From 5806a8062e093f72a529461e949343f01a5ab16e Mon Sep 17 00:00:00 2001
From: RandomCatboy <dylan@youhavethe.gay>
Date: Thu, 6 Aug 2026 19:57:39 +0200
Subject: [PATCH 1/5] Unified theme persistence across Settings, desktop
 navigation, and mobile navigation. Added optimistic theme/accent updates with
 rollback and race protection. Standardized the demo-mode banner across
 desktop and mobile. Hardened logout handling against failed and duplicate
 requests. Fixed investigation polling races that could miss completed reports
 or show stale data. Added request timeouts to S3 and Azure backup operations.
 Fixed S3 and Azure backup-retention pagination beyond provider result limits.
 Added safe XML entity decoding for cloud object names and continuation
 tokens. Improved chat hydration dependencies and unsupported AI-task
 handling. Made the global critical-error screen respect light and dark system
 themes. Added regression tests for backup pagination and XML parsing.

---
 src/app/(dashboard)/layout.tsx                |  9 +-
 src/app/global-error.tsx                      | 11 ++-
 src/components/chat/chat-dock.tsx             |  3 +-
 .../logs/threats/use-investigation-poll.ts    | 35 ++++++--
 .../mobile/shell/mobile-more-sheet.tsx        |  9 +-
 src/components/mobile/shell/mobile-shell.tsx  |  8 +-
 src/components/settings/appearance-form.tsx   | 29 +++----
 src/components/shell/topbar.tsx               |  7 +-
 src/components/shell/use-logout.ts            | 23 +++--
 src/lib/ai/prompts.ts                         |  2 +
 src/lib/backup/destinations/azure.test.ts     | 40 ++++++++-
 src/lib/backup/destinations/azure.ts          | 85 ++++++++++++++-----
 src/lib/backup/destinations/s3.test.ts        | 50 ++++++++++-
 src/lib/backup/destinations/s3.ts             | 77 ++++++++++++-----
 14 files changed, 291 insertions(+), 97 deletions(-)

diff --git a/src/app/(dashboard)/layout.tsx b/src/app/(dashboard)/layout.tsx
index 396a30a..92039fb 100644
--- a/src/app/(dashboard)/layout.tsx
+++ b/src/app/(dashboard)/layout.tsx
@@ -1,5 +1,4 @@
 import { redirect } from "next/navigation";
-import { LockKeyhole } from "lucide-react";
 import { requirePageUser } from "@/lib/auth/guards";
 import { isLockedDemoMode } from "@/lib/demo/mode";
 import { isMobileView } from "@/lib/device";
@@ -10,6 +9,7 @@ import { PrivacyProvider } from "@/components/privacy/privacy-provider";
 import { SidebarNav } from "@/components/shell/sidebar";
 import { Topbar } from "@/components/shell/topbar";
 import { MobileShell } from "@/components/mobile/shell/mobile-shell";
+import { DemoModeBanner } from "@/components/shell/demo-mode-banner";
 
 export const dynamic = "force-dynamic";
 
@@ -70,12 +70,7 @@ export default async function DashboardLayout({ children }: { children: React.Re
         </aside>
         <div className="flex min-w-0 flex-1 flex-col md:pl-60">
           <Topbar instanceName={shellIdentity.instanceName} user={shellUser} />
-          {demoLocked && (
-            <div className="flex items-center justify-center gap-2 border-b border-violet-500/20 bg-violet-500/10 px-4 py-2 text-center text-xs font-medium text-violet-700 dark:text-violet-300">
-              <LockKeyhole className="size-3.5" /> Public demo — exploration and
-              mock AI are enabled; persistent changes are locked.
-            </div>
-          )}
+          {demoLocked && <DemoModeBanner />}
           <main className="flex-1 p-4 md:p-6">{children}</main>
         </div>
         {aiConfig.enabled && <ChatDock />}
diff --git a/src/app/global-error.tsx b/src/app/global-error.tsx
index 0af7950..a55249d 100644
--- a/src/app/global-error.tsx
+++ b/src/app/global-error.tsx
@@ -20,10 +20,13 @@ export default function GlobalError({ error, reset }: { error: Error & { digest?
           fontFamily: "system-ui, sans-serif",
           textAlign: "center",
           padding: "1.5rem",
+          colorScheme: "light dark",
+          background: "Canvas",
+          color: "CanvasText",
         }}
       >
         <h1 style={{ fontSize: "1.5rem", fontWeight: 600 }}>Something went wrong</h1>
-        <p style={{ color: "#71717a", maxWidth: "28rem" }}>
+        <p style={{ opacity: 0.7, maxWidth: "28rem" }}>
           A critical error occurred. Try reloading the page; if it persists, check the server logs.
         </p>
         <button
@@ -31,9 +34,9 @@ export default function GlobalError({ error, reset }: { error: Error & { digest?
           style={{
             padding: "0.5rem 1rem",
             borderRadius: "0.5rem",
-            border: "1px solid #d4d4d8",
-            background: "#18181b",
-            color: "#fafafa",
+            border: "1px solid ButtonBorder",
+            background: "Highlight",
+            color: "HighlightText",
             cursor: "pointer",
           }}
         >
diff --git a/src/components/chat/chat-dock.tsx b/src/components/chat/chat-dock.tsx
index 48aea54..961f6c6 100644
--- a/src/components/chat/chat-dock.tsx
+++ b/src/components/chat/chat-dock.tsx
@@ -75,8 +75,7 @@ export function ChatDock() {
       if (stored.open) setOpen(true);
     }
     setRestored(true);
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, []);
+  }, [hydrate]);
 
   // Persist open state + transcript so a full page load doesn't lose the chat.
   useEffect(() => {
diff --git a/src/components/logs/threats/use-investigation-poll.ts b/src/components/logs/threats/use-investigation-poll.ts
index f973c47..f707256 100644
--- a/src/components/logs/threats/use-investigation-poll.ts
+++ b/src/components/logs/threats/use-investigation-poll.ts
@@ -73,9 +73,22 @@ export function useInvestigationPoll(
 
   // A different ticket re-seeds tracking from that ticket's persisted state.
   useEffect(() => {
-    setEngaged(isInvestigationActive(ticket.investigationStatus));
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [ticketId]);
+    const active = isInvestigationActive(ticket.investigationStatus);
+    if (active) {
+      // A run started elsewhere may reuse an old query cache entry for this
+      // ticket. Seed the cache from the newly observed persisted run before
+      // enabling polling so a previous report cannot flash or re-notify.
+      queryClient.setQueryData<InvestigationState>(["investigation", ticketId], ticketState(ticket));
+    }
+    setEngaged(active);
+  }, [
+    queryClient,
+    ticketId,
+    ticket.investigationStatus,
+    ticket.investigationProgress,
+    ticket.investigation,
+    ticket.investigatedAt,
+  ]);
 
   const query = useQuery({
     queryKey: ["investigation", ticketId],
@@ -99,16 +112,28 @@ export function useInvestigationPoll(
 
   // Fire the completion callback + refresh the list once, on the success edge.
   const prevStatus = useRef<InvestigationStatus | null>(state.status);
+  const ticketStatusRef = useRef(ticket.investigationStatus);
+  ticketStatusRef.current = ticket.investigationStatus;
+
+  // A newly selected ticket starts from its own persisted edge, so simply
+  // opening an already-completed ticket does not show a fresh completion toast.
+  useEffect(() => {
+    prevStatus.current = ticketStatusRef.current;
+  }, [ticketId]);
+
   useEffect(() => {
     const prev = prevStatus.current;
+    // Do not consume the success edge until the corresponding report has also
+    // arrived; the status and report may be persisted/read in separate ticks.
+    if (state.status === "success" && !state.report) return;
+
     prevStatus.current = state.status;
     if (prev !== "success" && state.status === "success" && state.report) {
       toast.success("Investigation complete");
       onInvestigated?.(state.report);
       void queryClient.invalidateQueries({ queryKey: ["tickets"] });
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [state.status]);
+  }, [state.status, state.report, onInvestigated, queryClient]);
 
   const enqueue = useMutation({
     mutationFn: () =>
diff --git a/src/components/mobile/shell/mobile-more-sheet.tsx b/src/components/mobile/shell/mobile-more-sheet.tsx
index 2afb004..3b4c439 100644
--- a/src/components/mobile/shell/mobile-more-sheet.tsx
+++ b/src/components/mobile/shell/mobile-more-sheet.tsx
@@ -3,7 +3,6 @@
 import { useState } from "react";
 import { usePathname } from "next/navigation";
 import Link from "next/link";
-import { useTheme } from "next-themes";
 import { LogOut, Monitor, Moon, Search, Settings, Sun } from "lucide-react";
 import { NAV_GROUPS, isActive } from "@/components/shell/nav";
 import { CommandPalette } from "@/components/shell/command-palette";
@@ -13,6 +12,7 @@ import { Avatar, AvatarFallback } from "@/components/ui/avatar";
 import { setViewMode } from "@/lib/view-mode";
 import { cn } from "@/lib/utils";
 import { BottomSheet } from "../ui/bottom-sheet";
+import { usePersistedThemeMode } from "@/components/shared/use-persisted-theme-mode";
 
 export interface MobileShellUser {
   username: string;
@@ -38,7 +38,7 @@ export function MobileMoreSheet({
 }) {
   const pathname = usePathname();
   const logout = useLogout();
-  const { resolvedTheme, setTheme } = useTheme();
+  const { resolvedTheme, setMode, isSaving: isSavingTheme } = usePersistedThemeMode();
   const [paletteOpen, setPaletteOpen] = useState(false);
   const isAdmin = user.role === "ADMIN";
   const initials = (user.displayName ?? user.username).slice(0, 2).toUpperCase();
@@ -132,8 +132,9 @@ export function MobileMoreSheet({
             </Link>
             <button
               type="button"
-              onClick={() => setTheme(resolvedTheme === "dark" ? "light" : "dark")}
-              className="flex min-h-12 w-full items-center gap-3 px-3.5 text-sm font-medium active:bg-muted/70"
+              onClick={() => void setMode(resolvedTheme === "dark" ? "light" : "dark")}
+              disabled={isSavingTheme}
+              className="flex min-h-12 w-full items-center gap-3 px-3.5 text-sm font-medium active:bg-muted/70 disabled:cursor-wait disabled:opacity-70"
             >
               <Sun className="size-4.5 text-muted-foreground dark:hidden" />
               <Moon className="hidden size-4.5 text-muted-foreground dark:block" />
diff --git a/src/components/mobile/shell/mobile-shell.tsx b/src/components/mobile/shell/mobile-shell.tsx
index 460418d..9f502a4 100644
--- a/src/components/mobile/shell/mobile-shell.tsx
+++ b/src/components/mobile/shell/mobile-shell.tsx
@@ -1,7 +1,7 @@
 import type { ReactNode } from "react";
-import { LockKeyhole } from "lucide-react";
 import { MobileTabBar } from "./mobile-tab-bar";
 import type { MobileShellUser } from "./mobile-more-sheet";
+import { DemoModeBanner } from "@/components/shell/demo-mode-banner";
 
 /**
  * Phone app frame: content above a fixed bottom tab bar. Pages own their own
@@ -21,11 +21,7 @@ export function MobileShell({
 }) {
   return (
     <div className="flex min-h-svh flex-col">
-      {demoLocked && (
-        <div className="flex items-center justify-center gap-2 border-b border-violet-500/20 bg-violet-500/10 px-4 py-2 text-center text-xs font-medium text-violet-700 dark:text-violet-300">
-          <LockKeyhole className="size-3.5 shrink-0" /> Public demo — persistent changes are locked.
-        </div>
-      )}
+      {demoLocked && <DemoModeBanner />}
       <main className="flex flex-1 flex-col pb-[calc(3.5rem+env(safe-area-inset-bottom))]">
         {children}
       </main>
diff --git a/src/components/settings/appearance-form.tsx b/src/components/settings/appearance-form.tsx
index c3adcc4..9a2c8fe 100644
--- a/src/components/settings/appearance-form.tsx
+++ b/src/components/settings/appearance-form.tsx
@@ -1,7 +1,6 @@
 "use client";
 
 import { useEffect, useState } from "react";
-import { useTheme } from "next-themes";
 import { Check, Laptop, Moon, Sun } from "lucide-react";
 import { toast } from "sonner";
 import { cn } from "@/lib/utils";
@@ -10,6 +9,7 @@ import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
 import { apiFetch } from "@/components/shared/api-client";
+import { usePersistedThemeMode } from "@/components/shared/use-persisted-theme-mode";
 
 const SWATCHES: Record<ThemeColor, { label: string; className: string }> = {
   blue: { label: "Blue", className: "bg-blue-600" },
@@ -26,13 +26,17 @@ const MODES: { value: ThemeMode; label: string; icon: typeof Sun }[] = [
 ];
 
 export function AppearanceForm({ initialColor }: { initialColor: ThemeColor }) {
-  const { theme, setTheme } = useTheme();
+  const { theme, setMode, isSaving: isSavingMode } = usePersistedThemeMode();
   const [color, setColor] = useState<ThemeColor>(initialColor);
+  const [isSavingColor, setIsSavingColor] = useState(false);
   const [mounted, setMounted] = useState(false);
   useEffect(() => setMounted(true), []);
 
   async function pickColor(next: ThemeColor) {
+    if (isSavingColor || next === color) return;
+
     const previous = color;
+    setIsSavingColor(true);
     setColor(next);
     document.documentElement.dataset.theme = next; // live preview
     try {
@@ -42,15 +46,8 @@ export function AppearanceForm({ initialColor }: { initialColor: ThemeColor }) {
       setColor(previous);
       document.documentElement.dataset.theme = previous;
       toast.error(err instanceof Error ? err.message : "Failed to save theme color");
-    }
-  }
-
-  async function pickMode(next: ThemeMode) {
-    setTheme(next);
-    try {
-      await apiFetch("/api/me", { method: "PATCH", body: JSON.stringify({ themeMode: next }) });
-    } catch (err) {
-      toast.error(err instanceof Error ? err.message : "Failed to save theme mode");
+    } finally {
+      setIsSavingColor(false);
     }
   }
 
@@ -69,10 +66,11 @@ export function AppearanceForm({ initialColor }: { initialColor: ThemeColor }) {
                 <button
                   key={c}
                   type="button"
-                  onClick={() => pickColor(c)}
+                  onClick={() => void pickColor(c)}
                   aria-pressed={active}
+                  disabled={isSavingColor}
                   className={cn(
-                    "flex flex-col items-center gap-2 rounded-lg border p-4 transition-colors outline-none hover:bg-accent focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50",
+                    "flex flex-col items-center gap-2 rounded-lg border p-4 transition-colors outline-none hover:bg-accent focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 disabled:cursor-wait disabled:opacity-70",
                     active && "border-primary ring-2 ring-primary/30",
                   )}
                 >
@@ -107,9 +105,10 @@ export function AppearanceForm({ initialColor }: { initialColor: ThemeColor }) {
                   type="button"
                   role="radio"
                   aria-checked={active}
-                  onClick={() => pickMode(m.value)}
+                  onClick={() => void setMode(m.value)}
+                  disabled={isSavingMode}
                   className={cn(
-                    "flex items-center gap-2 rounded-md px-4 py-1.5 text-sm transition-colors outline-none focus-visible:ring-3 focus-visible:ring-ring/50",
+                    "flex items-center gap-2 rounded-md px-4 py-1.5 text-sm transition-colors outline-none focus-visible:ring-3 focus-visible:ring-ring/50 disabled:cursor-wait disabled:opacity-70",
                     active
                       ? "bg-background font-medium text-foreground shadow-sm"
                       : "text-muted-foreground hover:text-foreground",
diff --git a/src/components/shell/topbar.tsx b/src/components/shell/topbar.tsx
index f871fa2..2dcc42a 100644
--- a/src/components/shell/topbar.tsx
+++ b/src/components/shell/topbar.tsx
@@ -11,7 +11,6 @@ import {
   Sun,
   User as UserIcon,
 } from "lucide-react";
-import { useTheme } from "next-themes";
 import { MOBILE_UA_PATTERN, setViewMode } from "@/lib/view-mode";
 import { useLogout } from "./use-logout";
 import Link from "next/link";
@@ -28,6 +27,7 @@ import {
 import { Sheet, SheetContent, SheetTitle, SheetTrigger } from "@/components/ui/sheet";
 import { SidebarNav } from "./sidebar";
 import { CommandPalette } from "./command-palette";
+import { usePersistedThemeMode } from "@/components/shared/use-persisted-theme-mode";
 
 interface TopbarProps {
   instanceName: string;
@@ -35,7 +35,7 @@ interface TopbarProps {
 }
 
 export function Topbar({ instanceName, user }: TopbarProps) {
-  const { resolvedTheme, setTheme } = useTheme();
+  const { resolvedTheme, setMode, isSaving: isSavingTheme } = usePersistedThemeMode();
   const [paletteOpen, setPaletteOpen] = useState(false);
   const [sheetOpen, setSheetOpen] = useState(false);
   const logout = useLogout();
@@ -83,7 +83,8 @@ export function Topbar({ instanceName, user }: TopbarProps) {
           variant="ghost"
           size="icon"
           aria-label="Toggle dark mode"
-          onClick={() => setTheme(resolvedTheme === "dark" ? "light" : "dark")}
+          disabled={isSavingTheme}
+          onClick={() => void setMode(resolvedTheme === "dark" ? "light" : "dark")}
         >
           <Sun className="size-4.5 dark:hidden" />
           <Moon className="hidden size-4.5 dark:block" />
diff --git a/src/components/shell/use-logout.ts b/src/components/shell/use-logout.ts
index 1884909..3e4521b 100644
--- a/src/components/shell/use-logout.ts
+++ b/src/components/shell/use-logout.ts
@@ -1,14 +1,27 @@
 "use client";
 
+import { useCallback, useRef } from "react";
 import { useRouter } from "next/navigation";
+import { toast } from "sonner";
+import { apiFetch } from "@/components/shared/api-client";
 import { pushWithNavigationFeedback } from "./navigation-feedback";
 
 /** Sign out and land on /login. Shared by the desktop topbar and mobile nav. */
 export function useLogout() {
   const router = useRouter();
-  return async function logout() {
-    await fetch("/api/auth/logout", { method: "POST" });
-    pushWithNavigationFeedback(router, "/login");
-    router.refresh();
-  };
+  const signingOutRef = useRef(false);
+
+  return useCallback(async () => {
+    if (signingOutRef.current) return;
+    signingOutRef.current = true;
+
+    try {
+      await apiFetch<{ ok: boolean }>("/api/auth/logout", { method: "POST" });
+      pushWithNavigationFeedback(router, "/login");
+      router.refresh();
+    } catch (err) {
+      signingOutRef.current = false;
+      toast.error(err instanceof Error ? err.message : "Could not sign out");
+    }
+  }, [router]);
 }
diff --git a/src/lib/ai/prompts.ts b/src/lib/ai/prompts.ts
index 1db2a12..c769862 100644
--- a/src/lib/ai/prompts.ts
+++ b/src/lib/ai/prompts.ts
@@ -69,5 +69,7 @@ export async function buildPrompt(input: AiGenerateInput): Promise<BuiltPrompt>
           "and why such a rule might exist in a homelab.",
       };
     }
+    default:
+      throw new ApiError(400, "invalid_task", "Unsupported AI generation task");
   }
 }
diff --git a/src/lib/backup/destinations/azure.test.ts b/src/lib/backup/destinations/azure.test.ts
index 7f240c4..f622b3a 100644
--- a/src/lib/backup/destinations/azure.test.ts
+++ b/src/lib/backup/destinations/azure.test.ts
@@ -1,9 +1,10 @@
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 import {
   buildAzureStringToSign,
   canonicalizedHeaders,
   rfc1123Date,
   signAzureSharedKey,
+  listBlobsAzure,
 } from "./azure";
 
 describe("rfc1123Date", () => {
@@ -94,3 +95,40 @@ describe("signAzureSharedKey", () => {
     expect(signAzureSharedKey(key, "anything")).toMatch(/^[A-Za-z0-9+/]{43}=$/);
   });
 });
+
+
+describe("listBlobsAzure", () => {
+  it("follows markers and decodes XML entities", async () => {
+    const fetchMock = vi
+      .spyOn(globalThis, "fetch")
+      .mockResolvedValueOnce(
+        new Response(
+          "<EnumerationResults><Blobs><Blob><Name>backups/one&amp;two.gz</Name><Properties><Last-Modified>2026-01-01</Last-Modified></Properties></Blob></Blobs><NextMarker>next&amp;marker</NextMarker></EnumerationResults>",
+          { status: 200 },
+        ),
+      )
+      .mockResolvedValueOnce(
+        new Response(
+          "<EnumerationResults><Blobs><Blob><Name>backups/three.gz</Name><Properties><Last-Modified>2026-01-02</Last-Modified></Properties></Blob></Blobs><NextMarker></NextMarker></EnumerationResults>",
+          { status: 200 },
+        ),
+      );
+
+    const blobs = await listBlobsAzure({
+      mode: "sharedKey",
+      accountName: "polysiem",
+      accountKey: Buffer.from("test-account-key").toString("base64"),
+      container: "backups",
+      prefix: "backups/",
+    });
+
+    expect(blobs).toEqual([
+      { key: "backups/one&two.gz", lastModified: "2026-01-01" },
+      { key: "backups/three.gz", lastModified: "2026-01-02" },
+    ]);
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(String(fetchMock.mock.calls[1]?.[0])).toContain("marker=next%26marker");
+
+    fetchMock.mockRestore();
+  });
+});
diff --git a/src/lib/backup/destinations/azure.ts b/src/lib/backup/destinations/azure.ts
index b669354..e2dc765 100644
--- a/src/lib/backup/destinations/azure.ts
+++ b/src/lib/backup/destinations/azure.ts
@@ -1,6 +1,12 @@
 import { createHmac } from "node:crypto";
 import type { AzureDestinationConfig } from "../types";
 import { joinKey } from "./keys";
+import {
+  BACKUP_METADATA_TIMEOUT_MS,
+  BACKUP_UPLOAD_TIMEOUT_MS,
+  backupStorageFetch,
+} from "./storage-request";
+import { xmlValue } from "./xml";
 
 /**
  * Azure Blob Storage uploads without the Azure SDK. Two credential modes:
@@ -158,15 +164,20 @@ export async function putBlobAzure(
 ): Promise<void> {
   if (config.mode === "sas") {
     if (!config.sasUrl) throw new Error("Azure sas mode requires a SAS URL");
-    const res = await fetch(sasBlobUrl(config.sasUrl, key), {
-      method: "PUT",
-      headers: {
-        "x-ms-blob-type": "BlockBlob",
-        "x-ms-version": API_VERSION,
-        "content-type": contentType,
+    const res = await backupStorageFetch(
+      "Azure",
+      sasBlobUrl(config.sasUrl, key),
+      {
+        method: "PUT",
+        headers: {
+          "x-ms-blob-type": "BlockBlob",
+          "x-ms-version": API_VERSION,
+          "content-type": contentType,
+        },
+        body: new Uint8Array(body),
       },
-      body: new Uint8Array(body),
-    });
+      BACKUP_UPLOAD_TIMEOUT_MS,
+    );
     if (!res.ok) await throwAzureError(res);
     return;
   }
@@ -174,7 +185,12 @@ export async function putBlobAzure(
     contentLength: body.length,
     contentType,
   });
-  const res = await fetch(url, { method: "PUT", headers, body: new Uint8Array(body) });
+  const res = await backupStorageFetch(
+    "Azure",
+    url,
+    { method: "PUT", headers, body: new Uint8Array(body) },
+    BACKUP_UPLOAD_TIMEOUT_MS,
+  );
   if (!res.ok) await throwAzureError(res);
 }
 
@@ -215,27 +231,50 @@ export interface AzureBlob {
  */
 export async function listBlobsAzure(config: AzureDestinationConfig): Promise<AzureBlob[]> {
   if (config.mode !== "sharedKey") return [];
-  const query: Record<string, string> = { comp: "list", restype: "container" };
-  if (config.prefix) query.prefix = config.prefix;
-  const { url, headers } = signSharedKeyRequest(config, "GET", "", { contentLength: 0, query });
-  const res = await fetch(url, { method: "GET", headers });
-  if (!res.ok) await throwAzureError(res);
-  const xml = await res.text();
+
   const blobs: AzureBlob[] = [];
-  const re = /<Blob>([\s\S]*?)<\/Blob>/g;
-  let m: RegExpExecArray | null;
-  while ((m = re.exec(xml)) !== null) {
-    const block = m[1];
-    const name = /<Name>([^<]+)<\/Name>/.exec(block)?.[1];
-    const lastModified = /<Last-Modified>([^<]+)<\/Last-Modified>/.exec(block)?.[1] ?? "";
-    if (name) blobs.push({ key: name, lastModified });
+  let marker: string | undefined;
+
+  for (;;) {
+    const query: Record<string, string> = { comp: "list", restype: "container" };
+    if (config.prefix) query.prefix = config.prefix;
+    if (marker) query.marker = marker;
+
+    const { url, headers } = signSharedKeyRequest(config, "GET", "", { contentLength: 0, query });
+    const res = await backupStorageFetch(
+      "Azure",
+      url,
+      { method: "GET", headers },
+      BACKUP_METADATA_TIMEOUT_MS,
+    );
+    if (!res.ok) await throwAzureError(res);
+
+    const xml = await res.text();
+    const re = /<Blob>([\s\S]*?)<\/Blob>/g;
+    let match: RegExpExecArray | null;
+    while ((match = re.exec(xml)) !== null) {
+      const name = xmlValue(match[1], "Name");
+      const lastModified = xmlValue(match[1], "Last-Modified") ?? "";
+      if (name) blobs.push({ key: name, lastModified });
+    }
+
+    const nextMarker = xmlValue(xml, "NextMarker");
+    if (!nextMarker) break;
+    if (nextMarker === marker) throw new Error("Azure returned the same blob-list marker twice");
+    marker = nextMarker;
   }
+
   return blobs;
 }
 
 /** Delete a single blob (sharedKey mode). */
 export async function deleteBlobAzure(config: AzureDestinationConfig, key: string): Promise<void> {
   const { url, headers } = signSharedKeyRequest(config, "DELETE", key, { contentLength: 0 });
-  const res = await fetch(url, { method: "DELETE", headers });
+  const res = await backupStorageFetch(
+    "Azure",
+    url,
+    { method: "DELETE", headers },
+    BACKUP_METADATA_TIMEOUT_MS,
+  );
   if (!res.ok) await throwAzureError(res);
 }
diff --git a/src/lib/backup/destinations/s3.test.ts b/src/lib/backup/destinations/s3.test.ts
index 9b8bbb3..1db941d 100644
--- a/src/lib/backup/destinations/s3.test.ts
+++ b/src/lib/backup/destinations/s3.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 import { createHmac } from "node:crypto";
 import {
   amzDates,
@@ -8,6 +8,7 @@ import {
   deriveSigningKey,
   sha256Hex,
   uriEncode,
+  listObjectsS3,
 } from "./s3";
 
 /**
@@ -124,3 +125,50 @@ describe("amzDates", () => {
     });
   });
 });
+
+describe("listObjectsS3", () => {
+  it("follows continuation tokens and decodes XML entities", async () => {
+    const fetchMock = vi
+      .spyOn(globalThis, "fetch")
+      .mockResolvedValueOnce(
+        new Response(
+          [
+            "<ListBucketResult>",
+            "<IsTruncated>true</IsTruncated>",
+            "<Contents><Key>backups/one&amp;two.gz</Key><LastModified>2026-01-01</LastModified></Contents>",
+            "<NextContinuationToken>next&amp;token</NextContinuationToken>",
+            "</ListBucketResult>",
+          ].join(""),
+          { status: 200 },
+        ),
+      )
+      .mockResolvedValueOnce(
+        new Response(
+          "<ListBucketResult><IsTruncated>false</IsTruncated><Contents><Key>backups/three.gz</Key><LastModified>2026-01-02</LastModified></Contents></ListBucketResult>",
+          { status: 200 },
+        ),
+      );
+
+    const objects = await listObjectsS3(
+      {
+        endpoint: "https://storage.example.test",
+        region: "us-east-1",
+        bucket: "polysiem",
+        prefix: "backups/",
+        accessKeyId: "access",
+        secretAccessKey: "secret",
+        forcePathStyle: true,
+      },
+      "backups/",
+    );
+
+    expect(objects).toEqual([
+      { key: "backups/one&two.gz", lastModified: "2026-01-01" },
+      { key: "backups/three.gz", lastModified: "2026-01-02" },
+    ]);
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(String(fetchMock.mock.calls[1]?.[0])).toContain("continuation-token=next%26token");
+
+    fetchMock.mockRestore();
+  });
+});
diff --git a/src/lib/backup/destinations/s3.ts b/src/lib/backup/destinations/s3.ts
index 5626e82..43fb59c 100644
--- a/src/lib/backup/destinations/s3.ts
+++ b/src/lib/backup/destinations/s3.ts
@@ -1,6 +1,12 @@
 import { createHash, createHmac } from "node:crypto";
 import type { S3DestinationConfig } from "../types";
 import { joinKey } from "./keys";
+import {
+  BACKUP_METADATA_TIMEOUT_MS,
+  BACKUP_UPLOAD_TIMEOUT_MS,
+  backupStorageFetch,
+} from "./storage-request";
+import { xmlValue } from "./xml";
 
 /**
  * AWS Signature Version 4 signing for single-PUT uploads to any S3-compatible
@@ -215,7 +221,12 @@ export async function putObjectS3(
   contentType: string,
 ): Promise<void> {
   const { url, headers } = signS3Request(config, { method: "PUT", key, body, contentType });
-  const res = await fetch(url, { method: "PUT", headers, body: new Uint8Array(body) });
+  const res = await backupStorageFetch(
+    "S3",
+    url,
+    { method: "PUT", headers, body: new Uint8Array(body) },
+    BACKUP_UPLOAD_TIMEOUT_MS,
+  );
   if (!res.ok) throw new Error(s3ErrorMessage(res.status, await res.text().catch(() => "")));
 }
 
@@ -245,35 +256,59 @@ export interface S3Object {
   lastModified: string;
 }
 
-/** List objects under a prefix via ListObjectsV2 (used for retention pruning). */
+/** List every object under a prefix via paginated ListObjectsV2. */
 export async function listObjectsS3(config: ResolvedS3Config, prefix: string): Promise<S3Object[]> {
-  const query: Record<string, string> = { "list-type": "2" };
-  if (prefix) query.prefix = prefix;
-  const { url, headers } = signS3Request(config, {
-    method: "GET",
-    key: "",
-    query,
-    body: Buffer.alloc(0),
-  });
-  const res = await fetch(url, { method: "GET", headers });
-  if (!res.ok) throw new Error(s3ErrorMessage(res.status, await res.text().catch(() => "")));
-  const xml = await res.text();
   const objects: S3Object[] = [];
-  const re = /<Contents>([\s\S]*?)<\/Contents>/g;
-  let m: RegExpExecArray | null;
-  while ((m = re.exec(xml)) !== null) {
-    const block = m[1];
-    const key = /<Key>([^<]+)<\/Key>/.exec(block)?.[1];
-    const lastModified = /<LastModified>([^<]+)<\/LastModified>/.exec(block)?.[1] ?? "";
-    if (key) objects.push({ key, lastModified });
+  let continuationToken: string | undefined;
+
+  for (;;) {
+    const query: Record<string, string> = { "list-type": "2" };
+    if (prefix) query.prefix = prefix;
+    if (continuationToken) query["continuation-token"] = continuationToken;
+
+    const { url, headers } = signS3Request(config, {
+      method: "GET",
+      key: "",
+      query,
+      body: Buffer.alloc(0),
+    });
+    const res = await backupStorageFetch(
+      "S3",
+      url,
+      { method: "GET", headers },
+      BACKUP_METADATA_TIMEOUT_MS,
+    );
+    if (!res.ok) throw new Error(s3ErrorMessage(res.status, await res.text().catch(() => "")));
+
+    const xml = await res.text();
+    const re = /<Contents>([\s\S]*?)<\/Contents>/g;
+    let match: RegExpExecArray | null;
+    while ((match = re.exec(xml)) !== null) {
+      const key = xmlValue(match[1], "Key");
+      const lastModified = xmlValue(match[1], "LastModified") ?? "";
+      if (key) objects.push({ key, lastModified });
+    }
+
+    if (xmlValue(xml, "IsTruncated") !== "true") break;
+    const nextToken = xmlValue(xml, "NextContinuationToken");
+    if (!nextToken || nextToken === continuationToken) {
+      throw new Error("S3 returned a truncated object list without a new continuation token");
+    }
+    continuationToken = nextToken;
   }
+
   return objects;
 }
 
 /** Delete a single object. Throws a readable error on failure. */
 export async function deleteObjectS3(config: ResolvedS3Config, key: string): Promise<void> {
   const { url, headers } = signS3Request(config, { method: "DELETE", key, body: Buffer.alloc(0) });
-  const res = await fetch(url, { method: "DELETE", headers });
+  const res = await backupStorageFetch(
+    "S3",
+    url,
+    { method: "DELETE", headers },
+    BACKUP_METADATA_TIMEOUT_MS,
+  );
   // S3 returns 204 for a successful delete; treat any 2xx as success.
   if (!res.ok) throw new Error(s3ErrorMessage(res.status, await res.text().catch(() => "")));
 }

From 86496f14faa2fd448f910b64e1190b8edf68aa47 Mon Sep 17 00:00:00 2001
From: RandomCatboy <dylan@youhavethe.gay>
Date: Thu, 6 Aug 2026 21:22:56 +0200
Subject: [PATCH 2/5] The new patch resolves the outstanding security,
 performance, and scalability findings: - Shared PostgreSQL-backed login
 throttling with bounded cleanup and successful-login reset. - Streaming
 backup upload limits, bounded decompression, row ceilings, batched inserts,
 and non-blocking crypto/decompression. - Indexed webhook lookup with
 transactional synchronization and shared rate limiting. - Aggregated workflow
 scheduler queries with bounded concurrency. - Bounded inventory processing
 across dashboards, topology maps, access maps, security analysis, MCP output,
 and integration matching. - Database-ranked storage utilization instead of
 loading every storage pool. - Consistent oversized-dataset states on desktop
 and mobile. - Hook dependency suppressions removed. - Concurrent
 backup-retention cleanup. - Nonce-based production CSP with unsafe-eval
 limited to development.

After applying the patch, deploy the migration:
`npx prisma migrate deploy`
`npx prisma generate`
---
 next.config.ts                                |  16 --
 .../migration.sql                             |  54 ++++++
 prisma/schema.prisma                          |  28 ++-
 .../network/access-map/access-map-data.ts     |  58 +++++-
 .../(dashboard)/network/access-map/page.tsx   |  44 ++++-
 src/app/(dashboard)/page.tsx                  |  84 ++++++--
 src/app/api/admin/backup/import/route.ts      |  36 +++-
 src/app/api/auth/login/route.ts               |  35 ++++
 src/app/api/security/route.ts                 |  17 +-
 src/app/api/workflows/hooks/[token]/route.ts  |  61 ++----
 src/components/logs/threats/ticket-sheet.tsx  |  10 +-
 .../mobile/pages/home/mobile-home.tsx         |  21 +-
 .../security/mobile-research-notebook.tsx     |   7 +-
 .../settings/backup-restore-section.tsx       |  41 ++--
 src/lib/backup/archive-crypto.ts              | 107 +++++++++-
 src/lib/backup/backup.test.ts                 |  41 +++-
 src/lib/backup/destinations/index.test.ts     |  30 +++
 src/lib/backup/destinations/index.ts          |  34 +++-
 src/lib/backup/import.ts                      | 182 ++++++++++++++++--
 src/lib/backup/limits.ts                      |  21 ++
 src/lib/backup/request-body.ts                |  58 ++++++
 src/lib/dataset-budget.ts                     |  16 ++
 src/lib/instance/reset.test.ts                |   2 +
 src/lib/instance/reset.ts                     |   6 +-
 src/lib/integrations/cloudflare/sync.ts       |  29 ++-
 src/lib/integrations/sync-helpers.ts          |  14 +-
 src/lib/integrations/tailscale/sync.ts        |  38 ++--
 src/lib/inventory/identity-index.ts           |  54 ++++++
 src/lib/mcp/overview.ts                       |  95 +++++++--
 src/lib/rate-limit.ts                         | 112 +++++++++++
 src/lib/security/collect.ts                   |  35 ++++
 src/lib/services/cloudflare.ts                |   7 +-
 src/lib/services/tailscale.ts                 |   5 +-
 src/lib/topology/footprint-data.ts            |  85 +++++++-
 src/lib/workflows/scheduler.test.ts           |  37 ++++
 src/lib/workflows/scheduler.ts                |  59 +++++-
 src/lib/workflows/service.ts                  |  48 +++--
 src/lib/workflows/webhook-index.ts            | 106 ++++++++++
 src/middleware.test.ts                        |  18 ++
 src/middleware.ts                             |  73 +++++--
 40 files changed, 1579 insertions(+), 245 deletions(-)
 create mode 100644 prisma/migrations/20260806181000_request_limits_and_webhook_index/migration.sql
 create mode 100644 src/lib/backup/destinations/index.test.ts
 create mode 100644 src/lib/backup/limits.ts
 create mode 100644 src/lib/backup/request-body.ts
 create mode 100644 src/lib/dataset-budget.ts
 create mode 100644 src/lib/inventory/identity-index.ts
 create mode 100644 src/lib/rate-limit.ts
 create mode 100644 src/lib/workflows/webhook-index.ts

diff --git a/next.config.ts b/next.config.ts
index 0b78e0b..fe31044 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -20,22 +20,6 @@ const nextConfig: NextConfig = {
           { key: "X-Frame-Options", value: "DENY" },
           { key: "X-Content-Type-Options", value: "nosniff" },
           { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
-          {
-            // Self-hosted, fully self-contained app. Allow inline styles/scripts
-            // (Next injects some) but block framing and third-party origins.
-            key: "Content-Security-Policy",
-            value: [
-              "default-src 'self'",
-              "img-src 'self' data: blob:",
-              "style-src 'self' 'unsafe-inline'",
-              "script-src 'self' 'unsafe-inline' 'unsafe-eval'",
-              "connect-src 'self'",
-              "font-src 'self' data:",
-              "frame-ancestors 'none'",
-              "base-uri 'self'",
-              "form-action 'self'",
-            ].join("; "),
-          },
         ],
       },
     ];
diff --git a/prisma/migrations/20260806181000_request_limits_and_webhook_index/migration.sql b/prisma/migrations/20260806181000_request_limits_and_webhook_index/migration.sql
new file mode 100644
index 0000000..9d33ca6
--- /dev/null
+++ b/prisma/migrations/20260806181000_request_limits_and_webhook_index/migration.sql
@@ -0,0 +1,54 @@
+CREATE TABLE "RateLimitBucket" (
+  "key" TEXT NOT NULL,
+  "count" INTEGER NOT NULL,
+  "windowStartedAt" TIMESTAMP(3) NOT NULL,
+  "expiresAt" TIMESTAMP(3) NOT NULL,
+  "updatedAt" TIMESTAMP(3) NOT NULL,
+  CONSTRAINT "RateLimitBucket_pkey" PRIMARY KEY ("key")
+);
+
+CREATE INDEX "RateLimitBucket_expiresAt_idx" ON "RateLimitBucket"("expiresAt");
+
+CREATE TABLE "WorkflowWebhook" (
+  "token" TEXT NOT NULL,
+  "workflowId" TEXT NOT NULL,
+  "nodeId" TEXT NOT NULL,
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT "WorkflowWebhook_pkey" PRIMARY KEY ("token")
+);
+
+CREATE UNIQUE INDEX "WorkflowWebhook_workflowId_nodeId_key"
+  ON "WorkflowWebhook"("workflowId", "nodeId");
+CREATE INDEX "WorkflowWebhook_workflowId_idx"
+  ON "WorkflowWebhook"("workflowId");
+ALTER TABLE "WorkflowWebhook" ADD CONSTRAINT "WorkflowWebhook_workflowId_fkey"
+  FOREIGN KEY ("workflowId") REFERENCES "Workflow"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- Backfill existing webhook nodes. Tokens are already stored in workflow.graph;
+-- the materialized table only makes lookup indexed and bounded.
+INSERT INTO "WorkflowWebhook" ("token", "workflowId", "nodeId")
+SELECT
+  node->'config'->>'token',
+  workflow."id",
+  node->>'id'
+FROM "Workflow" AS workflow
+CROSS JOIN LATERAL jsonb_array_elements(
+  CASE
+    WHEN jsonb_typeof(workflow."graph"->'nodes') = 'array' THEN workflow."graph"->'nodes'
+    ELSE '[]'::jsonb
+  END
+) AS node
+WHERE node->>'kind' = 'trigger.webhook'
+  AND COALESCE(node->'config'->>'token', '') <> '';
+
+-- Integration identity resolution compares the first DNS label case-insensitively.
+-- Functional partial indexes avoid loading/scanning complete active inventories.
+CREATE INDEX "Device_active_normalized_name_idx"
+  ON "Device" ((lower(split_part(rtrim("name", '.'), '.', 1))))
+  WHERE "status"::text <> 'REMOVED';
+CREATE INDEX "VirtualMachine_active_normalized_name_idx"
+  ON "VirtualMachine" ((lower(split_part(rtrim("name", '.'), '.', 1))))
+  WHERE "status"::text <> 'REMOVED';
+CREATE INDEX "Container_active_normalized_name_idx"
+  ON "Container" ((lower(split_part(rtrim("name", '.'), '.', 1))))
+  WHERE "status"::text <> 'REMOVED';
diff --git a/prisma/schema.prisma b/prisma/schema.prisma
index e1ce550..a38e0a1 100644
--- a/prisma/schema.prisma
+++ b/prisma/schema.prisma
@@ -142,6 +142,18 @@ model AppSetting {
   updatedAt DateTime @updatedAt
 }
 
+/// Shared fixed-window counters used for login and public webhook throttling.
+/// Rows expire naturally and may be pruned by maintenance without affecting data.
+model RateLimitBucket {
+  key             String   @id
+  count           Int
+  windowStartedAt DateTime
+  expiresAt       DateTime
+  updatedAt       DateTime @updatedAt
+
+  @@index([expiresAt])
+}
+
 // ---------- integrations ----------
 
 model IntegrationConfig {
@@ -1208,11 +1220,25 @@ model Workflow {
   createdAt   DateTime @default(now())
   updatedAt   DateTime @updatedAt
 
-  runs WorkflowRun[]
+  runs     WorkflowRun[]
+  webhooks WorkflowWebhook[]
 
   @@index([name])
 }
 
+/// Materialized lookup for public webhook tokens. The source of truth remains
+/// the workflow graph; this table is rebuilt transactionally whenever a graph changes.
+model WorkflowWebhook {
+  token      String   @id
+  workflowId String
+  workflow   Workflow @relation(fields: [workflowId], references: [id], onDelete: Cascade)
+  nodeId     String
+  createdAt  DateTime @default(now())
+
+  @@unique([workflowId, nodeId])
+  @@index([workflowId])
+}
+
 /// One execution of a workflow. Step outputs are persisted with secret output
 /// keys redacted; secret values only exist in the one-time run response.
 model WorkflowRun {
diff --git a/src/app/(dashboard)/network/access-map/access-map-data.ts b/src/app/(dashboard)/network/access-map/access-map-data.ts
index 61bf8f7..77cbd29 100644
--- a/src/app/(dashboard)/network/access-map/access-map-data.ts
+++ b/src/app/(dashboard)/network/access-map/access-map-data.ts
@@ -1,6 +1,7 @@
 import "server-only";
 
 import { prisma } from "@/lib/db";
+import { assertDatasetBudget } from "@/lib/dataset-budget";
 import { anonymizeForDisplay } from "@/lib/privacy/server";
 import { deriveAccessGraph } from "@/lib/topology/access";
 import { resolveObservedAssetAddresses } from "@/lib/topology/address-evidence";
@@ -22,6 +23,23 @@ import {
   buildTailscaleTailnets,
 } from "./access-map-providers";
 
+const ACCESS_MAP_BUDGET = {
+  networks: 2_000,
+  firewallRules: 25_000,
+  aliases: 10_000,
+  integrationTypes: 100,
+  portForwards: 25_000,
+  addresses: 50_000,
+  guestInterfaces: 50_000,
+  leases: 50_000,
+  neighbors: 50_000,
+  wirelessNetworks: 10_000,
+  wirelessAps: 10_000,
+  switchConfigs: 2_000,
+  switchVlansPerConfig: 4_096,
+  switchPortsPerConfig: 2_000,
+} as const;
+
 /** Load, assemble, and anonymize the complete access-map render model. */
 export async function loadAccessMapData() {
   const [networkRows, rules, aliases, pveIpsets, activeIntegrations, cloudflareSnapshots, tailscaleSnapshots, edgePortForwards] = await Promise.all([
@@ -29,6 +47,7 @@ export async function loadAccessMapData() {
       where: { status: { not: "REMOVED" } },
       orderBy: { name: "asc" },
       select: { id: true, name: true, vlanId: true, cidr: true, gateway: true, externalId: true, purpose: true, source: true },
+      take: ACCESS_MAP_BUDGET.networks + 1,
     }),
     prisma.firewallRule.findMany({
       // Gateway-level rules only — Proxmox guest-isolation rules feed the
@@ -49,19 +68,23 @@ export async function loadAccessMapData() {
         metadata: true,
         source: true,
       },
+      take: ACCESS_MAP_BUDGET.firewallRules + 1,
     }),
     prisma.firewallAlias.findMany({
       where: { status: { not: "REMOVED" }, aliasType: { notIn: ["pve-ipset", "pve-alias"] } },
       select: { name: true, aliasType: true, content: true },
+      take: ACCESS_MAP_BUDGET.aliases + 1,
     }),
     prisma.firewallAlias.findMany({
       where: { status: { not: "REMOVED" }, aliasType: { in: ["pve-ipset", "pve-alias"] } },
       select: { name: true, content: true },
+      take: ACCESS_MAP_BUDGET.aliases + 1,
     }),
     prisma.integrationConfig.findMany({
       where: { enabled: true },
       select: { type: true },
       distinct: ["type"],
+      take: ACCESS_MAP_BUDGET.integrationTypes + 1,
     }),
     listStoredCloudflareSnapshots(),
     listStoredTailscaleSnapshots(),
@@ -79,9 +102,17 @@ export async function loadAccessMapData() {
         descriptionText: true,
         source: true,
       },
+      take: ACCESS_MAP_BUDGET.portForwards + 1,
     }),
   ]);
 
+  assertDatasetBudget("Access-map networks", networkRows, ACCESS_MAP_BUDGET.networks);
+  assertDatasetBudget("Access-map firewall rules", rules, ACCESS_MAP_BUDGET.firewallRules);
+  assertDatasetBudget("Access-map firewall aliases", aliases, ACCESS_MAP_BUDGET.aliases);
+  assertDatasetBudget("Access-map Proxmox address sets", pveIpsets, ACCESS_MAP_BUDGET.aliases);
+  assertDatasetBudget("Access-map integration types", activeIntegrations, ACCESS_MAP_BUDGET.integrationTypes);
+  assertDatasetBudget("Access-map edge port forwards", edgePortForwards, ACCESS_MAP_BUDGET.portForwards);
+
   const pveAddressSets = pveIpsets.map((set) => ({ name: set.name, entries: set.content }));
   const integrationEvidence = buildIntegrationEvidence(
     activeIntegrations.map(({ type }) => type),
@@ -120,6 +151,7 @@ export async function loadAccessMapData() {
           },
         },
       },
+      take: ACCESS_MAP_BUDGET.addresses + 1,
     }),
     prisma.networkInterface.findMany({
       where: {
@@ -132,17 +164,25 @@ export async function loadAccessMapData() {
         vm: { select: { id: true, externalId: true, name: true, metadata: true } },
         container: { select: { id: true, externalId: true, name: true, metadata: true } },
       },
+      take: ACCESS_MAP_BUDGET.guestInterfaces + 1,
     }),
     prisma.dhcpLease.findMany({
       where: { status: { not: "REMOVED" } },
       select: { id: true, ipAddress: true, macAddress: true, hostname: true, isStatic: true, networkId: true },
+      take: ACCESS_MAP_BUDGET.leases + 1,
     }),
     prisma.networkNeighbor.findMany({
       where: { status: { not: "REMOVED" }, permanent: false },
       select: { id: true, ipAddress: true, macAddress: true, hostname: true, manufacturer: true, networkId: true },
+      take: ACCESS_MAP_BUDGET.neighbors + 1,
     }),
   ]);
 
+  assertDatasetBudget("Access-map IP addresses", ips, ACCESS_MAP_BUDGET.addresses);
+  assertDatasetBudget("Access-map guest interfaces", guestInterfaces, ACCESS_MAP_BUDGET.guestInterfaces);
+  assertDatasetBudget("Access-map DHCP leases", leases, ACCESS_MAP_BUDGET.leases);
+  assertDatasetBudget("Access-map network neighbors", neighbors, ACCESS_MAP_BUDGET.neighbors);
+
   const resolvedGuestObservations = resolveObservedAssetAddresses(
     guestInterfaces.flatMap((iface) => {
       const ownerId = iface.vm?.id ?? iface.container?.id;
@@ -194,20 +234,28 @@ export async function loadAccessMapData() {
         vlanId: true,
         networkId: true,
       },
+      take: ACCESS_MAP_BUDGET.wirelessNetworks + 1,
     }),
     prisma.wirelessAp.findMany({
       where: { status: { not: "REMOVED" } },
       orderBy: { name: "asc" },
       select: { id: true, name: true, model: true },
+      take: ACCESS_MAP_BUDGET.wirelessAps + 1,
     }),
   ]);
+  assertDatasetBudget("Access-map wireless networks", wifiSsids, ACCESS_MAP_BUDGET.wirelessNetworks);
+  assertDatasetBudget("Access-map wireless access points", wifiAps, ACCESS_MAP_BUDGET.wirelessAps);
 
   const switchConfigs = await prisma.switchConfig.findMany({
     include: {
       device: { select: { id: true, name: true } },
-      vlans: { select: { vlanId: true, svIpAddress: true, networkId: true } },
+      vlans: {
+        take: ACCESS_MAP_BUDGET.switchVlansPerConfig + 1,
+        select: { vlanId: true, svIpAddress: true, networkId: true },
+      },
       ports: {
         orderBy: { sortOrder: "asc" },
+        take: ACCESS_MAP_BUDGET.switchPortsPerConfig + 1,
         select: {
           shortName: true,
           description: true,
@@ -223,7 +271,13 @@ export async function loadAccessMapData() {
         },
       },
     },
+    take: ACCESS_MAP_BUDGET.switchConfigs + 1,
   });
+  assertDatasetBudget("Access-map switch configurations", switchConfigs, ACCESS_MAP_BUDGET.switchConfigs);
+  for (const config of switchConfigs) {
+    assertDatasetBudget("VLANs in one access-map switch", config.vlans, ACCESS_MAP_BUDGET.switchVlansPerConfig);
+    assertDatasetBudget("Ports in one access-map switch", config.ports, ACCESS_MAP_BUDGET.switchPortsPerConfig);
+  }
 
   const edgeIngressRules = edgePortForwards.map((forward) => ({
     id: `edge-nat:${forward.id}`,
@@ -395,7 +449,9 @@ export async function loadAccessMapData() {
         enabled: true,
         metadata: true,
       },
+      take: ACCESS_MAP_BUDGET.firewallRules + 1,
     });
+  assertDatasetBudget("Access-map Proxmox firewall rules", pveRules, ACCESS_MAP_BUDGET.firewallRules);
 
   const { pve, homeNetworkId, groupRuleCount } = buildAccessMapPveData(
     guestInterfaces,
diff --git a/src/app/(dashboard)/network/access-map/page.tsx b/src/app/(dashboard)/network/access-map/page.tsx
index 35370b6..ef06e3e 100644
--- a/src/app/(dashboard)/network/access-map/page.tsx
+++ b/src/app/(dashboard)/network/access-map/page.tsx
@@ -2,12 +2,16 @@ import Link from "next/link";
 import { Waypoints } from "lucide-react";
 import { requirePageUser } from "@/lib/auth/guards";
 import { isMobileView } from "@/lib/device";
+import { DatasetBudgetExceededError } from "@/lib/dataset-budget";
 import { PageHeader } from "@/components/shared/page-header";
 import { EmptyState } from "@/components/shared/empty-state";
 import { Button } from "@/components/ui/button";
 import { Badge } from "@/components/ui/badge";
 import { NetworkAccessMap } from "@/components/topology/network-access-map";
 import { MobileAccessMap } from "@/components/mobile/pages/maps/mobile-access-map";
+import { MobilePageHeader } from "@/components/mobile/ui/mobile-page-header";
+import { MobilePage } from "@/components/mobile/ui/mobile-page";
+import { MobileEmpty } from "@/components/mobile/ui/mobile-list";
 import { loadAccessMapData } from "./access-map-data";
 
 export const dynamic = "force-dynamic";
@@ -16,6 +20,42 @@ export const metadata = { title: "Access map" };
 
 export default async function AccessMapPage() {
   const { user } = await requirePageUser();
+  const mobile = await isMobileView();
+
+  let data: Awaited<ReturnType<typeof loadAccessMapData>>;
+  try {
+    data = await loadAccessMapData();
+  } catch (err) {
+    if (!(err instanceof DatasetBudgetExceededError)) throw err;
+    const description = `${err.dataset} exceeds the safe processing budget. Archive stale inventory records, then reload this view.`;
+    if (mobile) {
+      return (
+        <>
+          <MobilePageHeader title="Access map" />
+          <MobilePage>
+            <MobileEmpty
+              icon={<Waypoints />}
+              title="Access map paused"
+              description={description}
+            />
+          </MobilePage>
+        </>
+      );
+    }
+    return (
+      <div>
+        <PageHeader
+          title="Access map"
+          description="One reachability view assembled from every connected source: gateway policy, Proxmox workload firewalls, observed addresses, switching, and WiFi."
+        />
+        <EmptyState
+          icon={Waypoints}
+          title="Access map paused"
+          description={description}
+        />
+      </div>
+    );
+  }
 
   const {
     display,
@@ -23,9 +63,9 @@ export default async function AccessMapPage() {
     homeNetworkId,
     hasSwitchConfigs,
     empty,
-  } = await loadAccessMapData();
+  } = data;
 
-  if (await isMobileView()) {
+  if (mobile) {
     return (
       <MobileAccessMap
         graph={display.graph}
diff --git a/src/app/(dashboard)/page.tsx b/src/app/(dashboard)/page.tsx
index 74a46e6..2fa8d9d 100644
--- a/src/app/(dashboard)/page.tsx
+++ b/src/app/(dashboard)/page.tsx
@@ -17,9 +17,11 @@ import {
   Server,
   Share2,
   Shield,
+  TriangleAlert,
   Wifi,
   type LucideIcon,
 } from "lucide-react";
+import { Prisma } from "@prisma/client";
 import { prisma } from "@/lib/db";
 import { requirePageUser } from "@/lib/auth/guards";
 import { isMobileView } from "@/lib/device";
@@ -27,6 +29,7 @@ import { anonymizeForDisplay } from "@/lib/privacy/server";
 import { formatBytes, formatRelative } from "@/lib/format";
 import { isLiveQueryType, type IntegrationTypeValue } from "@/lib/types";
 import { loadFootprintInput } from "@/lib/topology/footprint-data";
+import { DatasetBudgetExceededError } from "@/lib/dataset-budget";
 import { deriveFootprint } from "@/lib/topology/footprint";
 import { FootprintMap } from "@/components/topology/footprint-map";
 import { MobileHome } from "@/components/mobile/pages/home/mobile-home";
@@ -61,20 +64,51 @@ interface StatTile {
   count: number;
 }
 
+interface DashboardStoragePool {
+  id: string;
+  name: string;
+  type: string | null;
+  totalBytes: bigint | null;
+  usedBytes: bigint | null;
+}
+
+const DASHBOARD_INTEGRATION_LIMIT = 100;
+
 export default async function DashboardHomePage() {
   const { user } = await requirePageUser();
   const isAdmin = user.role === "ADMIN";
 
   const notRemoved = { status: { not: "REMOVED" as const } };
-  const [footprintInput, hosts, vms, containers, networks, services, docs, rawIntegrations, rawPools] =
-    await Promise.all([
-      loadFootprintInput(),
+  const footprintPromise = loadFootprintInput()
+    .then((input) => ({ input, unavailableReason: null as string | null }))
+    .catch((err: unknown) => {
+      console.error("[dashboard] footprint load failed:", err);
+      const unavailableReason = err instanceof DatasetBudgetExceededError
+        ? `${err.message} The inventory counts remain available, but the full map is paused to protect app performance.`
+        : "The topology map could not be generated. Inventory counts and the rest of the dashboard are still available.";
+      return { input: null, unavailableReason };
+    });
+
+  const [
+    footprintResult,
+    hosts,
+    vms,
+    containers,
+    networks,
+    services,
+    docs,
+    integrationCount,
+    rawIntegrations,
+    rawPools,
+  ] = await Promise.all([
+      footprintPromise,
       prisma.device.count({ where: notRemoved }),
       prisma.virtualMachine.count({ where: notRemoved }),
       prisma.container.count({ where: notRemoved }),
       prisma.network.count({ where: notRemoved }),
       prisma.service.count({ where: notRemoved }),
       prisma.docPage.count(),
+      prisma.integrationConfig.count(),
       prisma.integrationConfig.findMany({
         select: {
           id: true,
@@ -86,15 +120,24 @@ export default async function DashboardHomePage() {
           lastSyncError: true,
         },
         orderBy: { createdAt: "asc" },
+        take: DASHBOARD_INTEGRATION_LIMIT,
       }),
-      prisma.storagePool.findMany({
-        where: { ...notRemoved, totalBytes: { not: null } },
-        select: { id: true, name: true, type: true, totalBytes: true, usedBytes: true },
-      }),
+      prisma.$queryRaw<DashboardStoragePool[]>(Prisma.sql`
+        SELECT "id", "name", "type", "totalBytes", "usedBytes"
+        FROM "StoragePool"
+        WHERE "status"::text <> 'REMOVED' AND "totalBytes" IS NOT NULL
+        ORDER BY CASE
+          WHEN "totalBytes" > 0 THEN COALESCE("usedBytes", 0)::numeric / "totalBytes"
+          ELSE 0
+        END DESC, "name" ASC
+        LIMIT 6
+      `),
     ]);
 
-  const footprint = await anonymizeForDisplay(deriveFootprint(footprintInput));
-  const hasFootprint = footprintInput.machines.length > 0;
+  const footprint = footprintResult.input
+    ? await anonymizeForDisplay(deriveFootprint(footprintResult.input))
+    : null;
+  const hasFootprint = Boolean(footprintResult.input && footprintResult.input.machines.length > 0);
   const integrations = await anonymizeForDisplay(rawIntegrations);
   const pools = await anonymizeForDisplay(rawPools);
 
@@ -122,7 +165,9 @@ export default async function DashboardHomePage() {
         tiles={tiles}
         footprint={footprint}
         hasFootprint={hasFootprint}
+        footprintUnavailableReason={footprintResult.unavailableReason}
         integrations={integrations}
+        integrationCount={integrationCount}
         integrationIcons={INTEGRATION_ICONS}
         pools={topPools}
         isAdmin={isAdmin}
@@ -152,7 +197,13 @@ export default async function DashboardHomePage() {
       </div>
 
       {/* Footprint map */}
-      {hasFootprint ? (
+      {footprintResult.unavailableReason ? (
+        <EmptyState
+          icon={TriangleAlert}
+          title="Topology map paused"
+          description={footprintResult.unavailableReason}
+        />
+      ) : hasFootprint && footprint ? (
         <FootprintMap graph={footprint} />
       ) : (
         <EmptyState
@@ -173,9 +224,16 @@ export default async function DashboardHomePage() {
 
       {/* Integration health */}
       <section>
-        <h2 className="mb-3 text-sm font-medium uppercase tracking-wider text-muted-foreground">
-          Integrations
-        </h2>
+        <div className="mb-3 flex flex-wrap items-baseline justify-between gap-2">
+          <h2 className="text-sm font-medium uppercase tracking-wider text-muted-foreground">
+            Integrations
+          </h2>
+          {integrationCount > integrations.length && (
+            <p className="text-xs text-muted-foreground">
+              Showing {integrations.length} of {integrationCount}
+            </p>
+          )}
+        </div>
         {integrations.length === 0 ? (
           <EmptyState
             icon={Plug}
diff --git a/src/app/api/admin/backup/import/route.ts b/src/app/api/admin/backup/import/route.ts
index a2ff5de..d4e5c47 100644
--- a/src/app/api/admin/backup/import/route.ts
+++ b/src/app/api/admin/backup/import/route.ts
@@ -1,7 +1,9 @@
 import type { NextRequest } from "next/server";
 import { ApiError, handleApi, jsonOk } from "@/lib/api";
 import { requireAdmin } from "@/lib/auth/guards";
-import { decodeBackupFile, prepareBackupForRestore, previewRestore, restoreArchive } from "@/lib/backup/import";
+import { decodeBackupFileAsync, prepareBackupForRestore, previewRestore, restoreArchive } from "@/lib/backup/import";
+import { BackupLimitError } from "@/lib/backup/limits";
+import { assertBackupFileSize, readBackupRequestBody } from "@/lib/backup/request-body";
 
 /**
  * POST /api/admin/backup/import — restore this PolySIEM instance from a backup
@@ -22,24 +24,37 @@ export const POST = handleApi(async (req: NextRequest) => {
   const previewParam = new URL(req.url).searchParams.get("preview");
   let preview = previewParam === "1" || previewParam === "true";
   let confirm = req.headers.get("x-confirm-restore") === "true";
-  let password: string | undefined;
+  let password = req.headers.get("x-backup-password") || undefined;
 
-  let buffer: Buffer;
+  const requestBody = await readBackupRequestBody(req);
+  let buffer = requestBody;
   const contentType = req.headers.get("content-type") ?? "";
   if (contentType.includes("multipart/form-data")) {
-    const form = await req.formData();
+    // Parse multipart only after the raw stream has passed the same hard byte
+    // ceiling as direct uploads. Calling req.formData() first would allow a
+    // chunked request to grow without a trustworthy Content-Length header.
+    const boundedRequest = new Request(req.url, {
+      method: "POST",
+      headers: { "Content-Type": contentType },
+      body: new Uint8Array(requestBody),
+    });
+    let form: FormData;
+    try {
+      form = await boundedRequest.formData();
+    } catch {
+      throw new ApiError(400, "invalid_request", "The multipart backup upload is malformed.");
+    }
     const file = form.get("file");
     if (!(file instanceof File)) {
       throw new ApiError(400, "invalid_request", "Expected a backup file in the 'file' form field.");
     }
+    assertBackupFileSize(file.size);
     buffer = Buffer.from(await file.arrayBuffer());
     if (form.get("mode") === "preview") preview = true;
     const confirmField = form.get("confirm");
     if (confirmField === "true" || confirmField === "1") confirm = true;
     const passwordField = form.get("password");
     if (typeof passwordField === "string" && passwordField.length > 0) password = passwordField;
-  } else {
-    buffer = Buffer.from(await req.arrayBuffer());
   }
 
   if (buffer.byteLength === 0) {
@@ -50,12 +65,15 @@ export const POST = handleApi(async (req: NextRequest) => {
   // version, unknown model). Surface those to the client as a 400 rather than
   // letting handleApi mask them behind a generic 500 — the operator needs to
   // know exactly why their file was rejected.
-  let decoded;
-  let archive;
+  let decoded: Awaited<ReturnType<typeof decodeBackupFileAsync>>;
+  let archive: ReturnType<typeof prepareBackupForRestore>;
   try {
-    decoded = decodeBackupFile(buffer, password);
+    decoded = await decodeBackupFileAsync(buffer, password);
     archive = prepareBackupForRestore(decoded);
   } catch (err) {
+    if (err instanceof BackupLimitError) {
+      throw new ApiError(413, "backup_too_large", err.message);
+    }
     throw new ApiError(400, "invalid_backup", err instanceof Error ? err.message : "Invalid backup file.");
   }
 
diff --git a/src/app/api/auth/login/route.ts b/src/app/api/auth/login/route.ts
index 5a4134c..fee473a 100644
--- a/src/app/api/auth/login/route.ts
+++ b/src/app/api/auth/login/route.ts
@@ -6,9 +6,39 @@ import { createSession, requestMeta, SESSION_COOKIE, sessionCookieOptions } from
 import { loginSchema } from "@/lib/validators/auth";
 import { audit } from "@/lib/audit";
 import { THEME_COOKIE, MODE_COOKIE } from "@/lib/theme";
+import { clearRateLimit, consumeRateLimit, pruneExpiredRateLimits, trustedClientIp } from "@/lib/rate-limit";
+
+const ACCOUNT_LIMIT = { limit: 10, windowMs: 15 * 60_000 } as const;
+const IP_LIMIT = { limit: 60, windowMs: 15 * 60_000 } as const;
+const GLOBAL_LIMIT = { limit: 300, windowMs: 15 * 60_000 } as const;
 
 export const POST = handleApi(async (req: NextRequest) => {
   const input = loginSchema.parse(await req.json());
+  const normalizedUsername = input.username.trim().toLowerCase();
+  const clientIp = trustedClientIp(req);
+  await pruneExpiredRateLimits();
+
+  // Check the global circuit breaker first. Once it is exhausted, do not create
+  // attacker-controlled account buckets for arbitrary usernames.
+  const globalLimit = await consumeRateLimit("login-global", "all", GLOBAL_LIMIT);
+  if (!globalLimit.allowed) {
+    return NextResponse.json(
+      { error: { code: "rate_limited", message: "Too many login attempts. Try again shortly." } },
+      { status: 429, headers: { "Retry-After": String(globalLimit.retryAfterSeconds) } },
+    );
+  }
+
+  const identityLimits = await Promise.all([
+    consumeRateLimit("login-account", normalizedUsername, ACCOUNT_LIMIT),
+    ...(clientIp ? [consumeRateLimit("login-ip", clientIp, IP_LIMIT)] : []),
+  ]);
+  const blocked = identityLimits.find((limit) => !limit.allowed);
+  if (blocked) {
+    return NextResponse.json(
+      { error: { code: "rate_limited", message: "Too many login attempts. Try again shortly." } },
+      { status: 429, headers: { "Retry-After": String(blocked.retryAfterSeconds) } },
+    );
+  }
 
   const user = await prisma.user.findUnique({ where: { username: input.username } });
   // Always verify against a hash to keep timing consistent.
@@ -20,6 +50,11 @@ export const POST = handleApi(async (req: NextRequest) => {
     return jsonError(401, "invalid_credentials", "Invalid username or password");
   }
 
+  await Promise.all([
+    clearRateLimit("login-account", normalizedUsername),
+    ...(clientIp ? [clearRateLimit("login-ip", clientIp)] : []),
+  ]);
+
   const { token, expiresAt } = await createSession(user.id, await requestMeta());
   await audit({ type: "user", userId: user.id }, "auth.login");
 
diff --git a/src/app/api/security/route.ts b/src/app/api/security/route.ts
index b42d3a8..6a9b02d 100644
--- a/src/app/api/security/route.ts
+++ b/src/app/api/security/route.ts
@@ -1,12 +1,13 @@
 import type { NextRequest } from "next/server";
 import { z } from "zod";
-import { handleApi, jsonOk } from "@/lib/api";
+import { ApiError, handleApi, jsonOk } from "@/lib/api";
 import { requireAdmin, requireUser } from "@/lib/auth/guards";
 import { SETTING_KEYS, getSetting, setSetting } from "@/lib/settings";
 import { runSecurityChecks } from "@/lib/security/checks";
 import { collectSecuritySnapshot } from "@/lib/security/collect";
 import { computeScore } from "@/lib/security/score";
 import type { SecurityReport } from "@/lib/security/types";
+import { DatasetBudgetExceededError } from "@/lib/dataset-budget";
 
 export const dynamic = "force-dynamic";
 
@@ -17,7 +18,19 @@ async function getDismissedIds(): Promise<string[]> {
 }
 
 async function buildReport(): Promise<SecurityReport> {
-  const snapshot = await collectSecuritySnapshot();
+  let snapshot: Awaited<ReturnType<typeof collectSecuritySnapshot>>;
+  try {
+    snapshot = await collectSecuritySnapshot();
+  } catch (err) {
+    if (err instanceof DatasetBudgetExceededError) {
+      throw new ApiError(
+        503,
+        "dataset_too_large",
+        `${err.message} Narrow or archive stale inventory before running the security advisor again.`,
+      );
+    }
+    throw err;
+  }
   const all = runSecurityChecks(snapshot);
   const dismissedSet = new Set(await getDismissedIds());
   const findings = all.filter((f) => !dismissedSet.has(f.id));
diff --git a/src/app/api/workflows/hooks/[token]/route.ts b/src/app/api/workflows/hooks/[token]/route.ts
index 9f39e9a..4526f95 100644
--- a/src/app/api/workflows/hooks/[token]/route.ts
+++ b/src/app/api/workflows/hooks/[token]/route.ts
@@ -1,11 +1,10 @@
 import type { NextRequest } from "next/server";
 import { ApiError, handleApi, jsonOk } from "@/lib/api";
-import { prisma } from "@/lib/db";
 import type { AuditActor } from "@/lib/audit";
+import { consumeRateLimit } from "@/lib/rate-limit";
 import { validateRunInput, validateTriggerParams } from "@/lib/workflows/engine";
 import { executeWorkflow } from "@/lib/workflows/executor";
-import { WEBHOOK_TRIGGER_KIND } from "@/lib/workflows/actions/trigger-webhook";
-import type { WorkflowGraph, WorkflowNodeSpec } from "@/lib/workflows/types";
+import { findIndexedWebhook } from "@/lib/workflows/webhook-index";
 
 type Ctx = { params: Promise<{ token: string }> };
 
@@ -13,37 +12,7 @@ export const dynamic = "force-dynamic";
 
 /** Webhook runs are started by the outside world, not a session user. */
 const SYSTEM_ACTOR: AuditActor = { type: "system" };
-
-// ---------------------------------------------------------------------------
-// In-memory rate limit: max runs per token per sliding minute. Only known
-// tokens are tracked, so the map is bounded by the number of webhook
-// workflows; a process restart simply resets the window.
-// ---------------------------------------------------------------------------
-
-const RATE_LIMIT_PER_MINUTE = 30;
-const RATE_WINDOW_MS = 60_000;
-const hitLog = new Map<string, number[]>();
-
-function rateLimited(token: string): boolean {
-  const now = Date.now();
-  const hits = (hitLog.get(token) ?? []).filter((t) => now - t < RATE_WINDOW_MS);
-  if (hits.length >= RATE_LIMIT_PER_MINUTE) {
-    hitLog.set(token, hits);
-    return true;
-  }
-  hits.push(now);
-  hitLog.set(token, hits);
-  return false;
-}
-
-/** The webhook-trigger node of a graph carrying exactly this token. */
-function webhookNodeWithToken(graph: WorkflowGraph, token: string): WorkflowNodeSpec | null {
-  return (
-    graph.nodes?.find?.(
-      (n) => n.kind === WEBHOOK_TRIGGER_KIND && typeof n.config?.token === "string" && n.config.token === token,
-    ) ?? null
-  );
-}
+const WEBHOOK_LIMIT = { limit: 30, windowMs: 60_000 } as const;
 
 /**
  * POST /api/workflows/hooks/[token] — PUBLIC entry point for webhook-triggered
@@ -59,16 +28,16 @@ export const POST = handleApi(async (req: NextRequest, ctx: Ctx) => {
   }
 
   // Disabled workflows are indistinguishable from unknown tokens on purpose.
-  const workflows = await prisma.workflow.findMany({ where: { enabled: true } });
-  const match = workflows
-    .map((w) => ({ workflow: w, node: webhookNodeWithToken(w.graph as unknown as WorkflowGraph, token) }))
-    .find((m) => m.node !== null);
-  if (!match?.node) {
-    throw new ApiError(404, "unknown_hook", "unknown hook");
-  }
-
-  if (rateLimited(token)) {
-    throw new ApiError(429, "rate_limited", `This hook is limited to ${RATE_LIMIT_PER_MINUTE} runs per minute — retry shortly`);
+  const match = await findIndexedWebhook(token);
+  if (!match) throw new ApiError(404, "unknown_hook", "unknown hook");
+
+  const limit = await consumeRateLimit("workflow-webhook", token, WEBHOOK_LIMIT);
+  if (!limit.allowed) {
+    throw new ApiError(
+      429,
+      "rate_limited",
+      `This hook is limited to ${WEBHOOK_LIMIT.limit} runs per minute — retry in ${limit.retryAfterSeconds}s`,
+    );
   }
 
   const body: unknown = await req.json().catch(() => null);
@@ -85,9 +54,7 @@ export const POST = handleApi(async (req: NextRequest, ctx: Ctx) => {
     throw new ApiError(422, "invalid_input", `Invalid webhook payload: ${errors.join("; ")}`);
   }
 
-  // A graph may hold several webhook triggers; activate the one whose token
-  // was called, so only its branch runs.
-  const result = await executeWorkflow(SYSTEM_ACTOR, match.workflow.id, values, {
+  const result = await executeWorkflow(SYSTEM_ACTOR, match.workflowId, values, {
     trigger: "webhook",
     triggerNodeId: match.node.id,
   });
diff --git a/src/components/logs/threats/ticket-sheet.tsx b/src/components/logs/threats/ticket-sheet.tsx
index 6221bf6..1b2cb0b 100644
--- a/src/components/logs/threats/ticket-sheet.tsx
+++ b/src/components/logs/threats/ticket-sheet.tsx
@@ -1,6 +1,6 @@
 "use client";
 
-import { useEffect, useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import { FileText, Pencil, RotateCcw, ShieldCheck, Sparkles, UserRound } from "lucide-react";
 import { toast } from "sonner";
 import { Badge } from "@/components/ui/badge";
@@ -64,15 +64,19 @@ export function TicketSheet({
   const [editSummary, setEditSummary] = useState("");
   const [editSeverity, setEditSeverity] = useState<TicketSeverityValue>("MEDIUM");
 
-  // Reset transient state whenever a different ticket is shown.
+  // Reset transient state only when selection changes; live updates to the
+  // same ticket must not overwrite an in-progress edit draft.
+  const draftTicketId = useRef<string | null>(null);
   useEffect(() => {
+    if (draftTicketId.current === ticket?.id) return;
+    draftTicketId.current = ticket?.id ?? null;
     setEditing(false);
     if (ticket) {
       setEditTitle(ticket.title);
       setEditSummary(ticket.summary);
       setEditSeverity(ticket.severity);
     }
-  }, [ticket?.id]); // eslint-disable-line react-hooks/exhaustive-deps
+  }, [ticket]);
 
   if (!ticket) return null;
   const isClosed = ticket.status === "CLOSED";
diff --git a/src/components/mobile/pages/home/mobile-home.tsx b/src/components/mobile/pages/home/mobile-home.tsx
index f341de1..f2db40a 100644
--- a/src/components/mobile/pages/home/mobile-home.tsx
+++ b/src/components/mobile/pages/home/mobile-home.tsx
@@ -57,15 +57,19 @@ export function MobileHome({
   tiles,
   footprint,
   hasFootprint,
+  footprintUnavailableReason,
   integrations,
+  integrationCount,
   integrationIcons,
   pools,
   isAdmin,
 }: {
   tiles: HomeTile[];
-  footprint: FootprintGraph;
+  footprint: FootprintGraph | null;
   hasFootprint: boolean;
+  footprintUnavailableReason?: string | null;
   integrations: HomeIntegration[];
+  integrationCount: number;
   integrationIcons: Record<IntegrationTypeValue, LucideIcon>;
   pools: HomePool[];
   isAdmin: boolean;
@@ -100,7 +104,7 @@ export function MobileHome({
         </div>
 
         {/* Attack-surface strip (chips the desktop map overlays) */}
-        {hasFootprint && (
+        {hasFootprint && footprint && (
           <MobileStatStrip>
             <MobileStat
               label="Open ports"
@@ -143,7 +147,7 @@ export function MobileHome({
             ) : undefined
           }
         >
-          {hasFootprint ? (
+          {hasFootprint && footprint ? (
             <div className="-mx-3.5 h-[42svh]">
               <FootprintMap
                 graph={footprint}
@@ -154,9 +158,9 @@ export function MobileHome({
           ) : (
             <MobileEmpty
               icon={<MapIcon />}
-              title="No footprint to draw yet"
-              description="Connect an integration and the dashboard will map your whole lab: machines, networks, and every inbound path."
-              action={addIntegration}
+              title={footprintUnavailableReason ? "Topology map paused" : "No footprint to draw yet"}
+              description={footprintUnavailableReason ?? "Connect an integration and the dashboard will map your whole lab: machines, networks, and every inbound path."}
+              action={footprintUnavailableReason ? undefined : addIntegration}
             />
           )}
         </MobileSection>
@@ -216,6 +220,11 @@ export function MobileHome({
               })}
             </MobileList>
           )}
+          {integrationCount > integrations.length && (
+            <p className="px-1 pt-2 text-xs text-muted-foreground">
+              Showing {integrations.length} of {integrationCount} integrations.
+            </p>
+          )}
         </MobileSection>
 
         {/* Storage */}
diff --git a/src/components/mobile/pages/security/mobile-research-notebook.tsx b/src/components/mobile/pages/security/mobile-research-notebook.tsx
index 18dc048..6ab0109 100644
--- a/src/components/mobile/pages/security/mobile-research-notebook.tsx
+++ b/src/components/mobile/pages/security/mobile-research-notebook.tsx
@@ -1,6 +1,6 @@
 "use client";
 
-import { useEffect, useMemo, useState, type ReactNode } from "react";
+import { useEffect, useMemo, useRef, useState, type ReactNode } from "react";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import {
   Archive,
@@ -160,12 +160,15 @@ export function MobileResearchNotebook() {
   // Unlike desktop (sidebar + page), the phone shows the index until a page is picked.
   const activePage = selectedMobilePage(pages, activeId);
 
+  const draftPageId = useRef<string | null>(null);
   useEffect(() => {
+    if (draftPageId.current === activePage?.id) return;
+    draftPageId.current = activePage?.id ?? null;
     if (activePage) {
       setNotes(activePage.notes ?? "");
       setTitle(activePage.title);
     }
-  }, [activePage?.id]); // eslint-disable-line react-hooks/exhaustive-deps
+  }, [activePage]);
 
   useEffect(() => {
     const subject = new URLSearchParams(window.location.search).get("subject")?.trim();
diff --git a/src/components/settings/backup-restore-section.tsx b/src/components/settings/backup-restore-section.tsx
index 9e8ce29..a03441a 100644
--- a/src/components/settings/backup-restore-section.tsx
+++ b/src/components/settings/backup-restore-section.tsx
@@ -6,6 +6,7 @@ import { AlertTriangle, Download, Loader2, ShieldAlert, Upload } from "lucide-re
 import { toast } from "sonner";
 import { formatDateTime } from "@/lib/format";
 import type { RestoreSummary } from "@/lib/backup/types";
+import { BACKUP_IMPORT_LIMITS, formatMiB } from "@/lib/backup/limits";
 import {
   AlertDialog,
   AlertDialogAction,
@@ -22,9 +23,24 @@ import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
 import { BACKUP_KEY } from "./backup-shared";
 
-/** Multipart POST that speaks the `{ data } / { error }` API shape. */
-async function postFile<T>(url: string, form: FormData, headers?: Record<string, string>): Promise<T> {
-  const res = await fetch(url, { method: "POST", body: form, headers });
+/** Bounded backup upload that speaks the `{ data } / { error }` API shape. */
+async function postBackupFile<T>(
+  url: string,
+  file: File,
+  password: string,
+  headers?: Record<string, string>,
+): Promise<T> {
+  if (file.size > BACKUP_IMPORT_LIMITS.uploadBytes) {
+    throw new Error(`Backup files are limited to ${formatMiB(BACKUP_IMPORT_LIMITS.uploadBytes)}.`);
+  }
+  const form = new FormData();
+  form.set("file", file);
+  if (password) form.set("password", password);
+  const res = await fetch(url, {
+    method: "POST",
+    body: form,
+    headers,
+  });
   let json: unknown = null;
   try {
     json = await res.json();
@@ -86,12 +102,8 @@ export function BackupRestoreSection() {
   });
 
   const runPreview = useMutation({
-    mutationFn: ({ file, password }: { file: File; password: string }) => {
-      const form = new FormData();
-      form.append("file", file);
-      if (password) form.append("password", password);
-      return postFile<RestoreSummary>("/api/admin/backup/import?preview=1", form);
-    },
+    mutationFn: ({ file, password }: { file: File; password: string }) =>
+      postBackupFile<RestoreSummary>("/api/admin/backup/import?preview=1", file, password),
     onSuccess: (summary) => setPreview(summary),
     onError: (err: Error) => {
       toast.error(err.message);
@@ -191,6 +203,9 @@ export function BackupRestoreSection() {
                   Replaces <strong>all</strong> current data with the contents of a backup archive. You will
                   be shown a summary and asked to confirm first.
                 </p>
+                <p className="mt-1 text-xs text-muted-foreground">
+                  Maximum upload: {formatMiB(BACKUP_IMPORT_LIMITS.uploadBytes)}.
+                </p>
               </div>
             </div>
             <input
@@ -271,13 +286,7 @@ function RestoreConfirmDialog({
   const restore = useMutation({
     mutationFn: () => {
       if (!file) throw new Error("No file selected");
-      const form = new FormData();
-      form.append("file", file);
-      // Both a header and a form field so the server can require an explicit,
-      // deliberate confirmation before this destructive operation runs.
-      form.append("confirm", "true");
-      if (password) form.append("password", password);
-      return postFile<RestoreSummary>("/api/admin/backup/import", form, {
+      return postBackupFile<RestoreSummary>("/api/admin/backup/import", file, password, {
         "x-confirm-restore": "true",
       });
     },
diff --git a/src/lib/backup/archive-crypto.ts b/src/lib/backup/archive-crypto.ts
index d8ca580..5b21b36 100644
--- a/src/lib/backup/archive-crypto.ts
+++ b/src/lib/backup/archive-crypto.ts
@@ -2,11 +2,13 @@ import {
   createCipheriv,
   createDecipheriv,
   randomBytes,
+  scrypt,
   scryptSync,
   timingSafeEqual,
 } from "node:crypto";
-import { gunzipSync, gzipSync } from "node:zlib";
+import { gunzip, gunzipSync, gzipSync } from "node:zlib";
 import type { BackupArchive } from "./types";
+import { BACKUP_IMPORT_LIMITS, BackupLimitError, formatMiB } from "./limits";
 
 const MAGIC = "POLYSIEM-ENCRYPTED-BACKUP\n";
 const ENVELOPE_VERSION = 1;
@@ -50,6 +52,43 @@ function deriveKey(password: string, salt: Buffer, envelope?: Pick<EncryptedEnve
   });
 }
 
+function deriveKeyAsync(
+  password: string,
+  salt: Buffer,
+  envelope: Pick<EncryptedEnvelope, "n" | "r" | "p">,
+): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    scrypt(password, salt, KEY_BYTES, {
+      N: envelope.n,
+      r: envelope.r,
+      p: envelope.p,
+      maxmem: SCRYPT_MAXMEM,
+    }, (err, key) => {
+      if (err) reject(err);
+      else resolve(Buffer.from(key));
+    });
+  });
+}
+
+function gunzipPortablePayload(compressed: Buffer): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    gunzip(compressed, { maxOutputLength: BACKUP_IMPORT_LIMITS.expandedBytes }, (err, output) => {
+      if (!err) {
+        resolve(output);
+        return;
+      }
+      const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+      if (code === "ERR_BUFFER_TOO_LARGE" || err.message.includes("maxOutputLength")) {
+        reject(new BackupLimitError(
+          `Backup expands beyond the ${formatMiB(BACKUP_IMPORT_LIMITS.expandedBytes)} restore limit.`,
+        ));
+        return;
+      }
+      reject(err);
+    });
+  });
+}
+
 function assertPassword(password: string): void {
   if (password.length < 8 || password.length > 1024) {
     throw new Error("Backup password must be between 8 and 1024 characters.");
@@ -107,14 +146,67 @@ function decryptBackupPayload(envelope: EncryptedEnvelope, password: string): Pa
   const iv = Buffer.from(envelope.iv, "base64");
   const tag = Buffer.from(envelope.tag, "base64");
   if (salt.byteLength !== 16 || iv.byteLength !== 12 || tag.byteLength !== 16) throw new Error("bad header");
+  const ciphertext = Buffer.from(envelope.ciphertext, "base64");
+  if (ciphertext.byteLength > BACKUP_IMPORT_LIMITS.uploadBytes) {
+    throw new BackupLimitError(`Encrypted backup payload exceeds the ${formatMiB(BACKUP_IMPORT_LIMITS.uploadBytes)} restore limit.`);
+  }
   const decipher = createDecipheriv("aes-256-gcm", deriveKey(password, salt, envelope), iv);
   decipher.setAAD(Buffer.from(MAGIC, "utf8"));
   decipher.setAuthTag(tag);
-  const compressed = Buffer.concat([
-    decipher.update(Buffer.from(envelope.ciphertext, "base64")),
-    decipher.final(),
-  ]);
-  return JSON.parse(gunzipSync(compressed).toString("utf8")) as Partial<PortablePayload>;
+  const compressed = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  let plaintext: Buffer;
+  try {
+    plaintext = gunzipSync(compressed, { maxOutputLength: BACKUP_IMPORT_LIMITS.expandedBytes });
+  } catch (err) {
+    const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+    if (code === "ERR_BUFFER_TOO_LARGE" || (err instanceof Error && err.message.includes("maxOutputLength"))) {
+      throw new BackupLimitError(`Backup expands beyond the ${formatMiB(BACKUP_IMPORT_LIMITS.expandedBytes)} restore limit.`);
+    }
+    throw err;
+  }
+  return JSON.parse(plaintext.toString("utf8")) as Partial<PortablePayload>;
+}
+
+async function decryptBackupPayloadAsync(
+  envelope: EncryptedEnvelope,
+  password: string,
+): Promise<Partial<PortablePayload>> {
+  const salt = Buffer.from(envelope.salt, "base64");
+  const iv = Buffer.from(envelope.iv, "base64");
+  const tag = Buffer.from(envelope.tag, "base64");
+  if (salt.byteLength !== 16 || iv.byteLength !== 12 || tag.byteLength !== 16) throw new Error("bad header");
+  const ciphertext = Buffer.from(envelope.ciphertext, "base64");
+  if (ciphertext.byteLength > BACKUP_IMPORT_LIMITS.uploadBytes) {
+    throw new BackupLimitError(`Encrypted backup payload exceeds the ${formatMiB(BACKUP_IMPORT_LIMITS.uploadBytes)} restore limit.`);
+  }
+  const decipher = createDecipheriv("aes-256-gcm", await deriveKeyAsync(password, salt, envelope), iv);
+  decipher.setAAD(Buffer.from(MAGIC, "utf8"));
+  decipher.setAuthTag(tag);
+  const compressed = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  const plaintext = await gunzipPortablePayload(compressed);
+  return JSON.parse(plaintext.toString("utf8")) as Partial<PortablePayload>;
+}
+
+/** Async variant used by HTTP restore so scrypt and gzip do not block the event loop. */
+export async function decodeEncryptedBackupAsync(
+  buffer: Buffer,
+  password?: string,
+): Promise<DecodedBackupFile> {
+  if (!isEncryptedBackup(buffer)) throw new Error("This is not a password-protected PolySIEM backup.");
+  if (!password) throw new Error("This backup is encrypted. Enter its backup password to continue.");
+  if (password.length > 1024) throw new Error("Backup password must be no more than 1024 characters.");
+
+  const envelope = parseEncryptedEnvelope(buffer);
+  try {
+    const payload = await decryptBackupPayloadAsync(envelope, password);
+    if (!payload.archive || typeof payload.appSecret !== "string" || payload.appSecret.length < 32) {
+      throw new Error("bad payload");
+    }
+    return { archive: payload.archive, passwordProtected: true, sourceAppSecret: payload.appSecret };
+  } catch (err) {
+    if (err instanceof BackupLimitError) throw err;
+    throw new Error("The backup password is incorrect, or the encrypted backup is corrupt.");
+  }
 }
 
 /** Open an encrypted backup. Authentication failures intentionally share one error. */
@@ -131,7 +223,8 @@ export function decodeEncryptedBackup(buffer: Buffer, password?: string): Decode
       throw new Error("bad payload");
     }
     return { archive: payload.archive, passwordProtected: true, sourceAppSecret: payload.appSecret };
-  } catch {
+  } catch (err) {
+    if (err instanceof BackupLimitError) throw err;
     throw new Error("The backup password is incorrect, or the encrypted backup is corrupt.");
   }
 }
diff --git a/src/lib/backup/backup.test.ts b/src/lib/backup/backup.test.ts
index 2c62b0c..e42f2f2 100644
--- a/src/lib/backup/backup.test.ts
+++ b/src/lib/backup/backup.test.ts
@@ -5,10 +5,11 @@ import {
   sha256Hex,
 } from "@/lib/crypto";
 import { encodeArchive } from "./export";
-import { decodeArchive, previewRestore } from "./import";
+import { decodeArchive, decodeBackupFileAsync, previewRestore } from "./import";
 import { currentSecretFingerprint, revive } from "./revive";
 import { decodeEncryptedBackup, encodeEncryptedBackup, isEncryptedBackup } from "./archive-crypto";
 import { rewrapArchiveSecrets } from "./portable-secrets";
+import { BACKUP_IMPORT_LIMITS, BackupLimitError } from "./limits";
 import { BACKUP_FORMAT_VERSION, type BackupArchive } from "./types";
 
 /**
@@ -74,6 +75,14 @@ describe("encodeArchive / decodeArchive round-trip", () => {
     // BigInt values remain strings through the JSON round-trip
     expect(decoded.data.device?.[0]?.memoryBytes).toBe("8589934592");
   });
+
+  it("decodes the HTTP restore path asynchronously", async () => {
+    const archive = makeArchive();
+    await expect(decodeBackupFileAsync(encodeArchive(archive))).resolves.toMatchObject({
+      archive,
+      passwordProtected: false,
+    });
+  });
 });
 
 describe("revive type reconstruction", () => {
@@ -154,6 +163,36 @@ describe("decodeArchive validation", () => {
     const bytes = encodeArchive({ data: {} } as unknown as BackupArchive);
     expect(() => decodeArchive(bytes)).toThrow(/missing a valid manifest/i);
   });
+
+  it("rejects a model that exceeds the configured row ceiling", () => {
+    const archive = makeArchive();
+    archive.data.device = Array.from(
+      { length: BACKUP_IMPORT_LIMITS.rowsPerModel + 1 },
+      (_, index) => ({ id: `device-${index}` }),
+    );
+    expect(() => decodeArchive(encodeArchive(archive))).toThrow(BackupLimitError);
+  });
+
+  it("rejects duplicate webhook tokens before a destructive restore", () => {
+    const archive = makeArchive();
+    archive.data.workflow = [
+      {
+        id: "workflow-a",
+        graph: {
+          nodes: [{ id: "hook-a", kind: "trigger.webhook", config: { token: "shared-token" } }],
+          edges: [],
+        },
+      },
+      {
+        id: "workflow-b",
+        graph: {
+          nodes: [{ id: "hook-b", kind: "trigger.webhook", config: { token: "shared-token" } }],
+          edges: [],
+        },
+      },
+    ];
+    expect(() => decodeArchive(encodeArchive(archive))).toThrow(/webhook token shared/i);
+  });
 });
 
 describe("password-protected portable backups", () => {
diff --git a/src/lib/backup/destinations/index.test.ts b/src/lib/backup/destinations/index.test.ts
new file mode 100644
index 0000000..79c89b8
--- /dev/null
+++ b/src/lib/backup/destinations/index.test.ts
@@ -0,0 +1,30 @@
+import { describe, expect, it } from "vitest";
+import { deleteWithConcurrency } from "./index";
+
+describe("deleteWithConcurrency", () => {
+  it("bounds requests and counts only successful deletions", async () => {
+    let active = 0;
+    let peak = 0;
+    const deleted = await deleteWithConcurrency(["a", "b", "c", "d", "e"], async (key) => {
+      active += 1;
+      peak = Math.max(peak, active);
+      await new Promise((resolve) => setTimeout(resolve, 2));
+      active -= 1;
+      if (key === "c") throw new Error("provider failure");
+    }, 2);
+    expect(peak).toBe(2);
+    expect(deleted).toBe(4);
+  });
+
+  it("falls back to one request for an invalid concurrency value", async () => {
+    let active = 0;
+    let peak = 0;
+    await deleteWithConcurrency(["a", "b", "c"], async () => {
+      active += 1;
+      peak = Math.max(peak, active);
+      await new Promise((resolve) => setTimeout(resolve, 1));
+      active -= 1;
+    }, Number.NaN);
+    expect(peak).toBe(1);
+  });
+});
diff --git a/src/lib/backup/destinations/index.ts b/src/lib/backup/destinations/index.ts
index d83e9e1..1d04487 100644
--- a/src/lib/backup/destinations/index.ts
+++ b/src/lib/backup/destinations/index.ts
@@ -58,6 +58,34 @@ export function resolveObjectKey(dest: ResolvedDestination, filename: string): s
   return joinKey("", filename); // sas: any prefix already lives in the SAS URL path
 }
 
+
+const RETENTION_DELETE_CONCURRENCY = 4;
+
+/** Delete stale objects concurrently without turning one provider failure into a burst. */
+export async function deleteWithConcurrency(
+  keys: readonly string[],
+  remove: (key: string) => Promise<void>,
+  concurrency = RETENTION_DELETE_CONCURRENCY,
+): Promise<number> {
+  let cursor = 0;
+  let deleted = 0;
+  const normalizedConcurrency = Number.isFinite(concurrency) ? Math.max(1, Math.floor(concurrency)) : 1;
+  const workers = Math.min(keys.length, normalizedConcurrency);
+  await Promise.all(Array.from({ length: workers }, async () => {
+    while (true) {
+      const index = cursor++;
+      if (index >= keys.length) return;
+      try {
+        await remove(keys[index]!);
+        deleted += 1;
+      } catch {
+        // Retention is best-effort; continue pruning other stale objects.
+      }
+    }
+  }));
+  return deleted;
+}
+
 /**
  * Retention: keep at most `retention` PolySIEM backups on the destination,
  * deleting the oldest beyond that. Best-effort — matches only our own
@@ -70,13 +98,11 @@ export async function pruneOldBackups(dest: ResolvedDestination, retention: numb
     if (dest.type === "s3") {
       const objects = await listObjectsS3(dest.config, dest.config.prefix ?? "");
       const stale = selectStale(objects, retention);
-      for (const key of stale) await deleteObjectS3(dest.config, key);
-      return stale.length;
+      return deleteWithConcurrency(stale, (key) => deleteObjectS3(dest.config, key));
     }
     const blobs = await listBlobsAzure(dest.config);
     const stale = selectStale(blobs, retention);
-    for (const key of stale) await deleteBlobAzure(dest.config, key);
-    return stale.length;
+    return deleteWithConcurrency(stale, (key) => deleteBlobAzure(dest.config, key));
   } catch {
     return 0; // best-effort — never break the run over pruning
   }
diff --git a/src/lib/backup/import.ts b/src/lib/backup/import.ts
index 66fac66..e2fd70d 100644
--- a/src/lib/backup/import.ts
+++ b/src/lib/backup/import.ts
@@ -1,5 +1,5 @@
 import "server-only";
-import { gunzipSync } from "node:zlib";
+import { gunzip, gunzipSync } from "node:zlib";
 import { Prisma } from "@prisma/client";
 import { prisma } from "@/lib/db";
 import { audit, type AuditActor } from "@/lib/audit";
@@ -11,8 +11,16 @@ import {
   type RestoreSummary,
 } from "./types";
 import { DEFERRED_FK_COLUMNS, FIELD_TYPES, currentSecretFingerprint, revive, tableName } from "./revive";
-import { decodeEncryptedBackup, isEncryptedBackup, type DecodedBackupFile } from "./archive-crypto";
+import {
+  decodeEncryptedBackup,
+  decodeEncryptedBackupAsync,
+  isEncryptedBackup,
+  type DecodedBackupFile,
+} from "./archive-crypto";
 import { rewrapArchiveSecrets } from "./portable-secrets";
+import { BACKUP_IMPORT_LIMITS, BackupLimitError, formatMiB } from "./limits";
+import { WEBHOOK_TRIGGER_KIND } from "@/lib/workflows/actions/trigger-webhook";
+import { rebuildWorkflowWebhookIndex } from "@/lib/workflows/webhook-index";
 
 /**
  * Backup restore engine. Restore is a DESTRUCTIVE wipe-and-replace: every backup
@@ -24,7 +32,7 @@ import { rewrapArchiveSecrets } from "./portable-secrets";
  */
 
 /** How long the restore transaction may run — a full instance can be large. */
-const RESTORE_TX_TIMEOUT_MS = 120_000;
+const RESTORE_TX_TIMEOUT_MS = 10 * 60_000;
 
 /* ------------------------------- decode ------------------------------- */
 
@@ -34,6 +42,91 @@ const RESTORE_TX_TIMEOUT_MS = 120_000;
  * `formatVersion`, and only reference known models. Throws actionable errors so
  * the UI can tell the operator exactly what is wrong.
  */
+function gunzipArchive(buffer: Buffer): Buffer {
+  try {
+    return gunzipSync(buffer, { maxOutputLength: BACKUP_IMPORT_LIMITS.expandedBytes });
+  } catch (err) {
+    const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+    if (code === "ERR_BUFFER_TOO_LARGE" || (err instanceof Error && err.message.includes("maxOutputLength"))) {
+      throw new BackupLimitError(
+        `Backup expands beyond the ${formatMiB(BACKUP_IMPORT_LIMITS.expandedBytes)} restore limit.`,
+      );
+    }
+    throw err;
+  }
+}
+
+function gunzipArchiveAsync(buffer: Buffer): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    gunzip(buffer, { maxOutputLength: BACKUP_IMPORT_LIMITS.expandedBytes }, (err, output) => {
+      if (!err) {
+        resolve(output);
+        return;
+      }
+      const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+      if (code === "ERR_BUFFER_TOO_LARGE" || err.message.includes("maxOutputLength")) {
+        reject(new BackupLimitError(
+          `Backup expands beyond the ${formatMiB(BACKUP_IMPORT_LIMITS.expandedBytes)} restore limit.`,
+        ));
+        return;
+      }
+      reject(err);
+    });
+  });
+}
+
+interface ArchivedWebhookNode {
+  workflowId: string;
+  nodeId: string;
+  token: string;
+}
+
+function archivedWebhookNodes(row: Record<string, unknown>): ArchivedWebhookNode[] {
+  const workflowId = typeof row.id === "string" ? row.id : "unknown workflow";
+  const graph = row.graph;
+  if (!graph || typeof graph !== "object" || Array.isArray(graph)) return [];
+  const nodes = (graph as { nodes?: unknown }).nodes;
+  if (!Array.isArray(nodes)) return [];
+
+  return nodes.flatMap((candidate) => {
+    if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) return [];
+    const node = candidate as { id?: unknown; kind?: unknown; config?: unknown };
+    if (node.kind !== WEBHOOK_TRIGGER_KIND) return [];
+    const config = node.config && typeof node.config === "object" && !Array.isArray(node.config)
+      ? node.config as { token?: unknown }
+      : null;
+    return [{
+      workflowId,
+      nodeId: typeof node.id === "string" ? node.id : "",
+      token: typeof config?.token === "string" ? config.token.trim() : "",
+    }];
+  });
+}
+
+function validateArchivedWebhookTokens(archive: Partial<BackupArchive>): void {
+  const workflows = archive.data?.workflow;
+  if (!Array.isArray(workflows)) return;
+  const tokenOwners = new Map<string, string>();
+
+  for (const row of workflows) {
+    const nodeIds = new Set<string>();
+    for (const node of archivedWebhookNodes(row)) {
+      if (!node.nodeId || nodeIds.has(node.nodeId)) {
+        throw new Error(`Backup workflow "${node.workflowId}" contains duplicate or invalid webhook node IDs.`);
+      }
+      nodeIds.add(node.nodeId);
+      if (!node.token) continue;
+      const priorOwner = tokenOwners.get(node.token);
+      if (priorOwner) {
+        throw new Error(
+          `Backup contains a webhook token shared by workflows "${priorOwner}" and "${node.workflowId}".`,
+        );
+      }
+      tokenOwners.set(node.token, node.workflowId);
+    }
+  }
+}
+
 function validateArchive(parsed: unknown): BackupArchive {
   if (!parsed || typeof parsed !== "object") {
     throw new Error("Backup archive is malformed: top-level value is not an object.");
@@ -56,18 +149,45 @@ function validateArchive(parsed: unknown): BackupArchive {
     throw new Error("Backup archive is missing its data section.");
   }
   const known = new Set<string>(BACKUP_MODELS);
-  for (const key of Object.keys(archive.data)) {
+  let totalRows = 0;
+  for (const [key, value] of Object.entries(archive.data)) {
     if (!known.has(key)) {
       throw new Error(`Backup archive references an unknown model "${key}"; it is incompatible with this PolySIEM.`);
     }
+    if (!Array.isArray(value)) {
+      throw new Error(`Backup archive model "${key}" must contain an array of rows.`);
+    }
+    if (value.length > BACKUP_IMPORT_LIMITS.rowsPerModel) {
+      throw new BackupLimitError(
+        `Backup model "${key}" contains ${value.length} rows; the per-model limit is ${BACKUP_IMPORT_LIMITS.rowsPerModel}.`,
+      );
+    }
+    for (const row of value) {
+      if (!row || typeof row !== "object" || Array.isArray(row)) {
+        throw new Error(`Backup archive model "${key}" contains a malformed row.`);
+      }
+    }
+    totalRows += value.length;
+    if (totalRows > BACKUP_IMPORT_LIMITS.totalRows) {
+      throw new BackupLimitError(`Backup contains more than ${BACKUP_IMPORT_LIMITS.totalRows} rows and cannot be restored safely.`);
+    }
   }
+  validateArchivedWebhookTokens(archive);
   return archive as BackupArchive;
 }
 
 export function decodeArchive(buffer: Buffer): BackupArchive {
+  let expanded: Buffer;
+  try {
+    expanded = gunzipArchive(buffer);
+  } catch (err) {
+    if (err instanceof BackupLimitError) throw err;
+    throw new Error("This file is not a valid PolySIEM backup (expected gzipped JSON — it may be corrupt or the wrong file).");
+  }
+
   let parsed: unknown;
   try {
-    parsed = JSON.parse(gunzipSync(buffer).toString("utf8"));
+    parsed = JSON.parse(expanded.toString("utf8"));
   } catch {
     throw new Error("This file is not a valid PolySIEM backup (expected gzipped JSON — it may be corrupt or the wrong file).");
   }
@@ -84,6 +204,32 @@ export function decodeBackupFile(buffer: Buffer, password?: string): DecodedBack
   return { ...decoded, archive: validateArchive(decoded.archive) };
 }
 
+/** Non-blocking HTTP decode path with the same validation and safety ceilings. */
+export async function decodeBackupFileAsync(
+  buffer: Buffer,
+  password?: string,
+): Promise<DecodedBackupFile> {
+  if (isEncryptedBackup(buffer)) {
+    const decoded = await decodeEncryptedBackupAsync(buffer, password);
+    return { ...decoded, archive: validateArchive(decoded.archive) };
+  }
+
+  let expanded: Buffer;
+  try {
+    expanded = await gunzipArchiveAsync(buffer);
+  } catch (err) {
+    if (err instanceof BackupLimitError) throw err;
+    throw new Error("This file is not a valid PolySIEM backup (expected gzipped JSON — it may be corrupt or the wrong file).");
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(expanded.toString("utf8"));
+  } catch {
+    throw new Error("This file is not a valid PolySIEM backup (expected gzipped JSON — it may be corrupt or the wrong file).");
+  }
+  return { archive: validateArchive(parsed), passwordProtected: false, sourceAppSecret: null };
+}
+
 /** Re-key protected credentials for this instance without changing process.env. */
 export function prepareBackupForRestore(decoded: DecodedBackupFile): BackupArchive {
   if (!decoded.sourceAppSecret) return decoded.archive;
@@ -189,7 +335,11 @@ export async function restoreArchive(
 ): Promise<RestoreSummary> {
   const { counts, totalRows } = summarize(archive);
 
-  const truncateSql = `TRUNCATE TABLE ${BACKUP_MODELS.map((m) => `"${tableName(m)}"`).join(", ")} RESTART IDENTITY CASCADE`;
+  const derivedTables = ["RateLimitBucket", "WorkflowWebhook"];
+  const truncateSql = `TRUNCATE TABLE ${[
+    ...derivedTables.map((table) => `"${table}"`),
+    ...BACKUP_MODELS.map((model) => `"${tableName(model)}"`),
+  ].join(", ")} RESTART IDENTITY CASCADE`;
 
   await prisma.$transaction(
     async (tx) => {
@@ -202,12 +352,17 @@ export async function restoreArchive(
         const rows = archive.data[model];
         if (!rows || rows.length === 0) continue;
         const deferred = DEFERRED_FK_COLUMNS[model];
-        const data = rows.map((row) => {
-          const revived = revive(model, row);
-          const insertable = deferred ? nullifyColumns(revived, deferred) : revived;
-          return applyJsonNulls(model, insertable);
-        });
-        await delegateOf<CreateManyDelegate>(tx, model).createMany({ data, skipDuplicates: false });
+        const delegate = delegateOf<CreateManyDelegate>(tx, model);
+        for (let offset = 0; offset < rows.length; offset += BACKUP_IMPORT_LIMITS.insertBatchRows) {
+          const data = rows
+            .slice(offset, offset + BACKUP_IMPORT_LIMITS.insertBatchRows)
+            .map((row) => {
+              const revived = revive(model, row);
+              const insertable = deferred ? nullifyColumns(revived, deferred) : revived;
+              return applyJsonNulls(model, insertable);
+            });
+          await delegate.createMany({ data, skipDuplicates: false });
+        }
       }
 
       // 3. Second pass: set the deferred FK columns now that all rows exist.
@@ -227,6 +382,9 @@ export async function restoreArchive(
           }
         }
       }
+
+      // WorkflowWebhook is a derived index and is intentionally not part of the archive.
+      await rebuildWorkflowWebhookIndex(tx);
     },
     { timeout: RESTORE_TX_TIMEOUT_MS },
   );
diff --git a/src/lib/backup/limits.ts b/src/lib/backup/limits.ts
new file mode 100644
index 0000000..037220e
--- /dev/null
+++ b/src/lib/backup/limits.ts
@@ -0,0 +1,21 @@
+/** Hard safety ceilings for destructive backup imports. */
+export const BACKUP_IMPORT_LIMITS = {
+  uploadBytes: 64 * 1024 * 1024,
+  // Multipart encoding adds boundaries and field headers around the file.
+  requestBytes: 65 * 1024 * 1024,
+  expandedBytes: 256 * 1024 * 1024,
+  totalRows: 500_000,
+  rowsPerModel: 100_000,
+  insertBatchRows: 1_000,
+} as const;
+
+export class BackupLimitError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "BackupLimitError";
+  }
+}
+
+export function formatMiB(bytes: number): string {
+  return `${Math.ceil(bytes / (1024 * 1024))} MiB`;
+}
diff --git a/src/lib/backup/request-body.ts b/src/lib/backup/request-body.ts
new file mode 100644
index 0000000..c99bda7
--- /dev/null
+++ b/src/lib/backup/request-body.ts
@@ -0,0 +1,58 @@
+import "server-only";
+
+import type { NextRequest } from "next/server";
+import { ApiError } from "@/lib/api";
+import { BACKUP_IMPORT_LIMITS, formatMiB } from "./limits";
+
+function tooLarge(): ApiError {
+  return new ApiError(
+    413,
+    "backup_too_large",
+    `Backup uploads are limited to ${formatMiB(BACKUP_IMPORT_LIMITS.uploadBytes)}.`,
+  );
+}
+
+function requestByteLimit(req: NextRequest): number {
+  const contentType = req.headers.get("content-type") ?? "";
+  return contentType.includes("multipart/form-data")
+    ? BACKUP_IMPORT_LIMITS.requestBytes
+    : BACKUP_IMPORT_LIMITS.uploadBytes;
+}
+
+export function assertBackupContentLength(req: NextRequest): void {
+  const raw = req.headers.get("content-length");
+  if (!raw) return;
+  const length = Number(raw);
+  if (Number.isFinite(length) && length > requestByteLimit(req)) throw tooLarge();
+}
+
+/** Read a raw request incrementally and stop before it can exceed the upload ceiling. */
+export async function readBackupRequestBody(req: NextRequest): Promise<Buffer> {
+  assertBackupContentLength(req);
+  if (!req.body) return Buffer.alloc(0);
+
+  const limit = requestByteLimit(req);
+  const reader = req.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (!value) continue;
+      total += value.byteLength;
+      if (total > limit) {
+        await reader.cancel("backup upload limit exceeded").catch(() => {});
+        throw tooLarge();
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks, total);
+}
+
+export function assertBackupFileSize(size: number): void {
+  if (size > BACKUP_IMPORT_LIMITS.uploadBytes) throw tooLarge();
+}
diff --git a/src/lib/dataset-budget.ts b/src/lib/dataset-budget.ts
new file mode 100644
index 0000000..530ed95
--- /dev/null
+++ b/src/lib/dataset-budget.ts
@@ -0,0 +1,16 @@
+import "server-only";
+
+/** Raised instead of silently truncating data that would make a derived view incorrect. */
+export class DatasetBudgetExceededError extends Error {
+  constructor(
+    public dataset: string,
+    public limit: number,
+  ) {
+    super(`${dataset} exceeds the safe processing limit of ${limit.toLocaleString()} rows.`);
+    this.name = "DatasetBudgetExceededError";
+  }
+}
+
+export function assertDatasetBudget<T>(dataset: string, rows: readonly T[], limit: number): void {
+  if (rows.length > limit) throw new DatasetBudgetExceededError(dataset, limit);
+}
diff --git a/src/lib/instance/reset.test.ts b/src/lib/instance/reset.test.ts
index b53e52e..21b42b7 100644
--- a/src/lib/instance/reset.test.ts
+++ b/src/lib/instance/reset.test.ts
@@ -99,6 +99,8 @@ describe("clearInstance", () => {
   it("scopes the truncate statement to explicit quoted model tables", () => {
     const sql = instanceTruncateSql();
     expect(sql).toMatch(/^TRUNCATE TABLE /);
+    expect(sql).toContain('"RateLimitBucket"');
+    expect(sql).toContain('"WorkflowWebhook"');
     expect(sql).toContain('"User"');
     expect(sql).toContain('"AppSetting"');
     expect(sql).toContain('"IntegrationConfig"');
diff --git a/src/lib/instance/reset.ts b/src/lib/instance/reset.ts
index 2ce8ac9..1215f82 100644
--- a/src/lib/instance/reset.ts
+++ b/src/lib/instance/reset.ts
@@ -11,7 +11,11 @@ const RESET_TX_TIMEOUT_MS = 120_000;
 
 /** Every persisted PolySIEM model, quoted explicitly to keep the wipe scoped. */
 export function instanceTruncateSql(): string {
-  const tables = BACKUP_MODELS.map((model) => `"${tableName(model)}"`).join(", ");
+  const derivedTables = ["RateLimitBucket", "WorkflowWebhook"];
+  const tables = [
+    ...derivedTables.map((table) => `"${table}"`),
+    ...BACKUP_MODELS.map((model) => `"${tableName(model)}"`),
+  ].join(", ");
   return `TRUNCATE TABLE ${tables} RESTART IDENTITY CASCADE`;
 }
 
diff --git a/src/lib/integrations/cloudflare/sync.ts b/src/lib/integrations/cloudflare/sync.ts
index 51b0992..18b09af 100644
--- a/src/lib/integrations/cloudflare/sync.ts
+++ b/src/lib/integrations/cloudflare/sync.ts
@@ -7,6 +7,10 @@ import { newCounts, type SyncStats } from "../sync-helpers";
 import { fetchCloudflareSnapshot } from "./client";
 import type { CloudflareAccountSnapshot } from "./types";
 import { cloudflareServiceCandidates, serviceEndpoint } from "./service-evidence";
+import { findInventoryByIdentityKeys, normalizedIdentityKey } from "@/lib/inventory/identity-index";
+import { assertDatasetBudget } from "@/lib/dataset-budget";
+
+const CLOUDFLARE_SERVICE_BUDGET = 20_000;
 
 interface ServiceTarget {
   deviceId: string | null;
@@ -21,14 +25,12 @@ function normalizedMachineName(value: string): string {
 /** Resolve a route origin to the strongest inventory identity PolySIEM already knows. */
 async function cloudflareOriginTargets(originHosts: string[]): Promise<Map<string, ServiceTarget>> {
   if (originHosts.length === 0) return new Map();
-  const [ips, devices, vms, containers] = await Promise.all([
+  const [ips, assets] = await Promise.all([
     prisma.ipAddress.findMany({
       where: { address: { in: originHosts } },
       select: { address: true, interface: { select: { deviceId: true, vmId: true, containerId: true } } },
     }),
-    prisma.device.findMany({ where: { status: { not: "REMOVED" } }, select: { id: true, name: true } }),
-    prisma.virtualMachine.findMany({ where: { status: { not: "REMOVED" } }, select: { id: true, name: true } }),
-    prisma.container.findMany({ where: { status: { not: "REMOVED" } }, select: { id: true, name: true } }),
+    findInventoryByIdentityKeys(originHosts),
   ]);
   const targets = new Map<string, ServiceTarget>();
   for (const ip of ips) {
@@ -46,13 +48,17 @@ async function cloudflareOriginTargets(originHosts: string[]): Promise<Map<strin
     const aliases = new Set([full, full.split(".")[0] ?? full]);
     for (const alias of aliases) named.set(alias, named.has(alias) ? null : target);
   };
-  for (const device of devices) addName(device.name, { deviceId: device.id, vmId: null, containerId: null });
-  for (const vm of vms) addName(vm.name, { deviceId: null, vmId: vm.id, containerId: null });
-  for (const container of containers) addName(container.name, { deviceId: null, vmId: null, containerId: container.id });
+  for (const asset of assets) {
+    addName(asset.name, {
+      deviceId: asset.kind === "device" ? asset.id : null,
+      vmId: asset.kind === "vm" ? asset.id : null,
+      containerId: asset.kind === "container" ? asset.id : null,
+    });
+  }
   for (const host of originHosts) {
-    if (targets.has(host)) continue;
     const full = normalizedMachineName(host);
-    const target = named.get(full) ?? named.get(full.split(".")[0] ?? full);
+    if (targets.has(full)) continue;
+    const target = named.get(full) ?? named.get(normalizedIdentityKey(full));
     if (target) targets.set(full, target);
   }
   return targets;
@@ -64,14 +70,19 @@ export async function syncCloudflareServices(
   snapshot: CloudflareAccountSnapshot,
 ) {
   const candidates = cloudflareServiceCandidates(snapshot);
+  assertDatasetBudget("Cloudflare route service candidates", candidates, CLOUDFLARE_SERVICE_BUDGET);
   const existing = await prisma.service.findMany({
     where: { integrationId, source: "CLOUDFLARE" },
     select: { id: true, externalId: true, status: true },
+    take: CLOUDFLARE_SERVICE_BUDGET + 1,
   });
   const documented = await prisma.service.findMany({
     where: { status: { not: "REMOVED" }, source: { not: "CLOUDFLARE" } },
     select: { url: true },
+    take: CLOUDFLARE_SERVICE_BUDGET + 1,
   });
+  assertDatasetBudget("Cloudflare-managed services", existing, CLOUDFLARE_SERVICE_BUDGET);
+  assertDatasetBudget("Documented services used for Cloudflare matching", documented, CLOUDFLARE_SERVICE_BUDGET);
   const documentedEndpoints = new Set(documented.map((service) => serviceEndpoint(service.url)).filter((value): value is string => Boolean(value)));
   const targets = await cloudflareOriginTargets([...new Set(candidates.map((candidate) => candidate.originHost).filter((value): value is string => Boolean(value)))]);
   const byExternalId = new Map(existing.flatMap((service) => service.externalId ? [[service.externalId, service] as const] : []));
diff --git a/src/lib/integrations/sync-helpers.ts b/src/lib/integrations/sync-helpers.ts
index 2a4c54a..f0c1058 100644
--- a/src/lib/integrations/sync-helpers.ts
+++ b/src/lib/integrations/sync-helpers.ts
@@ -1,6 +1,7 @@
 import { Prisma, type Source } from "@prisma/client";
 import { prisma } from "@/lib/db";
 import { pickNetworkForIp, type NetworkRef } from "./net";
+import { assertDatasetBudget } from "@/lib/dataset-budget";
 
 export interface FamilyCounts {
   created: number;
@@ -14,12 +15,20 @@ export function newCounts(): FamilyCounts {
 
 export type SyncStats = Record<string, FamilyCounts>;
 
+const SYNC_DATASET_BUDGET = {
+  networks: 10_000,
+  interfacesPerIntegration: 100_000,
+} as const;
+
 /** Networks with a CIDR used for IP → network containment lookups. */
 export async function loadNetworkRefs(): Promise<NetworkRef[]> {
-  return prisma.network.findMany({
+  const rows = await prisma.network.findMany({
     where: { cidr: { not: null }, status: { not: "REMOVED" } },
     select: { id: true, cidr: true },
+    take: SYNC_DATASET_BUDGET.networks + 1,
   });
+  assertDatasetBudget("Active sync networks", rows, SYNC_DATASET_BUDGET.networks);
+  return rows;
 }
 
 export interface DesiredInterface {
@@ -51,11 +60,14 @@ export async function syncInterfaces(
   networks: NetworkRef[],
   pruneMissing: boolean,
 ): Promise<FamilyCounts> {
+  assertDatasetBudget("Interfaces in one sync snapshot", desired, SYNC_DATASET_BUDGET.interfacesPerIntegration);
   const counts = newCounts();
   const existing = await prisma.networkInterface.findMany({
     where: { integrationId },
     select: { id: true, externalId: true },
+    take: SYNC_DATASET_BUDGET.interfacesPerIntegration + 1,
   });
+  assertDatasetBudget("Stored interfaces for one integration", existing, SYNC_DATASET_BUDGET.interfacesPerIntegration);
   const byExt = new Map(existing.map((e) => [e.externalId, e.id]));
 
   for (const iface of desired) {
diff --git a/src/lib/integrations/tailscale/sync.ts b/src/lib/integrations/tailscale/sync.ts
index 5ad5255..6f682a9 100644
--- a/src/lib/integrations/tailscale/sync.ts
+++ b/src/lib/integrations/tailscale/sync.ts
@@ -3,37 +3,26 @@ import { Prisma } from "@prisma/client";
 import { prisma } from "@/lib/db";
 import { loadNetworkRefs, newCounts, syncInterfaces, type DesiredInterface, type SyncStats } from "../sync-helpers";
 import { tailscaleSettingsSchema, type TailscaleDeviceSnapshot, type TailscaleSnapshot } from "@/lib/validators/integrations";
+import { findInventoryByIdentityKeys, normalizedIdentityKey } from "@/lib/inventory/identity-index";
+import { assertDatasetBudget } from "@/lib/dataset-budget";
 
 type AssetRef = { id: string; kind: "device" | "vm" | "container"; name: string };
+const TAILSCALE_DEVICE_BUDGET = 20_000;
 
 function identityKeys(device: TailscaleDeviceSnapshot): string[] {
   return [...new Set([device.hostname, device.name, device.dnsName ?? ""]
-    .map((value) => value.trim().toLowerCase().replace(/\.$/, "").split(".")[0])
+    .map(normalizedIdentityKey)
     .filter(Boolean))];
 }
 
-async function assetIndex(): Promise<Map<string, AssetRef[]>> {
-  const [devices, vms, containers] = await Promise.all([
-    prisma.device.findMany({
-      where: { status: { not: "REMOVED" }, source: { not: "TAILSCALE" } },
-      select: { id: true, name: true },
-    }),
-    prisma.virtualMachine.findMany({
-      where: { status: { not: "REMOVED" } },
-      select: { id: true, name: true },
-    }),
-    prisma.container.findMany({
-      where: { status: { not: "REMOVED" } },
-      select: { id: true, name: true },
-    }),
-  ]);
+async function assetIndex(observed: readonly TailscaleDeviceSnapshot[]): Promise<Map<string, AssetRef[]>> {
+  const assets = await findInventoryByIdentityKeys(
+    observed.flatMap((device) => [device.hostname, device.name, device.dnsName ?? ""]),
+    { excludeDeviceSource: "TAILSCALE" },
+  );
   const index = new Map<string, AssetRef[]>();
-  for (const asset of [
-    ...devices.map((item) => ({ ...item, kind: "device" as const })),
-    ...vms.map((item) => ({ ...item, kind: "vm" as const })),
-    ...containers.map((item) => ({ ...item, kind: "container" as const })),
-  ]) {
-    const key = asset.name.trim().toLowerCase().replace(/\.$/, "").split(".")[0];
+  for (const asset of assets) {
+    const key = normalizedIdentityKey(asset.name);
     const list = index.get(key) ?? [];
     list.push(asset);
     index.set(key, list);
@@ -67,12 +56,15 @@ export async function applyTailscaleSnapshot(
   runStart: Date,
   complete: boolean,
 ): Promise<SyncStats> {
+  assertDatasetBudget("Tailscale snapshot devices", snapshot.devices, TAILSCALE_DEVICE_BUDGET);
   const stats: SyncStats = { devices: newCounts(), tailscaleDevices: newCounts() };
-  const index = await assetIndex();
+  const index = await assetIndex(snapshot.devices);
   const existing = await prisma.device.findMany({
     where: { integrationId },
     select: { id: true, externalId: true },
+    take: TAILSCALE_DEVICE_BUDGET + 1,
   });
+  assertDatasetBudget("Tailscale-managed devices", existing, TAILSCALE_DEVICE_BUDGET);
   const byExternalId = new Map(existing.flatMap((item) => item.externalId ? [[item.externalId, item.id] as const] : []));
   const interfaces: DesiredInterface[] = [];
 
diff --git a/src/lib/inventory/identity-index.ts b/src/lib/inventory/identity-index.ts
new file mode 100644
index 0000000..66a12b4
--- /dev/null
+++ b/src/lib/inventory/identity-index.ts
@@ -0,0 +1,54 @@
+import "server-only";
+
+import { Prisma } from "@prisma/client";
+import { prisma } from "@/lib/db";
+
+export interface InventoryIdentityMatch {
+  id: string;
+  kind: "device" | "vm" | "container";
+  name: string;
+}
+
+const IDENTITY_QUERY_CHUNK_SIZE = 5_000;
+
+export function normalizedIdentityKey(value: string): string {
+  return value.trim().toLowerCase().replace(/\.$/, "").split(".")[0] ?? "";
+}
+
+/**
+ * Resolve only the inventory rows whose normalized first DNS label is relevant
+ * to an integration snapshot. Functional indexes added by the matching
+ * migration keep this bounded without transferring complete inventory tables.
+ */
+export async function findInventoryByIdentityKeys(
+  values: readonly string[],
+  options?: { excludeDeviceSource?: string },
+): Promise<InventoryIdentityMatch[]> {
+  const keys = [...new Set(values.map(normalizedIdentityKey).filter(Boolean))];
+  if (keys.length === 0) return [];
+  const sourceFilter = options?.excludeDeviceSource
+    ? Prisma.sql`AND "source"::text <> ${options.excludeDeviceSource}`
+    : Prisma.empty;
+  const matches: InventoryIdentityMatch[] = [];
+  for (let offset = 0; offset < keys.length; offset += IDENTITY_QUERY_CHUNK_SIZE) {
+    const chunk = keys.slice(offset, offset + IDENTITY_QUERY_CHUNK_SIZE);
+    matches.push(...await prisma.$queryRaw<InventoryIdentityMatch[]>(Prisma.sql`
+      SELECT "id", 'device'::text AS "kind", "name"
+      FROM "Device"
+      WHERE "status"::text <> 'REMOVED'
+        ${sourceFilter}
+        AND lower(split_part(rtrim("name", '.'), '.', 1)) IN (${Prisma.join(chunk)})
+      UNION ALL
+      SELECT "id", 'vm'::text AS "kind", "name"
+      FROM "VirtualMachine"
+      WHERE "status"::text <> 'REMOVED'
+        AND lower(split_part(rtrim("name", '.'), '.', 1)) IN (${Prisma.join(chunk)})
+      UNION ALL
+      SELECT "id", 'container'::text AS "kind", "name"
+      FROM "Container"
+      WHERE "status"::text <> 'REMOVED'
+        AND lower(split_part(rtrim("name", '.'), '.', 1)) IN (${Prisma.join(chunk)})
+    `));
+  }
+  return matches;
+}
diff --git a/src/lib/mcp/overview.ts b/src/lib/mcp/overview.ts
index a77ddc7..c0add6b 100644
--- a/src/lib/mcp/overview.ts
+++ b/src/lib/mcp/overview.ts
@@ -3,12 +3,50 @@ import { prisma } from "@/lib/db";
 import { getInstanceName } from "@/lib/settings";
 
 const NOT_REMOVED = { status: { not: "REMOVED" as const } };
+const OVERVIEW_HOST_LIMIT = 100;
+const OVERVIEW_GUESTS_PER_HOST_LIMIT = 50;
+const OVERVIEW_NETWORK_LIMIT = 200;
+const OVERVIEW_INTEGRATION_LIMIT = 1_000;
 
 function mdCell(value: string | number | null | undefined): string {
   if (value === null || value === undefined || value === "") return "—";
   return String(value).replace(/\|/g, "\\|").replace(/\r?\n/g, " ");
 }
 
+interface OverviewIntegration {
+  name: string;
+  type: string;
+  enabled: boolean;
+  lastSyncAt: Date | null;
+  lastSyncStatus: string | null;
+  lastSyncError: string | null;
+}
+
+function appendIntegrationOverview(
+  lines: string[],
+  integrations: OverviewIntegration[],
+  total: number,
+): void {
+  lines.push("## Integrations", "");
+  if (integrations.length === 0) {
+    lines.push("_No integrations configured._", "");
+    return;
+  }
+  if (total > integrations.length) {
+    lines.push(`_Showing the first ${integrations.length} of ${total} integrations._`, "");
+  }
+  lines.push("| Name | Type | Enabled | Last sync | Status | Error |");
+  lines.push("| --- | --- | --- | --- | --- | --- |");
+  for (const integration of integrations) {
+    lines.push(
+      `| ${mdCell(integration.name)} | ${integration.type} | ${integration.enabled ? "yes" : "no"} | ${mdCell(
+        integration.lastSyncAt?.toISOString(),
+      )} | ${mdCell(integration.lastSyncStatus)} | ${mdCell(integration.lastSyncError)} |`,
+    );
+  }
+  lines.push("");
+}
+
 /**
  * Markdown snapshot of the whole lab: instance name, entity counts, hosts with
  * nested VMs/containers, networks, and integration health. Served both as the
@@ -24,6 +62,7 @@ export async function buildOverviewMarkdown(): Promise<string> {
     serviceCount,
     storageCount,
     docCount,
+    integrationCount,
     hosts,
     networks,
     integrations,
@@ -36,24 +75,44 @@ export async function buildOverviewMarkdown(): Promise<string> {
     prisma.service.count({ where: NOT_REMOVED }),
     prisma.storagePool.count({ where: NOT_REMOVED }),
     prisma.docPage.count(),
+    prisma.integrationConfig.count(),
     prisma.device.findMany({
       where: NOT_REMOVED,
       orderBy: { name: "asc" },
+      take: OVERVIEW_HOST_LIMIT,
       select: {
         name: true,
         kind: true,
         source: true,
-        vms: { where: NOT_REMOVED, orderBy: { name: "asc" }, select: { name: true, powerState: true } },
-        containers: { where: NOT_REMOVED, orderBy: { name: "asc" }, select: { name: true, runtime: true, powerState: true } },
+        vms: {
+          where: NOT_REMOVED,
+          orderBy: { name: "asc" },
+          take: OVERVIEW_GUESTS_PER_HOST_LIMIT,
+          select: { name: true, powerState: true },
+        },
+        containers: {
+          where: NOT_REMOVED,
+          orderBy: { name: "asc" },
+          take: OVERVIEW_GUESTS_PER_HOST_LIMIT,
+          select: { name: true, runtime: true, powerState: true },
+        },
+        _count: {
+          select: {
+            vms: { where: NOT_REMOVED },
+            containers: { where: NOT_REMOVED },
+          },
+        },
       },
     }),
     prisma.network.findMany({
       where: NOT_REMOVED,
       orderBy: [{ vlanId: "asc" }, { name: "asc" }],
+      take: OVERVIEW_NETWORK_LIMIT,
       select: { name: true, vlanId: true, cidr: true, purpose: true },
     }),
     prisma.integrationConfig.findMany({
       orderBy: { name: "asc" },
+      take: OVERVIEW_INTEGRATION_LIMIT,
       select: {
         name: true,
         type: true,
@@ -88,15 +147,22 @@ export async function buildOverviewMarkdown(): Promise<string> {
   lines.push("");
   if (hosts.length === 0) {
     lines.push("_No devices recorded._");
+  } else if (deviceCount > hosts.length) {
+    lines.push(`_Showing the first ${hosts.length} of ${deviceCount} devices._`);
+    lines.push("");
   }
   for (const host of hosts) {
     lines.push(`### ${host.name} (${host.kind}, source: ${host.source})`);
     if (host.vms.length > 0) {
-      lines.push(`- VMs: ${host.vms.map((v) => `${v.name} [${v.powerState}]`).join(", ")}`);
+      const suffix = host._count.vms > host.vms.length ? `, … ${host._count.vms - host.vms.length} more` : "";
+      lines.push(`- VMs: ${host.vms.map((v) => `${v.name} [${v.powerState}]`).join(", ")}${suffix}`);
     }
     if (host.containers.length > 0) {
+      const suffix = host._count.containers > host.containers.length
+        ? `, … ${host._count.containers - host.containers.length} more`
+        : "";
       lines.push(
-        `- Containers: ${host.containers.map((c) => `${c.name} (${c.runtime}) [${c.powerState}]`).join(", ")}`,
+        `- Containers: ${host.containers.map((c) => `${c.name} (${c.runtime}) [${c.powerState}]`).join(", ")}${suffix}`,
       );
     }
     if (host.vms.length === 0 && host.containers.length === 0) {
@@ -110,6 +176,10 @@ export async function buildOverviewMarkdown(): Promise<string> {
   if (networks.length === 0) {
     lines.push("_No networks recorded._");
   } else {
+    if (networkCount > networks.length) {
+      lines.push(`_Showing the first ${networks.length} of ${networkCount} networks._`);
+      lines.push("");
+    }
     lines.push("| Name | VLAN | CIDR | Purpose |");
     lines.push("| --- | --- | --- | --- |");
     for (const n of networks) {
@@ -118,22 +188,7 @@ export async function buildOverviewMarkdown(): Promise<string> {
   }
   lines.push("");
 
-  lines.push("## Integrations");
-  lines.push("");
-  if (integrations.length === 0) {
-    lines.push("_No integrations configured._");
-  } else {
-    lines.push("| Name | Type | Enabled | Last sync | Status | Error |");
-    lines.push("| --- | --- | --- | --- | --- | --- |");
-    for (const i of integrations) {
-      lines.push(
-        `| ${mdCell(i.name)} | ${i.type} | ${i.enabled ? "yes" : "no"} | ${mdCell(
-          i.lastSyncAt?.toISOString(),
-        )} | ${mdCell(i.lastSyncStatus)} | ${mdCell(i.lastSyncError)} |`,
-      );
-    }
-  }
-  lines.push("");
+  appendIntegrationOverview(lines, integrations, integrationCount);
 
   return lines.join("\n");
 }
diff --git a/src/lib/rate-limit.ts b/src/lib/rate-limit.ts
new file mode 100644
index 0000000..0f379f4
--- /dev/null
+++ b/src/lib/rate-limit.ts
@@ -0,0 +1,112 @@
+import "server-only";
+
+import { isIP } from "node:net";
+import { Prisma } from "@prisma/client";
+import type { NextRequest } from "next/server";
+import { prisma } from "@/lib/db";
+import { sha256Hex } from "@/lib/crypto";
+
+export interface RateLimitPolicy {
+  limit: number;
+  windowMs: number;
+}
+
+export interface RateLimitResult {
+  allowed: boolean;
+  remaining: number;
+  retryAfterSeconds: number;
+}
+
+interface BucketRow {
+  count: number;
+  expiresAt: Date;
+}
+
+function bucketKey(namespace: string, identity: string): string {
+  return `${namespace}:${sha256Hex(identity)}`;
+}
+
+/**
+ * Shared fixed-window limiter backed by PostgreSQL. The single UPSERT is atomic,
+ * so limits hold across multiple PolySIEM replicas and concurrent requests.
+ */
+export async function consumeRateLimit(
+  namespace: string,
+  identity: string,
+  policy: RateLimitPolicy,
+): Promise<RateLimitResult> {
+  const now = new Date();
+  const expiresAt = new Date(now.getTime() + policy.windowMs);
+  const key = bucketKey(namespace, identity);
+  const rows = await prisma.$queryRaw<BucketRow[]>(Prisma.sql`
+    INSERT INTO "RateLimitBucket" ("key", "count", "windowStartedAt", "expiresAt", "updatedAt")
+    VALUES (${key}, 1, ${now}, ${expiresAt}, ${now})
+    ON CONFLICT ("key") DO UPDATE SET
+      "count" = CASE
+        WHEN "RateLimitBucket"."expiresAt" <= ${now} THEN 1
+        ELSE "RateLimitBucket"."count" + 1
+      END,
+      "windowStartedAt" = CASE
+        WHEN "RateLimitBucket"."expiresAt" <= ${now} THEN ${now}
+        ELSE "RateLimitBucket"."windowStartedAt"
+      END,
+      "expiresAt" = CASE
+        WHEN "RateLimitBucket"."expiresAt" <= ${now} THEN ${expiresAt}
+        ELSE "RateLimitBucket"."expiresAt"
+      END,
+      "updatedAt" = ${now}
+    RETURNING "count", "expiresAt"
+  `);
+  const bucket = rows[0];
+  if (!bucket) throw new Error("Rate limiter did not return a bucket");
+
+  return {
+    allowed: bucket.count <= policy.limit,
+    remaining: Math.max(0, policy.limit - bucket.count),
+    retryAfterSeconds: Math.max(1, Math.ceil((bucket.expiresAt.getTime() - now.getTime()) / 1000)),
+  };
+}
+
+/** Clear identity-specific failures after a successful authentication. */
+export async function clearRateLimit(namespace: string, identity: string): Promise<void> {
+  await prisma.rateLimitBucket.deleteMany({
+    where: { key: bucketKey(namespace, identity) },
+  });
+}
+
+/** Remove a bounded batch of expired counters so cleanup cannot monopolize a login request. */
+export async function pruneExpiredRateLimits(now = new Date(), limit = 1_000): Promise<number> {
+  const normalizedLimit = Math.min(10_000, Math.max(1, Math.floor(limit)));
+  const rows = await prisma.$queryRaw<Array<{ key: string }>>(Prisma.sql`
+    WITH expired AS (
+      SELECT "key"
+      FROM "RateLimitBucket"
+      WHERE "expiresAt" <= ${now}
+      ORDER BY "expiresAt" ASC
+      LIMIT ${normalizedLimit}
+    )
+    DELETE FROM "RateLimitBucket" AS bucket
+    USING expired
+    WHERE bucket."key" = expired."key"
+    RETURNING bucket."key"
+  `);
+  return rows.length;
+}
+
+/**
+ * Read a client address only when the deployment explicitly trusts its reverse
+ * proxy. This avoids letting callers forge X-Forwarded-For and bypass an IP
+ * limit. Account-based limiting remains active when proxy trust is disabled.
+ */
+export function trustedClientIp(req: NextRequest): string | null {
+  if (process.env.TRUST_PROXY_HEADERS !== "true") return null;
+  const candidates = [
+    req.headers.get("cf-connecting-ip"),
+    req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? null,
+    req.headers.get("x-real-ip"),
+  ];
+  for (const candidate of candidates) {
+    if (candidate && isIP(candidate)) return candidate;
+  }
+  return null;
+}
diff --git a/src/lib/security/collect.ts b/src/lib/security/collect.ts
index b541cac..d0d1949 100644
--- a/src/lib/security/collect.ts
+++ b/src/lib/security/collect.ts
@@ -2,6 +2,7 @@ import "server-only";
 
 import { prisma } from "@/lib/db";
 import { verifyPassword } from "@/lib/auth/password";
+import { assertDatasetBudget } from "@/lib/dataset-budget";
 import type {
   SecuritySnapshot,
   SnapshotDyndnsHost,
@@ -20,6 +21,19 @@ import type {
 
 const iso = (d: Date | null): string | null => (d ? d.toISOString() : null);
 
+const SECURITY_BUDGET = {
+  firewallRules: 25_000,
+  portForwards: 10_000,
+  dyndnsHosts: 10_000,
+  tunnelHostnames: 10_000,
+  wirelessNetworks: 10_000,
+  vms: 10_000,
+  containers: 10_000,
+  devices: 5_000,
+  sshKeyDeployments: 50_000,
+  services: 20_000,
+} as const;
+
 /** True when the seeded "admin" account still verifies against "admin". */
 async function detectDefaultAdminPassword(): Promise<boolean> {
   try {
@@ -113,6 +127,7 @@ export async function collectSecuritySnapshot(): Promise<SecuritySnapshot> {
         descriptionText: true,
         sequence: true,
       },
+      take: SECURITY_BUDGET.firewallRules + 1,
     }),
     prisma.portForward.findMany({
       where: notRemoved,
@@ -129,17 +144,21 @@ export async function collectSecuritySnapshot(): Promise<SecuritySnapshot> {
         targetPort: true,
         descriptionText: true,
       },
+      take: SECURITY_BUDGET.portForwards + 1,
     }),
     prisma.dyndnsHost.findMany({
       where: notRemoved,
       select: { id: true, hostname: true, enabled: true, status: true, metadata: true },
+      take: SECURITY_BUDGET.dyndnsHosts + 1,
     }),
     prisma.tunnelHostname.findMany({
       select: { id: true, hostname: true, metadata: true, tunnel: { select: { name: true } } },
+      take: SECURITY_BUDGET.tunnelHostnames + 1,
     }),
     prisma.wirelessNetwork.findMany({
       where: notRemoved,
       select: { id: true, name: true, enabled: true, status: true, security: true, wpaMode: true },
+      take: SECURITY_BUDGET.wirelessNetworks + 1,
     }),
     prisma.virtualMachine.findMany({
       where: notRemoved,
@@ -153,6 +172,7 @@ export async function collectSecuritySnapshot(): Promise<SecuritySnapshot> {
         description: true,
         metadata: true,
       },
+      take: SECURITY_BUDGET.vms + 1,
     }),
     prisma.container.findMany({
       where: notRemoved,
@@ -166,6 +186,7 @@ export async function collectSecuritySnapshot(): Promise<SecuritySnapshot> {
         description: true,
         metadata: true,
       },
+      take: SECURITY_BUDGET.containers + 1,
     }),
     prisma.device.findMany({
       where: notRemoved,
@@ -178,16 +199,30 @@ export async function collectSecuritySnapshot(): Promise<SecuritySnapshot> {
         lastSeenAt: true,
         description: true,
       },
+      take: SECURITY_BUDGET.devices + 1,
     }),
     prisma.sshKeyDeployment.findMany({
       select: { deviceId: true, vmId: true, containerId: true },
+      take: SECURITY_BUDGET.sshKeyDeployments + 1,
     }),
     prisma.service.findMany({
       where: notRemoved,
       select: { id: true, name: true, status: true, port: true, protocol: true, url: true },
+      take: SECURITY_BUDGET.services + 1,
     }),
   ]);
 
+  assertDatasetBudget("Security firewall rules", firewallRules, SECURITY_BUDGET.firewallRules);
+  assertDatasetBudget("Security port forwards", portForwards, SECURITY_BUDGET.portForwards);
+  assertDatasetBudget("Security dynamic DNS hosts", dyndnsHosts, SECURITY_BUDGET.dyndnsHosts);
+  assertDatasetBudget("Security tunnel hostnames", tunnelHostnames, SECURITY_BUDGET.tunnelHostnames);
+  assertDatasetBudget("Security wireless networks", wirelessNetworks, SECURITY_BUDGET.wirelessNetworks);
+  assertDatasetBudget("Security virtual machines", vms, SECURITY_BUDGET.vms);
+  assertDatasetBudget("Security containers", containers, SECURITY_BUDGET.containers);
+  assertDatasetBudget("Security devices", devices, SECURITY_BUDGET.devices);
+  assertDatasetBudget("Security SSH deployments", sshKeyDeployments, SECURITY_BUDGET.sshKeyDeployments);
+  assertDatasetBudget("Security services", services, SECURITY_BUDGET.services);
+
   const sessionsByUser = new Map(sessionCounts.map((s) => [s.userId, s._count._all]));
 
   // SSH-key coverage per target: a machine with zero documented keys is
diff --git a/src/lib/services/cloudflare.ts b/src/lib/services/cloudflare.ts
index 4b23fdf..311fdf1 100644
--- a/src/lib/services/cloudflare.ts
+++ b/src/lib/services/cloudflare.ts
@@ -2,14 +2,17 @@ import "server-only";
 import { prisma } from "@/lib/db";
 import { cloudflareSettingsSchema } from "@/lib/validators/integrations";
 import type { CloudflareAccountSnapshot } from "@/lib/integrations/cloudflare/types";
+import { assertDatasetBudget } from "@/lib/dataset-budget";
 
-/** Read all enabled, persisted Cloudflare accounts without touching credentials. */
-export async function listStoredCloudflareSnapshots(): Promise<CloudflareAccountSnapshot[]> {
+/** Read a bounded set of enabled, persisted Cloudflare accounts without touching credentials. */
+export async function listStoredCloudflareSnapshots(limit = 100): Promise<CloudflareAccountSnapshot[]> {
   const rows = await prisma.integrationConfig.findMany({
     where: { type: "CLOUDFLARE", enabled: true },
     orderBy: { name: "asc" },
     select: { settings: true },
+    take: limit + 1,
   });
+  assertDatasetBudget("Enabled Cloudflare integrations", rows, limit);
   return rows.flatMap((row) => {
     const parsed = cloudflareSettingsSchema.safeParse(row.settings ?? {});
     return parsed.success && parsed.data.syncedSnapshot
diff --git a/src/lib/services/tailscale.ts b/src/lib/services/tailscale.ts
index feb9fea..5a07b7d 100644
--- a/src/lib/services/tailscale.ts
+++ b/src/lib/services/tailscale.ts
@@ -1,13 +1,16 @@
 import "server-only";
 import { prisma } from "@/lib/db";
 import { tailscaleSettingsSchema, type TailscaleSnapshot } from "@/lib/validators/integrations";
+import { assertDatasetBudget } from "@/lib/dataset-budget";
 
-export async function listStoredTailscaleSnapshots(): Promise<TailscaleSnapshot[]> {
+export async function listStoredTailscaleSnapshots(limit = 100): Promise<TailscaleSnapshot[]> {
   const rows = await prisma.integrationConfig.findMany({
     where: { type: "TAILSCALE", enabled: true },
     orderBy: { name: "asc" },
     select: { settings: true },
+    take: limit + 1,
   });
+  assertDatasetBudget("Enabled Tailscale integrations", rows, limit);
   return rows.flatMap((row) => {
     const parsed = tailscaleSettingsSchema.safeParse(row.settings ?? {});
     return parsed.success && parsed.data.syncedSnapshot ? [parsed.data.syncedSnapshot] : [];
diff --git a/src/lib/topology/footprint-data.ts b/src/lib/topology/footprint-data.ts
index af0f724..5f54e09 100644
--- a/src/lib/topology/footprint-data.ts
+++ b/src/lib/topology/footprint-data.ts
@@ -15,6 +15,7 @@ import type { DnsClassification } from "@/lib/dns/cloudflare";
 import { discoveredCloudflaredTunnels } from "@/lib/integrations/elasticsearch/catalog";
 import { listStoredCloudflareSnapshots } from "@/lib/services/cloudflare";
 import { listStoredTailscaleSnapshots } from "@/lib/services/tailscale";
+import { assertDatasetBudget } from "@/lib/dataset-budget";
 import type {
   FootprintInput,
   FpCarriage,
@@ -27,6 +28,30 @@ import type {
 
 const notRemoved = { status: { not: "REMOVED" as const } };
 
+const FOOTPRINT_BUDGET = {
+  devices: 5_000,
+  vms: 10_000,
+  containers: 10_000,
+  networks: 2_000,
+  firewallRules: 25_000,
+  aliases: 10_000,
+  addresses: 50_000,
+  interfaces: 50_000,
+  switchConfigs: 2_000,
+  switchPortsPerConfig: 2_000,
+  switchVlansPerConfig: 4_096,
+  leases: 50_000,
+  neighbors: 50_000,
+  portForwards: 25_000,
+  dyndnsHosts: 10_000,
+  tunnels: 5_000,
+  tunnelHostnamesPerTunnel: 10_000,
+  gateways: 2_000,
+  elasticIntegrations: 1_000,
+  storedProviderIntegrations: 100,
+} as const;
+
+
 function deviceKind(kind: string): FpMachine["kind"] {
   if (kind === "firewall") return "firewall";
   if (kind === "switch") return "switch";
@@ -42,21 +67,25 @@ export async function loadFootprintInput(): Promise<FootprintInput> {
       where: notRemoved,
       orderBy: { name: "asc" },
       select: { id: true, name: true, kind: true, osName: true },
+      take: FOOTPRINT_BUDGET.devices + 1,
     }),
     prisma.virtualMachine.findMany({
       where: notRemoved,
       orderBy: { name: "asc" },
       select: { id: true, name: true, externalId: true, powerState: true, hostId: true, osName: true, metadata: true },
+      take: FOOTPRINT_BUDGET.vms + 1,
     }),
     prisma.container.findMany({
       where: notRemoved,
       orderBy: { name: "asc" },
       select: { id: true, name: true, externalId: true, powerState: true, hostId: true, osName: true, metadata: true },
+      take: FOOTPRINT_BUDGET.containers + 1,
     }),
     prisma.network.findMany({
       where: notRemoved,
       orderBy: { name: "asc" },
       select: { id: true, name: true, vlanId: true, cidr: true, externalId: true, purpose: true },
+      take: FOOTPRINT_BUDGET.networks + 1,
     }),
     prisma.firewallRule.findMany({
       where: { ...notRemoved, enabled: true, source: { not: "PROXMOX" } },
@@ -73,6 +102,7 @@ export async function loadFootprintInput(): Promise<FootprintInput> {
         descriptionText: true,
         metadata: true,
       },
+      take: FOOTPRINT_BUDGET.firewallRules + 1,
     }),
     prisma.firewallRule.findMany({
       where: { ...notRemoved, enabled: true, source: "PROXMOX" },
@@ -87,16 +117,20 @@ export async function loadFootprintInput(): Promise<FootprintInput> {
         enabled: true,
         metadata: true,
       },
+      take: FOOTPRINT_BUDGET.firewallRules + 1,
     }),
     prisma.firewallAlias.findMany({
       where: { ...notRemoved, aliasType: { notIn: ["pve-ipset", "pve-alias"] } },
       select: { name: true, aliasType: true, content: true },
+      take: FOOTPRINT_BUDGET.aliases + 1,
     }),
     prisma.firewallAlias.findMany({
       where: { ...notRemoved, aliasType: { in: ["pve-ipset", "pve-alias"] } },
       select: { name: true, content: true },
+      take: FOOTPRINT_BUDGET.aliases + 1,
     }),
     prisma.ipAddress.findMany({
+      take: FOOTPRINT_BUDGET.addresses + 1,
       select: {
         address: true,
         networkId: true,
@@ -118,6 +152,7 @@ export async function loadFootprintInput(): Promise<FootprintInput> {
         ],
       },
       orderBy: { externalId: "asc" },
+      take: FOOTPRINT_BUDGET.interfaces + 1,
       select: {
         source: true,
         integrationId: true,
@@ -131,11 +166,16 @@ export async function loadFootprintInput(): Promise<FootprintInput> {
       },
     }),
     prisma.switchConfig.findMany({
+      take: FOOTPRINT_BUDGET.switchConfigs + 1,
       select: {
         device: { select: { id: true } },
-        vlans: { select: { vlanId: true, networkId: true } },
+        vlans: {
+          take: FOOTPRINT_BUDGET.switchVlansPerConfig + 1,
+          select: { vlanId: true, networkId: true },
+        },
         ports: {
           orderBy: { sortOrder: "asc" },
+          take: FOOTPRINT_BUDGET.switchPortsPerConfig + 1,
           select: {
             shortName: true,
             mode: true,
@@ -154,15 +194,35 @@ export async function loadFootprintInput(): Promise<FootprintInput> {
     prisma.dhcpLease.findMany({
       where: notRemoved,
       select: { id: true, ipAddress: true, macAddress: true, hostname: true, isStatic: true, networkId: true },
+      take: FOOTPRINT_BUDGET.leases + 1,
     }),
     // permanent ARP entries are the firewall's own addresses — excluded.
     prisma.networkNeighbor.findMany({
       where: { ...notRemoved, permanent: false },
       select: { id: true, ipAddress: true, macAddress: true, hostname: true, manufacturer: true, networkId: true },
+      take: FOOTPRINT_BUDGET.neighbors + 1,
     }),
-    listStoredTailscaleSnapshots(),
+    listStoredTailscaleSnapshots(FOOTPRINT_BUDGET.storedProviderIntegrations),
   ]);
 
+  assertDatasetBudget("Topology devices", devices, FOOTPRINT_BUDGET.devices);
+  assertDatasetBudget("Topology virtual machines", vms, FOOTPRINT_BUDGET.vms);
+  assertDatasetBudget("Topology containers", containers, FOOTPRINT_BUDGET.containers);
+  assertDatasetBudget("Topology networks", networks, FOOTPRINT_BUDGET.networks);
+  assertDatasetBudget("Topology firewall rules", rules, FOOTPRINT_BUDGET.firewallRules);
+  assertDatasetBudget("Topology Proxmox firewall rules", pveRules, FOOTPRINT_BUDGET.firewallRules);
+  assertDatasetBudget("Topology firewall aliases", aliases, FOOTPRINT_BUDGET.aliases);
+  assertDatasetBudget("Topology Proxmox address sets", pveAddressSets, FOOTPRINT_BUDGET.aliases);
+  assertDatasetBudget("Topology IP addresses", ips, FOOTPRINT_BUDGET.addresses);
+  assertDatasetBudget("Topology interfaces", assetInterfaces, FOOTPRINT_BUDGET.interfaces);
+  assertDatasetBudget("Topology switch configurations", switchConfigs, FOOTPRINT_BUDGET.switchConfigs);
+  assertDatasetBudget("Topology DHCP leases", leases, FOOTPRINT_BUDGET.leases);
+  assertDatasetBudget("Topology network neighbors", neighbors, FOOTPRINT_BUDGET.neighbors);
+  for (const config of switchConfigs) {
+    assertDatasetBudget("Ports in one switch configuration", config.ports, FOOTPRINT_BUDGET.switchPortsPerConfig);
+    assertDatasetBudget("VLANs in one switch configuration", config.vlans, FOOTPRINT_BUDGET.switchVlansPerConfig);
+  }
+
   const proxmoxNetworkEvidence = deriveProxmoxNetworkEvidence(
     assetInterfaces.flatMap((iface) => {
       if (iface.source !== "PROXMOX" || !iface.integrationId) return [];
@@ -583,11 +643,13 @@ export async function loadFootprintInput(): Promise<FootprintInput> {
         enabled: true,
         sourceSpec: true,
       },
+      take: FOOTPRINT_BUDGET.portForwards + 1,
     }),
     prisma.dyndnsHost.findMany({
       where: notRemoved,
       orderBy: { hostname: "asc" },
       select: { id: true, hostname: true, service: true, enabled: true, currentIp: true, metadata: true },
+      take: FOOTPRINT_BUDGET.dyndnsHosts + 1,
     }),
     prisma.tunnel.findMany({
       orderBy: { name: "asc" },
@@ -598,23 +660,40 @@ export async function loadFootprintInput(): Promise<FootprintInput> {
         originIp: true,
         ingressHostnames: true,
         hostnames: {
+          take: FOOTPRINT_BUDGET.tunnelHostnamesPerTunnel + 1,
           select: { hostname: true, resolvedIps: true, proxied: true, metadata: true },
         },
       },
+      take: FOOTPRINT_BUDGET.tunnels + 1,
     }),
     prisma.networkGateway.findMany({
       where: notRemoved,
       orderBy: { name: "asc" },
       select: { id: true, name: true, interfaceName: true, ipAddress: true, isDefault: true, online: true },
+      take: FOOTPRINT_BUDGET.gateways + 1,
     }),
     prisma.integrationConfig.findMany({
       where: { type: "ELASTICSEARCH", enabled: true },
       orderBy: { createdAt: "asc" },
       select: { id: true, name: true, settings: true },
+      take: FOOTPRINT_BUDGET.elasticIntegrations + 1,
     }),
-    listStoredCloudflareSnapshots(),
+    listStoredCloudflareSnapshots(FOOTPRINT_BUDGET.storedProviderIntegrations),
   ]);
 
+  assertDatasetBudget("Topology port forwards", pfRows, FOOTPRINT_BUDGET.portForwards);
+  assertDatasetBudget("Topology dynamic DNS hosts", ddRows, FOOTPRINT_BUDGET.dyndnsHosts);
+  assertDatasetBudget("Topology tunnels", tunnelRows, FOOTPRINT_BUDGET.tunnels);
+  assertDatasetBudget("Topology gateways", gwRows, FOOTPRINT_BUDGET.gateways);
+  assertDatasetBudget("Topology Elasticsearch integrations", elasticRows, FOOTPRINT_BUDGET.elasticIntegrations);
+  for (const tunnel of tunnelRows) {
+    assertDatasetBudget(
+      "Hostnames in one topology tunnel",
+      tunnel.hostnames,
+      FOOTPRINT_BUDGET.tunnelHostnamesPerTunnel,
+    );
+  }
+
   const isUnrestricted = (spec: string | null): boolean =>
     !spec || spec.trim() === "" || spec.trim() === "*" || spec.trim().toLowerCase() === "any";
 
diff --git a/src/lib/workflows/scheduler.test.ts b/src/lib/workflows/scheduler.test.ts
index b90033e..0044897 100644
--- a/src/lib/workflows/scheduler.test.ts
+++ b/src/lib/workflows/scheduler.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it } from "vitest";
 import {
   esTriggerNodes,
   isDue,
+  runWithConcurrency,
   scheduleIntervalMinutes,
   securityTrailsTriggerNodes,
   threatTriggerNodes,
@@ -100,3 +101,39 @@ describe("threatTriggerNodes", () => {
     );
   });
 });
+
+
+describe("runWithConcurrency", () => {
+  it("never exceeds the configured number of workers", async () => {
+    let active = 0;
+    let peak = 0;
+    const seen: number[] = [];
+    await runWithConcurrency([0, 1, 2, 3, 4, 5], 2, async (value) => {
+      active += 1;
+      peak = Math.max(peak, active);
+      await new Promise((resolve) => setTimeout(resolve, 2));
+      seen.push(value);
+      active -= 1;
+    });
+    expect(peak).toBe(2);
+    expect(seen.sort((a, b) => a - b)).toEqual([0, 1, 2, 3, 4, 5]);
+  });
+
+  it("falls back to one worker for an invalid concurrency value", async () => {
+    let active = 0;
+    let peak = 0;
+    await runWithConcurrency([1, 2, 3], Number.NaN, async () => {
+      active += 1;
+      peak = Math.max(peak, active);
+      await new Promise((resolve) => setTimeout(resolve, 1));
+      active -= 1;
+    });
+    expect(peak).toBe(1);
+  });
+
+  it("handles an empty input without invoking the worker", async () => {
+    let calls = 0;
+    await runWithConcurrency([], 4, async () => { calls += 1; });
+    expect(calls).toBe(0);
+  });
+});
diff --git a/src/lib/workflows/scheduler.ts b/src/lib/workflows/scheduler.ts
index 6e3376c..8dd5d78 100644
--- a/src/lib/workflows/scheduler.ts
+++ b/src/lib/workflows/scheduler.ts
@@ -28,6 +28,33 @@ import {
  */
 
 const SYSTEM_ACTOR: AuditActor = { type: "system" };
+const DEFAULT_WORKFLOW_CONCURRENCY = 4;
+
+function schedulerConcurrency(): number {
+  const configured = Number(process.env.WORKFLOW_SCHEDULER_CONCURRENCY ?? DEFAULT_WORKFLOW_CONCURRENCY);
+  if (!Number.isFinite(configured)) return DEFAULT_WORKFLOW_CONCURRENCY;
+  return Math.min(16, Math.max(1, Math.floor(configured)));
+}
+
+/** Run independent jobs with a hard concurrency ceiling and stable item order. */
+export async function runWithConcurrency<T>(
+  items: readonly T[],
+  concurrency: number,
+  worker: (item: T, index: number) => Promise<void>,
+): Promise<void> {
+  let cursor = 0;
+  const normalizedConcurrency = Number.isFinite(concurrency) ? Math.max(1, Math.floor(concurrency)) : 1;
+  const workerCount = Math.min(items.length, normalizedConcurrency);
+  await Promise.all(
+    Array.from({ length: workerCount }, async () => {
+      while (true) {
+        const index = cursor++;
+        if (index >= items.length) return;
+        await worker(items[index]!, index);
+      }
+    }),
+  );
+}
 
 /** Pure due-ness check: a workflow with no runs yet is always due. */
 export function isDue(lastStartedAt: Date | null, intervalMinutes: number, now: Date): boolean {
@@ -200,18 +227,14 @@ async function evaluateAndFireSecurityTrailsTrigger(
 
 async function processScheduledWorkflow(
   workflow: Workflow,
+  lastStartedAt: Date | null,
   now: Date,
   executeWorkflow: ExecuteWorkflowFn,
 ): Promise<void> {
   const graph = workflow.graph as unknown as WorkflowGraph;
   const intervalMinutes = scheduleIntervalMinutes(graph);
   if (intervalMinutes !== null) {
-    const lastRun = await prisma.workflowRun.findFirst({
-      where: { workflowId: workflow.id },
-      orderBy: { startedAt: "desc" },
-      select: { startedAt: true },
-    });
-    if (isDue(lastRun?.startedAt ?? null, intervalMinutes, now)) {
+    if (isDue(lastStartedAt, intervalMinutes, now)) {
       try {
         await executeWorkflow(SYSTEM_ACTOR, workflow.id, {}, { trigger: "schedule" });
       } catch (err) {
@@ -263,10 +286,28 @@ export function startWorkflowScheduler(): void {
       // of this module's top-level graph so the pure helpers stay unit-testable.
       const { executeWorkflow } = await import("./executor");
       const workflows = await prisma.workflow.findMany({ where: { enabled: true } });
+      const scheduledIds = workflows.flatMap((workflow) =>
+        scheduleIntervalMinutes(workflow.graph as unknown as WorkflowGraph) === null ? [] : [workflow.id],
+      );
+      const latestRuns = scheduledIds.length === 0
+        ? []
+        : await prisma.workflowRun.groupBy({
+            by: ["workflowId"],
+            where: { workflowId: { in: scheduledIds } },
+            _max: { startedAt: true },
+          });
+      const latestRunByWorkflow = new Map(
+        latestRuns.map((row) => [row.workflowId, row._max.startedAt ?? null]),
+      );
       const now = new Date();
-      for (const workflow of workflows) {
-        await processScheduledWorkflow(workflow, now, executeWorkflow);
-      }
+      await runWithConcurrency(workflows, schedulerConcurrency(), async (workflow) => {
+        await processScheduledWorkflow(
+          workflow,
+          latestRunByWorkflow.get(workflow.id) ?? null,
+          now,
+          executeWorkflow,
+        );
+      });
     } catch (err) {
       console.error("[workflow-scheduler] tick failed:", err);
     } finally {
diff --git a/src/lib/workflows/service.ts b/src/lib/workflows/service.ts
index 2a8bde9..2a06df3 100644
--- a/src/lib/workflows/service.ts
+++ b/src/lib/workflows/service.ts
@@ -17,6 +17,7 @@ import type {
 import { validateGraph } from "./engine";
 import { actionCatalog } from "./registry";
 import type { CreateWorkflowInput, UpdateWorkflowInput } from "./schemas";
+import { syncWorkflowWebhookIndex } from "./webhook-index";
 
 /**
  * Workflow CRUD + run queries — the single source of truth used by the API
@@ -131,15 +132,19 @@ export async function createWorkflow(
   input: CreateWorkflowInput,
 ): Promise<WorkflowDto> {
   const graph = ensureWebhookTokens(input.graph);
-  const row = await prisma.workflow.create({
-    data: {
-      name: input.name.trim(),
-      description: input.description?.trim() || null,
-      enabled: input.enabled,
-      graph: graph as unknown as Prisma.InputJsonValue,
-      createdById: actor.userId ?? null,
-    },
-    include: LAST_RUN_INCLUDE,
+  const row = await prisma.$transaction(async (tx) => {
+    const created = await tx.workflow.create({
+      data: {
+        name: input.name.trim(),
+        description: input.description?.trim() || null,
+        enabled: input.enabled,
+        graph: graph as unknown as Prisma.InputJsonValue,
+        createdById: actor.userId ?? null,
+      },
+      include: LAST_RUN_INCLUDE,
+    });
+    await syncWorkflowWebhookIndex(tx, created.id, graph);
+    return created;
   });
   await audit(actor, "workflow.create", { type: "workflow", id: row.id }, {
     name: row.name,
@@ -154,17 +159,20 @@ export async function updateWorkflow(
   input: UpdateWorkflowInput,
 ): Promise<WorkflowDto> {
   await getWorkflow(id);
-  const row = await prisma.workflow.update({
-    where: { id },
-    data: {
-      ...(input.name !== undefined ? { name: input.name.trim() } : {}),
-      ...(input.description !== undefined ? { description: input.description?.trim() || null } : {}),
-      ...(input.enabled !== undefined ? { enabled: input.enabled } : {}),
-      ...(input.graph !== undefined
-        ? { graph: ensureWebhookTokens(input.graph) as unknown as Prisma.InputJsonValue }
-        : {}),
-    },
-    include: LAST_RUN_INCLUDE,
+  const graph = input.graph === undefined ? undefined : ensureWebhookTokens(input.graph);
+  const row = await prisma.$transaction(async (tx) => {
+    const updated = await tx.workflow.update({
+      where: { id },
+      data: {
+        ...(input.name !== undefined ? { name: input.name.trim() } : {}),
+        ...(input.description !== undefined ? { description: input.description?.trim() || null } : {}),
+        ...(input.enabled !== undefined ? { enabled: input.enabled } : {}),
+        ...(graph !== undefined ? { graph: graph as unknown as Prisma.InputJsonValue } : {}),
+      },
+      include: LAST_RUN_INCLUDE,
+    });
+    if (graph !== undefined) await syncWorkflowWebhookIndex(tx, id, graph);
+    return updated;
   });
   await audit(actor, "workflow.update", { type: "workflow", id }, { fields: Object.keys(input) });
   return toWorkflowDto(row);
diff --git a/src/lib/workflows/webhook-index.ts b/src/lib/workflows/webhook-index.ts
new file mode 100644
index 0000000..d77b2ce
--- /dev/null
+++ b/src/lib/workflows/webhook-index.ts
@@ -0,0 +1,106 @@
+import "server-only";
+
+import { Prisma } from "@prisma/client";
+import { ApiError } from "@/lib/api";
+import { prisma } from "@/lib/db";
+import { WEBHOOK_TRIGGER_KIND } from "./actions/trigger-webhook";
+import type { WorkflowGraph, WorkflowNodeSpec } from "./types";
+
+interface WebhookEntry {
+  token: string;
+  nodeId: string;
+}
+
+interface IndexedWebhookRow {
+  workflowId: string;
+  graph: Prisma.JsonValue;
+  nodeId: string;
+}
+
+function webhookEntries(graph: WorkflowGraph): WebhookEntry[] {
+  const entries = (graph.nodes ?? []).flatMap((node) => {
+    const token = node.kind === WEBHOOK_TRIGGER_KIND ? node.config?.token : null;
+    return typeof token === "string" && token.trim() !== ""
+      ? [{ token, nodeId: node.id }]
+      : [];
+  });
+  const unique = new Set(entries.map((entry) => entry.token));
+  if (unique.size !== entries.length) {
+    throw new ApiError(409, "duplicate_webhook_token", "Webhook trigger tokens must be unique.");
+  }
+  return entries;
+}
+
+/** Keep the materialized token lookup in lockstep with one workflow graph. */
+export async function syncWorkflowWebhookIndex(
+  tx: Prisma.TransactionClient,
+  workflowId: string,
+  graph: WorkflowGraph,
+): Promise<void> {
+  const entries = webhookEntries(graph);
+  await tx.$executeRaw(Prisma.sql`DELETE FROM "WorkflowWebhook" WHERE "workflowId" = ${workflowId}`);
+  if (entries.length === 0) return;
+
+  const values = entries.map((entry) => Prisma.sql`(${entry.token}, ${workflowId}, ${entry.nodeId})`);
+  try {
+    await tx.$executeRaw(Prisma.sql`
+      INSERT INTO "WorkflowWebhook" ("token", "workflowId", "nodeId")
+      VALUES ${Prisma.join(values)}
+    `);
+  } catch (err) {
+    const databaseCode = err instanceof Prisma.PrismaClientKnownRequestError
+      ? String((err.meta as { code?: unknown } | undefined)?.code ?? "")
+      : "";
+    if (
+      err instanceof Prisma.PrismaClientKnownRequestError &&
+      (err.code === "P2002" || (err.code === "P2010" && databaseCode === "23505"))
+    ) {
+      throw new ApiError(409, "duplicate_webhook_token", "A webhook token is already used by another workflow.");
+    }
+    throw err;
+  }
+}
+
+/** Rebuild all derived webhook rows after a destructive backup restore. */
+export async function rebuildWorkflowWebhookIndex(tx: Prisma.TransactionClient): Promise<void> {
+  await tx.$executeRaw(Prisma.sql`DELETE FROM "WorkflowWebhook"`);
+  await tx.$executeRaw(Prisma.sql`
+    INSERT INTO "WorkflowWebhook" ("token", "workflowId", "nodeId")
+    SELECT
+      node->'config'->>'token',
+      workflow."id",
+      node->>'id'
+    FROM "Workflow" AS workflow
+    CROSS JOIN LATERAL jsonb_array_elements(
+      CASE
+        WHEN jsonb_typeof(workflow."graph"->'nodes') = 'array' THEN workflow."graph"->'nodes'
+        ELSE '[]'::jsonb
+      END
+    ) AS node
+    WHERE node->>'kind' = ${WEBHOOK_TRIGGER_KIND}
+      AND COALESCE(node->'config'->>'token', '') <> ''
+  `);
+}
+
+/** Indexed public-hook lookup; only one matching workflow graph is loaded. */
+export async function findIndexedWebhook(
+  token: string,
+): Promise<{ workflowId: string; node: WorkflowNodeSpec } | null> {
+  const rows = await prisma.$queryRaw<IndexedWebhookRow[]>(Prisma.sql`
+    SELECT hook."workflowId", hook."nodeId", workflow."graph"
+    FROM "WorkflowWebhook" AS hook
+    INNER JOIN "Workflow" AS workflow ON workflow."id" = hook."workflowId"
+    WHERE hook."token" = ${token} AND workflow."enabled" = TRUE
+    LIMIT 1
+  `);
+  const row = rows[0];
+  if (!row) return null;
+  const graph = row.graph as unknown as WorkflowGraph;
+  const node = graph.nodes?.find?.(
+    (candidate) =>
+      candidate.id === row.nodeId &&
+      candidate.kind === WEBHOOK_TRIGGER_KIND &&
+      candidate.config?.token === token,
+  );
+  return node ? { workflowId: row.workflowId, node } : null;
+}
diff --git a/src/middleware.test.ts b/src/middleware.test.ts
index abac07d..ae021c8 100644
--- a/src/middleware.test.ts
+++ b/src/middleware.test.ts
@@ -58,6 +58,24 @@ describe("public demo middleware lock", () => {
     ).toBe(200);
   });
 
+  it("uses a nonce-based production CSP without executable inline scripts", () => {
+    vi.stubEnv("NODE_ENV", "production");
+    const response = middleware(new NextRequest("http://localhost/login"));
+    const policy = response.headers.get("Content-Security-Policy");
+
+    expect(policy).toContain("script-src 'self' 'nonce-");
+    expect(policy).toContain("'strict-dynamic'");
+    expect(policy).toContain("object-src 'none'");
+    expect(policy).not.toContain("'unsafe-eval'");
+    expect(policy).not.toContain("script-src 'self' 'unsafe-inline'");
+  });
+
+  it("keeps eval limited to local development tooling", () => {
+    vi.stubEnv("NODE_ENV", "development");
+    const response = middleware(new NextRequest("http://localhost/login"));
+    expect(response.headers.get("Content-Security-Policy")).toContain("'unsafe-eval'");
+  });
+
   it("keeps social preview images public without a session", () => {
     for (const path of ["/opengraph-image", "/twitter-image"]) {
       const response = middleware(new NextRequest(`http://localhost${path}`));
diff --git a/src/middleware.ts b/src/middleware.ts
index 74fcd03..3f6db08 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -11,6 +11,41 @@ const PUBLIC_PATHS = [
   "/twitter-image",
 ];
 
+function requestSecurityContext(request: NextRequest): {
+  headers: Headers;
+  contentSecurityPolicy: string;
+} {
+  const nonce = btoa(crypto.randomUUID());
+  const scriptSources = ["'self'", `'nonce-${nonce}'`, "'strict-dynamic'"];
+  if (process.env.NODE_ENV === "development") scriptSources.push("'unsafe-eval'");
+
+  const contentSecurityPolicy = [
+    "default-src 'self'",
+    "img-src 'self' data: blob:",
+    "style-src 'self' 'unsafe-inline'",
+    `script-src ${scriptSources.join(" ")}`,
+    "connect-src 'self'",
+    "font-src 'self' data:",
+    "worker-src 'self' blob:",
+    "object-src 'none'",
+    "frame-ancestors 'none'",
+    "base-uri 'self'",
+    "form-action 'self'",
+  ].join("; ");
+
+  // Next reads the request CSP/nonce when rendering framework and application
+  // scripts. The response receives the same policy below.
+  const headers = new Headers(request.headers);
+  headers.set("x-nonce", nonce);
+  headers.set("Content-Security-Policy", contentSecurityPolicy);
+  return { headers, contentSecurityPolicy };
+}
+
+function secured(response: NextResponse, contentSecurityPolicy: string): NextResponse {
+  response.headers.set("Content-Security-Policy", contentSecurityPolicy);
+  return response;
+}
+
 /**
  * Coarse route protection only: checks for the presence of the session cookie
  * and redirects to /login. Real session validation and role checks happen
@@ -18,23 +53,27 @@ const PUBLIC_PATHS = [
  */
 export function middleware(request: NextRequest) {
   const { pathname } = request.nextUrl;
+  const security = requestSecurityContext(request);
 
   if (
     isLockedDemoMode() &&
     !isPublicDemoRequestAllowed(pathname, request.method)
   ) {
-    return NextResponse.json(
-      {
-        error: {
-          code: "demo_read_only",
-          message:
-            "This public PolySIEM demo is read-only. Launch your own instance to save changes.",
+    return secured(
+      NextResponse.json(
+        {
+          error: {
+            code: "demo_read_only",
+            message:
+              "This public PolySIEM demo is read-only. Launch your own instance to save changes.",
+          },
         },
-      },
-      {
-        status: 423,
-        headers: { "Cache-Control": "no-store" },
-      },
+        {
+          status: 423,
+          headers: { "Cache-Control": "no-store" },
+        },
+      ),
+      security.contentSecurityPolicy,
     );
   }
 
@@ -44,17 +83,23 @@ export function middleware(request: NextRequest) {
     pathname.startsWith("/_next") ||
     pathname.includes(".")
   ) {
-    return NextResponse.next();
+    return secured(
+      NextResponse.next({ request: { headers: security.headers } }),
+      security.contentSecurityPolicy,
+    );
   }
 
   const hasSession = request.cookies.has("polysiem_session");
   if (!hasSession) {
     const login = new URL("/login", request.url);
     if (pathname !== "/") login.searchParams.set("next", pathname);
-    return NextResponse.redirect(login);
+    return secured(NextResponse.redirect(login), security.contentSecurityPolicy);
   }
 
-  return NextResponse.next();
+  return secured(
+    NextResponse.next({ request: { headers: security.headers } }),
+    security.contentSecurityPolicy,
+  );
 }
 
 export const config = {

From 144146b362cf194f0ef3d73e1854e4c434936614 Mon Sep 17 00:00:00 2001
From: RandomCatboy <dylan@youhavethe.gay>
Date: Sat, 8 Aug 2026 19:26:45 +0200
Subject: [PATCH 3/5] Bugs and fixes found during the full audit and
 code-quality pass. ORIGINAL CORRECTNESS / UX / RELIABILITY FINDINGS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Theme mode persistence could diverge between Settings, the desktop top bar, the mobile More sheet, local storage/cookies, and the persisted user profile; rapid changes could race:
  Fix: Added one shared persisted-theme hook with immediate preview, in-flight protection, persistence, disabled states while saving, and rollback when saving fails.

- Accent-color persistence had the same race/rollback problem as theme mode:
  Fix: Added the same guarded optimistic-save and rollback behavior for accent-color changes.

- Desktop and mobile demo-mode banners duplicated behavior, copy, and styling and used a fixed violet treatment that did not follow the selected accent theme:
  Fix: Replaced the duplicated banners with one shared DemoModeBanner using semantic theme tokens, shared copy/spacing/icon behavior, and consistent status semantics.

- Logout navigated to /login even when the server failed to invalidate the session, making a failed logout look successful; duplicate submissions were also possible:
  Fix: Logout now checks the API result, guards against duplicate submissions, reports failures, and navigates only after successful session invalidation.

- Investigation polling could remain stale because polling behavior was effectively tied to ticket-ID changes instead of all relevant persisted investigation state:
  Fix: Reworked the polling state/ref guards so a newly started or externally updated investigation re-engages correctly without relying on a suppressed dependency.

- Investigation polling could use an older React Query report after another client started a new run, producing stale UI/notifications:
  Fix: Seed the query cache from the newly persisted ticket state before polling the new run.

- Investigation completion could be consumed when SUCCESS arrived before the report payload, causing the completion callback/list invalidation to be missed:
  Fix: Completion is emitted only when both success state and report are present, so the callback and invalidation cannot be lost.

- Opening an already completed investigation could incorrectly behave like a newly completed run and create a false completion notification:
  Fix: Added completion-edge tracking so already-completed tickets do not emit a new completion event merely because they were opened.

- S3 backup upload/list/delete operations had no request timeout and could hang indefinitely on a degraded endpoint:
  Fix: Added bounded provider request timeouts, cache bypassing, and readable provider-specific timeout failures; uploads get a longer ceiling than metadata operations.

- Azure Blob backup upload/list/delete operations had no request timeout and could hang indefinitely on a degraded endpoint:
  Fix: Added the same bounded provider request timeout handling and cache bypassing for Azure Blob operations.

- S3 retention only processed the first ListObjectsV2 page, so old backups beyond the provider page limit could be silently ignored:
  Fix: Follow S3 continuation tokens until the listing is complete, with safety checks for missing/repeated continuation values.

- Azure Blob retention only processed the first listing page, so old backups beyond the provider page limit could be silently ignored:
  Fix: Follow Azure NextMarker pagination until completion, with loop-safety checks.

- Escaped XML entities in S3/Azure object names and continuation values were used without decoding, so retention could address the wrong key or fail deletion:
  Fix: Added shared XML decoding helpers and use decoded object/blob names and continuation values before subsequent requests/deletes.

- Backup retention deleted old cloud objects strictly sequentially, making large cleanup backlogs unnecessarily slow:
  Fix: Added bounded concurrent deletion while keeping cleanup best-effort and avoiding unbounded request bursts.

- Unsupported AI prompt task values had no runtime-safe default path and could fall through unexpectedly:
  Fix: Added an explicit default error for unsupported AI prompt tasks.

- Chat hydration relied on a hook dependency suppression instead of declaring the stable dependency, making stale behavior easier to introduce:
  Fix: Removed the suppression and declared the stable dependency explicitly.

- The root critical-error page mixed a light page treatment with a permanently dark action button and did not coherently follow system light/dark appearance:
  Fix: Updated the critical-error surface to follow the operating-system color scheme coherently.

- Two edit-form effects suppressed react-hooks/exhaustive-deps to avoid overwriting drafts, leaving correctness dependent on lint suppression:
  Fix: Replaced the suppressions with ID-based ref guards that preserve the intended “reset only when the selected record changes” behavior.

SECURITY / RESOURCE-BOUNDARY FINDINGS

- The login endpoint had no throttling or backoff, allowing brute-force attempts and CPU exhaustion through intentionally expensive password verification:
  Fix: Added PostgreSQL-backed account and trusted-client-IP fixed-window rate limits shared across replicas, with successful-login reset and bounded expiry cleanup.

- Client IP headers could be forged if blindly trusted for login limiting:
  Fix: Forwarded client-IP headers are used only when TRUST_PROXY_HEADERS=true, and values are validated as IP addresses; account limiting remains active otherwise.

- A first version of the login limiter added a shared global bucket that one attacker could exhaust to deny login to every valid user:
  Fix: Removed the global lockout bucket; valid accounts have independent buckets and unknown usernames share one bounded bucket so arbitrary names cannot grow limiter state unboundedly.

- Rate-limit expiry cleanup could select an expired row and then delete it after a concurrent request had refreshed the same bucket, erasing a fresh limit window:
  Fix: The DELETE predicate now rechecks expiresAt at deletion time, preventing cleanup from deleting concurrently refreshed buckets.

- Backup import read the complete request into memory without a strict upload ceiling, allowing oversized/chunked uploads to consume excessive memory:
  Fix: Added incremental bounded request-body reading, a 64 MiB backup-file ceiling, and bounded multipart overhead before form parsing.

- Multipart backup parsing could otherwise occur before a trustworthy raw-byte ceiling was enforced, allowing chunked multipart requests to grow beyond intended limits:
  Fix: Read and bound the raw request stream first, then parse multipart from the already-bounded buffer.

- Backup decompression had no explicit expanded-size ceiling, allowing highly compressible input to expand into excessive memory use:
  Fix: Added a 256 MiB decompressed-data ceiling and bounded decompression checks.

- The compressed-backup size ceiling originally existed only at the HTTP route, so alternate/internal decode callers could bypass it:
  Fix: Enforced the compressed-size ceiling again at the backup decode boundary and added regression coverage.

- Backup import had no per-model or aggregate row ceilings, allowing pathological archives to trigger excessive validation/database work:
  Fix: Added per-model and total-row limits before destructive restore begins.

- Backup restore wrote potentially very large model sets without batching:
  Fix: Added batched database inserts to bound restore memory/work-unit size.

- Backup restore performed expensive scrypt/gzip work synchronously on the request path, risking event-loop stalls:
  Fix: Moved HTTP restore password derivation and gzip/decompression work to asynchronous Node APIs.

- Backup archive validation did not cleanly separate manifest, model-row, and aggregate-data validation, making boundary rules harder to enforce and pushing complexity over the quality gate:
  Fix: Split validation into cohesive manifest/model/aggregate responsibilities and kept the orchestration function under the repository complexity threshold without suppressions.

- Backup restore accepted an encrypted-backup password through a request header path, increasing the chance of credentials appearing in intermediary/request-header logging:
  Fix: Removed backup-password header handling; encrypted restore passwords are accepted through multipart form data.

- Malformed backup rows and duplicate workflow webhook tokens could reach destructive restore work before being rejected:
  Fix: Added malformed-row and duplicate-webhook-token validation before destructive restore begins.

- Derived webhook indexes and rate-limit state could be stale after a full backup restore:
  Fix: Restore now rebuilds the derived webhook index and clears derived rate-limit state.

- Instance reset/reinstall paths did not initially include the new derived rate-limit/webhook-index tables introduced by the hardening work:
  Fix: Updated reset/reinstall cleanup and its tests to include the derived tables.

- Production CSP allowed unsafe-inline scripts and unsafe-eval, increasing XSS impact:
  Fix: Moved CSP generation into middleware with a per-request nonce and strict-dynamic; unsafe-eval is development-only, and object/frame/base/form restrictions remain explicit. Inline styles remain allowed where required by the framework.

WORKFLOW / WEBHOOK FINDINGS

- Public webhook-token lookup loaded every enabled workflow and inspected JSON graphs for every webhook request:
  Fix: Added a materialized WorkflowWebhook table with indexed token lookup.

- Workflow create/update operations could leave the materialized webhook lookup stale if the index was not synchronized with graph changes:
  Fix: Workflow saves maintain the webhook index transactionally with the workflow change.

- The public webhook rate limit was process-local, so multiple app replicas could each allow their own independent request quota:
  Fix: Moved webhook limiting to the shared PostgreSQL-backed rate limiter.

- The webhook-index migration could fail unpredictably on legacy graphs containing duplicate tokens, duplicate node IDs, blank IDs, or blank tokens that had previously been tolerated:
  Fix: Made migration backfill deterministic, ignores blank webhook IDs/tokens, preserves one deterministic row for legacy duplicates, and uses conflict handling so migration does not abort on ambiguous old data.

- The workflow scheduler issued a latest-run lookup per workflow, creating an N+1 query pattern:
  Fix: Replaced per-workflow latest-run queries with one grouped query used for the scheduler pass.

- The workflow scheduler evaluated enabled workflows strictly sequentially, causing scheduler latency to grow linearly with independent workflows:
  Fix: Added bounded workflow-processing concurrency with configurable clamped concurrency.

- Scheduler and backup-retention code independently reimplemented the same worker-pool/concurrency loop, creating a DRY maintenance risk:
  Fix: Consolidated the behavior into a shared bounded-concurrency helper while preserving caller-specific error handling.

INVENTORY / TOPOLOGY / DASHBOARD SCALE FINDINGS

- Cloudflare inventory matching scanned complete device/VM/container inventories even when only a small set of integration identities was relevant:
  Fix: Added targeted normalized identity lookups and functional indexes so only matching active inventory rows are fetched.

- Tailscale inventory matching scanned complete device/VM/container inventories even when only a small set of integration identities was relevant:
  Fix: Reused the targeted normalized identity lookup/index path for Tailscale matching.

- The SQL functional inventory indexes initially used predicates/normalization that did not exactly match the application query semantics, including enum/text predicate handling and surrounding whitespace:
  Fix: Changed partial-index predicates to direct enum-compatible comparisons and aligned SQL normalization with application normalization using trim/case/first-label handling.

- Large topology inputs loaded complete inventory/network/firewall/address/interface/lease/neighbor/tunnel/provider datasets with no explicit processing budget:
  Fix: Added explicit per-dataset budgets using limit+1 reads and a DatasetBudgetExceededError instead of unbounded processing.

- Secondary topology inbound-vector/provider-snapshot loaders remained unbounded after the first scale pass, leaving a back door around the new topology budgets:
  Fix: Added budgets/bounded reads to those secondary paths as well so the whole topology load path is covered.

- Access-map construction could process unbounded source datasets and become expensive or unstable as inventory grew:
  Fix: Added explicit data budgets and coherent oversized-state handling for the access-map path.

- Security-advisor snapshot collection loaded large complete tables without explicit ceilings:
  Fix: Added explicit budgets for firewall rules, port forwards, DNS/tunnel/wireless data, machines, SSH deployments, and services.

- Integration synchronization/provider snapshot paths could process complete datasets with no explicit budget:
  Fix: Added bounded provider/synchronization datasets and explicit failure when processing budgets are exceeded rather than silently consuming unbounded resources.

- MCP overview generation loaded/output complete inventories, networks, guests, and integration lists, creating potentially huge responses:
  Fix: Use exact aggregate counts plus bounded representative rows/guests/integrations with explicit “showing N of M” messaging.

- The main dashboard loaded every integration card even when only a bounded overview is useful:
  Fix: Limit dashboard integration cards, separately query the exact integration count, and display a visible “showing N of M” message.

- The main dashboard loaded every qualifying storage pool and ranked them in application memory:
  Fix: Rank utilization in PostgreSQL and fetch only the six fullest pools.

- Oversized topology/access-map data could otherwise produce an incomplete or misleading graph when naive truncation was used:
  Fix: Derived graph views fail closed with a clear paused/oversized state while exact inventory counts remain available; they do not silently render partial topology as complete evidence.

- The dashboard topology fallback initially caught unexpected errors as though they were normal dataset-budget overflows, masking real failures:
  Fix: Catch only DatasetBudgetExceededError; all unrelated exceptions now propagate through normal error handling.

CODE-QUALITY FINDINGS FOUND WHILE ENFORCING THE REPOSITORY SKILL

- The backup import API route accumulated transport parsing, multipart handling, option parsing, decode/error translation, and restore orchestration in one complex function:
  Fix: Split those responsibilities into cohesive named helpers while preserving behavior and keeping complexity within the repository’s maximum of 15.

- The Cloudflare sync path accumulated documented-service matching and stale-service reconciliation in one overly complex flow:
  Fix: Separated service matching and stale-service reconciliation into named responsibilities instead of suppressing or gaming the complexity metric.

- The mobile dashboard component exceeded/pressed the repository complexity budget as scale-state behavior was added:
  Fix: Refactored cohesive presentation/state responsibilities into helpers/components while preserving the same UI behavior.

- The topology data loader exceeded/pressed the repository complexity budget as dataset-budget handling expanded:
  Fix: Refactored cohesive data-loading/normalization responsibilities without one-line metric-hiding wrappers.

- Shared concurrency tests were coupled to the workflow scheduler through a test-only re-export instead of testing the abstraction at its actual module boundary:
  Fix: Moved bounded-concurrency tests next to src/lib/concurrency.ts and removed the scheduler’s test-only re-export/API leakage.

DELIVERY / PATCHING ERROR CORRECTED IN THIS HANDOFF
---
 .../migration.sql                             |  23 +-
 src/app/(dashboard)/page.tsx                  |  13 +-
 src/app/api/admin/backup/import/route.ts      | 141 +++++---
 src/app/api/auth/login/route.ts               |  22 +-
 .../mobile/pages/home/mobile-home.tsx         | 333 ++++++++++--------
 src/lib/backup/backup.test.ts                 |   5 +
 src/lib/backup/destinations/index.ts          |  23 +-
 src/lib/backup/import.ts                      |  94 +++--
 src/lib/concurrency.test.ts                   |  46 +++
 src/lib/concurrency.ts                        |  28 ++
 src/lib/integrations/cloudflare/sync.ts       |  40 ++-
 src/lib/inventory/identity-index.ts           |  12 +-
 src/lib/rate-limit.ts                         |   1 +
 src/lib/topology/footprint-data.ts            |  33 +-
 src/lib/workflows/scheduler.test.ts           |  37 --
 src/lib/workflows/scheduler.ts                |  21 +-
 16 files changed, 501 insertions(+), 371 deletions(-)
 create mode 100644 src/lib/concurrency.test.ts
 create mode 100644 src/lib/concurrency.ts

diff --git a/prisma/migrations/20260806181000_request_limits_and_webhook_index/migration.sql b/prisma/migrations/20260806181000_request_limits_and_webhook_index/migration.sql
index 9d33ca6..942ffa4 100644
--- a/prisma/migrations/20260806181000_request_limits_and_webhook_index/migration.sql
+++ b/prisma/migrations/20260806181000_request_limits_and_webhook_index/migration.sql
@@ -25,9 +25,11 @@ ALTER TABLE "WorkflowWebhook" ADD CONSTRAINT "WorkflowWebhook_workflowId_fkey"
   FOREIGN KEY ("workflowId") REFERENCES "Workflow"("id") ON DELETE CASCADE ON UPDATE CASCADE;
 
 -- Backfill existing webhook nodes. Tokens are already stored in workflow.graph;
--- the materialized table only makes lookup indexed and bounded.
+-- the materialized table only makes lookup indexed and bounded. Legacy graphs
+-- may contain duplicate tokens/node IDs, so preserve one deterministic row
+-- instead of making the migration fail on previously tolerated ambiguous data.
 INSERT INTO "WorkflowWebhook" ("token", "workflowId", "nodeId")
-SELECT
+SELECT DISTINCT ON (node->'config'->>'token')
   node->'config'->>'token',
   workflow."id",
   node->>'id'
@@ -39,16 +41,19 @@ CROSS JOIN LATERAL jsonb_array_elements(
   END
 ) AS node
 WHERE node->>'kind' = 'trigger.webhook'
-  AND COALESCE(node->'config'->>'token', '') <> '';
+  AND COALESCE(node->>'id', '') <> ''
+  AND COALESCE(btrim(node->'config'->>'token'), '') <> ''
+ORDER BY node->'config'->>'token', workflow."createdAt", workflow."id", node->>'id'
+ON CONFLICT DO NOTHING;
 
 -- Integration identity resolution compares the first DNS label case-insensitively.
 -- Functional partial indexes avoid loading/scanning complete active inventories.
 CREATE INDEX "Device_active_normalized_name_idx"
-  ON "Device" ((lower(split_part(rtrim("name", '.'), '.', 1))))
-  WHERE "status"::text <> 'REMOVED';
+  ON "Device" ((lower(split_part(rtrim(btrim("name"), '.'), '.', 1))))
+  WHERE "status" <> 'REMOVED';
 CREATE INDEX "VirtualMachine_active_normalized_name_idx"
-  ON "VirtualMachine" ((lower(split_part(rtrim("name", '.'), '.', 1))))
-  WHERE "status"::text <> 'REMOVED';
+  ON "VirtualMachine" ((lower(split_part(rtrim(btrim("name"), '.'), '.', 1))))
+  WHERE "status" <> 'REMOVED';
 CREATE INDEX "Container_active_normalized_name_idx"
-  ON "Container" ((lower(split_part(rtrim("name", '.'), '.', 1))))
-  WHERE "status"::text <> 'REMOVED';
+  ON "Container" ((lower(split_part(rtrim(btrim("name"), '.'), '.', 1))))
+  WHERE "status" <> 'REMOVED';
diff --git a/src/app/(dashboard)/page.tsx b/src/app/(dashboard)/page.tsx
index 2fa8d9d..c1dadf9 100644
--- a/src/app/(dashboard)/page.tsx
+++ b/src/app/(dashboard)/page.tsx
@@ -82,11 +82,12 @@ export default async function DashboardHomePage() {
   const footprintPromise = loadFootprintInput()
     .then((input) => ({ input, unavailableReason: null as string | null }))
     .catch((err: unknown) => {
-      console.error("[dashboard] footprint load failed:", err);
-      const unavailableReason = err instanceof DatasetBudgetExceededError
-        ? `${err.message} The inventory counts remain available, but the full map is paused to protect app performance.`
-        : "The topology map could not be generated. Inventory counts and the rest of the dashboard are still available.";
-      return { input: null, unavailableReason };
+      if (!(err instanceof DatasetBudgetExceededError)) throw err;
+      console.warn("[dashboard] topology processing budget exceeded:", err.message);
+      return {
+        input: null,
+        unavailableReason: `${err.message} The inventory counts remain available, but the full map is paused to protect app performance.`,
+      };
     });
 
   const [
@@ -125,7 +126,7 @@ export default async function DashboardHomePage() {
       prisma.$queryRaw<DashboardStoragePool[]>(Prisma.sql`
         SELECT "id", "name", "type", "totalBytes", "usedBytes"
         FROM "StoragePool"
-        WHERE "status"::text <> 'REMOVED' AND "totalBytes" IS NOT NULL
+        WHERE "status" <> 'REMOVED' AND "totalBytes" IS NOT NULL
         ORDER BY CASE
           WHEN "totalBytes" > 0 THEN COALESCE("usedBytes", 0)::numeric / "totalBytes"
           ELSE 0
diff --git a/src/app/api/admin/backup/import/route.ts b/src/app/api/admin/backup/import/route.ts
index d4e5c47..09e4f8e 100644
--- a/src/app/api/admin/backup/import/route.ts
+++ b/src/app/api/admin/backup/import/route.ts
@@ -5,6 +5,83 @@ import { decodeBackupFileAsync, prepareBackupForRestore, previewRestore, restore
 import { BackupLimitError } from "@/lib/backup/limits";
 import { assertBackupFileSize, readBackupRequestBody } from "@/lib/backup/request-body";
 
+interface UploadOptions {
+  preview: boolean;
+  confirm: boolean;
+}
+
+interface BackupUpload extends UploadOptions {
+  buffer: Buffer;
+  password?: string;
+}
+
+function initialUploadOptions(req: NextRequest): UploadOptions {
+  const previewParam = new URL(req.url).searchParams.get("preview");
+  return {
+    preview: previewParam === "1" || previewParam === "true",
+    confirm: req.headers.get("x-confirm-restore") === "true",
+  };
+}
+
+async function parseMultipartUpload(
+  req: NextRequest,
+  requestBody: Buffer,
+  contentType: string,
+  options: UploadOptions,
+): Promise<BackupUpload> {
+  // Parse multipart only after the raw stream has passed the same hard byte
+  // ceiling as direct uploads. Calling req.formData() first would allow a
+  // chunked request to grow without a trustworthy Content-Length header.
+  const boundedRequest = new Request(req.url, {
+    method: "POST",
+    headers: { "Content-Type": contentType },
+    body: new Uint8Array(requestBody),
+  });
+  let form: FormData;
+  try {
+    form = await boundedRequest.formData();
+  } catch {
+    throw new ApiError(400, "invalid_request", "The multipart backup upload is malformed.");
+  }
+
+  const file = form.get("file");
+  if (!(file instanceof File)) {
+    throw new ApiError(400, "invalid_request", "Expected a backup file in the 'file' form field.");
+  }
+  assertBackupFileSize(file.size);
+
+  const confirmField = form.get("confirm");
+  const passwordField = form.get("password");
+  return {
+    buffer: Buffer.from(await file.arrayBuffer()),
+    preview: options.preview || form.get("mode") === "preview",
+    confirm: options.confirm || confirmField === "true" || confirmField === "1",
+    password: typeof passwordField === "string" && passwordField.length > 0 ? passwordField : undefined,
+  };
+}
+
+async function readBackupUpload(req: NextRequest): Promise<BackupUpload> {
+  const options = initialUploadOptions(req);
+  const requestBody = await readBackupRequestBody(req);
+  const contentType = req.headers.get("content-type") ?? "";
+  if (contentType.includes("multipart/form-data")) {
+    return parseMultipartUpload(req, requestBody, contentType, options);
+  }
+  return { buffer: requestBody, ...options };
+}
+
+async function decodeRestoreInput(buffer: Buffer, password?: string) {
+  try {
+    const decoded = await decodeBackupFileAsync(buffer, password);
+    return { decoded, archive: prepareBackupForRestore(decoded) };
+  } catch (err) {
+    if (err instanceof BackupLimitError) {
+      throw new ApiError(413, "backup_too_large", err.message);
+    }
+    throw new ApiError(400, "invalid_backup", err instanceof Error ? err.message : "Invalid backup file.");
+  }
+}
+
 /**
  * POST /api/admin/backup/import — restore this PolySIEM instance from a backup
  * file. Admin-only and destructive: a real restore WIPES and replaces every
@@ -20,68 +97,18 @@ import { assertBackupFileSize, readBackupRequestBody } from "@/lib/backup/reques
  */
 export const POST = handleApi(async (req: NextRequest) => {
   const { user } = await requireAdmin();
-
-  const previewParam = new URL(req.url).searchParams.get("preview");
-  let preview = previewParam === "1" || previewParam === "true";
-  let confirm = req.headers.get("x-confirm-restore") === "true";
-  let password = req.headers.get("x-backup-password") || undefined;
-
-  const requestBody = await readBackupRequestBody(req);
-  let buffer = requestBody;
-  const contentType = req.headers.get("content-type") ?? "";
-  if (contentType.includes("multipart/form-data")) {
-    // Parse multipart only after the raw stream has passed the same hard byte
-    // ceiling as direct uploads. Calling req.formData() first would allow a
-    // chunked request to grow without a trustworthy Content-Length header.
-    const boundedRequest = new Request(req.url, {
-      method: "POST",
-      headers: { "Content-Type": contentType },
-      body: new Uint8Array(requestBody),
-    });
-    let form: FormData;
-    try {
-      form = await boundedRequest.formData();
-    } catch {
-      throw new ApiError(400, "invalid_request", "The multipart backup upload is malformed.");
-    }
-    const file = form.get("file");
-    if (!(file instanceof File)) {
-      throw new ApiError(400, "invalid_request", "Expected a backup file in the 'file' form field.");
-    }
-    assertBackupFileSize(file.size);
-    buffer = Buffer.from(await file.arrayBuffer());
-    if (form.get("mode") === "preview") preview = true;
-    const confirmField = form.get("confirm");
-    if (confirmField === "true" || confirmField === "1") confirm = true;
-    const passwordField = form.get("password");
-    if (typeof passwordField === "string" && passwordField.length > 0) password = passwordField;
-  }
-
-  if (buffer.byteLength === 0) {
+  const upload = await readBackupUpload(req);
+  if (upload.buffer.byteLength === 0) {
     throw new ApiError(400, "invalid_request", "No backup file was provided.");
   }
 
-  // decodeArchive throws plain, actionable Errors (bad gzip, unsupported
-  // version, unknown model). Surface those to the client as a 400 rather than
-  // letting handleApi mask them behind a generic 500 — the operator needs to
-  // know exactly why their file was rejected.
-  let decoded: Awaited<ReturnType<typeof decodeBackupFileAsync>>;
-  let archive: ReturnType<typeof prepareBackupForRestore>;
-  try {
-    decoded = await decodeBackupFileAsync(buffer, password);
-    archive = prepareBackupForRestore(decoded);
-  } catch (err) {
-    if (err instanceof BackupLimitError) {
-      throw new ApiError(413, "backup_too_large", err.message);
-    }
-    throw new ApiError(400, "invalid_backup", err instanceof Error ? err.message : "Invalid backup file.");
-  }
-
-  if (preview) {
+  // Decode errors are translated here so operators get an actionable 4xx
+  // instead of a generic server error for corrupt or incompatible archives.
+  const { decoded, archive } = await decodeRestoreInput(upload.buffer, upload.password);
+  if (upload.preview) {
     return jsonOk(previewRestore(archive, decoded.passwordProtected));
   }
-
-  if (!confirm) {
+  if (!upload.confirm) {
     throw new ApiError(
       400,
       "confirm_required",
diff --git a/src/app/api/auth/login/route.ts b/src/app/api/auth/login/route.ts
index fee473a..61d570f 100644
--- a/src/app/api/auth/login/route.ts
+++ b/src/app/api/auth/login/route.ts
@@ -10,26 +10,19 @@ import { clearRateLimit, consumeRateLimit, pruneExpiredRateLimits, trustedClient
 
 const ACCOUNT_LIMIT = { limit: 10, windowMs: 15 * 60_000 } as const;
 const IP_LIMIT = { limit: 60, windowMs: 15 * 60_000 } as const;
-const GLOBAL_LIMIT = { limit: 300, windowMs: 15 * 60_000 } as const;
 
 export const POST = handleApi(async (req: NextRequest) => {
   const input = loginSchema.parse(await req.json());
-  const normalizedUsername = input.username.trim().toLowerCase();
   const clientIp = trustedClientIp(req);
   await pruneExpiredRateLimits();
 
-  // Check the global circuit breaker first. Once it is exhausted, do not create
-  // attacker-controlled account buckets for arbitrary usernames.
-  const globalLimit = await consumeRateLimit("login-global", "all", GLOBAL_LIMIT);
-  if (!globalLimit.allowed) {
-    return NextResponse.json(
-      { error: { code: "rate_limited", message: "Too many login attempts. Try again shortly." } },
-      { status: 429, headers: { "Retry-After": String(globalLimit.retryAfterSeconds) } },
-    );
-  }
-
+  const user = await prisma.user.findUnique({ where: { username: input.username } });
+  // Unknown usernames share one bucket so arbitrary attacker-controlled names
+  // cannot create unbounded limiter rows. Valid accounts remain independent,
+  // so abuse against unknown names cannot globally lock out legitimate users.
+  const accountIdentity = user?.id ?? "unknown-account";
   const identityLimits = await Promise.all([
-    consumeRateLimit("login-account", normalizedUsername, ACCOUNT_LIMIT),
+    consumeRateLimit("login-account", accountIdentity, ACCOUNT_LIMIT),
     ...(clientIp ? [consumeRateLimit("login-ip", clientIp, IP_LIMIT)] : []),
   ]);
   const blocked = identityLimits.find((limit) => !limit.allowed);
@@ -40,7 +33,6 @@ export const POST = handleApi(async (req: NextRequest) => {
     );
   }
 
-  const user = await prisma.user.findUnique({ where: { username: input.username } });
   // Always verify against a hash to keep timing consistent.
   const ok = await verifyPassword(
     input.password,
@@ -51,7 +43,7 @@ export const POST = handleApi(async (req: NextRequest) => {
   }
 
   await Promise.all([
-    clearRateLimit("login-account", normalizedUsername),
+    clearRateLimit("login-account", accountIdentity),
     ...(clientIp ? [clearRateLimit("login-ip", clientIp)] : []),
   ]);
 
diff --git a/src/components/mobile/pages/home/mobile-home.tsx b/src/components/mobile/pages/home/mobile-home.tsx
index f2db40a..be052a6 100644
--- a/src/components/mobile/pages/home/mobile-home.tsx
+++ b/src/components/mobile/pages/home/mobile-home.tsx
@@ -1,4 +1,5 @@
 import Link from "next/link";
+import type { ReactNode } from "react";
 import {
   ChevronRight,
   Cloud,
@@ -49,6 +50,177 @@ export interface HomePool {
   pct: number;
 }
 
+function AttackSurfaceStats({ footprint }: { footprint: FootprintGraph }) {
+  return (
+    <MobileStatStrip>
+      <MobileStat
+        label="Open ports"
+        value={footprint.stats.openPorts}
+        icon={<ShieldAlert />}
+        tone={footprint.stats.openPorts > 0 ? "text-destructive" : undefined}
+      />
+      <MobileStat
+        label="Tunnel hosts"
+        value={footprint.stats.tunnelHostnames}
+        icon={<Cloud />}
+        tone={footprint.stats.tunnelHostnames > 0 ? "[color:var(--color-chart-3)]" : undefined}
+      />
+      <MobileStat
+        label="Dyn DNS"
+        value={footprint.stats.dyndnsNames}
+        icon={<Globe />}
+        tone={footprint.stats.dyndnsNames > 0 ? "text-info" : undefined}
+      />
+      <MobileStat
+        label="Exposed"
+        value={footprint.stats.exposedHostnames}
+        icon={<ShieldAlert />}
+        tone={footprint.stats.exposedHostnames > 0 ? "text-destructive" : undefined}
+      />
+    </MobileStatStrip>
+  );
+}
+
+function FootprintDashboardSection({
+  footprint,
+  hasFootprint,
+  unavailableReason,
+  addIntegration,
+}: {
+  footprint: FootprintGraph | null;
+  hasFootprint: boolean;
+  unavailableReason?: string | null;
+  addIntegration?: ReactNode;
+}) {
+  const canRenderMap = hasFootprint && footprint;
+  const sectionAction = hasFootprint ? (
+    <Link
+      href="/inventory/map"
+      className="flex items-center gap-0.5 text-xs font-medium text-primary active:opacity-70"
+    >
+      Lab map <ChevronRight className="size-3.5" />
+    </Link>
+  ) : undefined;
+
+  return (
+    <MobileSection title="Footprint" action={sectionAction}>
+      {canRenderMap ? (
+        <div className="-mx-3.5 h-[42svh]">
+          <FootprintMap graph={footprint} chromeless heightClassName="h-full rounded-none border-x-0" />
+        </div>
+      ) : (
+        <MobileEmpty
+          icon={<MapIcon />}
+          title={unavailableReason ? "Topology map paused" : "No footprint to draw yet"}
+          description={unavailableReason ?? "Connect an integration and the dashboard will map your whole lab: machines, networks, and every inbound path."}
+          action={unavailableReason ? undefined : addIntegration}
+        />
+      )}
+    </MobileSection>
+  );
+}
+
+function integrationSubtitle(integration: HomeIntegration, live: boolean): ReactNode {
+  if (integration.lastSyncStatus === "FAILED" && integration.lastSyncError) {
+    return <span className="text-destructive">{integration.lastSyncError}</span>;
+  }
+  if (live) return "Queried live";
+  if (integration.lastSyncAt) {
+    return `Last synced ${formatRelative(integration.lastSyncAt)}${integration.enabled ? "" : " · disabled"}`;
+  }
+  return `Not synced yet${integration.enabled ? "" : " · disabled"}`;
+}
+
+function IntegrationHealthSection({
+  integrations,
+  integrationCount,
+  integrationIcons,
+  addIntegration,
+}: {
+  integrations: HomeIntegration[];
+  integrationCount: number;
+  integrationIcons: Record<IntegrationTypeValue, LucideIcon>;
+  addIntegration?: ReactNode;
+}) {
+  if (integrations.length === 0) {
+    return (
+      <MobileSection title="Integrations">
+        <MobileEmpty
+          icon={<Plug />}
+          title="No integrations connected"
+          description="Connect Proxmox, OPNsense, or Elasticsearch and PolySIEM will document your lab automatically."
+          action={addIntegration}
+        />
+      </MobileSection>
+    );
+  }
+
+  return (
+    <MobileSection title="Integrations">
+      <MobileList>
+        {integrations.map((integration) => {
+          const Icon = integrationIcons[integration.type];
+          const live = isLiveQueryType(integration.type);
+          return (
+            <MobileListRow
+              key={integration.id}
+              leading={
+                <div className="flex size-8 items-center justify-center rounded-lg bg-primary/10 text-primary">
+                  <Icon className="size-4" />
+                </div>
+              }
+              title={
+                <>
+                  <span className="min-w-0 truncate">{integration.name}</span>
+                  <SyncStatusBadge status={integration.lastSyncStatus} />
+                </>
+              }
+              subtitle={integrationSubtitle(integration, live)}
+              trailing={live ? (
+                <Badge variant="outline" className="border-info/40 bg-info/10 text-info">
+                  Live
+                </Badge>
+              ) : (
+                <SyncNowButton integrationId={integration.id} name={integration.name} />
+              )}
+            />
+          );
+        })}
+      </MobileList>
+      {integrationCount > integrations.length && (
+        <p className="px-1 pt-2 text-xs text-muted-foreground">
+          Showing {integrations.length} of {integrationCount} integrations.
+        </p>
+      )}
+    </MobileSection>
+  );
+}
+
+function StorageSection({ pools }: { pools: HomePool[] }) {
+  if (pools.length === 0) return null;
+  return (
+    <MobileSection title="Storage">
+      <MobileList>
+        {pools.map((pool) => (
+          <div key={pool.id} className="space-y-1.5 px-3.5 py-3">
+            <div className="flex items-baseline justify-between gap-3 text-sm">
+              <span className="min-w-0 truncate font-medium">{pool.name}</span>
+              <span className="shrink-0 text-xs text-muted-foreground tabular-nums">
+                {pool.type ? `${pool.type} · ` : ""}
+                {Math.round(pool.pct)}%
+              </span>
+            </div>
+            <Progress value={pool.pct} aria-label={`${pool.name} usage`} />
+            <p className="text-xs text-muted-foreground">
+              {formatBytes(pool.usedBytes)} of {formatBytes(pool.totalBytes)} used
+            </p>
+          </div>
+        ))}
+      </MobileList>
+    </MobileSection>
+  );
+}
+
 /**
  * Phone launch screen: stat tiles, the footprint hero map, then integration
  * sync health and storage. Same data as the desktop dashboard, phone layout.
@@ -86,7 +258,6 @@ export function MobileHome({
     <>
       <MobilePageHeader title="Dashboard" />
       <MobilePage className="pb-6">
-        {/* Inventory at a glance — compact 3-up so the fold shows real content */}
         <div className="grid grid-cols-3 gap-2">
           {tiles.map((tile) => (
             <Link
@@ -103,152 +274,20 @@ export function MobileHome({
           ))}
         </div>
 
-        {/* Attack-surface strip (chips the desktop map overlays) */}
-        {hasFootprint && footprint && (
-          <MobileStatStrip>
-            <MobileStat
-              label="Open ports"
-              value={footprint.stats.openPorts}
-              icon={<ShieldAlert />}
-              tone={footprint.stats.openPorts > 0 ? "text-destructive" : undefined}
-            />
-            <MobileStat
-              label="Tunnel hosts"
-              value={footprint.stats.tunnelHostnames}
-              icon={<Cloud />}
-              tone={footprint.stats.tunnelHostnames > 0 ? "[color:var(--color-chart-3)]" : undefined}
-            />
-            <MobileStat
-              label="Dyn DNS"
-              value={footprint.stats.dyndnsNames}
-              icon={<Globe />}
-              tone={footprint.stats.dyndnsNames > 0 ? "text-info" : undefined}
-            />
-            <MobileStat
-              label="Exposed"
-              value={footprint.stats.exposedHostnames}
-              icon={<ShieldAlert />}
-              tone={footprint.stats.exposedHostnames > 0 ? "text-destructive" : undefined}
-            />
-          </MobileStatStrip>
-        )}
-
-        {/* Footprint hero map — full-bleed, pinch to zoom */}
-        <MobileSection
-          title="Footprint"
-          action={
-            hasFootprint ? (
-              <Link
-                href="/inventory/map"
-                className="flex items-center gap-0.5 text-xs font-medium text-primary active:opacity-70"
-              >
-                Lab map <ChevronRight className="size-3.5" />
-              </Link>
-            ) : undefined
-          }
-        >
-          {hasFootprint && footprint ? (
-            <div className="-mx-3.5 h-[42svh]">
-              <FootprintMap
-                graph={footprint}
-                chromeless
-                heightClassName="h-full rounded-none border-x-0"
-              />
-            </div>
-          ) : (
-            <MobileEmpty
-              icon={<MapIcon />}
-              title={footprintUnavailableReason ? "Topology map paused" : "No footprint to draw yet"}
-              description={footprintUnavailableReason ?? "Connect an integration and the dashboard will map your whole lab: machines, networks, and every inbound path."}
-              action={footprintUnavailableReason ? undefined : addIntegration}
-            />
-          )}
-        </MobileSection>
-
-        {/* Integration health */}
-        <MobileSection title="Integrations">
-          {integrations.length === 0 ? (
-            <MobileEmpty
-              icon={<Plug />}
-              title="No integrations connected"
-              description="Connect Proxmox, OPNsense, or Elasticsearch and PolySIEM will document your lab automatically."
-              action={addIntegration}
-            />
-          ) : (
-            <MobileList>
-              {integrations.map((integration) => {
-                const Icon = integrationIcons[integration.type];
-                const live = isLiveQueryType(integration.type);
-                const failed =
-                  integration.lastSyncStatus === "FAILED" && integration.lastSyncError;
-                return (
-                  <MobileListRow
-                    key={integration.id}
-                    leading={
-                      <div className="flex size-8 items-center justify-center rounded-lg bg-primary/10 text-primary">
-                        <Icon className="size-4" />
-                      </div>
-                    }
-                    title={
-                      <>
-                        <span className="min-w-0 truncate">{integration.name}</span>
-                        <SyncStatusBadge status={integration.lastSyncStatus} />
-                      </>
-                    }
-                    subtitle={
-                      failed ? (
-                        <span className="text-destructive">{integration.lastSyncError}</span>
-                      ) : live ? (
-                        "Queried live"
-                      ) : integration.lastSyncAt ? (
-                        `Last synced ${formatRelative(integration.lastSyncAt)}${integration.enabled ? "" : " · disabled"}`
-                      ) : (
-                        `Not synced yet${integration.enabled ? "" : " · disabled"}`
-                      )
-                    }
-                    trailing={
-                      live ? (
-                        <Badge variant="outline" className="border-info/40 bg-info/10 text-info">
-                          Live
-                        </Badge>
-                      ) : (
-                        <SyncNowButton integrationId={integration.id} name={integration.name} />
-                      )
-                    }
-                  />
-                );
-              })}
-            </MobileList>
-          )}
-          {integrationCount > integrations.length && (
-            <p className="px-1 pt-2 text-xs text-muted-foreground">
-              Showing {integrations.length} of {integrationCount} integrations.
-            </p>
-          )}
-        </MobileSection>
-
-        {/* Storage */}
-        {pools.length > 0 && (
-          <MobileSection title="Storage">
-            <MobileList>
-              {pools.map((pool) => (
-                <div key={pool.id} className="space-y-1.5 px-3.5 py-3">
-                  <div className="flex items-baseline justify-between gap-3 text-sm">
-                    <span className="min-w-0 truncate font-medium">{pool.name}</span>
-                    <span className="shrink-0 text-xs text-muted-foreground tabular-nums">
-                      {pool.type ? `${pool.type} · ` : ""}
-                      {Math.round(pool.pct)}%
-                    </span>
-                  </div>
-                  <Progress value={pool.pct} aria-label={`${pool.name} usage`} />
-                  <p className="text-xs text-muted-foreground">
-                    {formatBytes(pool.usedBytes)} of {formatBytes(pool.totalBytes)} used
-                  </p>
-                </div>
-              ))}
-            </MobileList>
-          </MobileSection>
-        )}
+        {hasFootprint && footprint && <AttackSurfaceStats footprint={footprint} />}
+        <FootprintDashboardSection
+          footprint={footprint}
+          hasFootprint={hasFootprint}
+          unavailableReason={footprintUnavailableReason}
+          addIntegration={addIntegration}
+        />
+        <IntegrationHealthSection
+          integrations={integrations}
+          integrationCount={integrationCount}
+          integrationIcons={integrationIcons}
+          addIntegration={addIntegration}
+        />
+        <StorageSection pools={pools} />
       </MobilePage>
     </>
   );
diff --git a/src/lib/backup/backup.test.ts b/src/lib/backup/backup.test.ts
index e42f2f2..52a52bf 100644
--- a/src/lib/backup/backup.test.ts
+++ b/src/lib/backup/backup.test.ts
@@ -164,6 +164,11 @@ describe("decodeArchive validation", () => {
     expect(() => decodeArchive(bytes)).toThrow(/missing a valid manifest/i);
   });
 
+  it("rejects a compressed file above the upload ceiling before decompression", () => {
+    const oversized = Buffer.allocUnsafe(BACKUP_IMPORT_LIMITS.uploadBytes + 1);
+    expect(() => decodeArchive(oversized)).toThrow(BackupLimitError);
+  });
+
   it("rejects a model that exceeds the configured row ceiling", () => {
     const archive = makeArchive();
     archive.data.device = Array.from(
diff --git a/src/lib/backup/destinations/index.ts b/src/lib/backup/destinations/index.ts
index 1d04487..cc2cf86 100644
--- a/src/lib/backup/destinations/index.ts
+++ b/src/lib/backup/destinations/index.ts
@@ -1,5 +1,6 @@
 import "server-only";
 import type { S3DestinationConfig, AzureDestinationConfig } from "../types";
+import { runWithConcurrency } from "@/lib/concurrency";
 import { joinKey } from "./keys";
 import {
   putObjectS3,
@@ -58,7 +59,6 @@ export function resolveObjectKey(dest: ResolvedDestination, filename: string): s
   return joinKey("", filename); // sas: any prefix already lives in the SAS URL path
 }
 
-
 const RETENTION_DELETE_CONCURRENCY = 4;
 
 /** Delete stale objects concurrently without turning one provider failure into a burst. */
@@ -67,22 +67,15 @@ export async function deleteWithConcurrency(
   remove: (key: string) => Promise<void>,
   concurrency = RETENTION_DELETE_CONCURRENCY,
 ): Promise<number> {
-  let cursor = 0;
   let deleted = 0;
-  const normalizedConcurrency = Number.isFinite(concurrency) ? Math.max(1, Math.floor(concurrency)) : 1;
-  const workers = Math.min(keys.length, normalizedConcurrency);
-  await Promise.all(Array.from({ length: workers }, async () => {
-    while (true) {
-      const index = cursor++;
-      if (index >= keys.length) return;
-      try {
-        await remove(keys[index]!);
-        deleted += 1;
-      } catch {
-        // Retention is best-effort; continue pruning other stale objects.
-      }
+  await runWithConcurrency(keys, concurrency, async (key) => {
+    try {
+      await remove(key);
+      deleted += 1;
+    } catch {
+      // Retention is best-effort; continue pruning other stale objects.
     }
-  }));
+  });
   return deleted;
 }
 
diff --git a/src/lib/backup/import.ts b/src/lib/backup/import.ts
index e2fd70d..c7cd762 100644
--- a/src/lib/backup/import.ts
+++ b/src/lib/backup/import.ts
@@ -36,6 +36,14 @@ const RESTORE_TX_TIMEOUT_MS = 10 * 60_000;
 
 /* ------------------------------- decode ------------------------------- */
 
+function assertCompressedBackupSize(buffer: Buffer): void {
+  if (buffer.byteLength > BACKUP_IMPORT_LIMITS.uploadBytes) {
+    throw new BackupLimitError(
+      `Backup file exceeds the ${formatMiB(BACKUP_IMPORT_LIMITS.uploadBytes)} restore limit.`,
+    );
+  }
+}
+
 /**
  * Parse gzipped-JSON backup bytes into an archive, validating that we can
  * actually apply it: it must be gzip, contain a manifest with a supported
@@ -127,56 +135,75 @@ function validateArchivedWebhookTokens(archive: Partial<BackupArchive>): void {
   }
 }
 
-function validateArchive(parsed: unknown): BackupArchive {
-  if (!parsed || typeof parsed !== "object") {
-    throw new Error("Backup archive is malformed: top-level value is not an object.");
+const KNOWN_BACKUP_MODELS = new Set<string>(BACKUP_MODELS);
+
+function validateManifest(manifest: unknown): asserts manifest is BackupArchive["manifest"] {
+  if (!manifest || typeof manifest !== "object" || !("formatVersion" in manifest)) {
+    throw new Error("Backup archive is missing a valid manifest.");
   }
-  const archive = parsed as Partial<BackupArchive>;
-  const manifest = archive.manifest;
-  if (!manifest || typeof manifest !== "object" || typeof manifest.formatVersion !== "number") {
+  const formatVersion = (manifest as { formatVersion?: unknown }).formatVersion;
+  if (typeof formatVersion !== "number") {
     throw new Error("Backup archive is missing a valid manifest.");
   }
-  if (manifest.formatVersion !== BACKUP_FORMAT_VERSION) {
-    const hint =
-      manifest.formatVersion > BACKUP_FORMAT_VERSION
-        ? "It was created by a newer version of PolySIEM — upgrade this instance to restore it."
-        : "It uses an older, unsupported backup format.";
-    throw new Error(
-      `Unsupported backup format version ${manifest.formatVersion} (this PolySIEM supports version ${BACKUP_FORMAT_VERSION}). ${hint}`,
+  if (formatVersion === BACKUP_FORMAT_VERSION) return;
+
+  const hint = formatVersion > BACKUP_FORMAT_VERSION
+    ? "It was created by a newer version of PolySIEM — upgrade this instance to restore it."
+    : "It uses an older, unsupported backup format.";
+  throw new Error(
+    `Unsupported backup format version ${formatVersion} (this PolySIEM supports version ${BACKUP_FORMAT_VERSION}). ${hint}`,
+  );
+}
+
+function validateModelRows(key: string, value: unknown): number {
+  if (!KNOWN_BACKUP_MODELS.has(key)) {
+    throw new Error(`Backup archive references an unknown model "${key}"; it is incompatible with this PolySIEM.`);
+  }
+  if (!Array.isArray(value)) {
+    throw new Error(`Backup archive model "${key}" must contain an array of rows.`);
+  }
+  if (value.length > BACKUP_IMPORT_LIMITS.rowsPerModel) {
+    throw new BackupLimitError(
+      `Backup model "${key}" contains ${value.length} rows; the per-model limit is ${BACKUP_IMPORT_LIMITS.rowsPerModel}.`,
     );
   }
-  if (!archive.data || typeof archive.data !== "object") {
+  for (const row of value) {
+    if (!row || typeof row !== "object" || Array.isArray(row)) {
+      throw new Error(`Backup archive model "${key}" contains a malformed row.`);
+    }
+  }
+  return value.length;
+}
+
+function validateArchiveData(data: unknown): asserts data is BackupArchive["data"] {
+  if (!data || typeof data !== "object" || Array.isArray(data)) {
     throw new Error("Backup archive is missing its data section.");
   }
-  const known = new Set<string>(BACKUP_MODELS);
+
   let totalRows = 0;
-  for (const [key, value] of Object.entries(archive.data)) {
-    if (!known.has(key)) {
-      throw new Error(`Backup archive references an unknown model "${key}"; it is incompatible with this PolySIEM.`);
-    }
-    if (!Array.isArray(value)) {
-      throw new Error(`Backup archive model "${key}" must contain an array of rows.`);
-    }
-    if (value.length > BACKUP_IMPORT_LIMITS.rowsPerModel) {
+  for (const [key, value] of Object.entries(data)) {
+    totalRows += validateModelRows(key, value);
+    if (totalRows > BACKUP_IMPORT_LIMITS.totalRows) {
       throw new BackupLimitError(
-        `Backup model "${key}" contains ${value.length} rows; the per-model limit is ${BACKUP_IMPORT_LIMITS.rowsPerModel}.`,
+        `Backup contains more than ${BACKUP_IMPORT_LIMITS.totalRows} rows and cannot be restored safely.`,
       );
     }
-    for (const row of value) {
-      if (!row || typeof row !== "object" || Array.isArray(row)) {
-        throw new Error(`Backup archive model "${key}" contains a malformed row.`);
-      }
-    }
-    totalRows += value.length;
-    if (totalRows > BACKUP_IMPORT_LIMITS.totalRows) {
-      throw new BackupLimitError(`Backup contains more than ${BACKUP_IMPORT_LIMITS.totalRows} rows and cannot be restored safely.`);
-    }
   }
+}
+
+function validateArchive(parsed: unknown): BackupArchive {
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("Backup archive is malformed: top-level value is not an object.");
+  }
+  const archive = parsed as Partial<BackupArchive>;
+  validateManifest(archive.manifest);
+  validateArchiveData(archive.data);
   validateArchivedWebhookTokens(archive);
   return archive as BackupArchive;
 }
 
 export function decodeArchive(buffer: Buffer): BackupArchive {
+  assertCompressedBackupSize(buffer);
   let expanded: Buffer;
   try {
     expanded = gunzipArchive(buffer);
@@ -209,6 +236,7 @@ export async function decodeBackupFileAsync(
   buffer: Buffer,
   password?: string,
 ): Promise<DecodedBackupFile> {
+  assertCompressedBackupSize(buffer);
   if (isEncryptedBackup(buffer)) {
     const decoded = await decodeEncryptedBackupAsync(buffer, password);
     return { ...decoded, archive: validateArchive(decoded.archive) };
diff --git a/src/lib/concurrency.test.ts b/src/lib/concurrency.test.ts
new file mode 100644
index 0000000..ef10861
--- /dev/null
+++ b/src/lib/concurrency.test.ts
@@ -0,0 +1,46 @@
+import { describe, expect, it } from "vitest";
+import { runWithConcurrency } from "./concurrency";
+
+describe("runWithConcurrency", () => {
+  it("never exceeds the configured number of workers", async () => {
+    let active = 0;
+    let peak = 0;
+    const seen: number[] = [];
+
+    await runWithConcurrency([0, 1, 2, 3, 4, 5], 2, async (value) => {
+      active += 1;
+      peak = Math.max(peak, active);
+      await new Promise((resolve) => setTimeout(resolve, 2));
+      seen.push(value);
+      active -= 1;
+    });
+
+    expect(peak).toBe(2);
+    expect(seen.sort((a, b) => a - b)).toEqual([0, 1, 2, 3, 4, 5]);
+  });
+
+  it("falls back to one worker for an invalid concurrency value", async () => {
+    let active = 0;
+    let peak = 0;
+
+    await runWithConcurrency([1, 2, 3], Number.NaN, async () => {
+      active += 1;
+      peak = Math.max(peak, active);
+      await new Promise((resolve) => setTimeout(resolve, 1));
+      active -= 1;
+    });
+
+    expect(peak).toBe(1);
+  });
+
+  it("handles an empty input without invoking the worker", async () => {
+    let calls = 0;
+
+    await runWithConcurrency([], 4, () => {
+      calls += 1;
+      return Promise.resolve();
+    });
+
+    expect(calls).toBe(0);
+  });
+});
diff --git a/src/lib/concurrency.ts b/src/lib/concurrency.ts
new file mode 100644
index 0000000..593a61b
--- /dev/null
+++ b/src/lib/concurrency.ts
@@ -0,0 +1,28 @@
+/**
+ * Run independent async work with a hard concurrency ceiling.
+ *
+ * The shared cursor is safe here because JavaScript advances it synchronously
+ * before each worker awaits. Invalid limits degrade to one worker instead of
+ * accidentally creating an unbounded fan-out.
+ */
+export async function runWithConcurrency<T>(
+  items: readonly T[],
+  concurrency: number,
+  worker: (item: T, index: number) => Promise<void>,
+): Promise<void> {
+  let cursor = 0;
+  const normalizedConcurrency = Number.isFinite(concurrency)
+    ? Math.max(1, Math.floor(concurrency))
+    : 1;
+  const workerCount = Math.min(items.length, normalizedConcurrency);
+
+  await Promise.all(
+    Array.from({ length: workerCount }, async () => {
+      while (true) {
+        const index = cursor++;
+        if (index >= items.length) return;
+        await worker(items[index]!, index);
+      }
+    }),
+  );
+}
diff --git a/src/lib/integrations/cloudflare/sync.ts b/src/lib/integrations/cloudflare/sync.ts
index 18b09af..f468a4b 100644
--- a/src/lib/integrations/cloudflare/sync.ts
+++ b/src/lib/integrations/cloudflare/sync.ts
@@ -6,7 +6,7 @@ import { cloudflareSettingsSchema, cloudflareSnapshotSchema } from "@/lib/valida
 import { newCounts, type SyncStats } from "../sync-helpers";
 import { fetchCloudflareSnapshot } from "./client";
 import type { CloudflareAccountSnapshot } from "./types";
-import { cloudflareServiceCandidates, serviceEndpoint } from "./service-evidence";
+import { cloudflareServiceCandidates, serviceEndpoint, type CloudflareServiceCandidate } from "./service-evidence";
 import { findInventoryByIdentityKeys, normalizedIdentityKey } from "@/lib/inventory/identity-index";
 import { assertDatasetBudget } from "@/lib/dataset-budget";
 
@@ -22,6 +22,30 @@ function normalizedMachineName(value: string): string {
   return value.trim().toLowerCase().replace(/\.$/, "");
 }
 
+function candidateMatchesDocumentedService(
+  candidate: CloudflareServiceCandidate,
+  documentedEndpoints: ReadonlySet<string>,
+): boolean {
+  const publicEndpoint = serviceEndpoint(candidate.url);
+  return (publicEndpoint !== null && documentedEndpoints.has(publicEndpoint))
+    || (candidate.originEndpoint !== null && documentedEndpoints.has(candidate.originEndpoint));
+}
+
+async function markMissingCloudflareServicesRemoved(
+  existing: Array<{ id: string; externalId: string | null; status: string }>,
+  materialized: ReadonlySet<string>,
+): Promise<number> {
+  const ids = existing
+    .filter((service) => service.externalId && !materialized.has(service.externalId) && service.status !== "REMOVED")
+    .map((service) => service.id);
+  if (ids.length === 0) return 0;
+  const removed = await prisma.service.updateMany({
+    where: { id: { in: ids } },
+    data: { status: "REMOVED" },
+  });
+  return removed.count;
+}
+
 /** Resolve a route origin to the strongest inventory identity PolySIEM already knows. */
 async function cloudflareOriginTargets(originHosts: string[]): Promise<Map<string, ServiceTarget>> {
   if (originHosts.length === 0) return new Map();
@@ -90,10 +114,7 @@ export async function syncCloudflareServices(
   const counts = newCounts();
 
   for (const candidate of candidates) {
-    const publicEndpoint = serviceEndpoint(candidate.url);
-    if ((publicEndpoint && documentedEndpoints.has(publicEndpoint)) || (candidate.originEndpoint && documentedEndpoints.has(candidate.originEndpoint))) {
-      continue;
-    }
+    if (candidateMatchesDocumentedService(candidate, documentedEndpoints)) continue;
     const target = candidate.originHost ? targets.get(normalizedMachineName(candidate.originHost)) : undefined;
     const data = {
       name: candidate.name,
@@ -125,14 +146,7 @@ export async function syncCloudflareServices(
     materialized.add(candidate.externalId);
   }
 
-  const missing = existing.filter((service) => service.externalId && !materialized.has(service.externalId) && service.status !== "REMOVED");
-  if (missing.length > 0) {
-    const removed = await prisma.service.updateMany({
-      where: { id: { in: missing.map((service) => service.id) } },
-      data: { status: "REMOVED" },
-    });
-    counts.stale += removed.count;
-  }
+  counts.stale += await markMissingCloudflareServicesRemoved(existing, materialized);
   return counts;
 }
 
diff --git a/src/lib/inventory/identity-index.ts b/src/lib/inventory/identity-index.ts
index 66a12b4..d156d42 100644
--- a/src/lib/inventory/identity-index.ts
+++ b/src/lib/inventory/identity-index.ts
@@ -35,19 +35,19 @@ export async function findInventoryByIdentityKeys(
     matches.push(...await prisma.$queryRaw<InventoryIdentityMatch[]>(Prisma.sql`
       SELECT "id", 'device'::text AS "kind", "name"
       FROM "Device"
-      WHERE "status"::text <> 'REMOVED'
+      WHERE "status" <> 'REMOVED'
         ${sourceFilter}
-        AND lower(split_part(rtrim("name", '.'), '.', 1)) IN (${Prisma.join(chunk)})
+        AND lower(split_part(rtrim(btrim("name"), '.'), '.', 1)) IN (${Prisma.join(chunk)})
       UNION ALL
       SELECT "id", 'vm'::text AS "kind", "name"
       FROM "VirtualMachine"
-      WHERE "status"::text <> 'REMOVED'
-        AND lower(split_part(rtrim("name", '.'), '.', 1)) IN (${Prisma.join(chunk)})
+      WHERE "status" <> 'REMOVED'
+        AND lower(split_part(rtrim(btrim("name"), '.'), '.', 1)) IN (${Prisma.join(chunk)})
       UNION ALL
       SELECT "id", 'container'::text AS "kind", "name"
       FROM "Container"
-      WHERE "status"::text <> 'REMOVED'
-        AND lower(split_part(rtrim("name", '.'), '.', 1)) IN (${Prisma.join(chunk)})
+      WHERE "status" <> 'REMOVED'
+        AND lower(split_part(rtrim(btrim("name"), '.'), '.', 1)) IN (${Prisma.join(chunk)})
     `));
   }
   return matches;
diff --git a/src/lib/rate-limit.ts b/src/lib/rate-limit.ts
index 0f379f4..30702d3 100644
--- a/src/lib/rate-limit.ts
+++ b/src/lib/rate-limit.ts
@@ -88,6 +88,7 @@ export async function pruneExpiredRateLimits(now = new Date(), limit = 1_000): P
     DELETE FROM "RateLimitBucket" AS bucket
     USING expired
     WHERE bucket."key" = expired."key"
+      AND bucket."expiresAt" <= ${now}
     RETURNING bucket."key"
   `);
   return rows.length;
diff --git a/src/lib/topology/footprint-data.ts b/src/lib/topology/footprint-data.ts
index 5f54e09..35887c6 100644
--- a/src/lib/topology/footprint-data.ts
+++ b/src/lib/topology/footprint-data.ts
@@ -59,6 +59,25 @@ function deviceKind(kind: string): FpMachine["kind"] {
   return "device";
 }
 
+function resolveWanAddress(
+  networks: ReadonlyArray<{ id: string; externalId: string | null }>,
+  addresses: ReadonlyArray<{
+    address: string;
+    networkId: string | null;
+    interface: { device: { kind: string } | null } | null;
+  }>,
+  gateways: FootprintInput["gateways"],
+): string | null {
+  const wanNetwork = networks.find((network) => (network.externalId ?? "").toLowerCase() === "wan");
+  if (wanNetwork) {
+    const wanAddresses = addresses.filter((address) => address.networkId === wanNetwork.id);
+    const firewallAddress = wanAddresses.find((address) => address.interface?.device?.kind === "firewall");
+    if (firewallAddress) return firewallAddress.address;
+    if (wanAddresses[0]) return wanAddresses[0].address;
+  }
+  return gateways.find((gateway) => gateway.isDefault)?.ipAddress ?? null;
+}
+
 /** Load everything the footprint derivation needs. */
 export async function loadFootprintInput(): Promise<FootprintInput> {
   const [devices, vms, containers, networks, rules, pveRules, aliases, pveAddressSets, ips, assetInterfaces, switchConfigs, leases, neighbors, tailscaleSnapshots] =
@@ -614,18 +633,6 @@ export async function loadFootprintInput(): Promise<FootprintInput> {
   }
   })();
 
-  // ----- WAN address: the firewall's IP on the wan-keyed network -----
-
-  const wanNetworkId = allNetworks.find((net) => (net.externalId ?? "").toLowerCase() === "wan")?.id ?? null;
-  let wanIp: string | null = null;
-  (() => {
-  if (wanNetworkId) {
-    const wanIps = ips.filter((ip) => ip.networkId === wanNetworkId);
-    wanIp =
-      wanIps.find((ip) => ip.interface?.device?.kind === "firewall")?.address ?? wanIps[0]?.address ?? null;
-  }
-  })();
-
   // ----- inbound vectors + gateways -----
 
   const [pfRows, ddRows, tunnelRows, gwRows, elasticRows, cloudflareSnapshots] = await Promise.all([
@@ -822,6 +829,6 @@ export async function loadFootprintInput(): Promise<FootprintInput> {
     gateways,
     // The firewall's own WAN address when documented; otherwise fall back to
     // the default gateway's observed address so the Internet node isn't blank.
-    wanIp: wanIp ?? gateways.find((gw) => gw.isDefault)?.ipAddress ?? null,
+    wanIp: resolveWanAddress(allNetworks, ips, gateways),
   };
 }
diff --git a/src/lib/workflows/scheduler.test.ts b/src/lib/workflows/scheduler.test.ts
index 0044897..b90033e 100644
--- a/src/lib/workflows/scheduler.test.ts
+++ b/src/lib/workflows/scheduler.test.ts
@@ -2,7 +2,6 @@ import { describe, expect, it } from "vitest";
 import {
   esTriggerNodes,
   isDue,
-  runWithConcurrency,
   scheduleIntervalMinutes,
   securityTrailsTriggerNodes,
   threatTriggerNodes,
@@ -101,39 +100,3 @@ describe("threatTriggerNodes", () => {
     );
   });
 });
-
-
-describe("runWithConcurrency", () => {
-  it("never exceeds the configured number of workers", async () => {
-    let active = 0;
-    let peak = 0;
-    const seen: number[] = [];
-    await runWithConcurrency([0, 1, 2, 3, 4, 5], 2, async (value) => {
-      active += 1;
-      peak = Math.max(peak, active);
-      await new Promise((resolve) => setTimeout(resolve, 2));
-      seen.push(value);
-      active -= 1;
-    });
-    expect(peak).toBe(2);
-    expect(seen.sort((a, b) => a - b)).toEqual([0, 1, 2, 3, 4, 5]);
-  });
-
-  it("falls back to one worker for an invalid concurrency value", async () => {
-    let active = 0;
-    let peak = 0;
-    await runWithConcurrency([1, 2, 3], Number.NaN, async () => {
-      active += 1;
-      peak = Math.max(peak, active);
-      await new Promise((resolve) => setTimeout(resolve, 1));
-      active -= 1;
-    });
-    expect(peak).toBe(1);
-  });
-
-  it("handles an empty input without invoking the worker", async () => {
-    let calls = 0;
-    await runWithConcurrency([], 4, async () => { calls += 1; });
-    expect(calls).toBe(0);
-  });
-});
diff --git a/src/lib/workflows/scheduler.ts b/src/lib/workflows/scheduler.ts
index 8dd5d78..81f91db 100644
--- a/src/lib/workflows/scheduler.ts
+++ b/src/lib/workflows/scheduler.ts
@@ -6,6 +6,7 @@ import { THREAT_TICKET_KIND } from "./threat-trigger-logic";
 import { isCensysTriggerKind } from "./censys-trigger-logic";
 import { isSecurityTrailsTriggerKind } from "./securitytrails-trigger-logic";
 import type { WorkflowGraph, WorkflowNodeSpec } from "./types";
+import { runWithConcurrency } from "@/lib/concurrency";
 import {
   SCHEDULE_MAX_MINUTES,
   SCHEDULE_MIN_MINUTES,
@@ -36,26 +37,6 @@ function schedulerConcurrency(): number {
   return Math.min(16, Math.max(1, Math.floor(configured)));
 }
 
-/** Run independent jobs with a hard concurrency ceiling and stable item order. */
-export async function runWithConcurrency<T>(
-  items: readonly T[],
-  concurrency: number,
-  worker: (item: T, index: number) => Promise<void>,
-): Promise<void> {
-  let cursor = 0;
-  const normalizedConcurrency = Number.isFinite(concurrency) ? Math.max(1, Math.floor(concurrency)) : 1;
-  const workerCount = Math.min(items.length, normalizedConcurrency);
-  await Promise.all(
-    Array.from({ length: workerCount }, async () => {
-      while (true) {
-        const index = cursor++;
-        if (index >= items.length) return;
-        await worker(items[index]!, index);
-      }
-    }),
-  );
-}
-
 /** Pure due-ness check: a workflow with no runs yet is always due. */
 export function isDue(lastStartedAt: Date | null, intervalMinutes: number, now: Date): boolean {
   if (lastStartedAt === null) return true;

From f15e7d386d3d7edab6380c450f82dcfe4ef8c865 Mon Sep 17 00:00:00 2001
From: RandomCatboy <dylan@youhavethe.gay>
Date: Sat, 8 Aug 2026 19:38:21 +0200
Subject: [PATCH 4/5] fix: satisfy exhaustive-deps in investigation polling

---
 .../logs/threats/use-investigation-poll.ts    | 36 +++++++++----------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/src/components/logs/threats/use-investigation-poll.ts b/src/components/logs/threats/use-investigation-poll.ts
index f707256..6273640 100644
--- a/src/components/logs/threats/use-investigation-poll.ts
+++ b/src/components/logs/threats/use-investigation-poll.ts
@@ -1,6 +1,6 @@
 "use client";
 
-import { useEffect, useRef, useState } from "react";
+import { useEffect, useMemo, useRef, useState } from "react";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { toast } from "sonner";
 import { apiFetch } from "@/components/shared/api-client";
@@ -23,16 +23,6 @@ export interface InvestigationState {
   investigatedAt: string | null;
 }
 
-/** Seed the poll state from a ticket DTO (its persisted background fields). */
-function ticketState(ticket: SecurityTicketDto): InvestigationState {
-  return {
-    status: ticket.investigationStatus,
-    progress: ticket.investigationProgress,
-    report: ticket.investigation,
-    investigatedAt: ticket.investigatedAt,
-  };
-}
-
 export interface UseInvestigationPoll {
   /** The current (seeded, then polled) investigation state. */
   state: InvestigationState;
@@ -64,7 +54,20 @@ export function useInvestigationPoll(
 ): UseInvestigationPoll {
   const queryClient = useQueryClient();
   const ticketId = ticket.id;
-  const seeded = ticketState(ticket);
+  const seeded = useMemo<InvestigationState>(
+    () => ({
+      status: ticket.investigationStatus,
+      progress: ticket.investigationProgress,
+      report: ticket.investigation,
+      investigatedAt: ticket.investigatedAt,
+    }),
+    [
+      ticket.investigationStatus,
+      ticket.investigationProgress,
+      ticket.investigation,
+      ticket.investigatedAt,
+    ],
+  );
 
   // "Engaged" once we're actively tracking a run: either the ticket was already
   // queued/running when the panel mounted (resume on reopen), or the user just
@@ -73,21 +76,18 @@ export function useInvestigationPoll(
 
   // A different ticket re-seeds tracking from that ticket's persisted state.
   useEffect(() => {
-    const active = isInvestigationActive(ticket.investigationStatus);
+    const active = isInvestigationActive(seeded.status);
     if (active) {
       // A run started elsewhere may reuse an old query cache entry for this
       // ticket. Seed the cache from the newly observed persisted run before
       // enabling polling so a previous report cannot flash or re-notify.
-      queryClient.setQueryData<InvestigationState>(["investigation", ticketId], ticketState(ticket));
+      queryClient.setQueryData<InvestigationState>(["investigation", ticketId], seeded);
     }
     setEngaged(active);
   }, [
     queryClient,
     ticketId,
-    ticket.investigationStatus,
-    ticket.investigationProgress,
-    ticket.investigation,
-    ticket.investigatedAt,
+    seeded,
   ]);
 
   const query = useQuery({

From 1779354c703e83cc4d35c2d3dbd47676c0d6e287 Mon Sep 17 00:00:00 2001
From: RandomCatboy <dylan@youhavethe.gay>
Date: Sat, 8 Aug 2026 20:05:58 +0200
Subject: [PATCH 5/5] fix: add missing shared theme and backup helper modules

---
 .../shared/use-persisted-theme-mode.ts        | 51 +++++++++++++++++++
 src/components/shell/demo-mode-banner.tsx     | 14 +++++
 .../backup/destinations/storage-request.ts    | 24 +++++++++
 src/lib/backup/destinations/xml.ts            | 22 ++++++++
 4 files changed, 111 insertions(+)
 create mode 100644 src/components/shared/use-persisted-theme-mode.ts
 create mode 100644 src/components/shell/demo-mode-banner.tsx
 create mode 100644 src/lib/backup/destinations/storage-request.ts
 create mode 100644 src/lib/backup/destinations/xml.ts

diff --git a/src/components/shared/use-persisted-theme-mode.ts b/src/components/shared/use-persisted-theme-mode.ts
new file mode 100644
index 0000000..a01d550
--- /dev/null
+++ b/src/components/shared/use-persisted-theme-mode.ts
@@ -0,0 +1,51 @@
+"use client";
+
+import { useCallback, useRef, useState } from "react";
+import { useTheme } from "next-themes";
+import { toast } from "sonner";
+import { apiFetch } from "@/components/shared/api-client";
+import { THEME_MODES, type ThemeMode } from "@/lib/types";
+
+function isThemeMode(value: string | undefined): value is ThemeMode {
+  return THEME_MODES.some((mode) => mode === value);
+}
+
+/**
+ * Applies a mode immediately, persists it to the user profile, and rolls the
+ * preview back if persistence fails. The in-flight guard also prevents rapid
+ * toggles from racing and leaving local storage and the profile out of sync.
+ */
+export function usePersistedThemeMode() {
+  const { theme, resolvedTheme, setTheme } = useTheme();
+  const [isSaving, setIsSaving] = useState(false);
+  const savingRef = useRef(false);
+
+  const setMode = useCallback(
+    async (next: ThemeMode): Promise<boolean> => {
+      if (savingRef.current) return false;
+
+      const previous: ThemeMode = isThemeMode(theme) ? theme : "system";
+      savingRef.current = true;
+      setIsSaving(true);
+      setTheme(next);
+
+      try {
+        await apiFetch("/api/me", {
+          method: "PATCH",
+          body: JSON.stringify({ themeMode: next }),
+        });
+        return true;
+      } catch (err) {
+        setTheme(previous);
+        toast.error(err instanceof Error ? err.message : "Failed to save theme mode");
+        return false;
+      } finally {
+        savingRef.current = false;
+        setIsSaving(false);
+      }
+    },
+    [setTheme, theme],
+  );
+
+  return { theme, resolvedTheme, setMode, isSaving };
+}
diff --git a/src/components/shell/demo-mode-banner.tsx b/src/components/shell/demo-mode-banner.tsx
new file mode 100644
index 0000000..d388550
--- /dev/null
+++ b/src/components/shell/demo-mode-banner.tsx
@@ -0,0 +1,14 @@
+import { LockKeyhole } from "lucide-react";
+
+/** Shared demo notice so desktop and mobile use identical copy and theme tokens. */
+export function DemoModeBanner() {
+  return (
+    <div
+      role="status"
+      className="flex items-center justify-center gap-2 border-b border-primary/20 bg-primary/10 px-4 py-2 text-center text-xs font-medium text-primary"
+    >
+      <LockKeyhole className="size-3.5 shrink-0" aria-hidden />
+      <span>Public demo — exploration is enabled; persistent changes are locked.</span>
+    </div>
+  );
+}
diff --git a/src/lib/backup/destinations/storage-request.ts b/src/lib/backup/destinations/storage-request.ts
new file mode 100644
index 0000000..c966bf8
--- /dev/null
+++ b/src/lib/backup/destinations/storage-request.ts
@@ -0,0 +1,24 @@
+/** Long enough for a sizeable single-PUT backup, but never unbounded. */
+export const BACKUP_UPLOAD_TIMEOUT_MS = 5 * 60_000;
+/** List/delete operations should fail fast enough for scheduler retries. */
+export const BACKUP_METADATA_TIMEOUT_MS = 30_000;
+
+export async function backupStorageFetch(
+  provider: "S3" | "Azure",
+  url: string,
+  init: RequestInit,
+  timeoutMs: number,
+): Promise<Response> {
+  try {
+    return await fetch(url, {
+      ...init,
+      cache: "no-store",
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (err) {
+    if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) {
+      throw new Error(`${provider} request timed out after ${Math.round(timeoutMs / 1000)}s`);
+    }
+    throw err;
+  }
+}
diff --git a/src/lib/backup/destinations/xml.ts b/src/lib/backup/destinations/xml.ts
new file mode 100644
index 0000000..9d376c0
--- /dev/null
+++ b/src/lib/backup/destinations/xml.ts
@@ -0,0 +1,22 @@
+/** Decode the small XML entity set used by S3/Azure list responses. */
+export function decodeXmlText(value: string): string {
+  return value.replace(/&(#x[\da-f]+|#\d+|amp|lt|gt|quot|apos);/gi, (entity, token: string) => {
+    const normalized = token.toLowerCase();
+    if (normalized === "amp") return "&";
+    if (normalized === "lt") return "<";
+    if (normalized === "gt") return ">";
+    if (normalized === "quot") return '"';
+    if (normalized === "apos") return "'";
+    const codePoint = normalized.startsWith("#x")
+      ? Number.parseInt(normalized.slice(2), 16)
+      : Number.parseInt(normalized.slice(1), 10);
+    return Number.isFinite(codePoint) && codePoint >= 0 && codePoint <= 0x10ffff
+      ? String.fromCodePoint(codePoint)
+      : entity;
+  });
+}
+
+export function xmlValue(block: string, tag: string): string | undefined {
+  const match = new RegExp(`<${tag}>([\\s\\S]*?)<\\/${tag}>`).exec(block);
+  return match ? decodeXmlText(match[1]) : undefined;
+}