+function _api_bans_can_manage_comment_type(string $ctype): bool
+{
+    global $userbank;
+
+    // SECURITY-REVIEW: submission and protest comments expose moderation
+    // records, so a generic web-admin session is not sufficient.
+    return match ($ctype) {
+        'B', 'C' => $userbank->is_admin(),
+        'S' => $userbank->HasAccess(WebPermission::mask(
+            WebPermission::Owner,
+            WebPermission::BanSubmissions,
+        )),
+        'P' => $userbank->HasAccess(WebPermission::mask(
+            WebPermission::Owner,
+            WebPermission::BanProtests,
+        )),
+        default => false,
+    };
+}
+
+function _api_bans_comment_subject_label(string $ctype): string
+{
+    return match ($ctype) {
+        'B' => 'ban',
+        'C' => 'comm block',
+        'S' => 'submission',
+        'P' => 'protest',
+        default => 'record',
+    };
+}
+
 function api_bans_add_comment(array $params): array
 {
     global $userbank, $username;
@@ -313,13 +403,26 @@ function api_bans_add_comment(array $params): array
     if ($redir === null) {
         throw new ApiError('bad_type', 'Bad comment type.');
     }
+    if (!_api_bans_can_manage_comment_type($ctype)) {
+        throw new ApiError('forbidden', 'You do not have permission to manage comments for this record.');
+    }
+    if ($bid <= 0) {
+        throw new ApiError('validation', 'Missing or invalid record id.', 'bid');
+    }
+    if ($ctext === '') {
+        throw new ApiError('validation', 'Comment is required.', 'ctext');
+    }
+    if (!_api_bans_comment_parent_exists($ctype, $bid)) {
+        throw new ApiError('not_found', 'Record not found.', 'bid', 404);
+    }
 
     $GLOBALS['PDO']->query(
         "INSERT INTO `:prefix_comments`(bid,type,aid,commenttxt,added) VALUES (?,?,?,?,UNIX_TIMESTAMP())"
     )->execute([$bid, $ctype, $userbank->GetAid(), $ctext]);
     $cid = (int) $GLOBALS['PDO']->lastInsertId();
 
-    Log::add(LogType::Message, 'Comment Added', "$username added a comment for ban #$bid");
+    $subject = _api_bans_comment_subject_label($ctype);
+    Log::add(LogType::Message, 'Comment Added', "$username added a comment for $subject #$bid");
 
     return [
         'reload'  => true,
@@ -336,6 +439,8 @@ function api_bans_add_comment(array $params): array
 function api_bans_edit_comment(array $params): array
 {
     global $userbank, $username;
+    $hasBid = array_key_exists('bid', $params);
+    $bid   = (int)($params['bid']   ?? 0);
     $cid   = (int)($params['cid']   ?? 0);
     $ctype = (string)($params['ctype'] ?? '');
     $ctext = trim((string)($params['ctext'] ?? ''));
@@ -354,23 +459,46 @@ function api_bans_edit_comment(array $params): array
     if ($redir === null) {
         throw new ApiError('bad_type', 'Bad comment type.');
     }
-
-    $row = $GLOBALS['PDO']->query(
-        "SELECT cid, aid FROM `:prefix_comments` WHERE cid = ?"
-    )->single([$cid]);
-    if (!$row) {
-        throw new ApiError('not_found', 'Comment not found.', null, 404);
+    if (!_api_bans_can_manage_comment_type($ctype)) {
+        throw new ApiError('forbidden', 'You do not have permission to manage comments for this record.');
+    }
+    if ($cid <= 0) {
+        throw new ApiError('validation', 'Missing or invalid comment id.', 'cid');
+    }
+    if ($hasBid && $bid <= 0) {
+        throw new ApiError('validation', 'Missing or invalid record id.', 'bid');
+    }
+    if ($ctext === '') {
+        throw new ApiError('validation', 'Comment is required.', 'ctext');
     }
 
-    $authorAid = (int) $row['aid'];
-    $canEdit = $authorAid === $userbank->GetAid() || $userbank->HasAccess(WebPermission::Owner);
-    if (!$canEdit) {
-        throw new ApiError('forbidden', 'You can only edit your own comments.', null, 403);
+    $comment = $GLOBALS['PDO']
+        ->query('SELECT aid, bid, type FROM `:prefix_comments` WHERE cid = ?')
+        ->single([$cid]);
+    if (!$comment) {
+        throw new ApiError('not_found', 'Comment not found.', 'cid', 404);
+    }
+    if ((string)$comment['type'] !== $ctype) {
+        throw new ApiError('validation', 'Comment type does not match.', 'ctype');
+    }
+    if ((int)$comment['aid'] !== $userbank->GetAid()
+        && !$userbank->HasAccess(WebPermission::Owner)) {
+        throw new ApiError('forbidden', 'You do not have permission to edit this comment.');
+    }
+    $commentBid = (int)$comment['bid'];
+    if ($hasBid && $commentBid !== $bid) {
+        throw new ApiError('validation', 'Comment does not belong to this record.', 'bid');
+    }
+    $bid = $commentBid;
+    if (!_api_bans_comment_parent_exists($ctype, $bid)) {
+        throw new ApiError('not_found', 'Record not found.', 'bid', 404);
     }
 
     $GLOBALS['PDO']->query(
-        "UPDATE `:prefix_comments` SET commenttxt = ?, editaid = ?, edittime = UNIX_TIMESTAMP() WHERE cid = ?"
-    )->execute([$ctext, $userbank->GetAid(), $cid]);
+        "UPDATE `:prefix_comments`
+         SET commenttxt = ?, editaid = ?, edittime = UNIX_TIMESTAMP()
+         WHERE cid = ? AND bid = ? AND type = ?"
+    )->execute([$ctext, $userbank->GetAid(), $cid, $bid, $ctype]);
 
     Log::add(LogType::Message, 'Comment Edited', "$username edited comment #$cid");
 
@@ -453,19 +581,38 @@ function api_bans_remove_comment(array $params): array
     $ctype = (string)($params['ctype'] ?? '');
     $page  = (int)($params['page']  ?? -1);
 
+    if ($cid <= 0) {
+        throw new ApiError('validation', 'Missing or invalid comment id.', 'cid');
+    }
+    if (!in_array($ctype, ['B', 'C', 'S', 'P'], true)) {
+        throw new ApiError('bad_type', 'Bad comment type.');
+    }
+
+    $comment = $GLOBALS['PDO']
+        ->query('SELECT type FROM `:prefix_comments` WHERE cid = ?')
+        ->single([$cid]);
+    if (!$comment) {
+        throw new ApiError('not_found', 'Comment not found.', 'cid', 404);
+    }
+    if ((string)$comment['type'] !== $ctype) {
+        throw new ApiError('validation', 'Comment type does not match.', 'ctype');
+    }
+
     $pagelink = $page !== -1 ? '&page=' . $page : '';
     // #1275 — match the section-aware redirect shape from
     // api_bans_add_comment / api_bans_edit_comment so a deleted
     // comment lands the admin back on the queue they were on.
-    $redir = match ($ctype) {
+    $redirects = [
         'B' => '?p=banlist' . $pagelink,
         'C' => '?p=commslist' . $pagelink,
         'S' => '?p=admin&c=bans&section=submissions',
         'P' => '?p=admin&c=bans&section=protests',
-        default => '?p=admin&c=bans',
-    };
+    ];
+    $redir = $redirects[$ctype];
 
-    $GLOBALS['PDO']->query("DELETE FROM `:prefix_comments` WHERE cid = ?")->execute([$cid]);
+    $GLOBALS['PDO']->query(
+        'DELETE FROM `:prefix_comments` WHERE cid = ? AND type = ?'
+    )->execute([$cid, $ctype]);
     Log::add(LogType::Message, 'Comment Deleted', "$username deleted comment #$cid");
 
     return [
diff --git a/web/getdemo.php b/web/getdemo.php
index 692eefba9..3c0b2b294 100644
--- a/web/getdemo.php
+++ b/web/getdemo.php
@@ -12,7 +12,7 @@
  *
  * `:prefix_demos` carries one row per uploaded demo with:
  *   - demtype  enum('B','S')  — B = Ban, S = Submission
- *   - demid    int            — fk to :prefix_bans.bid OR :prefix_submissions.id
+ *   - demid    int            — fk to :prefix_bans.bid OR :prefix_submissions.subid
  *   - filename text           — server-side basename under SB_DEMOS
  *   - origname text           — display name shown to the downloader
  *
@@ -23,10 +23,10 @@
  *      column might carry (tampered DB row, partial migration). We don't
  *      run user-supplied paths through this — but we DO run a row a DB
  *      compromise could have rewritten, so the LFI guard is layered.
- *   2. `in_array(scandir(SB_DEMOS), …, true)` ensures the file we resolve
- *      is actually one of the listed demos in the directory — symlinks
- *      pointing outside SB_DEMOS aren't valid even if `file_exists()`
- *      would have accepted them.
+ *   2. `in_array(scandir(SB_DEMOS), …, true)` ensures the requested
+ *      basename is present in the demo directory.
+ *   3. `is_link()` rejects symlinks, then `realpath()` containment proves
+ *      the canonical file path remains under the canonical demo root.
  *
  * Different from the legacy 1.x entry point (the rewrite does not
  * trace structurally back):
@@ -99,11 +99,31 @@ function getdemo_disposition_header(string $name): string
 $onDisk = basename((string) $row['filename']);
 $origin = (string) ($row['origname'] ?? '') !== '' ? (string) $row['origname'] : $onDisk;
 $path   = SB_DEMOS . '/' . $onDisk;
+if ($onDisk === '' || str_contains($onDisk, "\0")) {
+    getdemo_die(404, 'Demo file is no longer on disk.');
+}
 
+// SECURITY-REVIEW: the filename originates in an upload-backed database
+// row. Reject links and require canonical root containment before reading.
 $listing = is_dir(SB_DEMOS) ? scandir(SB_DEMOS) : false;
-if ($listing === false || !in_array($onDisk, $listing, true) || !is_file($path)) {
+$demoRoot = realpath(SB_DEMOS);
+$resolvedPath = realpath($path);
+$insideDemoRoot = $demoRoot !== false
+    && $resolvedPath !== false
+    && str_starts_with(
+        $resolvedPath,
+        rtrim($demoRoot, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR,
+    );
+if (
+    $listing === false
+    || !in_array($onDisk, $listing, true)
+    || is_link($path)
+    || !$insideDemoRoot
+    || !is_file($resolvedPath)
+) {
     getdemo_die(404, 'Demo file is no longer on disk.');
 }
+$path = $resolvedPath;
 
 $size = filesize($path);
 if ($size === false) {
diff --git a/web/includes/View/BanListView.php b/web/includes/View/BanListView.php
index 715e6a5e2..fa5b6667b 100644
--- a/web/includes/View/BanListView.php
+++ b/web/includes/View/BanListView.php
@@ -9,10 +9,9 @@
  * `$ban_list` items expose `bid|name|steam|state|length_human|
  * banned_human|sname|can_edit_ban|can_unban` plus avatar metadata; the
  * page chrome reads `$total_bans`, `$can_export`, `$hidetext`,
- * `$searchlink`, `$ban_nav`, the comment-edit scratch pad
- * (`$comment`, `$commenttype`, `$commenttext`, `$ctype`, `$cid`,
- * `$page`, `$canedit`, `$othercomments`), and the testid hooks reach
- * the per-row `state`.
+ * `$searchlink`, `$ban_nav`, and the testid hooks reach the per-row
+ * `state`. Add / Edit comments open the player drawer; there is no
+ * `?comment=` editor on this page.
  *
  * Each row also carries the legacy keys (`ban_id|player|class|
  * reban_link|edit_link|…`) so any third-party theme that forked the
@@ -32,9 +31,6 @@ final class BanListView extends View
 
     /**
      * @param list<array<string,mixed>>           $ban_list
-     * @param int|false                           $comment        Bid being commented on, or false when not in comment-edit mode.
-     * @param int                                 $page           Active pagination page (or -1 when not paginated).
-     * @param array<int, array<string,mixed>>|string $othercomments  Sibling comments shown beneath the editor; "None" string when the ban has no other comments.
      * @param list<array{sid: int, name: string}> $server_list    Enabled servers for the public filter bar's `<select name="server">` (#1226).
      * @param array{search: string, server: string, time: string, state: string} $filters Current filter state — drives the sticky filter bar's pre-fill + active selected `<option>` (#1226 + #1352).
      */
@@ -44,14 +40,6 @@ public function __construct(
         public readonly int $total_bans,
         public readonly bool $view_bans,
         public readonly bool $view_comments,
-        public readonly int|false $comment,
-        public readonly string $commenttype,
-        public readonly string $commenttext,
-        public readonly string $ctype,
-        public readonly string $cid,
-        public readonly int $page,
-        public readonly bool $canedit,
-        public readonly array|string $othercomments,
         public readonly string $searchlink,
         public readonly string $hidetext,
         public readonly bool $hideadminname,
diff --git a/web/includes/View/CommsListView.php b/web/includes/View/CommsListView.php
index ea31dc621..f9745122f 100644
--- a/web/includes/View/CommsListView.php
+++ b/web/includes/View/CommsListView.php
@@ -5,8 +5,9 @@
 
 /**
  * Public communications-blocklist (mute/gag) page — binds to
- * `page_comms.tpl`. The template renders the public block list; the
- * inline comment-edit drawer is a deferred-scope follow-up.
+ * `page_comms.tpl`. The template always renders the public block
+ * list. Add / Edit comments open the player drawer; there is no
+ * `?comment=` editor on this page.
  *
  * Per-row shape (each entry of `$ban_list`) — the redesign's slim
  * keys layered on top of every legacy key already present
@@ -31,10 +32,8 @@
  *   - delete_url    string admin delete URL
  *
  * `$ban_nav`, `$hidetext`, `$hideadminname`, `$view_bans`,
- * `$view_comments` and the comment-drawer set (`$comment`,
- * `$commenttype`, `$commenttext`, `$ctype`, `$cid`, `$page`,
- * `$othercomments`, `$canedit`) are preserved on this View for the
- * same compatibility reason.
+ * `$view_comments` are preserved on this View for the same
+ * compatibility reason.
  */
 final class CommsListView extends View
 {
@@ -62,8 +61,6 @@ final class CommsListView extends View
      * } $pagination Page navigation data. `prev_url` / `next_url`
      *     are `null` at the page boundaries so the template can
      *     `disabled` them.
-     * @param list<array<string,mixed>> $othercomments Sibling comments
-     *     in the comment-edit drawer (legacy theme contract).
      */
     public function __construct(
         public readonly int $total_bans,
@@ -102,14 +99,6 @@ public function __construct(
         // SmartyTemplateRule can verify any third-party theme that
         // forked the pre-v2.0.0 default keeps its variable references
         // typed.
-        public readonly bool|int|string $comment,
-        public readonly string $commenttype,
-        public readonly bool $canedit,
-        public readonly string $commenttext,
-        public readonly string $ctype,
-        public readonly int|string $cid,
-        public readonly int $page,
-        public readonly array $othercomments,
         public readonly string $ban_nav,
         public readonly string $hidetext,
         public readonly bool $hideadminname,
diff --git a/web/pages/admin.bans.php b/web/pages/admin.bans.php
index 46767640f..fe65e4220 100644
--- a/web/pages/admin.bans.php
+++ b/web/pages/admin.bans.php
@@ -620,7 +620,6 @@ function ProcessBan()
 
             $commentres = $protestCommentsByPid[(int) $prot['pid']] ?? [];
             $prot['commentdata'] = bansBuildComments($commentres, $userbank, (int) $prot['pid'], 'P');
-            $prot['protaddcomment'] = CreateLinkR('<i class="fas fa-comment-dots fa-lg"></i> Add Comment', 'index.php?p=banlist&comment=' . (int) $prot['pid'] . '&ctype=P');
 
             array_push($protest_list, $prot);
         }
@@ -748,7 +747,6 @@ function ProcessBan()
 
             $commentres = $protestArchivCommentsByPid[(int) $prot['pid']] ?? [];
             $prot['commentdata'] = bansBuildComments($commentres, $userbank, (int) $prot['pid'], 'P');
-            $prot['protaddcomment'] = CreateLinkR('<i class="fas fa-comment-dots fa-lg"></i> Add Comment', 'index.php?p=banlist&comment=' . (int) $prot['pid'] . '&ctype=P');
 
             array_push($protest_list_archiv, $prot);
         }
@@ -892,7 +890,6 @@ function ProcessBan()
 
             $commentres = $submissionCommentsBySubid[(int) $sub['subid']] ?? [];
             $sub['commentdata'] = bansBuildComments($commentres, $userbank, (int) $sub['subid'], 'S');
-            $sub['subaddcomment'] = CreateLinkR('<i class="fas fa-comment-dots fa-lg"></i> Add Comment', 'index.php?p=banlist&comment=' . (int) $sub['subid'] . '&ctype=S');
 
             array_push($submission_list, $sub);
         }
@@ -1011,7 +1008,6 @@ function ProcessBan()
 
             $commentres = $submissionArchivCommentsBySubid[(int) $sub['subid']] ?? [];
             $sub['commentdata'] = bansBuildComments($commentres, $userbank, (int) $sub['subid'], 'S');
-            $sub['subaddcomment'] = CreateLinkR('<i class="fas fa-comment-dots fa-lg"></i> Add Comment', 'index.php?p=banlist&comment=' . (int) $sub['subid'] . '&ctype=S');
 
             array_push($submission_list_archiv, $sub);
         }
@@ -1317,18 +1313,29 @@ function bansBuildComments(array $commentres, $userbank, int $rowId, string $typ
         $cdata            = [];
         $cdata['morecom'] = ($morecom == 1 ? true : false);
         if ($crow['aid'] == $userbank->GetAid() || $userbank->HasAccess(WebPermission::Owner)) {
-            $cdata['editcomlink'] = CreateLinkR('<i class="fas fa-edit fa-lg"></i>', 'index.php?p=banlist&comment=' . $rowId . '&ctype=' . $type . '&cid=' . $crow['cid'], 'Edit Comment');
+            // Raw text for the inline composer prefill. The card body is
+            // encodePreservingBr HTML (with `<br>` / URL wraps) and cannot
+            // round-trip into a textarea.
+            $rawCommentText = html_entity_decode((string) $crow['commenttxt'], ENT_QUOTES | ENT_HTML5, 'UTF-8');
+            $cdata['editcomlink'] = '<button type="button" class="tip"'
+                . ' data-action="comment-compose"'
+                . ' data-bid="' . $rowId . '"'
+                . ' data-ctype="' . htmlspecialchars($type, ENT_QUOTES, 'UTF-8') . '"'
+                . ' data-cid="' . (int) $crow['cid'] . '"'
+                . ' data-comment-text="' . htmlspecialchars($rawCommentText, ENT_QUOTES, 'UTF-8') . '"'
+                . ' data-tooltip="Edit Comment" aria-label="Edit comment"'
+                . '><i data-lucide="pencil" style="width:13px;height:13px" aria-hidden="true"></i></button>';
             if ($userbank->HasAccess(WebPermission::Owner)) {
                 // #1402: see web/scripts/comment-actions.js for the dispatcher.
             // $type is the literal letter 'P' (protests) or 'S' (submissions);
             // the api handler's `ctype` arm consumes both. No paginator on the
             // moderation queues, so data-page is the sentinel -1.
-            $cdata['delcomlink'] = '<a href="#" class="tip" title="Delete Comment" target="_self"'
+            $cdata['delcomlink'] = '<a href="#" class="tip" title="Delete Comment" aria-label="Delete comment" target="_self"'
                 . ' data-action="comment-delete"'
                 . ' data-cid="' . (int) $crow['cid'] . '"'
                 . ' data-ctype="' . htmlspecialchars($type, ENT_QUOTES, 'UTF-8') . '"'
                 . ' data-page="-1"'
-                . '><i class="fas fa-trash fa-lg"></i></a>';
+                . '><i data-lucide="trash-2" style="width:13px;height:13px" aria-hidden="true"></i></a>';
             }
         } else {
             $cdata['editcomlink'] = "";
diff --git a/web/pages/page.banlist.php b/web/pages/page.banlist.php
index 0ab67df7f..0a1ae0bc0 100644
--- a/web/pages/page.banlist.php
+++ b/web/pages/page.banlist.php
@@ -1089,9 +1089,12 @@ function setPostKey()
                     // the 2.0 theme no longer loads — the old `<i class="fas …">` rendered
                     // an empty `<a>`); `aria-label` gives the icon-only control an
                     // accessible name the way the row-action buttons do.
-                    $cdata['editcomlink'] = '<a href="index.php?p=banlist&comment=' . $data['ban_id'] . '&ctype=B&cid=' . (int) $crow['cid'] . $pagelink . '"'
-                        . ' class="tip" target="_self" data-tooltip="Edit Comment" aria-label="Edit comment"'
-                        . '><i data-lucide="pencil" style="width:13px;height:13px" aria-hidden="true"></i></a>';
+                    $cdata['editcomlink'] = '<button type="button" class="tip"'
+                        . ' data-drawer-bid="' . (int) $data['ban_id'] . '"'
+                        . ' data-comment-compose="edit"'
+                        . ' data-comment-cid="' . (int) $crow['cid'] . '"'
+                        . ' data-tooltip="Edit Comment" aria-label="Edit comment"'
+                        . '><i data-lucide="pencil" style="width:13px;height:13px" aria-hidden="true"></i></button>';
                     if ($userbank->HasAccess(WebPermission::Owner)) {
                         // #1402: `onclick="RemoveComment(...)"` was the v1.x bridge into
                         // the deleted sourcebans.js helper — every click threw
@@ -1100,8 +1103,9 @@ function setPostKey()
                         // the document-level dispatcher in web/scripts/comment-actions.js
                         // handles the confirm + JSON API round-trip uniformly across all
                         // four comment-thread surfaces (banlist / commslist / protests
-                        // / submissions). data-page lets the handler land the operator
-                        // back on the same paginated banlist view post-delete.
+                        // / submissions). Banlist / commslist delete stays in place
+                        // (no navigation); data-page is still sent so queue cards
+                        // (S / P) can honour the handler's redir envelope.
                         $cdata['delcomlink'] = '<a href="#" class="tip" title="Delete Comment" aria-label="Delete comment" target="_self"'
                             . ' data-action="comment-delete"'
                             . ' data-cid="' . (int) $crow['cid'] . '"'
@@ -1141,9 +1145,8 @@ function setPostKey()
     }
 
 
-    // #1544: Lucide icon (the 2.0 theme dropped Font Awesome); keeps the
-    // visible "Add Comment" label so it degrades gracefully anyway.
-    $data['addcomment'] = CreateLinkR('<i data-lucide="message-square-plus" style="width:13px;height:13px" aria-hidden="true"></i> Add Comment', 'index.php?p=banlist&comment=' . $data['ban_id'] . '&ctype=B' . $pagelink);
+    // #1544: Add Comment markup lives in page_bans.tpl (drawer trigger
+    // with data-comment-compose="add"). Do not emit a ?comment= link.
     //-----------------------------------
 
     $data['ub_reason']   = (isset($data['ub_reason']) ? $data['ub_reason'] : "");
@@ -1339,75 +1342,8 @@ function setPostKey()
     }
 }
 
-//COMMENT STUFF
-//----------------------------------------
-$commentMode    = false;
-$commentType    = '';
-$commentText    = '';
-$commentCtype   = '';
-$commentCid     = '';
-$commentCanedit = false;
-/** @var array<int, array<string, mixed>>|string $commentOthers */
-$commentOthers  = '';
-if (isset($_GET["comment"])) {
-    $_GET["comment"] = (int) $_GET["comment"];
-    $commentMode  = $_GET["comment"];
-    $commentType  = isset($_GET["cid"]) ? "Edit" : "Add";
-    if (isset($_GET["cid"])) {
-        $_GET["cid"]    = (int) $_GET["cid"];
-        $GLOBALS['PDO']->query("SELECT * FROM `:prefix_comments` WHERE cid = :cid");
-        $GLOBALS['PDO']->bind(':cid', $_GET["cid"]);
-        $ceditdata      = $GLOBALS['PDO']->single();
-        $ctext          = html_entity_decode($ceditdata['commenttxt'], ENT_QUOTES | ENT_HTML5, 'UTF-8');
-        $cotherdataedit = " AND cid != '" . $_GET["cid"] . "'";
-    } else {
-        $cotherdataedit = "";
-        $ctext          = "";
-    }
-
-    $_GET["ctype"] = substr((string) ($_GET["ctype"] ?? ''), 0, 1);
-
-    $cotherdata = $GLOBALS['PDO']->query("SELECT cid, aid, commenttxt, added, edittime,
-											(SELECT user FROM `:prefix_admins` WHERE aid = C.aid) AS comname,
-											(SELECT user FROM `:prefix_admins` WHERE aid = C.editaid) AS editname
-											FROM `:prefix_comments` AS C
-											WHERE type = ? AND bid = ?" . $cotherdataedit . " ORDER BY added desc")->resultset([
-        $_GET["ctype"],
-        $_GET["comment"],
-    ]);
-
-    // #1500: same gate as the per-ban comment thread above — null admin
-    // usernames for public viewers so this comment-edit surface (reachable
-    // by anyone via ?comment=N) doesn't leak them regardless of theme.
-    $commentsHideAdmin = Config::getBool('banlist.hideadminname') && !$userbank->is_admin();
-
-    $ocomments = [];
-    foreach ($cotherdata as $cdrow) {
-        $coment               = [];
-        $coment['comname']    = $commentsHideAdmin ? '' : $cdrow['comname'];
-        $coment['added']      = Config::time($cdrow['added']);
-        $commentTextRow       = html_entity_decode($cdrow['commenttxt'], ENT_QUOTES | ENT_HTML5, 'UTF-8');
-        $commentTextRow       = encodePreservingBr($commentTextRow);
-        // Parse links and wrap them in a <a href=""></a> tag to be easily clickable
-        $commentTextRow       = preg_replace('@(https?://([-\w\.]+)+(:\d+)?(/([\w/_\.]*(\?\S+)?)?)?)@', '<a href="$1" target="_blank">$1</a>', $commentTextRow);
-        $coment['commenttxt'] = $commentTextRow;
-
-        if ($cdrow['editname'] != "") {
-            $coment['edittime'] = Config::time($cdrow['edittime']);
-            $coment['editname'] = $commentsHideAdmin ? '' : $cdrow['editname'];
-        } else {
-            $coment['editname'] = "";
-            $coment['edittime'] = "";
-        }
-        array_push($ocomments, $coment);
-    }
-
-    $commentText    = (string) (isset($ctext) ? $ctext : '');
-    $commentCtype   = (string) $_GET["ctype"];
-    $commentCid     = isset($_GET["cid"]) ? (string) $_GET["cid"] : '';
-    $commentCanedit = $userbank->is_admin();
-    $commentOthers  = $ocomments;
-}
+// Add / Edit comments live in the player drawer (`theme.js`).
+// `?p=banlist&comment=` is not an editor surface.
 
 unset($_SESSION['CountryFetchHndl']);
 
@@ -1487,14 +1423,6 @@ function setPostKey()
     total_bans:      $BanCount,
     view_bans:       (bool) $userbank->HasAccess(WebPermission::mask(WebPermission::Owner, WebPermission::EditAllBans, WebPermission::EditOwnBans, WebPermission::EditGroupBans, WebPermission::Unban, WebPermission::UnbanOwnBans, WebPermission::UnbanGroupBans, WebPermission::DeleteBan)),
     view_comments:   $view_comments,
-    comment:         $commentMode === false ? false : (int) $commentMode,
-    commenttype:     $commentType,
-    commenttext:     $commentText,
-    ctype:           $commentCtype,
-    cid:             $commentCid,
-    page:            isset($_GET["page"]) ? $page : -1,
-    canedit:         $commentCanedit,
-    othercomments:   $commentOthers,
     searchlink:      $searchlink,
     hidetext:        $hidetext,
     hideadminname:   Config::getBool('banlist.hideadminname') && !$userbank->is_admin(),
diff --git a/web/pages/page.commslist.php b/web/pages/page.commslist.php
index 09c88fe12..6c97490be 100644
--- a/web/pages/page.commslist.php
+++ b/web/pages/page.commslist.php
@@ -877,9 +877,12 @@ function setPostKey()
                     // the 2.0 theme no longer loads — the old `<i class="fas …">` rendered
                     // an empty `<a>`); `aria-label` gives the icon-only control an
                     // accessible name the way the row-action buttons do.
-                    $cdata['editcomlink'] = '<a href="index.php?p=commslist&comment=' . $data['ban_id'] . '&ctype=C&cid=' . (int) $crow['cid'] . $pagelink . '"'
-                        . ' class="tip" target="_self" data-tooltip="Edit Comment" aria-label="Edit comment"'
-                        . '><i data-lucide="pencil" style="width:13px;height:13px" aria-hidden="true"></i></a>';
+                    $cdata['editcomlink'] = '<button type="button" class="tip"'
+                        . ' data-drawer-cid="' . (int) $data['ban_id'] . '"'
+                        . ' data-comment-compose="edit"'
+                        . ' data-comment-cid="' . (int) $crow['cid'] . '"'
+                        . ' data-tooltip="Edit Comment" aria-label="Edit comment"'
+                        . '><i data-lucide="pencil" style="width:13px;height:13px" aria-hidden="true"></i></button>';
                     if ($userbank->HasAccess(WebPermission::Owner)) {
                         // #1402: see web/scripts/comment-actions.js for the dispatcher.
                         $cdata['delcomlink'] = '<a href="#" class="tip" title="Delete Comment" aria-label="Delete comment" target="_self"'
@@ -920,9 +923,8 @@ function setPostKey()
         $data['commentdata'] = $comment;
     }
 
-    // #1544: Lucide icon (the 2.0 theme dropped Font Awesome); keeps the
-    // visible "Add Comment" label so it degrades gracefully anyway.
-    $data['addcomment'] = CreateLinkR('<i data-lucide="message-square-plus" style="width:13px;height:13px" aria-hidden="true"></i> Add Comment', 'index.php?p=commslist&comment=' . $data['ban_id'] . '&ctype=C' . $pagelink);
+    // #1544: Add Comment markup lives in page_comms.tpl (drawer trigger
+    // with data-comment-compose="add"). Do not emit a ?comment= link.
     //-----------------------------------
     $data['counts']     = $delimiter . $mutes . $gags;
 
@@ -1080,69 +1082,8 @@ function setPostKey()
     }
 }
 
-//COMMENT STUFF
-//----------------------------------------
-// Comment-drawer locals. Computed into PHP locals here (instead of
-// the older `$theme->assign(...)` calls) so they can be threaded
-// into the View constructor below — Renderer copies every public
-// property onto $theme. The shipped v2.0.0 default theme defers the
-// editor UI to a follow-up; any third-party theme that forked the
-// pre-v2.0.0 default still renders it when `{if $comment}` is truthy.
-$ceditType  = '';
-$ceditText  = '';
-$ceditCtype        = '';
-$ceditCid          = '';
-$ceditPage         = -1;
-$ceditOthers = [];
-if (isset($_GET["comment"])) {
-    $ceditType = isset($_GET["cid"]) ? "Edit" : "Add";
-    if (isset($_GET["cid"])) {
-        $GLOBALS['PDO']->query("SELECT * FROM `:prefix_comments` WHERE cid = :cid");
-        $GLOBALS['PDO']->bind(':cid', (int) $_GET["cid"]);
-        $ceditdata      = $GLOBALS['PDO']->single();
-        $ceditText = html_entity_decode($ceditdata['commenttxt'], ENT_QUOTES | ENT_HTML5, 'UTF-8');
-        $cotherdataedit = " AND cid != '" . (int) $_GET["cid"] . "'";
-    } else {
-        $cotherdataedit = "";
-    }
-    $cotherdata = $GLOBALS['PDO']->query("SELECT cid, aid, commenttxt, added, edittime,
-											(SELECT user FROM `:prefix_admins` WHERE aid = C.aid) AS comname,
-											(SELECT user FROM `:prefix_admins` WHERE aid = C.editaid) AS editname
-											FROM `:prefix_comments` AS C
-											WHERE type = ? AND bid = ?" . $cotherdataedit . " ORDER BY added desc")->resultset([
-        $_GET["ctype"],
-        $_GET["comment"],
-    ]);
-
-    // #1500: same gate as the per-comm comment thread above — null admin
-    // usernames for public viewers so this comment-edit surface (reachable
-    // by anyone via ?comment=N) doesn't leak them regardless of theme.
-    $commentsHideAdmin = Config::getBool('banlist.hideadminname') && !$userbank->is_admin();
-
-    foreach ($cotherdata as $cdrow) {
-        $coment               = [];
-        $coment['comname']    = $commentsHideAdmin ? '' : $cdrow['comname'];
-        $coment['added']      = Config::time($cdrow['added']);
-        $commentText          = html_entity_decode($cdrow['commenttxt'], ENT_QUOTES | ENT_HTML5, 'UTF-8');
-        $commentText          = encodePreservingBr($commentText);
-        $commentText          = preg_replace('@(https?://([-\w\.]+)+(:\d+)?(/([\w/_\.]*(\?\S+)?)?)?)@', '<a href="$1" target="_blank">$1</a>', $commentText);
-        $coment['commenttxt'] = $commentText;
-        if ($cdrow['editname'] != "") {
-            $coment['edittime'] = Config::time($cdrow['edittime']);
-            $coment['editname'] = $commentsHideAdmin ? '' : $cdrow['editname'];
-        } else {
-            $coment['editname'] = "";
-            $coment['edittime'] = "";
-        }
-        array_push($ceditOthers, $coment);
-    }
-
-    $ceditPage = isset($_GET["page"]) ? (int) $_GET["page"] : -1;
-    $ceditCtype = (string) $_GET["ctype"];
-    $ceditCid   = isset($_GET["cid"]) ? (int) $_GET["cid"] : '';
-}
-$ceditBid = (isset($_GET["comment"]) && $view_comments) ? (int) $_GET["comment"] : false;
-//----------------------------------------
+// Add / Edit comments live in the player drawer (`theme.js`).
+// `?p=commslist&comment=` is not an editor surface.
 
 unset($_SESSION['CountryFetchHndl']);
 
@@ -1269,14 +1210,6 @@ function setPostKey()
     can_unmute_gag:           $can_unmute_gag,
     can_delete_comm:          $can_delete_comm,
     is_filtered:              $commsIsFiltered,
-    comment:                  $ceditBid,
-    commenttype:              $ceditType,
-    canedit:                  $userbank->is_admin(),
-    commenttext:              $ceditText,
-    ctype:                    $ceditCtype,
-    cid:                      $ceditCid,
-    page:                     $ceditPage,
-    othercomments:            $ceditOthers,
     ban_nav:                  $ban_nav,
     hidetext:                 $hidetext,
     hideadminname:            $hideAdminName,
diff --git a/web/phpstan-baseline.neon b/web/phpstan-baseline.neon
index 5d2c9931c..f02ea35e1 100644
--- a/web/phpstan-baseline.neon
+++ b/web/phpstan-baseline.neon
@@ -198,12 +198,6 @@ parameters:
 			count: 1
 			path: pages/page.banlist.php
 
-		-
-			message: '#^Variable \$ctext in isset\(\) always exists and is not nullable\.$#'
-			identifier: isset.variable
-			count: 1
-			path: pages/page.banlist.php
-
 		-
 			message: '#^Variable \$res might not be defined\.$#'
 			identifier: variable.undefined
diff --git a/web/scripts/banlist.js b/web/scripts/banlist.js
index 1d947be42..9fe5d690b 100644
--- a/web/scripts/banlist.js
+++ b/web/scripts/banlist.js
@@ -5,12 +5,12 @@
    Layered on top of the server-rendered table from
    themes/default/page_bans.tpl. The template is fully usable
    without this script (filters fall through as a server-side
-   ?searchText= query, copy buttons no-op, comment-edit is a
-   normal POST round-trip), so this file only adds:
+   ?searchText= query, copy buttons no-op), so this file only
+   keeps the loading-skeleton hook on `#banlist-root`.
 
-     1. Comment edit form     — POSTs through sb.api.call()
-        instead of a `<form action="">` round-trip so the page
-        doesn't need to navigate away.
+   Add / Edit comments live in the player drawer (`theme.js`)
+   and on queue cards (`comment-actions.js`). There is no
+   `#banlist-comment-form` page editor.
 
    The status-filter chips are server-rendered anchors (#1352).
    Pre-#1352 this file owned a `applyStateFilter` row-hide layer
@@ -34,9 +34,6 @@
    inline `onclick="event.stopPropagation()"` on the button
    silently killed the document delegate on the bubble phase.
    Both halves are fixed in #1308 — the wiring stays in theme.js.
-
-   Each interaction is wrapped in a feature-detect (`if (foo)`)
-   so a missing element on the comment-only branch doesn't throw.
    ============================================================ */
 (function () {
   'use strict';
@@ -44,63 +41,6 @@
   /** @type {HTMLElement | null} */
   const root = /** @type {HTMLElement | null} */ (document.getElementById('banlist-root'));
 
-  // ---- COMMENT EDIT FORM ----------------------------------
-  // The form has no `action`, so submit hits this handler and goes
-  // through the JSON API. Falls back to navigation on non-OK responses.
-  /** @type {HTMLFormElement | null} */
-  const cform = /** @type {HTMLFormElement | null} */ (document.getElementById('banlist-comment-form'));
-  if (cform) {
-    cform.addEventListener('submit', (/** @type {SubmitEvent} */ e) => {
-      e.preventDefault();
-      const bid = parseInt(cform.dataset.bid || '0', 10);
-      const cid = parseInt(cform.dataset.cid || '0', 10);
-      const ctype = cform.dataset.ctype || 'B';
-      const page = parseInt(cform.dataset.page || '-1', 10);
-      const text = /** @type {HTMLTextAreaElement | null} */ (document.getElementById('banlist-comment-text'));
-      const value = text ? text.value : '';
-
-      const sb = /** @type {any} */ (window).sb;
-      const Actions = /** @type {any} */ (window).Actions;
-      if (!sb || !sb.api || !Actions) {
-        // sb / api-contract failed to load (offline, asset 404, …).
-        // Native form.submit() bypasses listeners per the HTML spec, so
-        // we don't need to detach this handler first; the submission
-        // POSTs to the action-less form URL, which page.banlist.php
-        // doesn't handle, but that's an acceptable fall-through —
-        // the network call is the primary path.
-        cform.submit();
-        return;
-      }
-
-      // Surface the busy state on the submit button while the comment
-      // POST is in flight. The success branch navigates to the banlist
-      // (`window.location.href = …`), so the disabled state hangs around
-      // until the new page paints; the catch branch releases it.
-      const SBPP = /** @type {any} */ (window).SBPP;
-      const submitBtn = /** @type {HTMLButtonElement | null} */ (cform.querySelector('button[type="submit"]'));
-      const setBusy = (/** @type {boolean} */ on) => {
-        if (!submitBtn) return;
-        if (SBPP && typeof SBPP.setBusy === 'function') SBPP.setBusy(submitBtn, on);
-        else submitBtn.disabled = on;
-      };
-      setBusy(true);
-
-      const action = cid > 0 ? Actions.BansEditComment : Actions.BansAddComment;
-      sb.api.call(action, { bid: bid, cid: cid, ctype: ctype, ctext: value, page: page })
-        .then(() => {
-          window.location.href = 'index.php?p=banlist' + (page > 0 ? '&page=' + page : '');
-        })
-        .catch((/** @type {Error} */ err) => {
-          setBusy(false);
-          if (SBPP && SBPP.showToast) {
-            SBPP.showToast({ kind: 'error', title: 'Failed to save comment', body: err.message });
-          } else {
-            alert('Failed to save comment: ' + err.message);
-          }
-        });
-    });
-  }
-
   // ---- LOADING SKELETON HOOK -------------------------------
   // The chip filter is now a server-rendered anchor (#1352) so
   // there's no client-side row-hide work for the skeleton hook
diff --git a/web/scripts/comment-actions.js b/web/scripts/comment-actions.js
index 8443d5bf9..60e0b4b75 100644
--- a/web/scripts/comment-actions.js
+++ b/web/scripts/comment-actions.js
@@ -2,43 +2,32 @@
 /* ============================================================
    comment-actions.js — shared comment-action dispatcher
 
-   Single document-level click delegate handling
-   `data-action="comment-delete"` triggers across the three
-   surfaces that render comment threads:
-
-     1. Public banlist  (`web/pages/page.banlist.php`)
-     2. Public commslist (`web/pages/page.commslist.php`)
-     3. Admin moderation queues — protests + submissions
-        (`web/pages/admin.bans.php`)
-
-   All three previously emitted inline
-   `onclick="RemoveComment(<cid>, '<ctype>', <page>);"` blobs
-   pointing at a helper in the deleted `web/scripts/sourcebans.js`
-   (#1123 D1). Without the helper, every trash-can click was a
-   silent `ReferenceError: RemoveComment is not defined` — no
-   toast, no API call, no row removal; the operator perceived the
-   button as broken.
-
-   The replacement uses `Actions.BansRemoveComment` (already
-   registered in `_register.php` with `ADMIN_OWNER`; `ctype` arm
-   handles 'B'/'C'/'S'/'P' in `api_bans_remove_comment`). On a
-   successful response we honour the handler's `message.redir`
-   envelope so the operator lands back on the same paginated view
-   they were on; on error we surface a toast and leave the row
-   intact.
-
-   Each trigger carries:
+   Document-level delegates for:
+
+     1. `data-action="comment-delete"` — confirm dialog +
+        Actions.BansRemoveComment. Surfaces: public banlist /
+        commslist inline threads, player-drawer comments, admin
+        moderation queues (protests + submissions).
+     2. `data-action="comment-compose"` — inline composer on the
+        four queue cards (protests / submissions, current +
+        archive). Banlist / commslist Add and Edit open the
+        player drawer instead (`theme.js`).
+
+   Delete: banlist / commslist (ctype B / C), including the player
+   drawer, stay on the current page. theme.js removes the comment
+   in place so scroll, pagination, and open disclosures survive.
+   Protest / submission queue cards (S / P) still honour
+   `message.redir` / reload after the toast settle.
+
+   Each delete trigger carries:
      - `data-cid="<int>"`   — required (the comments row id)
      - `data-ctype="<B|C|S|P>"` — required
      - `data-page="<int>"`  — optional, defaults to -1
 
-   Confirm chrome is a single shared `<dialog>` (injected once)
-   matching the banlist / commslist delete modals — not
-   `window.confirm()`.
-
-   This file lives at panel scope so any future page that needs
-   comment-delete just adds the `data-action="comment-delete"`
-   attribute + the three data hooks and includes this script.
+   Queue compose triggers carry `data-bid` + `data-ctype` and,
+   for Edit, `data-cid` + `data-comment-text` (raw text, not the
+   HTML body). Confirm chrome is a single shared `<dialog>`
+   (injected once) — not `window.confirm()`.
    ============================================================ */
 (function () {
     'use strict';
@@ -126,6 +115,108 @@
         pending = null;
     }
 
+    /**
+     * @param {HTMLFormElement} form
+     * @param {boolean} show
+     */
+    function showComposer(form, show) {
+        form.hidden = !show;
+        var card = form.closest('details');
+        var addBtn = card && card.querySelector('[data-testid="queue-comment-add"]');
+        if (addBtn instanceof HTMLElement) addBtn.hidden = show;
+        if (!show) {
+            var cidInput = /** @type {HTMLInputElement|null} */ (form.querySelector('input[name="cid"]'));
+            var textarea = /** @type {HTMLTextAreaElement|null} */ (form.querySelector('textarea[name="ctext"]'));
+            var err = /** @type {HTMLElement|null} */ (form.querySelector('[data-comment-error]'));
+            if (cidInput) cidInput.value = '';
+            if (textarea) textarea.value = '';
+            if (err) err.hidden = true;
+        }
+    }
+
+    /**
+     * @param {HTMLElement} trigger
+     */
+    function openQueueComposer(trigger) {
+        var card = trigger.closest('details');
+        var form = card && /** @type {HTMLFormElement|null} */ (card.querySelector('[data-comment-composer]'));
+        if (!form) {
+            toast('error', 'Comment failed', 'Missing comment composer on this card.');
+            return;
+        }
+        var cid = parseInt(trigger.getAttribute('data-cid') || '0', 10);
+        var raw = trigger.getAttribute('data-comment-text') || '';
+        var cidInput = /** @type {HTMLInputElement|null} */ (form.querySelector('input[name="cid"]'));
+        var textarea = /** @type {HTMLTextAreaElement|null} */ (form.querySelector('textarea[name="ctext"]'));
+        var err = /** @type {HTMLElement|null} */ (form.querySelector('[data-comment-error]'));
+        showComposer(form, true);
+        if (cidInput) cidInput.value = cid > 0 ? String(cid) : '';
+        if (textarea) {
+            textarea.value = cid > 0 ? raw : '';
+            try { textarea.focus(); } catch (_e) { /* focus may throw */ }
+        }
+        if (err) err.hidden = true;
+    }
+
+    /**
+     * @param {HTMLFormElement} form
+     */
+    function submitQueueComposer(form) {
+        var a = api(), A = actions();
+        var textarea = /** @type {HTMLTextAreaElement|null} */ (form.querySelector('textarea[name="ctext"]'));
+        var cidInput = /** @type {HTMLInputElement|null} */ (form.querySelector('input[name="cid"]'));
+        var err = /** @type {HTMLElement|null} */ (form.querySelector('[data-comment-error]'));
+        var value = textarea ? textarea.value.trim() : '';
+        if (value === '') {
+            if (err) err.hidden = false;
+            if (textarea) {
+                try { textarea.focus(); } catch (_e) { /* focus may throw */ }
+            }
+            return;
+        }
+        if (err) err.hidden = true;
+        if (!a || !A) {
+            toast('error', 'Comment failed', 'The API client is unavailable. Reload the page and try again.');
+            return;
+        }
+        var bid = parseInt(form.getAttribute('data-bid') || '0', 10);
+        var ctype = form.getAttribute('data-ctype') || '';
+        var cid = parseInt((cidInput && cidInput.value) || '0', 10);
+        if (!bid || !ctype) {
+            toast('error', 'Comment failed', 'Missing comment context.');
+            return;
+        }
+        var submitBtn = /** @type {HTMLButtonElement|null} */ (form.querySelector('button[type="submit"]'));
+        setBusy(submitBtn, true);
+        var action = cid > 0 ? A.BansEditComment : A.BansAddComment;
+        a.call(action, {
+            bid: bid,
+            cid: cid,
+            ctype: ctype,
+            ctext: value,
+            page: -1,
+        }).then(function (r) {
+            if (!r) {
+                setBusy(submitBtn, false);
+                return;
+            }
+            if (r.redirect) return;
+            if (r.ok === false) {
+                setBusy(submitBtn, false);
+                var em = (r.error && r.error.message) || 'Failed to save comment.';
+                toast('error', 'Comment failed', em);
+                return;
+            }
+            var data = r.data || {};
+            var msg = data.message || {};
+            toast('success', msg.title || 'Comment saved', msg.body || 'The comment was saved.');
+            window.location.reload();
+        }).catch(function (e) {
+            setBusy(submitBtn, false);
+            toast('error', 'Comment failed', String(e && e.message ? e.message : e));
+        });
+    }
+
     /**
      * @param {{cid: number, ctype: string, page: number, trigger: HTMLElement}} ctx
      */
@@ -165,12 +256,19 @@
             }
             var data = r.data || {};
             var msg = data.message || {};
+            var inList = ctx.ctype === 'B' || ctx.ctype === 'C';
             closeDeleteDialog();
             toast('success', msg.title || 'Comment Deleted', msg.body || 'The comment was deleted.');
-            // Honour the handler's redir envelope (sb.api.call only
-            // auto-redirects on r.redirect, NOT on data.message.redir).
-            // Match SbppGroupsAdd's 1.2-1.5s pause so the toast is
-            // visible before the navigation.
+            if (inList) {
+                document.dispatchEvent(new CustomEvent('sbpp:comment-deleted', {
+                    detail: { cid: ctx.cid, ctype: ctx.ctype },
+                }));
+                setBusy(submitBtn, false);
+                return;
+            }
+            // Queue cards (S / P): honour the handler's redir envelope
+            // (sb.api.call only auto-redirects on r.redirect, NOT on
+            // data.message.redir). Pause so the toast is visible first.
             setTimeout(function () {
                 if (msg.redir) window.location.href = msg.redir;
                 else window.location.reload();
@@ -192,6 +290,21 @@
             return;
         }
 
+        var composeTrigger = /** @type {HTMLElement|null} */ (t.closest && t.closest('[data-action="comment-compose"]'));
+        if (composeTrigger) {
+            e.preventDefault();
+            openQueueComposer(composeTrigger);
+            return;
+        }
+
+        var cancelComposer = /** @type {HTMLElement|null} */ (t.closest && t.closest('[data-comment-composer] [data-comment-cancel]'));
+        if (cancelComposer) {
+            e.preventDefault();
+            var form = /** @type {HTMLFormElement|null} */ (cancelComposer.closest('[data-comment-composer]'));
+            if (form) showComposer(form, false);
+            return;
+        }
+
         var trigger = /** @type {HTMLElement|null} */ (t.closest && t.closest('[data-action="comment-delete"]'));
         if (!trigger) return;
         e.preventDefault();
@@ -211,10 +324,16 @@
     document.addEventListener('submit', function (e) {
         var form = /** @type {Element|null} */ (e.target);
         if (!form || !(/** @type {Element} */ (form)).closest) return;
-        if (!form.matches('[data-testid="comment-delete-form"]')) return;
-        e.preventDefault();
-        if (!pending) return;
-        runDelete(pending);
+        if (form.matches('[data-testid="comment-delete-form"]')) {
+            e.preventDefault();
+            if (!pending) return;
+            runDelete(pending);
+            return;
+        }
+        if (form.matches('[data-comment-composer]')) {
+            e.preventDefault();
+            submitQueueComposer(/** @type {HTMLFormElement} */ (form));
+        }
     });
 
     document.addEventListener('cancel', function (e) {
diff --git a/web/tests/api/BansTest.php b/web/tests/api/BansTest.php
index 737742f88..8c83c8725 100644
--- a/web/tests/api/BansTest.php
+++ b/web/tests/api/BansTest.php
@@ -70,6 +70,17 @@ private function seedSubmission(string $name = 'Bob', string $steam = 'STEAM_0:1
         return (int)$pdo->lastInsertId();
     }
 
+    private function seedProtest(): int
+    {
+        $pdo = Fixture::rawPdo();
+        $pdo->prepare(sprintf(
+            'INSERT INTO `%s_protests` (`bid`, `email`, `reason`, `archiv`, `datesubmitted`, `pip`)
+             VALUES (0, ?, ?, "0", ?, "127.0.0.1")',
+            DB_PREFIX,
+        ))->execute(['protest@example.test', 'wrong ban', time()]);
+        return (int) $pdo->lastInsertId();
+    }
+
     public function testAddRejectsAnonymous(): void
     {
         $env = $this->api('bans.add', [
@@ -99,6 +110,129 @@ public function testAddSuccessSnapshot(): void
         $this->assertSnapshot('bans/add_success', $env, ['data.bid']);
     }
 
+    public function testAddRejectsMalformedDemoMetadataBeforeWritingBan(): void
+    {
+        $this->loginAsAdmin();
+        $cases = [
+            ['STEAM_0:1:1554011', str_repeat('0', 32), '', 'dfile'],
+            ['STEAM_0:1:1554012', '', 'evidence.dem', 'dfile'],
+            ['STEAM_0:1:1554013', str_repeat('g', 32), 'evidence.dem', 'dfile'],
+            ['STEAM_0:1:1554014', str_repeat('0', 32), str_repeat('a', 129), 'dname'],
+        ];
+
+        foreach ($cases as [$steam, $filename, $originalName, $field]) {
+            $env = $this->api('bans.add', [
+                'nickname' => 'Malformed demo',
+                'type'     => 0,
+                'steam'    => $steam,
+                'ip'       => '',
+                'length'   => 0,
+                'dfile'    => $filename,
+                'dname'    => $originalName,
+                'reason'   => 'demo validation',
+                'fromsub'  => 0,
+            ]);
+
+            $this->assertEnvelopeError($env, 'validation');
+            $this->assertSame($field, $env['error']['field']);
+            $this->assertNull($this->row('bans', ['authid' => $steam]));
+        }
+    }
+
+    public function testAddLinksOnlyARealUploaderShapedDemo(): void
+    {
+        $this->loginAsAdmin();
+        $filename = '15540000000000000000000000000001';
+        $path = SB_DEMOS . '/' . $filename;
+        if (!is_dir(SB_DEMOS)) {
+            mkdir(SB_DEMOS, 0775, true);
+        }
+        file_put_contents($path, 'demo-bytes');
+
+        try {
+            $env = $this->api('bans.add', [
+                'nickname' => 'Demo',
+                'type'     => 0,
+                'steam'    => 'STEAM_0:1:1554001',
+                'ip'       => '',
+                'length'   => 0,
+                'dfile'    => $filename,
+                'dname'    => 'evidence.dem',
+                'reason'   => 'demo validation',
+                'fromsub'  => 0,
+            ]);
+
+            $this->assertTrue($env['ok'], json_encode($env));
+            $demo = $this->row('demos', [
+                'demid'   => (int) $env['data']['bid'],
+                'demtype' => 'B',
+            ]);
+            $this->assertSame($filename, $demo['filename']);
+            $this->assertSame('evidence.dem', $demo['origname']);
+        } finally {
+            @unlink($path);
+        }
+    }
+
+    public function testAddRejectsMissingDemoFileBeforeWritingBan(): void
+    {
+        $this->loginAsAdmin();
+        $filename = '15540000000000000000000000000002';
+        @unlink(SB_DEMOS . '/' . $filename);
+
+        $env = $this->api('bans.add', [
+            'nickname' => 'Missing demo',
+            'type'     => 0,
+            'steam'    => 'STEAM_0:1:1554002',
+            'ip'       => '',
+            'length'   => 0,
+            'dfile'    => $filename,
+            'dname'    => 'missing.dem',
+            'reason'   => 'demo validation',
+            'fromsub'  => 0,
+        ]);
+
+        $this->assertEnvelopeError($env, 'validation');
+        $this->assertSame('dfile', $env['error']['field']);
+        $this->assertNull($this->row('bans', ['authid' => 'STEAM_0:1:1554002']));
+    }
+
+    public function testAddRejectsDemoSymlinkBeforeWritingBan(): void
+    {
+        $this->loginAsAdmin();
+        $filename = '15540000000000000000000000000003';
+        $link = SB_DEMOS . '/' . $filename;
+        if (!is_dir(SB_DEMOS)) {
+            mkdir(SB_DEMOS, 0775, true);
+        }
+        @unlink($link);
+        $target = tempnam(sys_get_temp_dir(), 'sbpp-demo-');
+        $this->assertIsString($target);
+        file_put_contents($target, 'outside-demo-root');
+        $this->assertTrue(symlink($target, $link));
+
+        try {
+            $env = $this->api('bans.add', [
+                'nickname' => 'Linked demo',
+                'type'     => 0,
+                'steam'    => 'STEAM_0:1:1554003',
+                'ip'       => '',
+                'length'   => 0,
+                'dfile'    => $filename,
+                'dname'    => 'linked.dem',
+                'reason'   => 'demo validation',
+                'fromsub'  => 0,
+            ]);
+
+            $this->assertEnvelopeError($env, 'validation');
+            $this->assertSame('dfile', $env['error']['field']);
+            $this->assertNull($this->row('bans', ['authid' => 'STEAM_0:1:1554003']));
+        } finally {
+            @unlink($link);
+            @unlink($target);
+        }
+    }
+
     public function testAddValidationMissingSteamForType0(): void
     {
         $this->loginAsAdmin();
@@ -664,6 +798,116 @@ public function testAddCommentRejectsBadType(): void
         $this->assertSnapshot('bans/add_comment_bad_type', $env);
     }
 
+    public function testAddCommentRejectsEmptyText(): void
+    {
+        $this->loginAsAdmin();
+        $bid = $this->seedBan();
+
+        $env = $this->api('bans.add_comment', [
+            'bid' => $bid, 'ctype' => 'B', 'ctext' => '  ', 'page' => -1,
+        ]);
+
+        $this->assertEnvelopeError($env, 'validation');
+        $this->assertSame('ctext', $env['error']['field']);
+        $this->assertSame([], $this->rows('comments', ['bid' => $bid]));
+    }
+
+    public function testAddCommentRejectsUnknownParent(): void
+    {
+        $this->loginAsAdmin();
+
+        $env = $this->api('bans.add_comment', [
+            'bid' => 999999,
+            'ctype' => 'B',
+            'ctext' => 'orphan comment',
+            'page' => -1,
+        ]);
+
+        $this->assertEnvelopeError($env, 'not_found');
+        $this->assertSame('bid', $env['error']['field']);
+        $this->assertSame([], $this->rows('comments', ['bid' => 999999]));
+    }
+
+    public function testModerationQueueCommentsRequireTheirSpecificPermissions(): void
+    {
+        $submissionId = $this->seedSubmission();
+        $protestId = $this->seedProtest();
+        $aid = $this->createAdminWithFlags(ADMIN_ADD_BAN);
+        $this->loginAs($aid);
+
+        foreach ([['S', $submissionId], ['P', $protestId]] as [$ctype, $parentId]) {
+            $env = $this->api('bans.add_comment', [
+                'bid' => $parentId,
+                'ctype' => $ctype,
+                'ctext' => 'unauthorized moderation note',
+                'page' => -1,
+            ]);
+
+            $this->assertEnvelopeError($env, 'forbidden');
+            $this->assertSame([], $this->rows('comments', [
+                'bid' => $parentId,
+                'type' => $ctype,
+            ]));
+        }
+    }
+
+    public function testModerationQueuePermissionsAllowCommentsAndReturnSectionRedirects(): void
+    {
+        $submissionId = $this->seedSubmission();
+        $protestId = $this->seedProtest();
+        $aid = $this->createAdminWithFlags(ADMIN_BAN_SUBMISSIONS | ADMIN_BAN_PROTESTS);
+        $this->loginAs($aid);
+
+        $submissionEnv = $this->api('bans.add_comment', [
+            'bid' => $submissionId,
+            'ctype' => 'S',
+            'ctext' => 'submission note',
+            'page' => -1,
+        ]);
+        $this->assertTrue($submissionEnv['ok'], json_encode($submissionEnv));
+        $this->assertSame(
+            'index.php?p=admin&c=bans&section=submissions',
+            $submissionEnv['data']['message']['redir'],
+        );
+
+        $protestEnv = $this->api('bans.add_comment', [
+            'bid' => $protestId,
+            'ctype' => 'P',
+            'ctext' => 'protest note',
+            'page' => -1,
+        ]);
+        $this->assertTrue($protestEnv['ok'], json_encode($protestEnv));
+        $this->assertSame(
+            'index.php?p=admin&c=bans&section=protests',
+            $protestEnv['data']['message']['redir'],
+        );
+    }
+
+    public function testEditModerationCommentRequiresCurrentQueuePermissionEvenForAuthor(): void
+    {
+        $submissionId = $this->seedSubmission();
+        $aid = $this->createAdminWithFlags(ADMIN_ADD_BAN);
+        $pdo = Fixture::rawPdo();
+        $pdo->prepare(sprintf(
+            'INSERT INTO `%s_comments` (`bid`, `type`, `aid`, `commenttxt`, `added`)
+             VALUES (?, "S", ?, ?, UNIX_TIMESTAMP())',
+            DB_PREFIX,
+        ))->execute([$submissionId, $aid, 'original note']);
+        $cid = (int) $pdo->lastInsertId();
+        $this->loginAs($aid);
+
+        $env = $this->api('bans.edit_comment', [
+            'bid' => $submissionId,
+            'cid' => $cid,
+            'ctype' => 'S',
+            'ctext' => 'unauthorized edit',
+            'page' => -1,
+        ]);
+
+        $this->assertEnvelopeError($env, 'forbidden');
+        $this->assertSame('original note', $this->row('comments', ['cid' => $cid])['commenttxt']);
+    }
+
     public function testEditCommentUpdatesRow(): void
     {
         $this->loginAsAdmin();
@@ -691,6 +935,57 @@ public function testEditCommentRejectsBadType(): void
         $this->assertEnvelopeError($env, 'bad_type');
     }
 
+    public function testEditCommentRejectsValidButMismatchedType(): void
+    {
+        $this->loginAsAdmin();
+        $bid = $this->seedBan();
+        $this->api('bans.add_comment', [
+            'bid' => $bid,
+            'ctype' => 'B',
+            'ctext' => 'ban-only comment',
+            'page' => -1,
+        ]);
+        $cid = (int) $this->row('comments', ['bid' => $bid])['cid'];
+
+        $env = $this->api('bans.edit_comment', [
+            'bid' => $bid,
+            'cid' => $cid,
+            'ctype' => 'C',
+            'ctext' => 'retargeted comment',
+            'page' => -1,
+        ]);
+
+        $this->assertEnvelopeError($env, 'validation');
+        $this->assertSame('ctype', $env['error']['field']);
+        $this->assertSame('ban-only comment', $this->row('comments', ['cid' => $cid])['commenttxt']);
+    }
+
+    public function testEditCommentRejectsMismatchedParentId(): void
+    {
+        $this->loginAsAdmin();
+        $bid = $this->seedBan();
+        $otherBid = $this->seedBan('STEAM_0:1:882211');
+        $this->api('bans.add_comment', [
+            'bid' => $bid,
+            'ctype' => 'B',
+            'ctext' => 'original text',
+            'page' => -1,
+        ]);
+        $cid = (int) $this->row('comments', ['bid' => $bid])['cid'];
+
+        $env = $this->api('bans.edit_comment', [
+            'bid' => $otherBid,
+            'cid' => $cid,
+            'ctype' => 'B',
+            'ctext' => 'wrong-parent edit',
+            'page' => -1,
+        ]);
+
+        $this->assertEnvelopeError($env, 'validation');
+        $this->assertSame('bid', $env['error']['field']);
+        $this->assertSame('original text', $this->row('comments', ['cid' => $cid])['commenttxt']);
+    }
+
     public function testEditCommentRejectsNonAuthor(): void
     {
         $authorAid = $this->createAdminWithFlags(ADMIN_ADD_BAN);
@@ -728,6 +1023,29 @@ public function testRemoveCommentDeletesRow(): void
         $this->assertSnapshot('bans/remove_comment_success', $env);
     }
 
+    public function testRemoveCommentRejectsValidButMismatchedType(): void
+    {
+        $this->loginAsAdmin();
+        $bid = $this->seedBan();
+        $this->api('bans.add_comment', [
+            'bid' => $bid,
+            'ctype' => 'B',
+            'ctext' => 'keep this comment',
+            'page' => -1,
+        ]);
+        $cid = (int) $this->row('comments', ['bid' => $bid])['cid'];
+
+        $env = $this->api('bans.remove_comment', [
+            'cid' => $cid,
+            'ctype' => 'C',
+            'page' => -1,
+        ]);
+
+        $this->assertEnvelopeError($env, 'validation');
+        $this->assertSame('ctype', $env['error']['field']);
+        $this->assertNotNull($this->row('comments', ['cid' => $cid]));
+    }
+
     public function testPasteRequiresKnownServer(): void
     {
         $this->loginAsAdmin();
diff --git a/web/tests/e2e/fixtures/db.ts b/web/tests/e2e/fixtures/db.ts
index da238eaa2..c1ad17706 100644
--- a/web/tests/e2e/fixtures/db.ts
+++ b/web/tests/e2e/fixtures/db.ts
@@ -174,13 +174,12 @@ export async function seedCommsRawE2e(rows: CommsSeedRow[]): Promise<void> {
  * `type='C'` attaches to a comm-block row (the bid here is the
  * comms table cid — the column was reused from v1.x without a rename).
  *
- * Used by the banlist-comments-visibility spec because there is no
- * JSON action for adding admin-authored per-row comments — the
- * production write path is the legacy `?p=banlist&comment=N` POST
- * handler. Driving an HTML POST through Playwright would couple the
- * spec to the comment-edit chrome and CSRF handshake, which is
- * unrelated to what we're verifying (the disclosure renders, the
- * drawer paints the same data).
+ * Used by the banlist-comments-visibility spec to attach comments
+ * without going through `bans.add_comment` (that path would couple
+ * the spec to CSRF + the drawer / queue composer chrome). Driving
+ * the JSON action through Playwright is unrelated to what we're
+ * verifying (the disclosure renders, the drawer paints the same
+ * data).
  */
 export interface CommentSeedRow {
     type: 'B' | 'C';
diff --git a/web/tests/e2e/scripts/seed-comments-e2e.php b/web/tests/e2e/scripts/seed-comments-e2e.php
index a2298d2d1..e869c0c99 100644
--- a/web/tests/e2e/scripts/seed-comments-e2e.php
+++ b/web/tests/e2e/scripts/seed-comments-e2e.php
@@ -4,20 +4,17 @@
  *
  * Why this exists alongside `seed-comms-e2e.php`:
  *
- *   - There is no JSON API action for adding admin-authored
- *     per-row comments (the legacy `?p=banlist&comment=N` POST
- *     handler is the production write path; it owns CSRF + the
- *     `:prefix_comments.commenttxt` substitution that turns a few
- *     literal sequences into `<br/>` etc., and isn't worth
- *     re-implementing as a JSON action just for tests).
+ *   - The production write path is `bans.add_comment`, but driving
+ *     that JSON action through Playwright would couple this seeder
+ *     to CSRF + the drawer / queue composer chrome. Tests that only
+ *     need rows present (disclosure + drawer mirror) insert SQL
+ *     directly.
  *   - `Sbpp\Tests\Synthesizer` has a comments-seeding path but it
  *     refuses any DB other than `sourcebans` (dev DB only); same
  *     refusal guard as `seed-comms-e2e.php`.
  *   - The banlist-comments-visibility e2e spec needs both a row
- *     AND comments on it. Driving an HTML POST through Playwright
- *     would couple the spec to the comment-edit page's chrome and
- *     CSRF handshake — unnecessary for what we're verifying (the
- *     disclosure renders, the drawer paints the same data).
+ *     AND comments on it. SQL insert keeps that independent of the
+ *     composer chrome.
  *
  * This shim is e2e-only: refuses any DB other than the e2e schema
  * (default `sourcebans_e2e`). Same shape and guardrails as the
diff --git a/web/tests/e2e/specs/flows/banlist-comments-visibility.spec.ts b/web/tests/e2e/specs/flows/banlist-comments-visibility.spec.ts
index 266105df6..5e7da4d80 100644
--- a/web/tests/e2e/specs/flows/banlist-comments-visibility.spec.ts
+++ b/web/tests/e2e/specs/flows/banlist-comments-visibility.spec.ts
@@ -23,6 +23,15 @@
  *     comments, defaults closed, opens to reveal the comment text.
  *   - Same drawer surface still renders the comment under
  *     `[data-testid="drawer-comments"]` when the row's drawer is opened.
+ *     Add comment reveals `[data-testid="drawer-comment-form"]` and
+ *     does not navigate to `?comment=`.
+ *   - Saving a comment in the drawer patches the matching table
+ *     disclosure (count + body) without a page reload.
+ *   - Deleting a comment from the table disclosure or the drawer
+ *     leaves scroll, pagination, and open disclosures intact.
+ *   - Commslist Add Comment opens the same drawer composer.
+ *   - Protest-queue Add Comment reveals the inline card composer and
+ *     stays on `?p=admin&c=bans`.
  *   - Mobile banlist: the non-interactive count indicator
  *     (`[data-testid="ban-comments-count-mobile"]`) renders inside the
  *     `.ban-cards` wrapper. The drawer is the canonical mobile
@@ -30,13 +39,14 @@
  */
 
 import { expect, test } from '../../fixtures/auth.ts';
-import { seedBanViaApi } from '../../fixtures/seeds.ts';
+import { seedBanViaApi, seedCommViaApi } from '../../fixtures/seeds.ts';
 import { seedCommentsRawE2e } from '../../fixtures/db.ts';
 
 const SEED_NICK_PREFIX = 'e2e-comments-target';
 const SEED_REASON      = 'e2e comments seed reason';
 const FIRST_COMMENT    = 'first comment from e2e';
 const SECOND_COMMENT   = 'second comment from e2e';
+const LIVE_COMMENT     = 'live-sync comment from e2e';
 
 /**
  * Per-subtest authid offset. See player-drawer.spec.ts's matching
@@ -49,6 +59,10 @@ const SUBTEST_OFFSETS = {
     'inline-disclosure': 0,
     'drawer-mirror':     1,
     'mobile-count':      2,
+    'comms-compose':     3,
+    'list-sync':         4,
+    'list-delete':       5,
+    'drawer-delete':     6,
 } as const;
 
 function uniqueSeed(
@@ -208,9 +222,234 @@ test.describe('#BANLIST-COMMENTS: per-row comments visibility', () => {
         await expect(commentsBlock).toBeVisible();
         await expect(commentsBlock).toContainText(FIRST_COMMENT);
 
-        // #1544: the drawer carries the "Add comment" CTA for admins so a
-        // thread can be extended without hunting for the inline disclosure.
-        await expect(commentsBlock.locator('[data-testid="drawer-comment-add"]')).toBeVisible();
+        // Add comment opens the collapsed composer in place. The list
+        // URL must not change to `?comment=` (that page editor is gone).
+        const addBtn = commentsBlock.locator('[data-testid="drawer-comment-add"]');
+        await expect(addBtn).toBeVisible();
+        await addBtn.click();
+        const composer = drawer.locator('[data-testid="drawer-comment-form"]');
+        await expect(composer).toBeVisible();
+        await expect(page).toHaveURL(/[?&]p=banlist\b/);
+        await expect(page).not.toHaveURL(/[?&]comment=/);
+    });
+
+    test('drawer comment save patches the table disclosure without a reload', async ({ page }, testInfo) => {
+        // The list row is SSR. Closing the drawer used to leave the
+        // chip/count at the pre-save value until the operator refreshed.
+        // `loadDrawer` now patches the matching `<details>` from the
+        // detail envelope, so the new comment is visible in the table
+        // immediately. Desktop-only: the mobile card has no disclosure.
+        test.skip(Boolean(testInfo.project.name === 'mobile-chromium'), 'desktop-only — mobile cards use the drawer as the comment surface');
+
+        const seed = uniqueSeed(testInfo, 'list-sync');
+        const bid  = await seedOrLookup(page, seed);
+        await seedCommentsRawE2e([
+            { type: 'B', bid, text: FIRST_COMMENT },
+        ]);
+
+        await page.goto('/index.php?p=banlist');
+
+        const disclosure = page.locator(
+            `[data-testid="ban-comments-inline"][data-bid="${bid}"]`,
+        );
+        await expect(disclosure).toBeVisible();
+        await expect(disclosure.locator('[data-testid="ban-comments-toggle"] .tabular-nums')).toHaveText('1');
+
+        await page
+            .locator(
+                `[data-testid="drawer-trigger"][data-drawer-href*="id=${bid}"]`,
+            )
+            .first()
+            .click();
+
+        const drawer = page.locator('#drawer-root');
+        await expect(drawer).toHaveAttribute('data-drawer-open', 'true');
+        await expect(drawer).not.toHaveAttribute('data-loading', /.+/);
+
+        await drawer.locator('[data-testid="drawer-comment-add"]').click();
+        const composer = drawer.locator('[data-testid="drawer-comment-form"]');
+        await expect(composer).toBeVisible();
+        await composer.locator('textarea[name="ctext"]').fill(LIVE_COMMENT);
+        await composer.locator('button[type="submit"]').click();
+
+        await expect(drawer).not.toHaveAttribute('data-loading', /.+/);
+        await expect(drawer.locator('[data-testid="drawer-comments"]')).toContainText(LIVE_COMMENT);
+
+        await drawer.locator('[data-drawer-close][aria-label="Close"]').click();
+        await expect(drawer).toHaveAttribute('data-drawer-open', 'false');
+
+        await expect(disclosure.locator('[data-testid="ban-comments-toggle"] .tabular-nums')).toHaveText('2');
+        await expect(disclosure.locator('[data-testid="ban-comments-toggle"]')).toHaveAttribute('aria-label', '2 comments');
+
+        const toggle = disclosure.locator('[data-testid="ban-comments-toggle"]');
+        await toggle.click();
+        await expect
+            .poll(async () => await disclosure.evaluate((el) => (el as HTMLDetailsElement).open))
+            .toBe(true);
+        const items = disclosure.locator('[data-testid="ban-comment-item"]');
+        await expect(items).toHaveCount(2);
+        await expect(disclosure.locator('[data-testid="ban-comment-text"]', {
+            hasText: FIRST_COMMENT,
+        })).toBeVisible();
+        await expect(disclosure.locator('[data-testid="ban-comment-text"]', {
+            hasText: LIVE_COMMENT,
+        })).toBeVisible();
+        await expect(page).not.toHaveURL(/[?&]comment=/);
+    });
+
+    test('table comment delete keeps the disclosure open and does not reload', async ({ page }, testInfo) => {
+        test.skip(Boolean(testInfo.project.name === 'mobile-chromium'), 'desktop-only — mobile cards have no inline disclosure');
+
+        const seed = uniqueSeed(testInfo, 'list-delete');
+        const bid  = await seedOrLookup(page, seed);
+        await seedCommentsRawE2e([
+            { type: 'B', bid, text: FIRST_COMMENT },
+            { type: 'B', bid, text: SECOND_COMMENT },
+        ]);
+
+        await page.goto('/index.php?p=banlist');
+
+        const disclosure = page.locator(
+            `[data-testid="ban-comments-inline"][data-bid="${bid}"]`,
+        );
+        await expect(disclosure).toBeVisible();
+        await disclosure.locator('[data-testid="ban-comments-toggle"]').click();
+        await expect
+            .poll(async () => await disclosure.evaluate((el) => (el as HTMLDetailsElement).open))
+            .toBe(true);
+
+        await page.evaluate(() => { (window as Window & { __sbppKeepAlive?: boolean }).__sbppKeepAlive = true; });
+
+        const doomed = disclosure.locator('[data-testid="ban-comment-item"]', {
+            hasText: FIRST_COMMENT,
+        });
+        await doomed.locator('[data-action="comment-delete"]').click();
+        await page.locator('[data-testid="comment-delete-submit"]').click();
+
+        await expect(doomed).toHaveCount(0);
+        await expect(disclosure.locator('[data-testid="ban-comment-item"]')).toHaveCount(1);
+        await expect(disclosure.locator('[data-testid="ban-comment-text"]', {
+            hasText: SECOND_COMMENT,
+        })).toBeVisible();
+        await expect(disclosure.locator('[data-testid="ban-comments-toggle"] .tabular-nums')).toHaveText('1');
+        await expect
+            .poll(async () => await disclosure.evaluate((el) => (el as HTMLDetailsElement).open))
+            .toBe(true);
+        await expect(page).toHaveURL(/[?&]p=banlist\b/);
+        expect(
+            await page.evaluate(() => (window as Window & { __sbppKeepAlive?: boolean }).__sbppKeepAlive),
+            'B/C comment delete must not reload the page',
+        ).toBe(true);
+    });
+
+    test('drawer comment delete keeps the drawer open and does not reload', async ({ page }, testInfo) => {
+        test.skip(Boolean(testInfo.project.name === 'mobile-chromium'), 'desktop-only — drawer chrome covered by responsive/drawer.spec.ts on mobile');
+
+        const seed = uniqueSeed(testInfo, 'drawer-delete');
+        const bid  = await seedOrLookup(page, seed);
+        await seedCommentsRawE2e([
+            { type: 'B', bid, text: FIRST_COMMENT },
+            { type: 'B', bid, text: SECOND_COMMENT },
+        ]);
+
+        await page.goto('/index.php?p=banlist');
+
+        await page
+            .locator(
+                `[data-testid="drawer-trigger"][data-drawer-href*="id=${bid}"]`,
+            )
+            .first()
+            .click();
+
+        const drawer = page.locator('#drawer-root');
+        await expect(drawer).toHaveAttribute('data-drawer-open', 'true');
+        await expect(drawer).not.toHaveAttribute('data-loading', /.+/);
+
+        const commentsBlock = drawer.locator('[data-testid="drawer-comments"]');
+        await expect(commentsBlock).toContainText(FIRST_COMMENT);
+        await expect(commentsBlock).toContainText(SECOND_COMMENT);
+
+        await page.evaluate(() => { (window as Window & { __sbppKeepAlive?: boolean }).__sbppKeepAlive = true; });
+
+        const doomed = commentsBlock.locator('li', { hasText: FIRST_COMMENT });
+        await doomed.locator('[data-action="comment-delete"]').click();
+        await page.locator('[data-testid="comment-delete-submit"]').click();
+
+        await expect(commentsBlock).not.toContainText(FIRST_COMMENT);
+        await expect(commentsBlock).toContainText(SECOND_COMMENT);
+        await expect(drawer).toHaveAttribute('data-drawer-open', 'true');
+        await expect(drawer).not.toHaveAttribute('data-loading', /.+/);
+
+        const disclosure = page.locator(
+            `[data-testid="ban-comments-inline"][data-bid="${bid}"]`,
+        );
+        await expect(disclosure.locator('[data-testid="ban-comments-toggle"] .tabular-nums')).toHaveText('1');
+        await expect(page).toHaveURL(/[?&]p=banlist\b/);
+        expect(
+            await page.evaluate(() => (window as Window & { __sbppKeepAlive?: boolean }).__sbppKeepAlive),
+            'drawer comment delete must not reload the page',
+        ).toBe(true);
+    });
+
+    test('commslist Add Comment opens the drawer composer without navigating', async ({ page }, testInfo) => {
+        test.skip(Boolean(testInfo.project.name === 'mobile-chromium'), 'desktop-only — comms drawer chrome is covered by responsive/drawer.spec.ts on mobile');
+
+        const seed = uniqueSeed(testInfo, 'comms-compose');
+        try {
+            await seedCommViaApi(page, {
+                nickname: seed.nick,
+                steam:    seed.steam,
+                reason:   SEED_REASON,
+                type:     1,
+                length:   60,
+            });
+        } catch (err) {
+            if (!String(err).includes('already_blocked')) throw err;
+        }
+
+        await page.goto('/index.php?p=commslist');
+
+        const row = page.locator('[data-testid="comm-row"]', { hasText: seed.nick }).first();
+        await expect(row).toBeVisible();
+        await row.locator('[data-testid="comm-comments-toggle"]').click();
+        await row.locator('[data-testid="comm-comment-add"]').click();
+
+        const drawer = page.locator('#drawer-root');
+        await expect(drawer).toHaveAttribute('data-drawer-open', 'true');
+        await expect(drawer).not.toHaveAttribute('data-loading', /.+/);
+        await expect(drawer.locator('[data-testid="drawer-comment-form"]')).toBeVisible();
+        await expect(page).toHaveURL(/[?&]p=commslist\b/);
+        await expect(page).not.toHaveURL(/[?&]comment=/);
+    });
+
+    test('protest queue Add Comment shows the card composer without leaving the queue', async ({ page }, testInfo) => {
+        test.skip(Boolean(testInfo.project.name === 'mobile-chromium'), 'desktop-only — queue cards share the same dispatcher on mobile');
+
+        await page.goto('/index.php?p=admin&c=bans&section=protests');
+        await expect(page).toHaveURL(/section=protests/);
+
+        await page.evaluate(() => {
+            const card = document.createElement('details');
+            card.setAttribute('open', '');
+            card.setAttribute('data-testid', 'synth-queue-card');
+            card.innerHTML =
+                '<button type="button" data-action="comment-compose" data-bid="1" data-ctype="P" data-testid="queue-comment-add">Add Comment</button>'
+                + '<form hidden data-comment-composer data-bid="1" data-ctype="P" data-testid="queue-comment-form">'
+                +   '<input type="hidden" name="cid" value="">'
+                +   '<textarea name="ctext" aria-required="true"></textarea>'
+                +   '<p hidden data-comment-error>Please leave a comment.</p>'
+                +   '<button type="submit">Save comment</button>'
+                +   '<button type="button" data-comment-cancel>Cancel</button>'
+                + '</form>';
+            document.body.appendChild(card);
+        });
+
+        await page.locator('[data-testid="synth-queue-card"] [data-testid="queue-comment-add"]').click();
+        await expect(page.locator('[data-testid="synth-queue-card"] [data-testid="queue-comment-form"]')).toBeVisible();
+        await expect(page).toHaveURL(/[?&]p=admin\b/);
+        await expect(page).toHaveURL(/c=bans/);
+        await expect(page).toHaveURL(/section=protests/);
+        await expect(page).not.toHaveURL(/[?&]comment=/);
     });
 
     test('mobile banlist: non-interactive count indicator renders inside the card', async ({ page }, testInfo) => {
diff --git a/web/tests/e2e/specs/flows/comment-delete-dispatcher.spec.ts b/web/tests/e2e/specs/flows/comment-delete-dispatcher.spec.ts
index fa738fd64..1b2b8f092 100644
--- a/web/tests/e2e/specs/flows/comment-delete-dispatcher.spec.ts
+++ b/web/tests/e2e/specs/flows/comment-delete-dispatcher.spec.ts
@@ -2,8 +2,8 @@
  * Flow spec — issue #1402: the `comment-actions.js` dispatcher
  * (loaded from core/footer.tpl globally) wires a single
  * document-level click handler for `[data-action="comment-delete"]`
- * triggers across the panel (banlist comment editor, commslist
- * comment editor, admin moderation queues).
+ * triggers across the panel (player drawer comments, inline
+ * banlist / commslist threads, admin moderation queues).
  *
  * What this locks in (pre-fix breakage)
  * -------------------------------------
diff --git a/web/tests/integration/AdminEditBanDemoTest.php b/web/tests/integration/AdminEditBanDemoTest.php
index 6244e0270..bf204cd86 100644
--- a/web/tests/integration/AdminEditBanDemoTest.php
+++ b/web/tests/integration/AdminEditBanDemoTest.php
@@ -34,4 +34,32 @@ public function testEditBanTemplateShipsRemoveDemoButton(): void
         $this->assertStringContainsString('data-testid="editban-demo-remove"', $contents);
         $this->assertStringContainsString('data-ban-id="{$ban_id}"', $contents);
     }
+
+    public function testBanlistShipsResponsiveDemoDownloadActions(): void
+    {
+        $contents = file_get_contents(self::webRoot() . '/themes/default/page_bans.tpl');
+        $this->assertIsString($contents);
+        $this->assertStringContainsString('{if $ban.demo_available}', $contents);
+        $this->assertStringContainsString('data-testid="row-action-demo-download"', $contents);
+        $this->assertStringContainsString('data-testid="row-action-demo-download-mobile"', $contents);
+        $this->assertStringContainsString('href="getdemo.php?type=B&amp;id={$ban.bid}"', $contents);
+    }
+
+    public function testDemoDownloadRejectsLinksAndRequiresCanonicalRootContainment(): void
+    {
+        $contents = file_get_contents(self::webRoot() . '/getdemo.php');
+        $this->assertIsString($contents);
+
+        $this->assertStringContainsString('is_link($path)', $contents);
+        $this->assertStringContainsString('str_contains($onDisk, "\0")', $contents);
+        $this->assertStringContainsString('$demoRoot = realpath(SB_DEMOS)', $contents);
+        $this->assertStringContainsString('$resolvedPath = realpath($path)', $contents);
+        $this->assertStringContainsString('str_starts_with(', $contents);
+        $this->assertStringContainsString('$path = $resolvedPath;', $contents);
+        $this->assertLessThan(
+            strpos($contents, 'readfile($path)'),
+            strpos($contents, 'is_link($path)'),
+            'the symlink and root-containment gates must run before any demo bytes are read',
+        );
+    }
 }
diff --git a/web/tests/integration/BanListIpColumnTest.php b/web/tests/integration/BanListIpColumnTest.php
index fbd24ac4a..d4dd150f0 100644
--- a/web/tests/integration/BanListIpColumnTest.php
+++ b/web/tests/integration/BanListIpColumnTest.php
@@ -215,14 +215,6 @@ private function renderBanList(bool $hideplayerips, ?array $banList = null): str
             total_bans:      count($rows),
             view_bans:       false,
             view_comments:   false,
-            comment:         false,
-            commenttype:     '',
-            commenttext:     '',
-            ctype:           '',
-            cid:             '',
-            page:            -1,
-            canedit:         false,
-            othercomments:   'None',
             searchlink:      '',
             hidetext:        'Hide',
             hideadminname:   false,
diff --git a/web/tests/integration/BanlistCommentsVisibilityTest.php b/web/tests/integration/BanlistCommentsVisibilityTest.php
index a8c802dff..fd7061f05 100644
--- a/web/tests/integration/BanlistCommentsVisibilityTest.php
+++ b/web/tests/integration/BanlistCommentsVisibilityTest.php
@@ -46,9 +46,11 @@
  *     same disclosure shape as admin.
  *   - Comment author / timestamp / text reach the rendered HTML
  *     through the same `encodePreservingBr` + URL-wrap regex pipeline
- *     the comment-edit-mode "Other comments" foreach has used since
- *     v1.x — the disclosure reuses the `nofilter` annotation pattern
- *     from that block.
+ *     used since v1.x — the disclosure reuses the `nofilter`
+ *     annotation pattern.
+ *   - Add / Edit comments open the player drawer (banlist / commslist)
+ *     or an inline composer on the queue card (protests / submissions).
+ *     `?comment=` is not an editor surface: the list still renders.
  *   - Mobile cards emit a non-interactive count indicator (the card
  *     is wrapped in a single `<a>` so a nested `<details>` would be
  *     invalid HTML; mobile users tap through to the drawer where
@@ -71,6 +73,15 @@ final class BanlistCommentsVisibilityTest extends ApiTestCase
     /** @var int cid of the seeded mute with comments. */
     private int $commWithCommentsCid = 0;
 
+    /** @var int cid of the first seeded ban comment. */
+    private int $firstBanCommentCid = 0;
+
+    /** @var int subid of the seeded submission with comments. */
+    private int $submissionWithCommentsId = 0;
+
+    /** @var int pid of the seeded protest with comments. */
+    private int $protestWithCommentsId = 0;
+
     protected function setUp(): void
     {
         parent::setUp();
@@ -208,6 +219,11 @@ public function testBanlistAdminSeesAddCommentCtaOnUncommentedRow(): void
             $html,
             'admin must see the per-row "Add comment" CTA (#1544)',
         );
+        $this->assertStringContainsString(
+            'data-comment-compose="add"',
+            $html,
+            'Add Comment must open the player drawer composer, not navigate to ?comment=',
+        );
     }
 
     #[RunInSeparateProcess]
@@ -338,113 +354,6 @@ public function testBanlistHidesCommentAuthorWhenHideAdminName(): void
         );
     }
 
-    // ---------------------------------------------------------------
-    // Banlist — #1500 (M2): the ?comment=N "Other comments" surface.
-    // The comment-edit view (page.banlist.php $cotherdata block) is
-    // reachable by ANY caller — there is no admin gate; $commentCanedit
-    // only controls whether the textarea + submit render. Pre-fix it
-    // listed every comment on the ban with the author / editor admin
-    // username inline regardless of banlist.hideadminname, so it was a
-    // second leak surface distinct from the inline disclosure above.
-    // ---------------------------------------------------------------
-
-    #[RunInSeparateProcess]
-    #[PreserveGlobalState(false)]
-    public function testBanlistCommentViewHidesAuthorAndEditorForPublicWhenHideAdminName(): void
-    {
-        // Give both seeded comments an editor so the "last edit by"
-        // branch is exercised (the editor name is a second admin
-        // username that must be suppressed too).
-        Fixture::rawPdo()->prepare(sprintf(
-            'UPDATE `%s_comments` SET editaid = ?, edittime = ? WHERE bid = ? AND type = ?',
-            DB_PREFIX,
-        ))->execute([Fixture::adminAid(), time() - 300, $this->banWithCommentsBid, 'B']);
-
-        Fixture::rawPdo()->prepare(sprintf(
-            "REPLACE INTO `%s_settings` (`setting`, `value`) VALUES
-                ('config.enablepubliccomments', '1'),
-                ('banlist.hideadminname', '1')",
-            DB_PREFIX,
-        ))->execute();
-        \Config::init($GLOBALS['PDO']);
-
-        // Anonymous caller hits the comment-edit view in "Add" mode (no
-        // cid), which lists every comment on the ban as "Other comments".
-        $_GET = [
-            'p'       => 'banlist',
-            'comment' => (string) $this->banWithCommentsBid,
-            'ctype'   => 'B',
-        ];
-        $html = $this->renderBanlistPage();
-
-        // The "Other comments" surface + bodies render...
-        $this->assertStringContainsString(
-            'Other comments',
-            $html,
-            'the comment-edit view must list existing comments under "Other comments"',
-        );
-        $this->assertStringContainsString('first comment from worker C', $html);
-        // ...the "last edit by" line renders (edittime present, gated on
-        // edittime not editname so the indicator survives the #1500 null)...
-        $this->assertStringContainsString(
-            'last edit',
-            $html,
-            'the edit indicator must survive — it gates on edittime, which #1500 does NOT null',
-        );
-        // ...but neither the author nor the editor admin username leaks...
-        $this->assertStringNotContainsString(
-            '<strong>admin</strong>',
-            $html,
-            'comment author (admin username) must not leak in the ?comment=N view (#1500 M2)',
-        );
-        $this->assertStringNotContainsString(
-            'by admin',
-            $html,
-            'comment editor (admin username) must not leak in the "last edit by" line (#1500 M2)',
-        );
-        // ...and the Hidden placeholder stands in for author AND editor
-        // (two comments × {author + editor} = at least 2 occurrences).
-        $this->assertGreaterThanOrEqual(
-            2,
-            substr_count($html, '<i class="text-faint">Hidden</i>'),
-            'both the suppressed author and editor must render the Hidden placeholder (#1500 M2)',
-        );
-    }
-
-    #[RunInSeparateProcess]
-    #[PreserveGlobalState(false)]
-    public function testBanlistCommentViewShowsAuthorAndEditorForAdmin(): void
-    {
-        // Control for the M2 test above: an admin viewer resolves
-        // hideadminname=false, so the ?comment=N view shows both the
-        // author and editor admin usernames un-hidden.
-        Fixture::rawPdo()->prepare(sprintf(
-            'UPDATE `%s_comments` SET editaid = ?, edittime = ? WHERE bid = ? AND type = ?',
-            DB_PREFIX,
-        ))->execute([Fixture::adminAid(), time() - 300, $this->banWithCommentsBid, 'B']);
-        $this->setPublicCommentsFlag(true);
-        $this->loginAsAdmin();
-
-        $_GET = [
-            'p'       => 'banlist',
-            'comment' => (string) $this->banWithCommentsBid,
-            'ctype'   => 'B',
-        ];
-        $html = $this->renderBanlistPage();
-
-        $this->assertStringContainsString('Other comments', $html);
-        $this->assertStringContainsString(
-            '<strong>admin</strong>',
-            $html,
-            'admin viewer sees the un-hidden comment author in the ?comment=N view (control for #1500 M2)',
-        );
-        $this->assertStringNotContainsString(
-            '<i class="text-faint">Hidden</i>',
-            $html,
-            'no Hidden placeholder for admin viewers',
-        );
-    }
-
     // ---------------------------------------------------------------
     // Commslist — same shape, sister-fix
     // ---------------------------------------------------------------
@@ -597,6 +506,159 @@ public function testApiBansDetailHidesCommentsForAnonymousWithFlagOff(): void
         );
     }
 
+    #[RunInSeparateProcess]
+    #[PreserveGlobalState(false)]
+    public function testBanlistDoesNotRenderEditorForMismatchedCommentId(): void
+    {
+        $this->loginAsAdmin();
+        $this->setPublicCommentsFlag(false);
+        $_GET = [
+            'p'       => 'banlist',
+            'comment' => (string) $this->banWithoutCommentsBid,
+            'ctype'   => 'B',
+            'cid'     => (string) $this->firstBanCommentCid,
+        ];
+
+        $html = $this->renderBanlistPage();
+
+        $this->assertStringNotContainsString('id="banlist-comment-form"', $html);
+        $this->assertStringContainsString('data-testid="ban-row"', $html);
+    }
+
+    #[RunInSeparateProcess]
+    #[PreserveGlobalState(false)]
+    public function testBanlistDoesNotRenderAddEditorForUnknownParent(): void
+    {
+        $this->loginAsAdmin();
+        $this->setPublicCommentsFlag(false);
+        $_GET = [
+            'p'       => 'banlist',
+            'comment' => '999999',
+            'ctype'   => 'B',
+        ];
+
+        $html = $this->renderBanlistPage();
+
+        $this->assertStringNotContainsString('id="banlist-comment-form"', $html);
+        $this->assertStringContainsString('data-testid="ban-row"', $html);
+    }
+
+    #[RunInSeparateProcess]
+    #[PreserveGlobalState(false)]
+    public function testSubmissionCommentQueryDoesNotOpenEditor(): void
+    {
+        $this->loginAsAdmin();
+        $_GET = [
+            'p'       => 'banlist',
+            'comment' => (string) $this->submissionWithCommentsId,
+            'ctype'   => 'S',
+        ];
+
+        $html = $this->renderBanlistPage();
+
+        $this->assertStringNotContainsString('id="banlist-comment-form"', $html);
+        $this->assertStringNotContainsString('data-testid="drawer-comment-form"', $html);
+        $this->assertStringContainsString('data-testid="ban-row"', $html);
+        $this->assertStringNotContainsString('submission moderation comment', $html);
+    }
+
+    #[RunInSeparateProcess]
+    #[PreserveGlobalState(false)]
+    public function testProtestCommentQueryDoesNotOpenEditor(): void
+    {
+        $this->loginAsAdmin();
+        $_GET = [
+            'p'       => 'banlist',
+            'comment' => (string) $this->protestWithCommentsId,
+            'ctype'   => 'P',
+        ];
+
+        $html = $this->renderBanlistPage();
+
+        $this->assertStringNotContainsString('id="banlist-comment-form"', $html);
+        $this->assertStringContainsString('data-testid="ban-row"', $html);
+        $this->assertStringNotContainsString('protest moderation comment', $html);
+    }
+
+    #[RunInSeparateProcess]
+    #[PreserveGlobalState(false)]
+    public function testCommslistCommentQueryKeepsTheList(): void
+    {
+        $this->loginAsAdmin();
+        $this->setPublicCommentsFlag(false);
+        $_GET = [
+            'p'       => 'commslist',
+            'comment' => (string) $this->commWithCommentsCid,
+            'ctype'   => 'C',
+        ];
+
+        $html = $this->renderCommslistPage();
+
+        $this->assertStringNotContainsString('id="banlist-comment-form"', $html);
+        $this->assertStringNotContainsString('data-testid="comms-comment-form"', $html);
+        $this->assertStringContainsString('data-testid="comms-header"', $html);
+        $this->assertStringContainsString('data-testid="comm-row"', $html);
+        $this->assertStringContainsString('data-comment-compose="add"', $html);
+    }
+
+    #[RunInSeparateProcess]
+    #[PreserveGlobalState(false)]
+    public function testCommslistDoesNotRenderAddEditorForUnknownParent(): void
+    {
+        $this->loginAsAdmin();
+        $this->setPublicCommentsFlag(false);
+        $_GET = [
+            'p'       => 'commslist',
+            'comment' => '999999',
+            'ctype'   => 'C',
+        ];
+
+        $html = $this->renderCommslistPage();
+
+        $this->assertStringNotContainsString('id="banlist-comment-form"', $html);
+        $this->assertStringContainsString('data-testid="comm-row"', $html);
+    }
+
+    #[RunInSeparateProcess]
+    #[PreserveGlobalState(false)]
+    public function testPublicCommentsSettingDoesNotExposeModerationQueueComments(): void
+    {
+        $this->setPublicCommentsFlag(true);
+        $_GET = [
+            'p'       => 'banlist',
+            'comment' => (string) $this->submissionWithCommentsId,
+            'ctype'   => 'S',
+        ];
+
+        $html = $this->renderBanlistPage();
+
+        $this->assertStringNotContainsString('id="banlist-comment-form"', $html);
+        $this->assertStringNotContainsString('submission moderation comment', $html);
+    }
+
+    #[RunInSeparateProcess]
+    #[PreserveGlobalState(false)]
+    public function testQueueSurfacesDoNotLinkToBanlistCommentEditor(): void
+    {
+        $web = dirname(__DIR__, 2);
+        $files = [
+            $web . '/pages/admin.bans.php',
+            $web . '/themes/default/page_admin_bans_protests.tpl',
+            $web . '/themes/default/page_admin_bans_protests_archiv.tpl',
+            $web . '/themes/default/page_admin_bans_submissions.tpl',
+            $web . '/themes/default/page_admin_bans_submissions_archiv.tpl',
+        ];
+        foreach ($files as $file) {
+            $this->assertFileExists($file);
+            $src = (string) file_get_contents($file);
+            $this->assertStringNotContainsString(
+                'p=banlist&comment=',
+                $src,
+                basename($file) . ' must not bounce queue comments to ?p=banlist&comment=',
+            );
+        }
+    }
+
     // ---------------------------------------------------------------
     // Helpers
     // ---------------------------------------------------------------
@@ -647,6 +709,7 @@ private function seedRowsAndComments(): void
             DB_PREFIX,
         ));
         $insertComment->execute(['B', $this->banWithCommentsBid, $aid, 'first comment from worker C', $now - 1800]);
+        $this->firstBanCommentCid = (int) $pdo->lastInsertId();
         $insertComment->execute(['B', $this->banWithCommentsBid, $aid, 'second seed comment', $now - 600]);
 
         // Seed a mute with comments so the commslist disclosure has
@@ -664,6 +727,35 @@ private function seedRowsAndComments(): void
         $this->commWithCommentsCid = (int) $pdo->lastInsertId();
 
         $insertComment->execute(['C', $this->commWithCommentsCid, $aid, 'mute comment for worker C', $now - 600]);
+
+        $pdo->prepare(sprintf(
+            'INSERT INTO `%s_submissions`
+              (`name`, `SteamId`, `email`, `reason`, `archiv`, `submitted`, `ModID`, `ip`, `server`)
+             VALUES (?, ?, ?, ?, "0", ?, 0, "127.0.0.1", 0)',
+            DB_PREFIX,
+        ))->execute(['ReportedPlayer', 'STEAM_0:1:42020', 'reporter@example.test', 'cheating', $now - 500]);
+        $this->submissionWithCommentsId = (int) $pdo->lastInsertId();
+        $insertComment->execute([
+            'S',
+            $this->submissionWithCommentsId,
+            $aid,
+            'submission moderation comment',
+            $now - 400,
+        ]);
+
+        $pdo->prepare(sprintf(
+            'INSERT INTO `%s_protests` (`bid`, `email`, `reason`, `archiv`, `datesubmitted`, `pip`)
+             VALUES (0, ?, ?, "0", ?, "127.0.0.1")',
+            DB_PREFIX,
+        ))->execute(['protester@example.test', 'wrong ban', $now - 300]);
+        $this->protestWithCommentsId = (int) $pdo->lastInsertId();
+        $insertComment->execute([
+            'P',
+            $this->protestWithCommentsId,
+            $aid,
+            'protest moderation comment',
+            $now - 200,
+        ]);
     }
 
     private function bootstrapSmartyTheme(): void
diff --git a/web/themes/default/js/theme.js b/web/themes/default/js/theme.js
index a2f704d05..56095f04c 100644
--- a/web/themes/default/js/theme.js
+++ b/web/themes/default/js/theme.js
@@ -500,6 +500,7 @@
     drawerRoot.innerHTML = '';
     drawerDetail = null;
     drawerKind = null;
+    drawerKey = null;
   }
 
   /**
@@ -587,6 +588,13 @@
    * @type {'ban' | 'comm' | null}
    */
   let drawerKind = null;
+  /**
+   * Last successful (or in-flight) drawer key. Used to reopen the same
+   * record after an in-drawer comment save / delete. Cleared on
+   * `closeDrawer()`.
+   * @type {DrawerKey | null}
+   */
+  let drawerKey = null;
 
   /**
    * Build the rendered drawer HTML for a successful bans.detail OR
@@ -729,14 +737,11 @@
     const focal  = isComm
       ? ((data && data.block) || {})
       : ((data && data.ban) || {});
-    // #1544: comment CTAs route to the same server-rendered
-    // `?p=…&comment=…` edit surface the inline banlist/commslist
-    // disclosure uses; delete reuses the global `data-action=
-    // "comment-delete"` dispatcher in web/scripts/comment-actions.js.
-    const commentPage  = isComm ? 'commslist' : 'banlist';
+    // Add / Edit live in this pane (collapsed composer). Delete
+    // reuses the global `data-action="comment-delete"` dispatcher in
+    // web/scripts/comment-actions.js, which emits `sbpp:comment-deleted`
+    // so we patch the drawer + table in place (no page reload).
     const commentCtype = isComm ? 'C' : 'B';
-    const focalId      = isComm ? (data && data.cid) : (data && data.bid);
-    const escFocalId   = escapeHtml(String(focalId));
 
     /** @type {Array<[string, string]>} */
     const idRows = [];
@@ -790,8 +795,9 @@
     /**
      * Per-comment edit / delete row. Both gates come pre-computed from
      * the handler (`c.can_edit` / `c.can_delete`, mirroring
-     * page.banlist.php); `data-page="-1"` tells the delete dispatcher to
-     * redirect back to the un-paginated list after the API round-trip.
+     * page.banlist.php). Edit opens the collapsed composer in this pane
+     * (`data-comment-edit`); delete reuses comment-actions.js
+     * (`data-page="-1"` is ignored when the trigger is in the drawer).
      * @param {any} c
      * @returns {string}
      */
@@ -800,10 +806,10 @@
       const cid = escapeHtml(String(c.cid));
       return '<div style="display:flex;gap:0.625rem;margin-top:0.375rem">'
         + (c.can_edit
-          ? '<a href="index.php?p=' + commentPage + '&amp;comment=' + escFocalId + '&amp;ctype=' + commentCtype + '&amp;cid=' + cid + '"'
-            + ' class="tip" data-tooltip="Edit Comment" aria-label="Edit comment"'
-            + ' style="color:var(--text-muted);line-height:1;display:inline-flex">'
-            + '<i data-lucide="pencil" style="width:13px;height:13px"></i></a>'
+          ? '<button type="button" class="tip" data-tooltip="Edit Comment" aria-label="Edit comment"'
+            + ' data-comment-edit="' + cid + '"'
+            + ' style="appearance:none;background:none;border:0;padding:0;color:var(--text-muted);line-height:1;display:inline-flex;cursor:pointer">'
+            + '<i data-lucide="pencil" style="width:13px;height:13px"></i></button>'
           : '')
         + (c.can_delete
           ? '<a href="#" class="tip" data-tooltip="Delete Comment" aria-label="Delete comment"'
@@ -833,10 +839,21 @@
     let commentsHtml = '';
     if (commentsVisible) {
       const addCta = canComment
-        ? '<a href="index.php?p=' + commentPage + '&amp;comment=' + escFocalId + '&amp;ctype=' + commentCtype + '"'
-          + ' class="btn btn--secondary btn--sm" data-testid="drawer-comment-add" style="margin-top:0.625rem">'
+        ? '<button type="button" class="btn btn--secondary btn--sm" data-testid="drawer-comment-add" style="margin-top:0.625rem">'
           + '<i data-lucide="message-square-plus" style="width:13px;height:13px"></i> Add comment'
-          + '</a>'
+          + '</button>'
+        : '';
+      const composer = canComment
+        ? '<form hidden data-testid="drawer-comment-form" style="margin-top:0.625rem">'
+          + '<label class="label" for="drawer-comment-text">Comment</label>'
+          + '<textarea class="textarea" id="drawer-comment-text" name="ctext" rows="4" aria-required="true"></textarea>'
+          + '<p class="text-xs" data-comment-error hidden role="alert" style="color:var(--danger);margin:0.25rem 0 0">Please leave a comment.</p>'
+          + '<input type="hidden" name="cid" value="">'
+          + '<div class="flex gap-2 mt-2">'
+          +   '<button type="submit" class="btn btn--primary btn--sm">Save comment</button>'
+          +   '<button type="button" class="btn btn--secondary btn--sm" data-comment-cancel>Cancel</button>'
+          + '</div>'
+          + '</form>'
         : '';
       commentsHtml = '<section data-testid="drawer-comments" style="margin-top:0.5rem">'
         + '<h3 class="text-xs text-faint" style="text-transform:uppercase;letter-spacing:0.06em;margin:0 0 0.5rem">Comments</h3>'
@@ -844,7 +861,7 @@
           ? '<p class="text-sm text-muted" style="margin:0">No comments.</p>'
           : '<ul style="list-style:none;margin:0;padding:0;display:flex;flex-direction:column;gap:0.625rem">'
             + comments.map((c) =>
-                '<li style="border:1px solid var(--border);border-radius:var(--radius-md);padding:0.625rem 0.75rem;background:var(--bg-surface)">'
+                '<li data-comment-cid="' + escapeHtml(String(c.cid)) + '" style="border:1px solid var(--border);border-radius:var(--radius-md);padding:0.625rem 0.75rem;background:var(--bg-surface)">'
                 + '<div style="display:flex;justify-content:space-between;font-size:0.75rem;color:var(--text-muted);margin-bottom:0.25rem">'
                 +   '<span class="font-medium">' + escapeHtml(c.author_hidden ? 'Hidden' : (c.author || 'unknown')) + '</span>'
                 +   '<span>' + escapeHtml(c.added_human || '') + '</span>'
@@ -855,6 +872,7 @@
               ).join('')
             + '</ul>')
         + addCta
+        + composer
         + '</section>';
     }
 
@@ -1201,12 +1219,18 @@
    * `player` / `admin` / `server` / `comments` shape, so the
    * downstream renderers branch only on `drawerKind` (set here before
    * `renderDrawerBody` runs).
+   *
+   * `compose` opens the collapsed comment composer after the Overview
+   * pane paints (table Add / Edit buttons pass this so the operator
+   * lands in the textarea without a second click).
    * @param {DrawerKey} key
+   * @param {{mode: 'add'|'edit', cid?: number}} [compose]
    * @returns {Promise<void>}
    */
-  async function loadDrawer(key) {
+  async function loadDrawer(key, compose) {
     if (!drawerRoot) return;
     drawerKind = key.kind;
+    drawerKey = key;
     showDrawer(renderDrawerLoading());
     drawerRoot.dataset.loading = 'true';
 
@@ -1222,6 +1246,11 @@
     if (env && env.ok && env.data) {
       drawerDetail = env.data;
       showDrawer(renderDrawerBody(env.data));
+      syncListComments(key, env.data);
+      if (compose) {
+        activateDrawerTab('overview', false);
+        openCommentComposer(compose);
+      }
     } else {
       drawerDetail = null;
       const msg = (env && env.error && env.error.message) || 'Unknown error.';
@@ -1229,6 +1258,358 @@
     }
   }
 
+  /**
+   * Page number the list-row delete trigger should carry (same
+   * `isset($_GET['page']) ? (int) $page : -1` the PHP builders emit).
+   * @returns {number}
+   */
+  function listCommentPage() {
+    const raw = new URLSearchParams(window.location.search).get('page');
+    if (raw == null || raw === '') return -1;
+    const n = parseInt(raw, 10);
+    return Number.isFinite(n) && n > 0 ? n : -1;
+  }
+
+  /**
+   * Escape comment body and restore line breaks + URL wraps the way
+   * `encodePreservingBr` + the page-handler regex do for SSR HTML.
+   * @param {string} raw
+   * @returns {string}
+   */
+  function formatListCommentText(raw) {
+    const html = escapeHtml(raw || '').replace(/\r\n|\r|\n/g, '<br/>');
+    return html.replace(/https?:\/\/[^\s<]+/g, (url) =>
+      '<a href="' + url + '" target="_blank">' + url + '</a>');
+  }
+
+  /**
+   * Author / editor label for the list disclosure (Hidden / name /
+   * deleted admin). Matches `page_bans.tpl` / `page_comms.tpl`, not
+   * the drawer's "unknown" wording.
+   * @param {boolean} hidden
+   * @param {string | null | undefined} name
+   * @returns {string}
+   */
+  function listCommentPersonHtml(hidden, name) {
+    if (hidden) return '<i class="text-faint">Hidden</i>';
+    if (name) return '<strong>' + escapeHtml(name) + '</strong>';
+    return '<i class="text-faint">deleted admin</i>';
+  }
+
+  /**
+   * Format a unix-seconds stamp close to Config::time's default
+   * `Y-m-d H:i:s`. The operator dateformat is server-side; a refresh
+   * still paints the configured form.
+   * @param {number} unix
+   * @returns {string}
+   */
+  function formatListCommentTime(unix) {
+    const d = new Date(unix * 1000);
+    if (Number.isNaN(d.getTime())) return '';
+    const p = (/** @type {number} */ n) => String(n).padStart(2, '0');
+    return d.getFullYear() + '-' + p(d.getMonth() + 1) + '-' + p(d.getDate())
+      + ' ' + p(d.getHours()) + ':' + p(d.getMinutes()) + ':' + p(d.getSeconds());
+  }
+
+  /**
+   * One `<li>` for the inline disclosure, mirroring the Smarty item
+   * (meta, body, last-edit, edit/delete). Edit reopens the drawer
+   * composer; delete stays on `comment-actions.js`.
+   * @param {any} c
+   * @param {DrawerKey} key
+   * @returns {string}
+   */
+  function renderListCommentItem(c, key) {
+    const isComm = key.kind === 'comm';
+    const itemTest = isComm ? 'comm-comment-item' : 'ban-comment-item';
+    const textTest = isComm ? 'comm-comment-text' : 'ban-comment-text';
+    const actTest = isComm ? 'comm-comment-actions' : 'ban-comment-actions';
+    const cid = String(Number(c && c.cid) || 0);
+    const cidAttr = escapeHtml(cid);
+    const idAttr = escapeHtml(String(key.id));
+    const drawerAttr = isComm
+      ? ' data-drawer-cid="' + idAttr + '"'
+      : ' data-drawer-bid="' + idAttr + '"';
+    const added = escapeHtml((c && c.added_human) || '');
+    let editLine = '';
+    const editedAt = c && c.edited_at != null ? Number(c.edited_at) : 0;
+    if (editedAt > 0) {
+      const when = formatListCommentTime(editedAt);
+      const editor = c && c.author_hidden
+        ? '<i class="text-faint">Hidden</i>'
+        : (c && c.edited_by
+          ? escapeHtml(String(c.edited_by))
+          : '<i>deleted admin</i>');
+      editLine = '<div class="ban-comments-inline__edit text-xs text-faint">last edit '
+        + escapeHtml(when) + ' by ' + editor + '</div>';
+    }
+    let actions = '';
+    if (c && (c.can_edit || c.can_delete)) {
+      actions = '<div class="ban-comments-inline__actions" data-testid="' + actTest + '">'
+        + (c.can_edit
+          ? '<button type="button" class="tip"' + drawerAttr
+            + ' data-comment-compose="edit" data-comment-cid="' + cidAttr + '"'
+            + ' data-tooltip="Edit Comment" aria-label="Edit comment">'
+            + '<i data-lucide="pencil" style="width:13px;height:13px" aria-hidden="true"></i></button>'
+          : '')
+        + (c.can_delete
+          ? '<a href="#" class="tip" title="Delete Comment" aria-label="Delete comment" target="_self"'
+            + ' data-action="comment-delete" data-cid="' + cidAttr + '"'
+            + ' data-ctype="' + (isComm ? 'C' : 'B') + '"'
+            + ' data-page="' + listCommentPage() + '">'
+            + '<i data-lucide="trash-2" style="width:13px;height:13px" aria-hidden="true"></i></a>'
+          : '')
+        + '</div>';
+    }
+    return '<li class="ban-comments-inline__item" data-testid="' + itemTest + '">'
+      + '<div class="ban-comments-inline__meta">'
+      + listCommentPersonHtml(!!(c && c.author_hidden), c && c.author)
+      + '<span class="text-faint">&middot;</span>'
+      + '<span class="text-xs text-faint tabular-nums">' + added + '</span>'
+      + '</div>'
+      + '<div class="ban-comments-inline__text" data-testid="' + textTest + '">'
+      + formatListCommentText((c && c.text) || '') + '</div>'
+      + editLine
+      + actions
+      + '</li>';
+  }
+
+  /**
+   * Keep the mobile ban-card count chip in lockstep with the desktop
+   * disclosure. Inserts the indicator when the first comment lands on
+   * a previously empty row; removes it when the last comment goes.
+   * @param {number} bid
+   * @param {number} count
+   * @returns {void}
+   */
+  function syncMobileBanCommentCount(bid, count) {
+    const card = document.querySelector('[data-testid="ban-card"][data-id="' + String(bid) + '"]');
+    if (!(card instanceof HTMLElement)) return;
+    let el = card.querySelector('[data-testid="ban-comments-count-mobile"]');
+    if (count <= 0) {
+      if (el) el.remove();
+      return;
+    }
+    const word = count === 1 ? 'comment' : 'comments';
+    if (!(el instanceof HTMLElement)) {
+      const actions = card.querySelector('.ban-card__actions');
+      if (!(actions instanceof HTMLElement)) return;
+      el = document.createElement('div');
+      el.className = 'text-xs text-faint truncate';
+      el.setAttribute('style', 'margin-top:0.125rem;display:flex;align-items:center;gap:0.25rem');
+      el.setAttribute('data-testid', 'ban-comments-count-mobile');
+      actions.appendChild(el);
+    }
+    el.innerHTML = '<i data-lucide="message-square-text" style="width:11px;height:11px" aria-hidden="true"></i>'
+      + '<span class="tabular-nums">' + count + '</span>'
+      + '<span>' + word + '</span>';
+  }
+
+  /**
+   * Patch the matching list-row comment disclosure from a fresh
+   * `bans.detail` / `comms.detail` envelope. Add / edit re-run
+   * `loadDrawer` and call this; delete patches in place via
+   * `removeCommentLocally` instead (no remount, no navigation).
+   * @param {DrawerKey} key
+   * @param {any} data
+   * @returns {void}
+   */
+  function syncListComments(key, data) {
+    if (!data || data.comments_visible === false) return;
+    const comments = Array.isArray(data.comments) ? data.comments : [];
+    const isComm = key.kind === 'comm';
+    const id = String(key.id);
+    const details = document.querySelector(
+      isComm
+        ? '[data-testid="comm-comments-inline"][data-cid="' + id + '"]'
+        : '[data-testid="ban-comments-inline"][data-bid="' + id + '"]',
+    );
+    if (details instanceof HTMLElement) {
+      const count = comments.length;
+      const label = count === 1 ? '1 comment' : count + ' comments';
+      const summary = details.querySelector(
+        isComm ? '[data-testid="comm-comments-toggle"]' : '[data-testid="ban-comments-toggle"]',
+      );
+      if (summary instanceof HTMLElement) {
+        summary.setAttribute('title', label);
+        summary.setAttribute('aria-label', label);
+        const num = summary.querySelector('.tabular-nums');
+        if (num) num.textContent = String(count);
+      }
+      const list = details.querySelector(
+        isComm ? '[data-testid="comm-comments-list"]' : '[data-testid="ban-comments-list"]',
+      );
+      if (list instanceof HTMLElement) {
+        list.innerHTML = comments.map((/** @type {any} */ c) => renderListCommentItem(c, key)).join('');
+      }
+      initIcons();
+    }
+    if (!isComm) syncMobileBanCommentCount(key.id, comments.length);
+  }
+
+  /**
+   * After a list/drawer comment delete, drop the matching `<li>` and
+   * retarget the chip. Does not navigate or remount the drawer, so
+   * scroll, pagination, and open `<details>` survive.
+   * @param {HTMLElement} details
+   * @returns {void}
+   */
+  function updateDisclosureAfterDelete(details) {
+    const count = details.querySelectorAll(
+      '[data-testid="ban-comment-item"], [data-testid="comm-comment-item"]',
+    ).length;
+    const label = count === 1 ? '1 comment' : count + ' comments';
+    const summary = details.querySelector(
+      '[data-testid="ban-comments-toggle"], [data-testid="comm-comments-toggle"]',
+    );
+    if (summary instanceof HTMLElement) {
+      summary.setAttribute('title', label);
+      summary.setAttribute('aria-label', label);
+      const num = summary.querySelector('.tabular-nums');
+      if (num) num.textContent = String(count);
+    }
+    const bid = details.getAttribute('data-bid');
+    if (bid) syncMobileBanCommentCount(Number(bid), count);
+  }
+
+  /**
+   * @param {number} cid
+   * @returns {void}
+   */
+  function removeCommentLocally(cid) {
+    const cidStr = String(cid);
+    const links = document.querySelectorAll(
+      '[data-action="comment-delete"][data-cid="' + cidStr + '"]',
+    );
+    /** @type {HTMLElement[]} */
+    const detailsToUpdate = [];
+    links.forEach((el) => {
+      const details = el.closest('details.ban-comments-inline');
+      if (details instanceof HTMLElement && detailsToUpdate.indexOf(details) === -1) {
+        detailsToUpdate.push(details);
+      }
+      const li = el.closest('li');
+      if (li) li.remove();
+    });
+    detailsToUpdate.forEach(updateDisclosureAfterDelete);
+
+    if (drawerRoot) {
+      const section = drawerRoot.querySelector('[data-testid="drawer-comments"]');
+      if (section) {
+        const ul = section.querySelector('ul');
+        if (ul && ul.querySelectorAll('li').length === 0) {
+          const empty = document.createElement('p');
+          empty.className = 'text-sm text-muted';
+          empty.setAttribute('style', 'margin:0');
+          empty.textContent = 'No comments.';
+          ul.replaceWith(empty);
+        }
+      }
+    }
+
+    if (drawerDetail && Array.isArray(drawerDetail.comments)) {
+      drawerDetail.comments = drawerDetail.comments.filter(
+        (/** @type {any} */ c) => Number(c.cid) !== cid,
+      );
+    }
+  }
+
+  /**
+   * Reveal the Overview comment composer. Edit prefills from the
+   * already-fetched `bans.detail` / `comms.detail` envelope.
+   * @param {{mode: 'add'|'edit', cid?: number}} opts
+   * @returns {void}
+   */
+  function openCommentComposer(opts) {
+    if (!drawerRoot) return;
+    const form = drawerRoot.querySelector('[data-testid="drawer-comment-form"]');
+    if (!(form instanceof HTMLFormElement)) return;
+    const textarea = /** @type {HTMLTextAreaElement | null} */ (form.querySelector('textarea[name="ctext"]'));
+    const cidInput = /** @type {HTMLInputElement | null} */ (form.querySelector('input[name="cid"]'));
+    const err = form.querySelector('[data-comment-error]');
+    const addBtn = drawerRoot.querySelector('[data-testid="drawer-comment-add"]');
+    if (err instanceof HTMLElement) err.hidden = true;
+    form.hidden = false;
+    if (addBtn instanceof HTMLElement) addBtn.hidden = true;
+    let text = '';
+    let cid = 0;
+    if (opts.mode === 'edit' && opts.cid) {
+      cid = opts.cid;
+      const comments = Array.isArray(drawerDetail && drawerDetail.comments) ? drawerDetail.comments : [];
+      const match = comments.find((/** @type {any} */ c) => Number(c.cid) === cid);
+      if (match && typeof match.text === 'string') text = match.text;
+    }
+    if (cidInput) cidInput.value = cid > 0 ? String(cid) : '';
+    if (textarea) {
+      textarea.value = text;
+      try { textarea.focus(); } catch (_e) { /* focus may throw */ }
+    }
+  }
+
+  /** @returns {void} */
+  function hideCommentComposer() {
+    if (!drawerRoot) return;
+    const form = drawerRoot.querySelector('[data-testid="drawer-comment-form"]');
+    if (form instanceof HTMLFormElement) {
+      form.hidden = true;
+      const textarea = form.querySelector('textarea[name="ctext"]');
+      const cidInput = form.querySelector('input[name="cid"]');
+      const err = form.querySelector('[data-comment-error]');
+      if (textarea instanceof HTMLTextAreaElement) textarea.value = '';
+      if (cidInput instanceof HTMLInputElement) cidInput.value = '';
+      if (err instanceof HTMLElement) err.hidden = true;
+    }
+    const addBtn = drawerRoot.querySelector('[data-testid="drawer-comment-add"]');
+    if (addBtn instanceof HTMLElement) addBtn.hidden = false;
+  }
+
+  /**
+   * POST `bans.add_comment` / `bans.edit_comment` and refresh the drawer.
+   * @param {HTMLFormElement} form
+   * @returns {Promise<void>}
+   */
+  async function submitCommentForm(form) {
+    if (!drawerDetail || !drawerKey) return;
+    const textarea = /** @type {HTMLTextAreaElement | null} */ (form.querySelector('textarea[name="ctext"]'));
+    const cidInput = /** @type {HTMLInputElement | null} */ (form.querySelector('input[name="cid"]'));
+    const err = form.querySelector('[data-comment-error]');
+    const text = textarea ? textarea.value.trim() : '';
+    if (!text) {
+      if (err instanceof HTMLElement) err.hidden = false;
+      return;
+    }
+    if (err instanceof HTMLElement) err.hidden = true;
+    const cid = cidInput ? parseInt(cidInput.value || '0', 10) : 0;
+    const isComm = drawerKey.kind === 'comm';
+    const bid = isComm ? Number(drawerDetail.cid) : Number(drawerDetail.bid);
+    const ctype = isComm ? 'C' : 'B';
+    const submitBtn = /** @type {HTMLButtonElement | null} */ (form.querySelector('button[type="submit"]'));
+    setBusy(submitBtn, true);
+    try {
+      const action = cid > 0 ? Actions.BansEditComment : Actions.BansAddComment;
+      const env = await sb.api.call(action, { bid: bid, cid: cid, ctype: ctype, ctext: text, page: -1 });
+      if (env && env.ok) {
+        showToast({
+          kind: 'success',
+          title: cid > 0 ? 'Comment updated' : 'Comment added',
+        });
+        await loadDrawer(drawerKey);
+      } else {
+        const msg = (env && env.error && env.error.message) || 'Could not save comment.';
+        showToast({ kind: 'error', title: 'Comment not saved', body: msg });
+      }
+    } finally {
+      setBusy(submitBtn, false);
+    }
+  }
+
+  document.addEventListener('sbpp:comment-deleted', (/** @type {Event} */ e) => {
+    const detail = /** @type {CustomEvent} */ (e).detail;
+    const cid = Number(detail && detail.cid);
+    if (!cid) return;
+    removeCommentLocally(cid);
+  });
+
   document.addEventListener('click', (/** @type {MouseEvent} */ e) => {
     const target = /** @type {Element | null} */ (e.target);
     const trigger = target && target.closest('[data-drawer-bid], [data-drawer-cid], [data-drawer-href]');
@@ -1266,7 +1647,40 @@
         // behaviour — the palette is only closed when it was the source
         // of the navigation.
         if (target && target.closest('.palette')) closePalette();
-        loadDrawer(key);
+        const htmlEl = /** @type {HTMLElement} */ (trigger);
+        const composeMode = htmlEl.dataset.commentCompose;
+        /** @type {{mode: 'add'|'edit', cid?: number} | undefined} */
+        let compose;
+        if (composeMode === 'add' || composeMode === 'edit') {
+          const cidRaw = htmlEl.dataset.commentCid;
+          compose = {
+            mode: composeMode,
+            cid: cidRaw && /^\d+$/.test(cidRaw) ? parseInt(cidRaw, 10) : undefined,
+          };
+        }
+        void loadDrawer(key, compose);
+        return;
+      }
+    }
+
+    if (drawerRoot && target && drawerRoot.contains(target)) {
+      const addCommentBtn = target.closest('[data-testid="drawer-comment-add"]');
+      if (addCommentBtn) {
+        e.preventDefault();
+        openCommentComposer({ mode: 'add' });
+        return;
+      }
+      const editCommentBtn = target.closest('[data-comment-edit]');
+      if (editCommentBtn instanceof HTMLElement) {
+        e.preventDefault();
+        const cid = parseInt(editCommentBtn.dataset.commentEdit || '0', 10);
+        openCommentComposer({ mode: 'edit', cid: cid });
+        return;
+      }
+      const cancelCommentBtn = target.closest('[data-testid="drawer-comment-form"] [data-comment-cancel]');
+      if (cancelCommentBtn) {
+        e.preventDefault();
+        hideCommentComposer();
         return;
       }
     }
@@ -1336,6 +1750,12 @@
   // (re-)rendered by the lazy loader keeps working.
   document.addEventListener('submit', (/** @type {SubmitEvent} */ e) => {
     const target = /** @type {Element | null} */ (e.target);
+    const commentForm = target && target.closest('[data-testid="drawer-comment-form"]');
+    if (commentForm instanceof HTMLFormElement) {
+      e.preventDefault();
+      void submitCommentForm(commentForm);
+      return;
+    }
     const form = target && target.closest('[data-notes-add]');
     if (!(form instanceof HTMLFormElement)) return;
     e.preventDefault();
diff --git a/web/themes/default/page_admin_bans_protests.tpl b/web/themes/default/page_admin_bans_protests.tpl
index 485ed8b1a..7b8b10b65 100644
--- a/web/themes/default/page_admin_bans_protests.tpl
+++ b/web/themes/default/page_admin_bans_protests.tpl
@@ -159,8 +159,16 @@
                                 </dl>
 
                                 <ul class="text-sm" style="list-style:none;padding:0;margin:0;display:flex;flex-direction:column;gap:0.375rem">
-                                    {* nofilter: protaddcomment is CreateLinkR-built `<a>` HTML with integer pid + static URL; no user input flows in. *}
-                                    <li>{$protest.protaddcomment nofilter}</li>
+                                    <li>
+                                      <button type="button" class="btn btn--ghost btn--sm"
+                                              data-action="comment-compose"
+                                              data-bid="{$protest.pid}"
+                                              data-ctype="P"
+                                              data-testid="queue-comment-add">
+                                        <i data-lucide="message-square-plus" style="width:13px;height:13px" aria-hidden="true"></i>
+                                        Add Comment
+                                      </button>
+                                    </li>
                                 </ul>
                             </div>
 
@@ -177,7 +185,7 @@
                                                     <span class="flex items-center gap-2">
                                                         <span>{$commenta.added|escape}</span>
                                                         {if $commenta.editcomlink != ""}
-                                                            {* nofilter: editcomlink/delcomlink are CreateLinkR-built HTML from admin.bans.php with integer cid + literal pid; no user input. *}
+                                                            {* nofilter: editcomlink/delcomlink are server-built buttons/anchors with integer cid + pid; comment text on edit is htmlspecialchars'd into data-comment-text. *}
                                                             <span>{$commenta.editcomlink nofilter} {$commenta.delcomlink nofilter}</span>
                                                         {/if}
                                                     </span>
@@ -199,6 +207,16 @@
                             {else}
                                 <div class="text-xs text-faint mt-3">{$protest.commentdata|escape}</div>
                             {/if}
+                            <form hidden class="mt-4" data-comment-composer data-bid="{$protest.pid}" data-ctype="P" data-testid="queue-comment-form">
+                              <input type="hidden" name="cid" value="">
+                              <label class="label" for="queue-comment-text-p{$protest.pid}">Comment</label>
+                              <textarea class="textarea" name="ctext" id="queue-comment-text-p{$protest.pid}" rows="4" aria-required="true"></textarea>
+                              <p hidden class="text-sm" data-comment-error style="color:var(--danger);margin:0.5rem 0 0">Please leave a comment.</p>
+                              <div class="flex gap-2 mt-3">
+                                <button type="submit" class="btn btn--primary btn--sm">Save comment</button>
+                                <button type="button" class="btn btn--secondary btn--sm" data-comment-cancel>Cancel</button>
+                              </div>
+                            </form>
                         </div>
                     </details>
                 {/foreach}
diff --git a/web/themes/default/page_admin_bans_protests_archiv.tpl b/web/themes/default/page_admin_bans_protests_archiv.tpl
index a9bf15f59..99799fbe8 100644
--- a/web/themes/default/page_admin_bans_protests_archiv.tpl
+++ b/web/themes/default/page_admin_bans_protests_archiv.tpl
@@ -169,8 +169,16 @@
                                 </dl>
 
                                 <ul class="text-sm" style="list-style:none;padding:0;margin:0;display:flex;flex-direction:column;gap:0.375rem">
-                                    {* nofilter: protaddcomment is CreateLinkR-built `<a>` HTML with integer pid + static URL; no user input flows in. *}
-                                    <li>{$protest.protaddcomment nofilter}</li>
+                                    <li>
+                                      <button type="button" class="btn btn--ghost btn--sm"
+                                              data-action="comment-compose"
+                                              data-bid="{$protest.pid}"
+                                              data-ctype="P"
+                                              data-testid="queue-comment-add">
+                                        <i data-lucide="message-square-plus" style="width:13px;height:13px" aria-hidden="true"></i>
+                                        Add Comment
+                                      </button>
+                                    </li>
                                 </ul>
                             </div>
 
@@ -187,7 +195,7 @@
                                                     <span class="flex items-center gap-2">
                                                         <span>{$commenta.added|escape}</span>
                                                         {if $commenta.editcomlink != ""}
-                                                            {* nofilter: editcomlink/delcomlink are CreateLinkR-built HTML from admin.bans.php with integer cid + literal pid; no user input. *}
+                                                            {* nofilter: editcomlink/delcomlink are server-built buttons/anchors with integer cid + pid; comment text on edit is htmlspecialchars'd into data-comment-text. *}
                                                             <span>{$commenta.editcomlink nofilter} {$commenta.delcomlink nofilter}</span>
                                                         {/if}
                                                     </span>
@@ -209,6 +217,16 @@
                             {else}
                                 <div class="text-xs text-faint mt-3">{$protest.commentdata|escape}</div>
                             {/if}
+                            <form hidden class="mt-4" data-comment-composer data-bid="{$protest.pid}" data-ctype="P" data-testid="queue-comment-form">
+                              <input type="hidden" name="cid" value="">
+                              <label class="label" for="queue-comment-text-pa{$protest.pid}">Comment</label>
+                              <textarea class="textarea" name="ctext" id="queue-comment-text-pa{$protest.pid}" rows="4" aria-required="true"></textarea>
+                              <p hidden class="text-sm" data-comment-error style="color:var(--danger);margin:0.5rem 0 0">Please leave a comment.</p>
+                              <div class="flex gap-2 mt-3">
+                                <button type="submit" class="btn btn--primary btn--sm">Save comment</button>
+                                <button type="button" class="btn btn--secondary btn--sm" data-comment-cancel>Cancel</button>
+                              </div>
+                            </form>
                         </div>
                     </details>
                 {/foreach}
diff --git a/web/themes/default/page_admin_bans_submissions.tpl b/web/themes/default/page_admin_bans_submissions.tpl
index 0c44f1bb8..f2c28bcfd 100644
--- a/web/themes/default/page_admin_bans_submissions.tpl
+++ b/web/themes/default/page_admin_bans_submissions.tpl
@@ -176,9 +176,18 @@
                                 </dl>
 
                                 <ul class="text-sm" style="list-style:none;padding:0;margin:0;display:flex;flex-direction:column;gap:0.375rem">
-                                    {* nofilter: sub.demo is server-built `<a href="getdemo.php?id={URLENCODED INT}…">` HTML, sub.subaddcomment is CreateLinkR-built; no user input flows in. *}
+                                    {* nofilter: sub.demo is server-built `<a href="getdemo.php?id={URLENCODED INT}…">` HTML; no user input flows in. *}
                                     <li>{$sub.demo nofilter}</li>
-                                    <li>{$sub.subaddcomment nofilter}</li>
+                                    <li>
+                                      <button type="button" class="btn btn--ghost btn--sm"
+                                              data-action="comment-compose"
+                                              data-bid="{$sub.subid}"
+                                              data-ctype="S"
+                                              data-testid="queue-comment-add">
+                                        <i data-lucide="message-square-plus" style="width:13px;height:13px" aria-hidden="true"></i>
+                                        Add Comment
+                                      </button>
+                                    </li>
                                 </ul>
                             </div>
 
@@ -195,7 +204,7 @@
                                                     <span class="flex items-center gap-2">
                                                         <span>{$commenta.added|escape}</span>
                                                         {if $commenta.editcomlink != ""}
-                                                            {* nofilter: editcomlink/delcomlink are CreateLinkR-built `<a … onclick="…">` HTML from admin.bans.php with integer cid + literal subid; no user input. *}
+                                                            {* nofilter: editcomlink/delcomlink are server-built buttons/anchors with integer cid + subid; comment text on edit is htmlspecialchars'd into data-comment-text. *}
                                                             <span>{$commenta.editcomlink nofilter} {$commenta.delcomlink nofilter}</span>
                                                         {/if}
                                                     </span>
@@ -217,6 +226,16 @@
                             {else}
                                 <div class="text-xs text-faint mt-3">{$sub.commentdata|escape}</div>
                             {/if}
+                            <form hidden class="mt-4" data-comment-composer data-bid="{$sub.subid}" data-ctype="S" data-testid="queue-comment-form">
+                              <input type="hidden" name="cid" value="">
+                              <label class="label" for="queue-comment-text-s{$sub.subid}">Comment</label>
+                              <textarea class="textarea" name="ctext" id="queue-comment-text-s{$sub.subid}" rows="4" aria-required="true"></textarea>
+                              <p hidden class="text-sm" data-comment-error style="color:var(--danger);margin:0.5rem 0 0">Please leave a comment.</p>
+                              <div class="flex gap-2 mt-3">
+                                <button type="submit" class="btn btn--primary btn--sm">Save comment</button>
+                                <button type="button" class="btn btn--secondary btn--sm" data-comment-cancel>Cancel</button>
+                              </div>
+                            </form>
                         </div>
                     </details>
                 {/foreach}
diff --git a/web/themes/default/page_admin_bans_submissions_archiv.tpl b/web/themes/default/page_admin_bans_submissions_archiv.tpl
index c9a2456c3..e849b692d 100644
--- a/web/themes/default/page_admin_bans_submissions_archiv.tpl
+++ b/web/themes/default/page_admin_bans_submissions_archiv.tpl
@@ -174,9 +174,18 @@
                                 </dl>
 
                                 <ul class="text-sm" style="list-style:none;padding:0;margin:0;display:flex;flex-direction:column;gap:0.375rem">
-                                    {* nofilter: sub.demo is server-built `<a href="getdemo.php?id={URLENCODED INT}…">` HTML, sub.subaddcomment is CreateLinkR-built; no user input. *}
+                                    {* nofilter: sub.demo is server-built `<a href="getdemo.php?id={URLENCODED INT}…">` HTML; no user input flows in. *}
                                     <li>{$sub.demo nofilter}</li>
-                                    <li>{$sub.subaddcomment nofilter}</li>
+                                    <li>
+                                      <button type="button" class="btn btn--ghost btn--sm"
+                                              data-action="comment-compose"
+                                              data-bid="{$sub.subid}"
+                                              data-ctype="S"
+                                              data-testid="queue-comment-add">
+                                        <i data-lucide="message-square-plus" style="width:13px;height:13px" aria-hidden="true"></i>
+                                        Add Comment
+                                      </button>
+                                    </li>
                                 </ul>
                             </div>
 
@@ -193,7 +202,7 @@
                                                     <span class="flex items-center gap-2">
                                                         <span>{$commenta.added|escape}</span>
                                                         {if $commenta.editcomlink != ""}
-                                                            {* nofilter: editcomlink/delcomlink are CreateLinkR-built `<a … onclick="…">` HTML from admin.bans.php with integer cid + literal subid; no user input. *}
+                                                            {* nofilter: editcomlink/delcomlink are server-built buttons/anchors with integer cid + subid; comment text on edit is htmlspecialchars'd into data-comment-text. *}
                                                             <span>{$commenta.editcomlink nofilter} {$commenta.delcomlink nofilter}</span>
                                                         {/if}
                                                     </span>
@@ -215,6 +224,16 @@
                             {else}
                                 <div class="text-xs text-faint mt-3">{$sub.commentdata|escape}</div>
                             {/if}
+                            <form hidden class="mt-4" data-comment-composer data-bid="{$sub.subid}" data-ctype="S" data-testid="queue-comment-form">
+                              <input type="hidden" name="cid" value="">
+                              <label class="label" for="queue-comment-text-sa{$sub.subid}">Comment</label>
+                              <textarea class="textarea" name="ctext" id="queue-comment-text-sa{$sub.subid}" rows="4" aria-required="true"></textarea>
+                              <p hidden class="text-sm" data-comment-error style="color:var(--danger);margin:0.5rem 0 0">Please leave a comment.</p>
+                              <div class="flex gap-2 mt-3">
+                                <button type="submit" class="btn btn--primary btn--sm">Save comment</button>
+                                <button type="button" class="btn btn--secondary btn--sm" data-comment-cancel>Cancel</button>
+                              </div>
+                            </form>
                         </div>
                     </details>
                 {/foreach}
diff --git a/web/themes/default/page_bans.tpl b/web/themes/default/page_bans.tpl
index ea660e0d0..3cd29f9e0 100644
--- a/web/themes/default/page_bans.tpl
+++ b/web/themes/default/page_bans.tpl
@@ -3,65 +3,17 @@
    Vars: $ban_list, $total_bans, $hidetext, $searchlink, $view_bans,
          $hideadminname, $hideplayerips, $groupban, $friendsban,
          $general_unban, $can_delete, $can_export, $admin_postkey,
-         $view_comments, plus the comment-edit scratch pad
-         ($comment, $commenttype, $commenttext, $ctype, $cid, $page,
-         $canedit, $othercomments).
+         $view_comments.
    Per-row $ban.* keys: bid, name, steam, state, length, length_human,
          banned_human, banned_iso, sname, reason, aname, ban_ip_raw,
          can_edit_ban, can_unban, mod_icon, country, demo_available,
          view_delete, type, commentdata.
    Permission gates that aren't pre-precomputable on the View use
    the {has_access flag=...} block plugin (A3 helper).
+   Add / Edit comments open the player drawer (data-comment-compose);
+   there is no `?comment=` editor on this page.
    ============================================================ *}
 
-{* -- Comment edit mode -- replaces the body when ?comment=N is set.
-   The legacy default theme renders this at the top of the file; we
-   keep the same surface but drop the page chrome around it so the
-   action sits in a focused card. CSRF + submit go through the JSON
-   API (sb.api.call(Actions.BansAddComment / BansEditComment)) —
-   wired in the inline form handler below. *}
-{if $comment}
-<div class="card" style="max-width:42rem;margin:1.5rem auto">
-  <div class="card__header">
-    <div>
-      <h3>{$commenttype} comment</h3>
-      <p>Visible to admins; commented threads also surface to the public when public comments are enabled.</p>
-    </div>
-  </div>
-  <div class="card__body">
-    <form id="banlist-comment-form" data-bid="{$comment}" data-ctype="{$ctype}" data-cid="{$cid}" data-page="{$page}">
-      <label class="label" for="banlist-comment-text">Comment</label>
-      <textarea class="textarea" id="banlist-comment-text" name="commenttext" rows="6" {if !$canedit}disabled{/if}>{$commenttext}</textarea>
-      <div class="flex gap-2 mt-4">
-        {if $canedit}
-        <button class="btn btn--primary" type="submit">{$commenttype} comment</button>
-        {/if}
-        <button class="btn btn--secondary" type="button" onclick="history.back()">Back</button>
-      </div>
-    </form>
-
-    <div class="mt-6">
-      {foreach from=$othercomments item=com name=othercomments}
-        {if $smarty.foreach.othercomments.first}<h3 style="font-size:var(--fs-base);font-weight:600;margin:0 0 0.5rem">Other comments</h3>{/if}
-        <div class="mt-4" style="border-top:1px solid var(--border);padding-top:0.75rem">
-          <div class="flex items-center justify-between">
-            {* #1500: comment author is an admin username; hide it for public viewers when banlist.hideadminname is on (parity with the inline disclosure block below). *}
-            {if $hideadminname}<i class="text-faint">Hidden</i>{elseif !empty($com.comname)}<strong>{$com.comname|escape}</strong>{else}<i class="text-faint">deleted admin</i>{/if}
-            <span class="text-xs text-muted">{$com.added}</span>
-          </div>
-          {* nofilter: $com.commenttxt is server-built HTML produced by encodePreservingBr (htmlspecialchars per text segment, only `<br/>` survives) plus a URL-wrap regex that wraps already-escaped URLs in `<a>` tags — see page.banlist.php $cotherdata loop *}
-          <div class="text-sm mt-2">{$com.commenttxt nofilter}</div>
-          {* gate on edittime not editname: #1500 nulls editname for hidden viewers, edittime survives so the "last edit" indicator still shows. *}
-          {if !empty($com.edittime)}
-          <div class="text-xs text-faint mt-2">last edit {$com.edittime} by {if $hideadminname}<i class="text-faint">Hidden</i>{elseif !empty($com.editname)}{$com.editname|escape}{else}<i>deleted admin</i>{/if}</div>
-          {/if}
-        </div>
-      {/foreach}
-    </div>
-  </div>
-</div>
-{else}
-
 <div id="banlist-root" class="p-6 space-y-4" style="max-width:1700px;margin:0 auto" data-loading="false">
   <div class="flex items-center justify-between gap-3" style="flex-wrap:wrap">
     <div>
@@ -374,7 +326,7 @@
                         <span class="text-faint">&middot;</span>
                         <span class="text-xs text-faint tabular-nums">{$com.added}</span>
                       </div>
-                      {* nofilter: $com.commenttxt is server-built HTML produced by encodePreservingBr (htmlspecialchars per text segment, only `<br/>` survives) plus a URL-wrap regex that wraps already-escaped URLs in `<a>` tags — see page.banlist.php $commentres loop. Same provenance + safety as the existing comment-edit-mode block at the top of this template. *}
+                      {* nofilter: $com.commenttxt is server-built HTML produced by encodePreservingBr (htmlspecialchars per text segment, only `<br/>` survives) plus a URL-wrap regex that wraps already-escaped URLs in `<a>` tags — see page.banlist.php $commentres loop. *}
                       <div class="ban-comments-inline__text" data-testid="ban-comment-text">{$com.commenttxt nofilter}</div>
                       {if !empty($com.edittime)}
                       <div class="ban-comments-inline__edit text-xs text-faint">last edit {$com.edittime} by {if $hideadminname}<i class="text-faint">Hidden</i>{elseif !empty($com.editname)}{$com.editname|escape}{else}<i>deleted admin</i>{/if}</div>
@@ -394,12 +346,18 @@
                     {/foreach}
                     {/if}
                   </ul>
-                  {* #1544: "Add comment" CTA — restores the per-punishment
-                     comment affordance dropped in the 2.0.0 migration. Gated on
-                     $can_comment ($userbank->is_admin()); the link lands on the
-                     ?comment=N comment-edit branch of this template. *}
+                  {* #1544: "Add comment" opens the player drawer and
+                     activates the Overview composer (data-comment-compose). *}
                   {if $can_comment}
-                  <div class="ban-comments-inline__add" data-testid="ban-comment-add">{$ban.addcomment nofilter}</div>
+                  <div class="ban-comments-inline__add">
+                    <button type="button" class="btn btn--ghost btn--sm"
+                            data-drawer-bid="{$ban.bid}"
+                            data-comment-compose="add"
+                            data-testid="ban-comment-add">
+                      <i data-lucide="message-square-plus" style="width:13px;height:13px" aria-hidden="true"></i>
+                      Add Comment
+                    </button>
+                  </div>
                   {/if}
                 </details>
                 {/if}
@@ -531,6 +489,15 @@
                 </a>
                 {/if}
               {/if}
+              {if $ban.demo_available}
+              <a class="btn btn--ghost btn--icon btn--sm"
+                 href="getdemo.php?type=B&amp;id={$ban.bid}"
+                 data-testid="row-action-demo-download"
+                 data-tooltip="Download demo"
+                 aria-label="Download demo for {$ban.name|escape}">
+                <i data-lucide="download" style="width:14px;height:14px"></i>
+              </a>
+              {/if}
               {if !empty($ban.steam)}
               {* #1308: NO `onclick="event.stopPropagation()"` here. The
                  document-level [data-copy] click delegate in theme.js
@@ -681,7 +648,7 @@
           </div>
           <span class="text-faint" aria-hidden="true">&rsaquo;</span>
         </a>
-        {if $view_bans || !empty($ban.steam) || $ban.can_delete_ban}
+        {if $view_bans || $ban.demo_available || !empty($ban.steam) || $ban.can_delete_ban}
         <div class="row-actions row-actions--icons ban-card__actions">
           {if $view_bans}
             {if $ban.can_edit_ban && $ban.state != 'unbanned'}
@@ -716,6 +683,15 @@
             </a>
             {/if}
           {/if}
+          {if $ban.demo_available}
+          <a class="btn btn--ghost btn--icon btn--sm"
+             href="getdemo.php?type=B&amp;id={$ban.bid}"
+             data-testid="row-action-demo-download-mobile"
+             data-tooltip="Download demo"
+             aria-label="Download demo for {$ban.name|escape}">
+            <i data-lucide="download" style="width:14px;height:14px"></i>
+          </a>
+          {/if}
           {if !empty($ban.steam)}
           <button class="btn btn--ghost btn--icon btn--sm" type="button"
                   data-copy="{$ban.steam|escape}"
@@ -834,7 +810,6 @@
   <div class="skel" style="height:2.5rem;margin-bottom:0.5rem"></div>
   <div class="skel" style="height:2.5rem"></div>
 </div>
-{/if}
 
 {* ============================================================
    #1301 — unban confirm + reason modal scaffold.
@@ -907,19 +882,13 @@
   </form>
 </dialog>
 
-{* banlist.js wires both branches: the chip filter / copy buttons /
-   skeleton hook on the listing branch, and the `#banlist-comment-form`
-   submit -> sb.api.call(BansAddComment / BansEditComment) on the
-   comment-edit branch. The IIFE feature-detects every element it
-   touches, so loading it unconditionally is safe; loading it only on
-   the listing branch silently broke comment save (no submit handler
-   attached, native form submission to action-less URL no-ops). *}
+{* banlist.js only owns the listing skeleton hook. Comment add/edit
+   lives in the player drawer (theme.js) and on queue cards
+   (comment-actions.js). *}
 <script src="./scripts/banlist.js" defer></script>
 {* #1402: trash-can-on-a-comment triggers (`data-action="comment-delete"`)
-   on the comment-edit branch are handled by the global comment-actions.js
-   dispatcher loaded from core/footer.tpl — single mount point shared
-   with the admin moderation queues (protests / submissions) and the
-   commslist comment-edit branch. *}
+   are handled by the global comment-actions.js dispatcher loaded from
+   core/footer.tpl. *}
 
 {* ============================================================
    #1301 — banlist row-action wiring (inline page-tail JS).
@@ -1275,4 +1244,4 @@
    these props, this manifest stops being necessary, and the View
    drops them. Until then, keep this block at EOF.
    ============================================================ *}
-{if false}{$ban_nav}{$ctype}{$cid}{$page}{$canedit}{$othercomments}{$commenttype}{$commenttext}{$comment}{$friendsban}{$groupban}{$can_delete}{$general_unban}{$hidetext}{$searchlink}{$can_export}{$admin_postkey}{$view_comments}{$view_bans}{$hideadminname}{$total_bans}{/if}
+{if false}{$ban_nav}{$friendsban}{$groupban}{$can_delete}{$general_unban}{$hidetext}{$searchlink}{$can_export}{$admin_postkey}{$view_comments}{$view_bans}{$hideadminname}{$total_bans}{/if}
diff --git a/web/themes/default/page_comms.tpl b/web/themes/default/page_comms.tpl
index d3e762e2b..8d8c56556 100644
--- a/web/themes/default/page_comms.tpl
+++ b/web/themes/default/page_comms.tpl
@@ -8,9 +8,6 @@
     `unmuted` instead of `unbanned`. View: Sbpp\View\CommsListView.
 
     Skipped from the design / handoff for B4 (each open for follow-up):
-      * Comment edit drawer — the `?comment=` flow stays on the legacy
-        theme; the new theme list-only page just exposes the row's edit
-        URL. Wiring the new comment editor needs its own template.
       * Live-server hostname resolution — the schema has no hostname
         column; sname renders ip:port (or "Web Block" for sid=0) until
         a future ticket re-implements the LoadServerHost equivalent
@@ -19,6 +16,10 @@
     Testability hooks (`data-testid`) match the B4 spec: comm-row /
     filter-chip-* / row-action-* / page-prev / page-next / comms-search.
 *}
+
+{* Add / Edit comments open the player drawer (data-comment-compose);
+   there is no `?comment=` editor on this page. *}
+
 <div class="p-6 space-y-4" style="max-width:1700px;margin:0 auto;width:100%">
 
     {* -- Page header --------------------------------------------------- *}
@@ -287,9 +288,17 @@
                                             {/foreach}
                                             {/if}
                                           </ul>
-                                          {* #1544: "Add comment" CTA — restores the per-punishment comment affordance dropped in the 2.0.0 migration. Gated on $can_comment ($userbank->is_admin()); the link lands on the ?comment=N comment-edit branch of this template. *}
+                                          {* #1544: "Add comment" opens the player drawer and activates the Overview composer (data-comment-compose). *}
                                           {if $can_comment}
-                                          <div class="ban-comments-inline__add" data-testid="comm-comment-add">{$comm.addcomment nofilter}</div>
+                                          <div class="ban-comments-inline__add">
+                                            <button type="button" class="btn btn--ghost btn--sm"
+                                                    data-drawer-cid="{$comm.cid}"
+                                                    data-comment-compose="add"
+                                                    data-testid="comm-comment-add">
+                                              <i data-lucide="message-square-plus" style="width:13px;height:13px" aria-hidden="true"></i>
+                                              Add Comment
+                                            </button>
+                                          </div>
                                           {/if}
                                         </details>
                                         {/if}
@@ -697,6 +706,8 @@
 
 </div>
 
+<script src="./scripts/banlist.js" defer></script>
+
 {* ============================================================
    #1301 — comms unblock confirm + reason modal scaffold.
 
@@ -1205,4 +1216,4 @@
    these props, this manifest stops being necessary, and the View
    drops them. Until then, keep this block at EOF.
    ============================================================ *}
-{if false}{$ban_nav}{$canedit}{$cid}{$comment}{$commenttext}{$commenttype}{$ctype}{$hide_inactive}{$hideadminname}{$hidetext}{$othercomments}{$page}{$view_bans}{$view_comments}{/if}
+{if false}{$ban_nav}{$hide_inactive}{$hidetext}{$view_bans}{/if}