diff --git a/AGENTS.md b/AGENTS.md
index ca9374e58..4a07e6b20 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -4745,18 +4745,18 @@ contributions without contacting every contributor individually.
 - Bare HTML-entity glyphs (`✎` ✎ / `✓` ✓ / `↺` ↺
   / `📋` 📋 / `✕` ✕ / etc.) as row-action button labels
   → use Lucide icons (`<i data-lucide="pencil|check|rotate-ccw|copy|trash-2|x">`)
-  with an optional visible text label. The bare-entity shape was
-  what the v2.0 banlist row-actions cell shipped while the sibling
+  with `data-tooltip` + `aria-label` on icon-only buttons
+  (`class="btn btn--ghost|secondary btn--icon btn--sm"` inside
+  `.row-actions.row-actions--icons`). The bare-entity shape was what
+  the v2.0 banlist row-actions cell shipped while the sibling
   commslist row used Lucide icons + text labels — the inconsistency
-  read as broken icons / a different app, the icon-only buttons
-  gave no visual affordance, and screen readers announced the
-  glyph code rather than the action. The shared button class chain
-  (`.btn--ghost btn--sm` for Edit/Copy/Remove, `.btn--secondary btn--sm`
-  for Unban/Re-apply with a danger color override on Remove) is what
-  page_comms.tpl established as the canonical reference and what
-  page_bans.tpl now mirrors. Icons should be 13×13 inline-sized
-  (`style="width:13px;height:13px"`) for visual parity with the
-  rest of the panel chrome. Pinned by
+  read as broken icons / a different app, and screen readers
+  announced the glyph code rather than the action. Density chrome
+  for banlist / commslist / admin-admins is icon-only + the themed
+  `data-tooltip` contract from `sb.js` (admins list is the
+  reference). Icons are 14×14 inline-sized
+  (`style="width:14px;height:14px"`); Remove puts
+  `color:var(--danger)` on the icon, not the button. Pinned by
   `web/tests/integration/PublicBanListRegressionTest::testBanlistRowActionsUseLucideIconsNotEntityGlyphs`.
 - `onclick="event.stopPropagation()"` on a `[data-copy]` button →
   the document-level COPY BUTTONS delegate in `theme.js` listens on
@@ -4899,9 +4899,9 @@ contributions without contacting every contributor individually.
 | Add a popup file-upload page (demo / icon / mapimage / new asset type) | `Sbpp\Upload\UploadHandler::handle()` (`web/includes/Upload/UploadHandler.php`). The page handler at `web/pages/admin.upload<x>.php` is a thin wrapper passing the per-page knobs (`permission` mask, `field` `$_FILES` key, `allowed` extensions, `destDir`, `callback` JS function name on `window.opener`, `auditOk` / `auditFmt` / `errorMsg` / `title` / `formName` / `formats` strings, optional `renameToHash` for demo-style randomised filenames). The handler runs CSRF + permission check, sanitises `$_FILES[…]['name']` via `sanitiseName()` (basename + strip backslashes + trim leading dots — defends LFI on the icon / mapimage paths where the filename hits disk), `move_uploaded_file()`s to the destination, calls `Log::add(LogType::Message, …)`, and on success emits the `<script>window.opener.<callback>(...)</script>` blob the parent page picks up. The three reference call sites (`admin.uploaddemo.php`, `admin.uploadicon.php`, `admin.uploadmapimg.php`) are 30-line wrappers; new asset types should match that line budget. Anti-pattern: hand-rolling the move / log / popup-emission sequence per page (the pre-v2.0 shape). |
 | Edit a template                        | `web/themes/default/*.tpl`                               |
 | Reuse the moderation-queue card layout (admin submissions / protests, mobile-stacked summary rows) | `web/themes/default/css/theme.css` (`.queue-row`, `.queue-row__body`, `.queue-row__date` — #1207 PUB-2). Apply by adding `class="queue-row …"` to the outer `<details>` and dropping the inline `flex` / `flex-shrink:0` styles from the summary children. |
-| Add visible row actions to a table-rendered admin list (Edit / Unmute / Remove buttons + responsive mobile-card mirror) | `web/themes/default/page_comms.tpl` (#1207 ADM-5) is the canonical reference: `<button class="btn btn--secondary btn--sm">` / `<a class="btn btn--ghost btn--sm">` inside a `.row-actions` cell, plus `.ban-card__actions` row of identical-data-action buttons in the mobile card. Wire destructive / state-changing buttons via `data-action="…"` + `data-bid` + `data-fallback-href`; the inline page-tail JS calls `sb.api.call(Actions.PascalName)` and falls back to the GET URL if the JSON dispatcher is absent. The public banlist (`web/themes/default/page_bans.tpl`) follows the same shape — same chrome (Lucide icon + visible text label inside `.btn--ghost` / `.btn--secondary btn--sm`), same `.ban-card__actions` mobile row, same `data-action` / `data-fallback-href` wiring (`bans-unban` / `bans-delete`). The Remove affordance points at the legacy GET handler (`?p=banlist&a=delete&id=…&key=…` at the top of `page.banlist.php`) because no JSON `bans.delete` action exists yet — the inline JS `confirm()`-prompts then navigates, mirroring commslist's flow without adding a new handler / snapshot / permission-matrix entry. |
-| Wire a comment-delete trash icon on any of the four comment-rendering surfaces (banlist, commslist, admin.bans protests, admin.bans submissions) | `web/scripts/comment-actions.js` (#1402). Single document-level dispatcher loaded from `core/footer.tpl` (`<script src="./scripts/comment-actions.js" defer>`) that picks up every `[data-action="comment-delete"]` click, `window.confirm`s the destructive intent, then `sb.api.call(Actions.BansRemoveComment, { cid, ctype, page })`. The four call sites emit the trigger with `data-cid="<int>"` + `data-ctype="<B|C|S|P>"` + `data-page="<int>"` (the page number for client-side row-hide / paginator-aware redirect; `data-page="-1"` is the sentinel for unpaginated moderation queues). The `ctype` letter matches `:prefix_comments.type` (B=ban, C=comm-block, S=submission, P=protest); `api_bans_remove_comment`'s `ctype` arm consumes all four. Don't duplicate the dispatcher inline per page — the single mount point is the contract, otherwise a future bug-fix has to land in four places. |
-| Add a confirm + reason modal for an irreversible row-level action (unban, lift comm block, delete admin, delete mod, …) | `web/themes/default/page_bans.tpl` (`#bans-unban-dialog`, `Actions.BansUnban`) and `web/themes/default/page_comms.tpl` (`#comms-unblock-dialog`, `Actions.CommsUnblock`) are the canonical reference (#1301), with `web/themes/default/page_admin_admins_list.tpl` (`#admins-delete-dialog`, `Actions.AdminsRemove`, #1352) and `web/themes/default/page_admin_mods_list.tpl` (`#mod-delete-dialog`, `Actions.ModsRemove`, #1397) as the third and fourth references for the optional-reason variant. Shape: a `<dialog hidden>` with a `<form method="dialog">` carrying a `<textarea aria-required="true">` (or `aria-required="false"` for the optional-reason variant — see admins-delete / mod-delete) (NOT the native `required` — that lets the browser block the form submit before our handler runs, swallowing the inline-error UX), a Cancel button, and a Confirm submit button. The page-tail JS opens the dialog via `showModal()` on `[data-action]` clicks, validates the trimmed reason on submit (load-bearing gate is server-side), forwards `ureason` to the JSON action, and on success flips the row in place via the same `flipRowToUnbanned`/`flipRowToUnmuted` helper the legacy single-click flow used (or removes the row outright + decrements the count badge for the admins-delete / mod-delete variants where there's no "now-unbanned" state to render). The legacy GET fallback (`?p=banlist&a=unban&id=…&key=…&ureason=…` / `?p=commslist&a=ungag…&ureason=…`) is the no-JS / hand-edited-URL path; both halves now reject empty `ureason` server-side so the audit log carries the *why*. The admins-delete and mod-delete variants have no legacy GET handler — `RemoveAdmin()` / `RemoveMod()` always went through the JSON dispatcher pre-#1123 D1 — so their `data-fallback-href` lands the operator back at the list page as a graceful no-op when the JSON dispatcher is missing entirely (third-party theme stripping `api.js`); the audit-log "Reason: …" suffix is only emitted when `ureason` is non-empty (vs always-emitted on the bans / comms variants where reason is required). **Do not** put `onclick="event.stopPropagation()"` on the trigger button — `document.addEventListener('click')` is how the dialog opener picks the click up, and stopPropagation would silently swallow it (the action button isn't inside any `[data-drawer-href]` ancestor anyway, so the defensiveness was a copy-paste from the row-name anchor that doesn't apply here). The submit button MUST flip through `setBusy(submitBtn, true)` BEFORE `sb.api.call(...)` leaves the page and clear via `setBusy(submitBtn, false)` on every non-navigating response branch — see "Loading state on action buttons" in Conventions for the contract, the inline-script local wrapper shape, and the regression guard. |
+| Add visible row actions to a table-rendered admin list (Edit / Unmute / Remove buttons + responsive mobile-card mirror) | `web/themes/default/page_admin_admins_list.tpl` is the density reference: icon-only `<a class="btn btn--ghost btn--icon btn--sm">` / `<button class="btn btn--secondary btn--icon btn--sm">` inside `.row-actions.row-actions--icons`, with `data-tooltip` + `aria-label` (themed tooltip via `sb.js`). Public banlist / commslist (`page_bans.tpl` / `page_comms.tpl`) follow the same chrome on `table table--compact` desktop tables (tighter cell padding + 22px avatars + 1.75rem icon buttons via `.table.table--compact .row-actions--icons .btn--icon.btn--sm`), plus `.ban-card__actions` mobile rows. Wire destructive / state-changing buttons via `data-action="…"` + `data-bid` + `data-fallback-href`; the inline page-tail JS calls `sb.api.call(Actions.PascalName)` and falls back to the GET URL if the JSON dispatcher is absent. Banlist Remove points at the legacy GET handler (`?p=banlist&a=delete&id=…&key=…`) because no JSON `bans.delete` action exists yet. |
+| Wire a comment-delete trash icon on any of the four comment-rendering surfaces (banlist, commslist, admin.bans protests, admin.bans submissions) | `web/scripts/comment-actions.js` (#1402). Single document-level dispatcher loaded from `core/footer.tpl` (`<script src="./scripts/comment-actions.js" defer>`) that picks up every `[data-action="comment-delete"]` click, opens a shared `#comment-delete-dialog` `<dialog>` (injected once by the script), then `sb.api.call(Actions.BansRemoveComment, { cid, ctype, page })`. The four call sites emit the trigger with `data-cid="<int>"` + `data-ctype="<B|C|S|P>"` + `data-page="<int>"` (the page number for client-side row-hide / paginator-aware redirect; `data-page="-1"` is the sentinel for unpaginated moderation queues). The `ctype` letter matches `:prefix_comments.type` (B=ban, C=comm-block, S=submission, P=protest); `api_bans_remove_comment`'s `ctype` arm consumes all four. Don't duplicate the dispatcher inline per page — the single mount point is the contract, otherwise a future bug-fix has to land in four places. Do NOT reintroduce `window.confirm()` for this surface. |
+| Add a confirm + reason modal for an irreversible row-level action (unban, lift comm block, delete admin, delete mod, …) | `web/themes/default/page_bans.tpl` (`#bans-unban-dialog`, `Actions.BansUnban`) and `web/themes/default/page_comms.tpl` (`#comms-unblock-dialog`, `Actions.CommsUnblock`) are the canonical reference (#1301), with `web/themes/default/page_admin_admins_list.tpl` (`#admins-delete-dialog`, `Actions.AdminsRemove`, #1352) and `web/themes/default/page_admin_mods_list.tpl` (`#mod-delete-dialog`, `Actions.ModsRemove`, #1397) as the third and fourth references for the optional-reason variant. Confirm-only delete (no reason field): `#bans-delete-dialog` (legacy GET navigate), `#comms-delete-dialog` (`Actions.CommsDelete`), and `#comment-delete-dialog` (injected by `comment-actions.js`). Never use `window.confirm()` / `alert()` for these row actions. Shape: a `<dialog hidden>` with a `<form method="dialog">` carrying a `<textarea aria-required="true">` (or `aria-required="false"` for the optional-reason variant — see admins-delete / mod-delete; omit the textarea for confirm-only deletes) (NOT the native `required` — that lets the browser block the form submit before our handler runs, swallowing the inline-error UX), a Cancel button, and a Confirm submit button. The page-tail JS opens the dialog via `showModal()` on `[data-action]` clicks, validates the trimmed reason on submit (load-bearing gate is server-side), forwards `ureason` to the JSON action, and on success flips the row in place via the same `flipRowToUnbanned`/`flipRowToUnmuted` helper the legacy single-click flow used (or removes the row outright + decrements the count badge for the admins-delete / mod-delete / comms-delete variants where there's no "now-unbanned" state to render). The legacy GET fallback (`?p=banlist&a=unban&id=…&key=…&ureason=…` / `?p=commslist&a=ungag…&ureason=…`) is the no-JS / hand-edited-URL path; both halves now reject empty `ureason` server-side so the audit log carries the *why*. The admins-delete and mod-delete variants have no legacy GET handler — `RemoveAdmin()` / `RemoveMod()` always went through the JSON dispatcher pre-#1123 D1 — so their `data-fallback-href` lands the operator back at the list page as a graceful no-op when the JSON dispatcher is missing entirely (third-party theme stripping `api.js`); the audit-log "Reason: …" suffix is only emitted when `ureason` is non-empty (vs always-emitted on the bans / comms variants where reason is required). **Do not** put `onclick="event.stopPropagation()"` on the trigger button — `document.addEventListener('click')` is how the dialog opener picks the click up, and stopPropagation would silently swallow it (the action button isn't inside any `[data-drawer-href]` ancestor anyway, so the defensiveness was a copy-paste from the row-name anchor that doesn't apply here). The submit button MUST flip through `setBusy(submitBtn, true)` BEFORE `sb.api.call(...)` leaves the page and clear via `setBusy(submitBtn, false)` on every non-navigating response branch — see "Loading state on action buttons" in Conventions for the contract, the inline-script local wrapper shape, and the regression guard. |
 | Emit a toast from a server-side branch (lostpassword reset success, banlist GET-fallback unban result, admin.edit.* not-found guard, …) | `\Sbpp\View\Toast::emit($kind, $title, $body, ?$redirect, ?$duration_ms)` (`web/includes/View/Toast.php`). Stashes the payload in a `<script type="application/json" class="sbpp-pending-toast">…</script>` block that `theme.js`'s `flushPendingToasts` picks up on `DOMContentLoaded`. Always FQN at call sites (no `use Sbpp\View\Toast;` shim). The chrome JS renders the body through `escapeHtml`; the PHP JSON encoder uses `JSON_HEX_TAG \| JSON_HEX_AMP \| JSON_HEX_APOS \| JSON_HEX_QUOT \| JSON_INVALID_UTF8_SUBSTITUTE \| JSON_THROW_ON_ERROR` so a `</script>` in body cannot break out AND malformed UTF-8 in player names (the #1108 / #765 Latin-1-on-utf8 shape) substitutes to U+FFFD instead of throwing. Multi-toast safe: emit calls stack cleanly; the first non-empty `$redirect` wins (chrome navigates ~1500ms after the toast paints so the user can read it). The optional 5th arg `$duration_ms` (#1409) overrides the chrome's `SHOWTOAST_DEFAULT_DURATION` (~6000ms post-#1444; was ~4000ms in the v2 RC chrome) — `null` (default) keeps the chrome timing, `0` makes the toast persistent (no auto-dismiss; user must click the X button), `> 0` is an explicit ms override. The 5 NOT-* destructive-action-failed branches in `page.banlist.php` / `page.commslist.php` ("Player NOT Unbanned", "Ban NOT Deleted", "Player NOT UnGagged" × 2, "Ban NOT Deleted") pass `0` so severe-error confirmations don't auto-dismiss before the operator finishes reading. Negative `$duration_ms` throws `\InvalidArgumentException` (Fail closed; see "Duration semantics" in Conventions). Persistent + redirect are mutually exclusive (#1409): pass `null` for `$redirect` when emitting `duration_ms: 0` — the chrome's auto-redirect would otherwise navigate ~1500ms after paint, tearing down the persistent toast before the operator can acknowledge it. The chrome ALSO carries a whole-drain inhibit (`flushPendingToasts` skips the redirect setTimeout entirely when any block had `duration_ms: 0`) as defence-in-depth, but the call-site half (`$redirect=null`) is the primary contract pinned by `testNotStarBranchesPassPersistentDurationMs`'s strict regex (which disambiguates the two `Player NOT UnGagged` sites in `page.commslist.php` by body substring + asserts each site's call shape with `assertSame($expected_count, …)`). Painted ARIA role is kind-aware (#1409 review): `role="alert"` for `kind === 'error'` (assertive — screen readers interrupt to surface), `role="status"` for every other kind (polite). Persistent error toasts especially benefit from `alert` because the screen-reader user is the population least likely to notice a visual change without an auditory cue. Pair with `PageDie()` (or `exit`) whenever the handler's "render the page body" path is no longer meaningful — pre-#1403 the legacy `<script>ShowBox(...)</script>` shape carried its own `window.location` and beat the page render to the user; the lifted helper relies on the explicit redirect + the 1500ms settle. See "Server-side toast emission" in Conventions for the full contract (the "ARIA role contract" subsection covers the kind-aware role rationale). Pinned by `web/tests/integration/ToastEmitRegressionTest.php` (static grep + wire-format + JSON-escape + UTF-8-substitute + FIRST-wins-redirect + `duration_ms` omitted/set/negative/escape contracts + the 5 NOT-* call sites pass `duration_ms: 0` AND `$redirect=null` + call-site contract) and the six marquee E2E specs (`lostpassword-toast.spec.ts`, `protest-toast.spec.ts`, `banlist-getfallback-toast.spec.ts`, `commslist-getfallback-toast.spec.ts`, `admin-edit-comms-toast.spec.ts`, `toast-persistent-duration.spec.ts`). The lostpassword spec seeds the dev stack's mailpit and asserts the password-reset email lands at the right address — the marquee user-reported regression from the audit. The persistent-duration spec (#1409, thresholds updated in #1444) drives a NOT-* branch payload and asserts the toast is STILL visible past the default ~6000ms window; its sister regression-guard test drives `window.SBPP.showToast(...)` directly (no page-flow / redirect dependency, post-review reshape) and asserts a routine toast auto-dismisses inside the ~6000-8000ms window so a regression bumping or zeroing the default duration fails loudly. |
 | Add a loading indicator to an action button that fires `sb.api.call(...)` without a page refresh | `window.SBPP.setBusy(btn, busy)` (`web/themes/default/js/theme.js`) writes the `data-loading="true"` + `aria-busy="true"` + `disabled` triple atomically; the CSS spinner lives in `web/themes/default/css/theme.css` under `.btn[data-loading="true"]` + the `sbpp-btn-spin` keyframe. Inline page-tail scripts inside `.tpl` files define a local `setBusy(btn, busy)` wrapper that delegates to `window.SBPP.setBusy` when present and falls back to `btn.disabled = busy` so third-party themes that strip `theme.js` still gate against double-clicks. Canonical reference shapes: the three confirm-dialog flows (`page_comms.tpl` / `page_bans.tpl` / `page_admin_admins_list.tpl`), the form-submit flows (`page_admin_groups_list.tpl` / `page_admin_groups_add.tpl` / `page_admin_bans_add.tpl` / `page_admin_bans_email.tpl` / `page_youraccount.tpl` / `page_lostpassword.tpl` / `page_login.tpl`), the row-action flows (`page_admin_servers_list.tpl` / `page_admin_bans_protests.tpl` / `page_admin_bans_protests_archiv.tpl` / `page_admin_bans_submissions.tpl` / `page_admin_bans_submissions_archiv.tpl`), and the drawer Notes paths (`theme.js`'s `submitNoteForm` / `deleteNote`). Comment edit on the banlist (`web/scripts/banlist.js`) carries the same pattern for the `sb.api.call(BansEditComment)` round-trip. Regression guards: `web/tests/e2e/specs/flows/action-loading-indicator.spec.ts` (stalls `Actions.CommsUnblock` via `page.route`, asserts the busy-attribute triple on the submit button while in flight, releases the route, and confirms the row flips in-place; the second test counts requests to prove the disabled gate blocks a double-click) **plus** `web/tests/e2e/specs/flows/loading-animations.spec.ts` (#1362 — samples `getComputedStyle(::after).transform` at multiple frame boundaries under both `reducedMotion: 'reduce'` AND `'no-preference'`, asserts the matrix values change across samples; catches the v2.0 RC1 regression where the global `prefers-reduced-motion: reduce` reset froze the spinner under reduced motion). |
 | Add a loading indicator to the player drawer or one of its lazy panes (so the chrome doesn't read as blank while the JSON action is in flight) | `renderDrawerLoading()` (header skeleton for the in-flight `bans.detail`) and `renderPaneSkeleton()` (placeholder for History / Comms / Notes activation) in `web/themes/default/js/theme.js`. Both lean on the `.skel` CSS rule in `theme.css` (linear-gradient + `shimmer` keyframe + dark-mode override + the `@media (prefers-reduced-motion: reduce)` per-rule override that keeps the shimmer sliding even under reduced motion, #1362). The header skeleton carries `[data-testid="drawer-loading"]` + `aria-busy="true"` + per-block `[data-skeleton]` (terminal markers under `#drawer-root[data-loading="true"]`); the lazy-pane skeleton carries `[data-pane-empty]` + `aria-busy="true"` and deliberately omits `[data-skeleton]` because the panel parent's `hidden` attribute doesn't compose into `[data-skeleton]:not([hidden])` and a nested marker would stall every page-load waiter that runs after the drawer opens. Class name is `.skel` (singular) — NOT `.skeleton`; the pre-fix `class="skeleton"` typo had no matching rule and the shimmer rows rendered as transparent zero-background divs (the user-visible "drawer is blank" regression). Regression guards: `web/tests/e2e/specs/flows/drawer-loading-indicator.spec.ts` (stalls `bans.detail` then `bans.player_history` via `page.route`, asserts the skeleton header is visible + the `.skel` block paints a `linear-gradient` background via `getComputedStyle(el).backgroundImage`, releases the routes, and confirms the drawer flips to `renderDrawerBody` / the pane fills with content) **plus** `web/tests/e2e/specs/flows/loading-animations.spec.ts` (#1362 — samples `getComputedStyle(.skel).backgroundPositionX` at multiple frame boundaries under both `reducedMotion: 'reduce'` AND `'no-preference'`, asserts the values change across samples; catches the v2.0 RC1 regression where the global reset froze the shimmer alongside the spinner). |
@@ -4909,7 +4909,7 @@ contributions without contacting every contributor individually.
 | Re-apply (Reban) affordance on the public banlist for expired / unbanned rows | `web/themes/default/page_bans.tpl`. The desktop row-actions cell emits `<a class="btn btn--secondary btn--sm" data-testid="row-action-reapply" href="index.php?p=admin&c=bans&section=add-ban&rebanid={$ban.bid}&key={$admin_postkey}">…<i data-lucide="rotate-ccw">…Re-apply</a>` when `$can_add_ban && ($ban.state == 'expired' \|\| $ban.state == 'unbanned')`. The smart-default block on `admin.bans.php`'s `add-ban` section detects `?rebanid=…` and pre-populates the form via `BansPrepareReban`. Mobile parity (this PR) — the mobile card was restructured from a single wrapping `<a>` to the `page_comms.tpl` shape (`<div data-testid="ban-card">` wrapping `<a class="ban-card__summary" data-testid="drawer-trigger">` + a sibling `<div class="row-actions ban-card__actions">`), so the same Re-apply button surfaces under `data-testid="row-action-reapply-mobile"`. The drawer trigger stays the inner anchor's `data-drawer-href` + `data-testid="drawer-trigger"` so the existing responsive spec selector keeps working. |
 | Fan rcon kick / block commands out to every enabled server after a successful `Actions.BansAdd` / `Actions.CommsAdd` (the hidden `<iframe id="srvkicker">` pattern) | `web/themes/default/page_admin_bans_add.tpl` (#1441 — `Actions.BansAdd .then(r => ...)` handler reads `r.data.kickit` and spawns the iframe pointing at `pages/admin.kickit.php?check=<check>&type=<type>`) + `web/themes/default/page_admin_comms_add.tpl` (the older sibling — `Actions.CommsAdd .then(r => ...)` reads `r.data.block` and spawns the iframe pointing at `pages/admin.blockit.php?check=<steam>&type=<type>&length=<length>`). The URL parameter `check=` is symmetric across both surfaces; the JS envelope field names are NOT — bans.add returns `r.data.kickit.check` while comms.add returns `r.data.block.steam`, because `api_bans_add` and `api_comms_add` chose different envelope shapes when the kickit/blockit envelopes were originally added. Always read the server-side envelope shape (`web/api/handlers/bans.php::api_bans_add` / `web/api/handlers/comms.php::api_comms_add`) FIRST when porting between the two branches. The iframe template (`web/themes/default/page_kickit.tpl` / `page_blockit.tpl`) auto-fires `Actions.KickitLoadServers` (or `Actions.BlockitLoadServers`) on `window.addEventListener('load', ...)` which enumerates enabled servers and fans out per-server `Actions.KickitKickPlayer` / `Actions.BlockitBlockPlayer` rcon calls. The iframe is `display: none` — the operator never sees it, but the panel can spawn it from any surface that needs server-side rcon side-effects (the right-click context menu's "Kick player" item navigates to the same `pages/admin.kickit.php` URL as a top-level document instead — see "Add or extend the server-player right-click context menu" row). Don't reach for `setBusy(submitBtn, false)` after spawning the iframe — the success branch keeps the button busy through the 2s `setTimeout` that reloads the parent page (matching `page_admin_comms_add.tpl`'s shape), preventing operators from queuing a second submit while rcon fans out. Regression guards: `web/tests/e2e/specs/flows/ban-kickit-iframe.spec.ts` (#1441 — stubs both `Actions.BansAdd` and `pages/admin.kickit.php` at the network layer; asserts the iframe is spawned exactly once with `toBe(1)` on the request count so a future double-mount regression — e.g. a `.then()` chain that resolves twice, a `dispatchEvent` re-firing the submit handler, a `setBusy` gap — surfaces immediately) + `web/tests/e2e/specs/flows/kickit-iframe.spec.ts` (#1433 — exercises the deeper rcon round-trip via the context-menu path) + `web/tests/api/KickitTest.php` (PHPUnit — handler permission gate + malformed-input envelopes). Pre-#1441 the bans-add side carried a `typeof window.ShowKickBox === 'function'` guard pointing at a v1.x helper that was deleted at #1123 D1; the `if` body silently never ran and operators reported "banning doesn't kick" (the canonical "chrome reads as success while the load-bearing action never fired" UI regression — see the matching anti-pattern entry under Anti-patterns). |
 | Wrap a public-list legacy advanced-search form (banlist / commslist) in a default-collapsed `<details class="filters-details">` disclosure | `web/themes/default/page_bans.tpl` + `web/themes/default/page_comms.tpl` (#1315). The same `.filters-details` rules in `web/themes/default/css/theme.css` cover the chrome (summary chevron, `[open]` state, hover bg, focus ring, count badge); the public-list usage adds a `.filters-details__body > form.card` rule that suppresses the inner card framing because the disclosure body wraps a `{load_template file="admin.bans.search"}` (or `…comms.search`) — i.e. a sibling page-render that emits its own `<form class="card">`. The View DTO (`Sbpp\View\BanListView` / `Sbpp\View\CommsListView`) carries a `bool $is_advanced_search_open` set by the page handler from `isset($_GET['advSearch']) && (string) $_GET['advSearch'] !== ''` so the legacy `?advSearch=…&advType=…` URL shim auto-opens the disclosure. Bare `?p=banlist` / `?p=commslist` and simple-bar filters (`?searchText=` / `?server=` / `?time=`) leave it closed so the unfiltered list reaches above the fold. Selectors anchor on `[data-testid="banlist-advsearch-disclosure"]` / `[data-testid="commslist-advsearch-disclosure"]` (the `<details>`) + the `…-toggle` (the `<summary>`) + the `…-active` count badge. The same `.filters-details` chrome was introduced for admin-admins by #1303 — both surfaces share the CSS so a future tweak is single-source. |
-| Surface admin-authored per-ban / per-comm comments inline on the public banlist + commslist (`<details data-testid="ban-comments-inline">` / `comm-comments-inline`) | `web/themes/default/page_bans.tpl` + `web/themes/default/page_comms.tpl` (#BANLIST-COMMENTS, this PR). Both desktop tables render a native `<details class="ban-comments-inline">` next to the player-name cell whose `<summary>` doubles as the count chip (icon + tabular-nums count + "comment(s)" label) and whose body lists each comment with `<strong>{$com.comname}</strong>` + timestamp + `<div data-testid="ban-comment-text">{$com.commenttxt nofilter}</div>`. The `nofilter` is load-bearing because `$com.commenttxt` is server-built HTML produced by `encodePreservingBr` (per-segment `htmlspecialchars`, only `<br/>` survives) plus the URL-wrap regex that wraps already-escaped `https?://...` strings in `<a>` tags — same trust contract as the existing comment-edit-mode "Other comments" foreach at the top of `page_bans.tpl`. The mobile cards emit a non-interactive `<div data-testid="ban-comments-count-mobile">` count indicator instead — the card wraps every cell in a single `<a data-drawer-href>`, so a nested `<details>` would be invalid HTML (interactive content inside interactive content); mobile users tap through to the drawer (`renderOverviewPane` paints the same comments under `[data-testid="drawer-comments"]`). Both surfaces gate on `$view_comments` (mirrors the page handler's `Config::getBool('config.enablepubliccomments') \|\| $userbank->is_admin()` check at `page.banlist.php` line 766 / `page.commslist.php` line 734). The drawer surface (`api_bans_detail.comments_visible` + `api_bans_detail.comments`) is unchanged — both surfaces share the same data path and same gate so there's no leak risk. The commslist regression was worse than the banlist's because there's no drawer fallback on `<tr data-testid="comm-row">`; the inline disclosure is the ONLY on-page way for admins to see comm-block comment text. Regression guards: `web/tests/integration/BanlistCommentsVisibilityTest.php` (admin sees disclosure regardless of flag, anonymous gated correctly, drawer mirrors disclosure via `bans.detail`) + `web/tests/e2e/specs/flows/banlist-comments-visibility.spec.ts` (desktop disclosure renders + opens, drawer paints same data, mobile count indicator is a `<div>` not a `<details>`). The fix restores the v1.x `mooaccordion` discoverability that was lost when the v2.0 rewrite of `page_bans.tpl` collapsed the inline panel down to a silent `<span>[N]</span>` count badge with no affordance. **#1500: `banlist.hideadminname` now also suppresses the comment AUTHOR + EDITOR (both are admin usernames), matching the focal `admin.name` / `removed_by` gate.** The suppression lands at the DATA layer for the three server-rendered surfaces — `page.banlist.php` / `page.commslist.php` null `comname` / `editname` (preserving `edittime`, so the "last edit" indicator survives) before they reach the template, so a third-party theme that renders the name directly can't re-leak it; the templates then render a three-way `{if $hideadminname}Hidden{elseif !empty($com.comname)}name{else}deleted admin{/if}` for both the inline `<details>` disclosure AND the `?comment=N` "Other comments" comment-edit view (reachable by ANY caller — no admin gate, only `$canedit` differs). The JSON drawer path (`api_bans_detail` / `api_comms_detail`) nulls the comment `author` / `edited_by` AND ships an `author_hidden` boolean sentinel so `theme.js` + `partials/player-drawer.tpl` render "Hidden" (policy) distinctly from "unknown" (deleted admin → `author` already null, `author_hidden` false). Regression guards extended: `BanlistCommentsVisibilityTest` (inline + `?comment=N` author/editor-hidden branches + admin control), `BansTest`/`CommsTest::testDetailHidesCommentAuthorForPublicWhenHideAdminName` (API `author` / `edited_by` / `author_hidden` contract). Known follow-up (out of scope #1500): the `?comment=N` view renders comment BODIES regardless of `config.enablepubliccomments` — that's a separate body-exposure surface, not a name leak. |
+| Surface admin-authored per-ban / per-comm comments inline on the public banlist + commslist (`<details data-testid="ban-comments-inline">` / `comm-comments-inline`) | `web/themes/default/page_bans.tpl` + `web/themes/default/page_comms.tpl` (#BANLIST-COMMENTS). Both desktop tables wrap the player-name anchor + comment chip in `.ban-player-cell__head` so the collapsed chip sits on the SAME line as the name (icon + tabular-nums count only; `title` / `aria-label` carry "N comment(s)"). The name uses `.ban-player-cell__name` (ellipsis truncate) so the chip never wraps alone; opened details take `flex-basis: 100%` and the body lists each comment below. CSS lives under `.ban-comments-inline*` in `theme.css`. The `nofilter` on comment text is load-bearing (`encodePreservingBr` + URL-wrap). Mobile cards keep a non-interactive count indicator (`ban-comments-count-mobile`). Gate: `$view_comments`. **#1500** also hides comment author/editor when `banlist.hideadminname` is on. Regression: `BanlistCommentsVisibilityTest` + `banlist-comments-visibility.spec.ts`. |
 | Filter the public banlist by ban state (`?p=banlist&state=permanent\|active\|expired\|unbanned`) — server-side rowset narrowing for a chip strip | `web/pages/page.banlist.php` (#1352). The `?state=` value is allowlisted (`['permanent','active','expired','unbanned']`, anything else falls through to "All"), composed into the existing `$publicFilterAnd` / `$publicFilterWheren` SQL fragments via the per-state predicates documented inline. **Symmetric defensive shape across the four arms**: `permanent` / `active` BOTH require `RemovedOn IS NULL` (otherwise a pre-2.0 admin-lifted row with `ends > now` would match BOTH `?state=active` AND `?state=unbanned`); `expired` carries THREE arms (`RemoveType = 'E'` post-migration shape + `RemoveType IS NULL AND length > 0 AND ends < now AND RemovedOn IS NULL` for pre-475 installs the prune writer never touched + `RemoveType IS NULL AND RemovedOn IS NOT NULL AND length > 0 AND (RemovedBy IS NULL OR RemovedBy = 0)` for the fork-divergence shape `810.php` pass 2 backfills); `unbanned` carries TWO arms (`RemoveType IN ('D', 'U')` post-migration shape + `RemovedOn IS NOT NULL AND RemoveType IS NULL AND RemovedBy IS NOT NULL AND RemovedBy > 0` for pre-2.0 admin-lifts that `810.php` pass 1 backfills). The `RemovedBy > 0` vs `RemovedBy IS NULL OR = 0` split between unbanned / expired is the **load-bearing distinction** — natural expiry sets `RemovedBy = 0` (PruneBans) or NULL (pre-475); admin lifts set `RemovedBy = <aid>`. The View DTO (`Sbpp\View\BanListView`) carries `string $active_state` + `string $chip_base_link`; the chip strip in `web/themes/default/page_bans.tpl` renders as real `<a href="index.php?p=banlist{$chip_base_link}&state=…">` anchors with `aria-current="true"` (NOT `aria-pressed` — only valid on role=button; axe rejects it on `<a>` as `aria-allowed-attr`) and `data-active="true"` server-rendered on the matching chip — never `<button onclick=…>` (the legacy `web/scripts/banlist.js applyStateFilter` row-hide layer was a client-side filter on top of server-side pagination, so on installs with thousands of bans the unbanned chip silently rendered an empty page 1). The "Hide inactive" toggle is suppressed in the template when `$active_state !== ''` so the two predicates (`hideinactive` is `RemoveType IS NULL`; `?state=expired` / `unbanned` ask for the OPPOSITE) don't visually fight. Pagination URLs preserve `&state=` via `$stateFilterLink`; the per-row state classifier in the same file mirrors the SQL filter (a row pulled in by `?state=unbanned` renders the Unbanned pill, never the legacy mis-classified "Active" pill). The JSON API parity surface is `api_bans_detail` + `api_bans_player_history` in `web/api/handlers/bans.php` — same `isPre2AdminLift` defensive branch so the drawer's detail view + the history pane don't visibly contradict the SQL filter. Regression guards: `web/tests/integration/BanListStateFilterTest.php` (per-state row inclusion / exclusion + chip render contract + suppressed Hide-inactive toggle + symmetric `expired` arm 3 contract), `web/tests/integration/UpdaterBackfillRemoveTypeTest.php` (the migration's idempotency + two-pass cross-contamination contract), `web/tests/api/BansTest.php::testDetailReportsUnbannedForPre2AdminLiftWithRemoveTypeNull` (API parity), `web/tests/e2e/specs/responsive/banlist.spec.ts` + `web/tests/e2e/specs/responsive/filters.spec.ts` (mobile chip click navigates + asserts `aria-current` rather than `history.replaceState` + `aria-pressed`'ing). |
 | Edit the player-detail drawer (open trigger, tabs, panes, lazy loaders) | `web/themes/default/js/theme.js` (`renderDrawerBody` / `loadPaneIfNeeded`). The drawer handles two focal kinds via `drawerKind` (`'ban'` / `'comm'`): the bans list ships `data-drawer-bid` / `data-drawer-href` on row anchors, the comms list ships `data-drawer-cid`. `loadDrawer({kind, id})` dispatches to `Actions.BansDetail` (bid → `bans.detail`) or `Actions.CommsDetail` (cid → `comms.detail`) and stamps the response into `drawerDetail`. `loadPaneIfNeeded` then keys lazy panes off the focal kind: bans-focal History sends `{bid}` (handler excludes the focal via `BA.bid <> ?`); comm-focal History sends `{authid: drawerDetail.player.steam_id}` (no focal to exclude — different table); bans-focal Comms sends `{bid}` (resolves to authid; no comm to exclude); comm-focal Comms sends `{cid}` (handler excludes the focal cid via `C.bid <> ?` — sister contract to the bans-focal History exclusion so the Overview pane and the Comms tab don't render the same record twice). The Notes tab is admin-only and shared across both focal kinds (keys off `player.steam_id`). |
 | Add a comms-list player drawer parity surface (mirror the banlist's `data-drawer-href` row anchor with a comm-focal equivalent) | The desktop `<tr data-testid="comm-row">` and mobile `<div data-testid="comm-card">` rows in `web/themes/default/page_comms.tpl` carry a player-name anchor with `data-drawer-cid="{$comm.cid}"` + `data-testid="drawer-trigger"`. The `href` falls back to a useful no-JS surface (`?p=commslist&id=…` desktop / `?p=commslist&searchText=…` mobile) so the affordance still leads somewhere when JS is off / `theme.js` is stripped by a third-party theme. The drawer JS (`theme.js`'s document `click` delegate at `[data-drawer-bid], [data-drawer-cid], [data-drawer-href]`) routes the click through `keyFromTrigger(trigger)` which returns `{kind: 'comm', id}` for cid triggers; downstream `loadDrawer` dispatches `Actions.CommsDetail` and the renderer branches on `drawerKind === 'comm'` for the header chip ("Comm #N") and the Overview pane's focal-block grid (`[data-testid="drawer-block"]` with `Type` / `Reason` / `Started` / `Ends` rows — vs `[data-testid="drawer-ban"]` on the bans-focal path). The handler is `api_comms_detail` in `web/api/handlers/comms.php` (sister to `api_bans_detail`, same envelope shape modulo `cid` instead of `bid` / `block` instead of `ban` / `'unmuted'` instead of `'unbanned'` in the state vocab — both `api_comms_detail` AND `api_comms_player_history` use `'unmuted'` for `RemoveType IN ('U', 'D')` rows so the drawer's Overview pane and Comms tab don't render contradictory state labels for the same player). Public action; field-level hide-* gating mirrors `bans.detail`. Pill CSS lives next to `.pill--unbanned` in `theme.css` (`.pill--unmuted` carries the same success-bg + emerald colour treatment because admin-lifted is admin-lifted regardless of the focal kind). The drawer JS's `stateLabel()` switch in `theme.js` carries the matching `'unmuted' → 'Unmuted'` arm. Regression guards: `web/tests/api/CommsTest.php` (snapshot + state vocab + lifted-block branch + permanent-block branch + `comms.player_history` cid path with focal exclusion + 404 on unknown cid + lone-focal empty-feed shape) and `web/tests/e2e/specs/flows/ui/comms-drawer.spec.ts` (desktop) + `web/tests/e2e/specs/responsive/drawer.spec.ts` (mobile — clicking a `.ban-cards [data-testid="drawer-trigger"]` opens the comm-focal drawer, header reads "Comm #N", Type row in Overview pane). The desktop spec mirrors `player-drawer.spec.ts`'s isolation strategy — NO `truncateE2eDb` between tests, unique authids per (subtest × project × worker), and `seedCommOrAccept` / `seedBanOrAccept` helpers that tolerate `already_blocked` / `already_banned` so a Playwright retry on the same worker reuses the existing row. Adding a per-test truncate would only widen the cross-file race window where a concurrent worker's API call lands during another worker's truncate→reseed gap and gets a `forbidden` cascade; the comms-drawer tests are read-shaped (open the drawer, assert the chrome) so authid-namespacing is enough. |
diff --git a/web/pages/page.banlist.php b/web/pages/page.banlist.php
index ba07a2f74..3b9cd89a1 100644
--- a/web/pages/page.banlist.php
+++ b/web/pages/page.banlist.php
@@ -620,21 +620,7 @@ function setPostKey()
             $where   = "WHERE BA.bid = ?";
             $advcrit = [$value];
             break;
-        case "steamid":
-            // #1130: match both STEAM_0:Y:Z and STEAM_1:Y:Z stored variants;
-            // see SteamID::toSearchPattern() for rationale. The pre-switch
-            // normalisation block above has already canonicalised $value to
-            // STEAM_0 form, but the Y:Z tail is invariant so the pattern is
-            // the same either way.
-            $authidPattern = SteamID::toSearchPattern($value);
-            if ($authidPattern !== null) {
-                $where   = "WHERE BA.authid REGEXP ?";
-                $advcrit = [$authidPattern];
-            } else {
-                $where   = "WHERE BA.authid = ?";
-                $advcrit = [$value];
-            }
-            break;
+        case "steamid": // legacy exact-match URL; folded to always-partial
         case "steam":
             $where   = "WHERE BA.authid LIKE ?";
             $advcrit = ["%$value%"];
diff --git a/web/pages/page.commslist.php b/web/pages/page.commslist.php
index 586c69feb..812bcc8f4 100644
--- a/web/pages/page.commslist.php
+++ b/web/pages/page.commslist.php
@@ -497,18 +497,7 @@ function setPostKey()
             $where   = "WHERE CO.bid = ?";
             $advcrit = [$value];
             break;
-        case "steamid":
-            // #1130: match both STEAM_0:Y:Z and STEAM_1:Y:Z stored variants;
-            // see SteamID::toSearchPattern() for rationale.
-            $authidPattern = SteamID::toSearchPattern($value);
-            if ($authidPattern !== null) {
-                $where   = "WHERE CO.authid REGEXP ?";
-                $advcrit = [$authidPattern];
-            } else {
-                $where   = "WHERE CO.authid = ?";
-                $advcrit = [$value];
-            }
-            break;
+        case "steamid": // legacy exact-match URL; folded to always-partial
         case "steam":
             $where   = "WHERE CO.authid LIKE ?";
             $advcrit = ["%$value%"];
diff --git a/web/scripts/comment-actions.js b/web/scripts/comment-actions.js
index 88bae0d06..8443d5bf9 100644
--- a/web/scripts/comment-actions.js
+++ b/web/scripts/comment-actions.js
@@ -32,6 +32,10 @@
      - `data-ctype="<B|C|S|P>"` — required
      - `data-page="<int>"`  — optional, defaults to -1
 
+   Confirm chrome is a single shared `<dialog>` (injected once)
+   matching the banlist / commslist delete modals — not
+   `window.confirm()`.
+
    This file lives at panel scope so any future page that needs
    comment-delete just adds the `data-action="comment-delete"`
    attribute + the three data hooks and includes this script.
@@ -65,58 +69,103 @@
         }
     }
 
-    document.addEventListener('click', function (e) {
-        var t = /** @type {Element|null} */ (e.target);
-        if (!t) return;
-        var trigger = /** @type {HTMLElement|null} */ (t.closest && t.closest('[data-action="comment-delete"]'));
-        if (!trigger) return;
-        e.preventDefault();
+    /** @type {{cid: number, ctype: string, page: number, trigger: HTMLElement}|null} */
+    var pending = null;
 
-        var cid = parseInt(trigger.getAttribute('data-cid') || '0', 10);
-        var ctype = trigger.getAttribute('data-ctype') || '';
-        var page = parseInt(trigger.getAttribute('data-page') || '-1', 10);
+    /** @returns {HTMLDialogElement} */
+    function ensureDialog() {
+        var existing = /** @type {HTMLDialogElement|null} */ (document.getElementById('comment-delete-dialog'));
+        if (existing) return existing;
 
-        if (!cid || !ctype) {
-            toast('error', 'Delete failed', 'Missing comment context.');
-            return;
-        }
+        var d = document.createElement('dialog');
+        d.id = 'comment-delete-dialog';
+        d.className = 'palette';
+        d.setAttribute('aria-labelledby', 'comment-delete-dialog-title');
+        d.setAttribute('data-testid', 'comment-delete-dialog');
+        d.setAttribute('hidden', '');
+        d.setAttribute('style', 'max-width:32rem;width:90vw;padding:1.25rem;border-radius:0.75rem;border:1px solid var(--border)');
+        d.innerHTML =
+            '<form method="dialog" data-testid="comment-delete-form">'
+            + '<h2 id="comment-delete-dialog-title" style="font-size:var(--fs-lg);font-weight:600;margin:0 0 0.25rem">Delete comment</h2>'
+            + '<p class="text-sm text-muted m-0" style="margin-bottom:0.75rem">'
+            + 'Delete this comment? This cannot be undone.'
+            + '</p>'
+            + '<div class="flex gap-2 mt-4" style="justify-content:flex-end">'
+            + '<button type="button" class="btn btn--secondary" data-testid="comment-delete-cancel" value="cancel">Cancel</button>'
+            + '<button type="submit" class="btn btn--danger" data-testid="comment-delete-submit" value="confirm">'
+            + '<i data-lucide="trash-2" style="width:13px;height:13px"></i> Delete comment'
+            + '</button>'
+            + '</div>'
+            + '</form>';
+        document.body.appendChild(d);
+        var lucide = /** @type {any} */ (window).lucide;
+        if (lucide && typeof lucide.createIcons === 'function') lucide.createIcons();
+        return d;
+    }
 
-        // Confirm prompt — comment deletion is irreversible and the
-        // legacy helper used the native confirm() too. We keep it as
-        // a native `confirm()` rather than a `<dialog>` because the
-        // trash-can appears in dense threads (potentially 10+ per
-        // page) and the dialog scaffolding noise per row would
-        // dwarf the affordance.
-        if (!window.confirm('Are you sure you want to delete this comment?')) {
-            return;
+    /**
+     * @param {{cid: number, ctype: string, page: number, trigger: HTMLElement}} ctx
+     */
+    function openDeleteDialog(ctx) {
+        pending = ctx;
+        var d = ensureDialog();
+        d.removeAttribute('hidden');
+        try { d.showModal(); }
+        catch (_e) { d.setAttribute('open', ''); }
+        var submitBtn = /** @type {HTMLButtonElement|null} */ (d.querySelector('[data-testid="comment-delete-submit"]'));
+        if (submitBtn) {
+            try { submitBtn.focus(); } catch (_e) { /* focus may throw */ }
         }
+    }
+
+    function closeDeleteDialog() {
+        var d = /** @type {HTMLDialogElement|null} */ (document.getElementById('comment-delete-dialog'));
+        if (!d) return;
+        try { d.close(); } catch (_e) { /* not opened modally */ }
+        d.setAttribute('hidden', '');
+        pending = null;
+    }
 
+    /**
+     * @param {{cid: number, ctype: string, page: number, trigger: HTMLElement}} ctx
+     */
+    function runDelete(ctx) {
         var a = api(), A = actions();
         if (!a || !A) {
             toast('error', 'Delete failed', 'The API client is unavailable. Reload the page and try again.');
             return;
         }
 
-        setBusy(trigger, true);
+        var submitBtn = /** @type {HTMLButtonElement|null} */ (
+            document.querySelector('#comment-delete-dialog [data-testid="comment-delete-submit"]')
+        );
+        setBusy(submitBtn, true);
+        setBusy(ctx.trigger, true);
         a.call(A.BansRemoveComment, {
-            cid:   cid,
-            ctype: ctype,
-            page:  page,
+            cid:   ctx.cid,
+            ctype: ctx.ctype,
+            page:  ctx.page,
         }).then(function (r) {
             // sb.api.call follows r.redirect natively when the envelope
             // sets it; on success api_bans_remove_comment surfaces a
             // `message.redir` field that drives the navigation back to
             // the same paginated view. Mirror SbppGroupsAdd's shape.
-            if (!r) { setBusy(trigger, false); return; }
+            if (!r) {
+                setBusy(submitBtn, false);
+                setBusy(ctx.trigger, false);
+                return;
+            }
             if (r.redirect) return;
             if (r.ok === false) {
-                setBusy(trigger, false);
+                setBusy(submitBtn, false);
+                setBusy(ctx.trigger, false);
                 var em = (r.error && r.error.message) || 'Failed to delete comment.';
                 toast('error', 'Delete failed', em);
                 return;
             }
             var data = r.data || {};
             var msg = data.message || {};
+            closeDeleteDialog();
             toast('success', msg.title || 'Comment Deleted', msg.body || 'The comment was deleted.');
             // Honour the handler's redir envelope (sb.api.call only
             // auto-redirects on r.redirect, NOT on data.message.redir).
@@ -127,17 +176,50 @@
                 else window.location.reload();
             }, 1200);
         }).catch(function (err) {
-            // #1402 adversarial review MEDIUM 4: defensive .catch() arm
-            // so a throw inside the success callback (or a sb.api.call
-            // internal failure) doesn't leave the trash-can stuck in
-            // its busy state. The trash-can appears in dense threads
-            // (potentially 10+ per page) and a stuck row reads as a
-            // broken affordance — the operator clicks again, gets the
-            // confirm prompt, and the second click stays no-op'd
-            // because the bubble-phase delegate sees `aria-busy` and
-            // the dispatch silently re-fires.
-            setBusy(trigger, false);
+            setBusy(submitBtn, false);
+            setBusy(ctx.trigger, false);
             toast('error', 'Delete failed', String(err && err.message ? err.message : err));
         });
+    }
+
+    document.addEventListener('click', function (e) {
+        var t = /** @type {Element|null} */ (e.target);
+        if (!t) return;
+
+        if (t.closest && t.closest('[data-testid="comment-delete-cancel"]')) {
+            e.preventDefault();
+            closeDeleteDialog();
+            return;
+        }
+
+        var trigger = /** @type {HTMLElement|null} */ (t.closest && t.closest('[data-action="comment-delete"]'));
+        if (!trigger) return;
+        e.preventDefault();
+
+        var cid = parseInt(trigger.getAttribute('data-cid') || '0', 10);
+        var ctype = trigger.getAttribute('data-ctype') || '';
+        var page = parseInt(trigger.getAttribute('data-page') || '-1', 10);
+
+        if (!cid || !ctype) {
+            toast('error', 'Delete failed', 'Missing comment context.');
+            return;
+        }
+
+        openDeleteDialog({ cid: cid, ctype: ctype, page: page, trigger: trigger });
+    });
+
+    document.addEventListener('submit', function (e) {
+        var form = /** @type {Element|null} */ (e.target);
+        if (!form || !(/** @type {Element} */ (form)).closest) return;
+        if (!form.matches('[data-testid="comment-delete-form"]')) return;
+        e.preventDefault();
+        if (!pending) return;
+        runDelete(pending);
+    });
+
+    document.addEventListener('cancel', function (e) {
+        var t = /** @type {Element|null} */ (e.target);
+        if (!t || t.id !== 'comment-delete-dialog') return;
+        pending = null;
     });
 })();
diff --git a/web/tests/e2e/specs/flows/comment-delete-dispatcher.spec.ts b/web/tests/e2e/specs/flows/comment-delete-dispatcher.spec.ts
index c2f71fde1..fa738fd64 100644
--- a/web/tests/e2e/specs/flows/comment-delete-dispatcher.spec.ts
+++ b/web/tests/e2e/specs/flows/comment-delete-dispatcher.spec.ts
@@ -19,8 +19,8 @@
  *      rather than `onclick="RemoveComment(...)"`.
  *   2. `web/scripts/comment-actions.js` (new file) carries the
  *      single document-level event delegate that consumes those
- *      data attributes, prompts via `window.confirm`, and dispatches
- *      to `Actions.BansRemoveComment` via `sb.api.call`.
+ *      data attributes, opens a styled `<dialog>` confirm, and
+ *      dispatches to `Actions.BansRemoveComment` via `sb.api.call`.
  *   3. The script is included globally in `core/footer.tpl` so the
  *      contract is symmetric across every page that renders a
  *      `delcomlink`.
@@ -34,8 +34,8 @@
  *
  *   - fires the click handler on a `[data-action="comment-delete"]`
  *     trigger (proving the dispatcher loaded + is listening),
- *   - shows a `window.confirm` prompt before calling the API
- *     (proving the destructive-action gate),
+ *   - paints `[data-testid="comment-delete-dialog"]` before calling
+ *     the API (proving the destructive-action gate),
  *   - sends the API call with cid + ctype + page extracted from
  *     the data attributes,
  *   - aborts when the user dismisses the confirm.
@@ -98,14 +98,6 @@ test.describe('flow: comment-delete dispatcher (#1402 — RemoveComment zombie)'
 
         await page.goto(ADMIN_BANS_PROTESTS_ROUTE);
 
-        // Auto-accept the window.confirm prompt the dispatcher
-        // raises before firing the API.
-        page.once('dialog', async (dialog) => {
-            expect(dialog.type()).toBe('confirm');
-            expect(dialog.message()).toMatch(/delete/i);
-            await dialog.accept();
-        });
-
         // Inject a synthetic trigger anywhere on the page. The
         // dispatcher is a document-level delegate, so the position
         // is irrelevant.
@@ -122,6 +114,8 @@ test.describe('flow: comment-delete dispatcher (#1402 — RemoveComment zombie)'
         });
 
         await page.locator('[data-testid="synth-delcomlink"]').click();
+        await expect(page.locator('[data-testid="comment-delete-dialog"]')).toBeVisible();
+        await page.locator('[data-testid="comment-delete-submit"]').click();
 
         // The API call must have landed with the values from the
         // data attributes.
@@ -151,11 +145,6 @@ test.describe('flow: comment-delete dispatcher (#1402 — RemoveComment zombie)'
 
         await page.goto(ADMIN_BANS_PROTESTS_ROUTE);
 
-        // Dismiss the prompt.
-        page.once('dialog', async (dialog) => {
-            await dialog.dismiss();
-        });
-
         await page.evaluate(() => {
             const a = document.createElement('a');
             a.setAttribute('href', '#');
@@ -169,14 +158,11 @@ test.describe('flow: comment-delete dispatcher (#1402 — RemoveComment zombie)'
         });
 
         await page.locator('[data-testid="synth-delcomlink-cancel"]').click();
+        await expect(page.locator('[data-testid="comment-delete-dialog"]')).toBeVisible();
+        await page.locator('[data-testid="comment-delete-cancel"]').click();
 
-        // The cancelled-confirm path returns synchronously from the
-        // dispatcher (window.confirm → false → return without
-        // touching the API). Playwright's click() awaits the click
-        // event's handlers, so by the time the awaited click resolves
-        // the dispatcher has already early-returned. No settle timer
-        // needed (AGENTS.md "Playwright E2E specifics" flags
-        // `waitForTimeout` for negative assertions as an anti-pattern).
+        // Cancel closes the dialog without touching the API.
+        await expect(page.locator('[data-testid="comment-delete-dialog"]')).toBeHidden();
         expect(apiCalls, 'cancelled confirm must NOT call the API').toBe(0);
     });
 
diff --git a/web/tests/e2e/specs/flows/comms-affordances.spec.ts b/web/tests/e2e/specs/flows/comms-affordances.spec.ts
index 7f5e6ceb7..7591389a5 100644
--- a/web/tests/e2e/specs/flows/comms-affordances.spec.ts
+++ b/web/tests/e2e/specs/flows/comms-affordances.spec.ts
@@ -6,10 +6,12 @@
  * ------------------
  *
  *  - **ADM-5 (P1)** — Edit / Unmute / Remove buttons on active comm
- *    rows render *visibly by default* (not hover-only). The pre-fix
- *    `.row-actions { opacity: 0 }` rule was removed from `theme.css`
- *    in this slice; the assertions below treat "visible without
- *    hover" as a contract by reading `getComputedStyle(...).opacity`.
+ *    rows render *visibly by default* (not hover-only). Labels are
+ *    icon-only via `data-tooltip` + `aria-label` (admins-list
+ *    density contract). The pre-fix `.row-actions { opacity: 0 }`
+ *    rule was removed from `theme.css` in this slice; the
+ *    assertions below treat "visible without hover" as a contract
+ *    by reading `getComputedStyle(...).opacity`.
  *  - **ADM-6 (P2)** — Lifting an active block updates the row
  *    *in-place* (no full reload): the wrapper's `data-state` flips
  *    to `unmuted`, the status pill swaps `pill--active` →
@@ -21,10 +23,10 @@
  *    `display:none` below 769px and the `.ban-cards` container
  *    takes over per `theme.css`'s responsive block).
  *  - Remove is a destructive action that goes through
- *    `Actions.CommsDelete` (slice introduces it), prompts a native
- *    `confirm()`, and on accept removes both the desktop `<tr>` and
- *    the mobile `<div>` mirrors of the row + decrements the visible
- *    count.
+ *    `Actions.CommsDelete` (slice introduces it), prompts a styled
+ *    `#comms-delete-dialog`, and on accept removes both the desktop
+ *    `<tr>` and the mobile `<div>` mirrors of the row + decrements
+ *    the visible count.
  *
  * Project gating
  * --------------
@@ -172,12 +174,13 @@ test.describe('flow: comms list affordances (#1207 ADM-5/ADM-6)', () => {
         await expect(editBtn).toBeVisible();
         await expect(unmuteBtn).toBeVisible();
         await expect(deleteBtn).toBeVisible();
-        // The visible label is part of the affordance — pre-fix
-        // these were icon-only links. Locking the text in catches
-        // a regression that drops the `<span>` while keeping the
-        // testid.
-        await expect(unmuteBtn).toContainText(/ungag|unmute|lift/i);
-        await expect(deleteBtn).toContainText(/remove/i);
+        // Icon-only row actions: labels live on data-tooltip +
+        // aria-label (admins-list contract), not visible text.
+        await expect(editBtn).toHaveAttribute('data-tooltip', 'Edit');
+        await expect(unmuteBtn).toHaveAttribute('data-tooltip', /^(Ungag|Unmute|Lift block)$/);
+        await expect(unmuteBtn).toHaveAttribute('aria-label', /ungag|unmute|lift/i);
+        await expect(deleteBtn).toHaveAttribute('data-tooltip', 'Remove');
+        await expect(deleteBtn).toHaveAttribute('aria-label', /remove/i);
 
         // ---- ADM-6: click Unmute → confirm modal → in-place flip + toast -
         // #1301: the Unmute button now opens
@@ -215,7 +218,8 @@ test.describe('flow: comms list affordances (#1207 ADM-5/ADM-6)', () => {
         await expect(row.locator('[data-testid="row-action-unmute"]')).toHaveCount(0);
         const reapply = row.locator('[data-testid="row-action-reapply"]');
         await expect(reapply).toBeVisible();
-        await expect(reapply).toContainText(/re-apply/i);
+        await expect(reapply).toHaveAttribute('data-tooltip', 'Re-apply');
+        await expect(reapply).toHaveAttribute('aria-label', /re-apply/i);
         // The Re-apply anchor goes through the existing
         // `comms.prepare_reblock` flow at `?p=admin&c=comms&rebanid=<bid>`.
         await expect(reapply).toHaveAttribute('href', /[?&]rebanid=\d+\b/);
@@ -323,12 +327,11 @@ test.describe('flow: comms list affordances (#1207 ADM-5/ADM-6)', () => {
             .textContent();
         const before = Number((countBefore || '').replace(/[^0-9]/g, ''));
 
-        // The inline JS prompts `window.confirm` before issuing the
-        // destructive call. Playwright dismisses dialogs by default;
-        // wire an accept handler so the click resolves the API path.
-        page.once('dialog', (d) => d.accept());
-
+        // The inline JS opens `#comms-delete-dialog` before issuing
+        // the destructive call. Confirm via the styled submit button.
         await row.locator('[data-testid="row-action-delete"]').click();
+        await expect(page.locator('[data-testid="comms-delete-dialog"]')).toBeVisible();
+        await page.locator('[data-testid="comms-delete-submit"]').click();
 
         // Row is removed from the DOM; the matching `comm-card`
         // mirror is removed too (the JS targets both via
diff --git a/web/tests/integration/BanlistCommentsVisibilityTest.php b/web/tests/integration/BanlistCommentsVisibilityTest.php
index 1eb0bf267..89718f914 100644
--- a/web/tests/integration/BanlistCommentsVisibilityTest.php
+++ b/web/tests/integration/BanlistCommentsVisibilityTest.php
@@ -110,6 +110,16 @@ public function testBanlistAdminSeesInlineDisclosureOnCommentedRow(): void
             $html,
             'the disclosure summary doubles as the count chip / clickable affordance',
         );
+        $this->assertStringContainsString(
+            'ban-player-cell__head',
+            $html,
+            'comment chip must share the player-name head row (collapsed height stays one line)',
+        );
+        $this->assertStringNotContainsString(
+            'ban-comments-inline__label',
+            $html,
+            'summary is icon+count only; "comment(s)" text lives in title/aria-label',
+        );
         $this->assertStringContainsString(
             'data-bid="' . $this->banWithCommentsBid . '"',
             $html,
@@ -429,6 +439,16 @@ public function testCommslistAdminSeesInlineDisclosureOnCommentedRow(): void
             $html,
             'the disclosure summary doubles as the count chip / clickable affordance',
         );
+        $this->assertStringContainsString(
+            'ban-player-cell__head',
+            $html,
+            'comment chip must share the player-name head row (collapsed height stays one line)',
+        );
+        $this->assertStringNotContainsString(
+            'ban-comments-inline__label',
+            $html,
+            'summary is icon+count only; "comment(s)" text lives in title/aria-label',
+        );
         $this->assertStringContainsString(
             'data-cid="' . $this->commWithCommentsCid . '"',
             $html,
diff --git a/web/tests/integration/PublicBanListRegressionTest.php b/web/tests/integration/PublicBanListRegressionTest.php
index 19350aad2..68060cb85 100644
--- a/web/tests/integration/PublicBanListRegressionTest.php
+++ b/web/tests/integration/PublicBanListRegressionTest.php
@@ -332,6 +332,33 @@ public function testBanlistRowActionsUseLucideIconsNotEntityGlyphs(): void
             );
         }
 
+        // Density chrome: icon-only buttons carry btn--icon +
+        // data-tooltip (admins-list contract). Visible text labels
+        // after the Lucide icon are gone. Lookaheads keep the
+        // assertion order-independent across class / testid / tooltip.
+        $densityExpectations = [
+            'row-action-edit'       => 'Edit',
+            'row-action-reapply'    => 'Re-apply',
+            'row-action-copy-steam' => 'Copy SteamID',
+        ];
+        foreach ($densityExpectations as $testid => $tooltip) {
+            $this->assertMatchesRegularExpression(
+                '#<(?:a|button)\b(?=[^>]*\bbtn--icon\b)(?=[^>]*data-testid="' . preg_quote($testid, '#') . '")(?=[^>]*data-tooltip="' . preg_quote($tooltip, '#') . '")[^>]*>#',
+                $html,
+                $testid . ' must be icon-only (btn--icon) with data-tooltip="' . $tooltip . '".',
+            );
+        }
+        $this->assertStringContainsString(
+            'row-actions row-actions--icons',
+            $html,
+            'Banlist row actions must use the row-actions--icons density wrapper.',
+        );
+        $this->assertMatchesRegularExpression(
+            '#<table\b[^>]*\btable--compact\b#',
+            $html,
+            'Banlist desktop table must use table--compact for dense row height.',
+        );
+
         // The four bare entity glyphs the v2.0 shape used as
         // affordance icons. None of them should appear inside the
         // rendered row-actions cell — the swap to Lucide is total.
diff --git a/web/themes/default/box_admin_bans_search.tpl b/web/themes/default/box_admin_bans_search.tpl
index 40ed0e6d4..3decfeebf 100644
--- a/web/themes/default/box_admin_bans_search.tpl
+++ b/web/themes/default/box_admin_bans_search.tpl
@@ -16,7 +16,9 @@
     page.banlist.php?advSearch=…&advType=… continues to parse the
     same `$_GET` shape):
         advType=name           advSearch=<text>           (nickname)
-        advType=steam|steamid  advSearch=<text>           (partial vs exact)
+        advType=steam|steamid  advSearch=<text>           (always partial / LIKE;
+                                                          steamid kept for legacy
+                                                          exact-match URLs)
         advType=ip             advSearch=<text>           (gated by !hideplayerips)
         advType=reason         advSearch=<text>
         advType=date           advSearch="<dd>,<mm>,<yyyy>"
@@ -51,8 +53,7 @@
     Testability hooks (per #1123 issue body, "search-<scope>-<…>"):
         data-testid="search-bans-form"           outer form
         data-testid="search-bans-name"           nickname <input>
-        data-testid="search-bans-steamid"        SteamID <input>
-        data-testid="search-bans-steam-match"    exact / partial match
+        data-testid="search-bans-steamid"        SteamID <input> (always partial)
         data-testid="search-bans-ip"             IP <input>     (gated)
         data-testid="search-bans-reason"         reason <input>
         data-testid="search-bans-date-day"       date triple, …-month, …-year
@@ -101,27 +102,17 @@
 
         <div class="grid gap-3" style="grid-template-columns:10rem 1fr auto;align-items:end">
             <label class="label" for="search-bans-steamid" style="grid-column:1;align-self:end">Steam ID</label>
-            <div class="flex gap-2" style="flex-wrap:wrap">
-                <input class="input font-mono"
-                       id="search-bans-steamid"
-                       type="text"
-                       placeholder="STEAM_0:0:1234 or [U:1:1234]&hellip;"
-                       data-testid="search-bans-steamid"
-                       style="flex:1;min-width:14rem"
-                       autocomplete="off">
-                <select class="select"
-                        id="search-bans-steam-match"
-                        data-testid="search-bans-steam-match"
-                        style="width:9rem">
-                    <option value="0" selected>Exact match</option>
-                    <option value="1">Partial match</option>
-                </select>
-            </div>
+            <input class="input font-mono"
+                   id="search-bans-steamid"
+                   type="text"
+                   placeholder="Substring match against Steam ID&hellip;"
+                   data-testid="search-bans-steamid"
+                   autocomplete="off">
             <button type="submit"
                     class="btn btn--secondary btn--sm"
                     data-testid="search-bans-submit-steamid"
-                    data-search-key=""
-                    data-search-compose="steam">
+                    data-search-key="steam"
+                    data-search-from="search-bans-steamid">
                 <i data-lucide="search" style="width:14px;height:14px"></i> Search
             </button>
         </div>
@@ -412,13 +403,6 @@
      */
     function readPair(btn) {
         var compose = btn.getAttribute('data-search-compose');
-        if (compose === 'steam') {
-            var sid = document.getElementById('search-bans-steamid');
-            var match = document.getElementById('search-bans-steam-match');
-            var sval = (sid instanceof HTMLInputElement) ? sid.value.trim() : '';
-            var mval = (match instanceof HTMLSelectElement) ? match.value : '0';
-            return { key: (mval === '1' ? 'steam' : 'steamid'), value: sval };
-        }
         if (compose === 'date') {
             var keys = ['day', 'month', 'year'];
             var parts = keys.map(function (k) {
diff --git a/web/themes/default/box_admin_comms_search.tpl b/web/themes/default/box_admin_comms_search.tpl
index 5a3dfd6e8..962bfe56f 100644
--- a/web/themes/default/box_admin_comms_search.tpl
+++ b/web/themes/default/box_admin_comms_search.tpl
@@ -16,7 +16,9 @@
     page.commslist.php?advSearch=…&advType=… continues to parse the
     same `$_GET` shape):
         advType=name           advSearch=<text>            (nickname)
-        advType=steam|steamid  advSearch=<text>            (partial vs exact)
+        advType=steam|steamid  advSearch=<text>            (always partial / LIKE;
+                                                           steamid kept for legacy
+                                                           exact-match URLs)
         advType=reason         advSearch=<text>
         advType=date           advSearch="<dd>,<mm>,<yyyy>"
         advType=length         advSearch="<op>,<minutes>"  op ∈ e|h|l|eh|el
@@ -49,8 +51,7 @@
     Testability hooks (per #1123 issue body, "search-<scope>-<…>"):
         data-testid="search-comms-form"           outer form
         data-testid="search-comms-name"           nickname <input>
-        data-testid="search-comms-steamid"        SteamID <input>
-        data-testid="search-comms-steam-match"    exact / partial match
+        data-testid="search-comms-steamid"        SteamID <input> (always partial)
         data-testid="search-comms-reason"         reason <input>
         data-testid="search-comms-date-day"       date triple, …-month, …-year
         data-testid="search-comms-length-op"      length comparator
@@ -98,27 +99,17 @@
 
         <div class="grid gap-3" style="grid-template-columns:10rem 1fr auto;align-items:end">
             <label class="label" for="search-comms-steamid" style="grid-column:1;align-self:end">Steam ID</label>
-            <div class="flex gap-2" style="flex-wrap:wrap">
-                <input class="input font-mono"
-                       id="search-comms-steamid"
-                       type="text"
-                       placeholder="STEAM_0:0:1234 or [U:1:1234]&hellip;"
-                       data-testid="search-comms-steamid"
-                       style="flex:1;min-width:14rem"
-                       autocomplete="off">
-                <select class="select"
-                        id="search-comms-steam-match"
-                        data-testid="search-comms-steam-match"
-                        style="width:9rem">
-                    <option value="0" selected>Exact match</option>
-                    <option value="1">Partial match</option>
-                </select>
-            </div>
+            <input class="input font-mono"
+                   id="search-comms-steamid"
+                   type="text"
+                   placeholder="Substring match against Steam ID&hellip;"
+                   data-testid="search-comms-steamid"
+                   autocomplete="off">
             <button type="submit"
                     class="btn btn--secondary btn--sm"
                     data-testid="search-comms-submit-steamid"
-                    data-search-key=""
-                    data-search-compose="steam">
+                    data-search-key="steam"
+                    data-search-from="search-comms-steamid">
                 <i data-lucide="search" style="width:14px;height:14px"></i> Search
             </button>
         </div>
@@ -392,13 +383,6 @@
      */
     function readPair(btn) {
         var compose = btn.getAttribute('data-search-compose');
-        if (compose === 'steam') {
-            var sid = document.getElementById('search-comms-steamid');
-            var match = document.getElementById('search-comms-steam-match');
-            var sval = (sid instanceof HTMLInputElement) ? sid.value.trim() : '';
-            var mval = (match instanceof HTMLSelectElement) ? match.value : '0';
-            return { key: (mval === '1' ? 'steam' : 'steamid'), value: sval };
-        }
         if (compose === 'date') {
             var keys = ['day', 'month', 'year'];
             var parts = keys.map(function (k) {
diff --git a/web/themes/default/css/theme.css b/web/themes/default/css/theme.css
index 1db1d1af4..e4ccefca1 100644
--- a/web/themes/default/css/theme.css
+++ b/web/themes/default/css/theme.css
@@ -1203,14 +1203,37 @@ html.dark .pill--online    { color: #6ee7b7; }
    for the markup and AGENTS.md "Per-ban comments visibility"
    for the cross-surface contract.
 
-   The summary is laid out inline-flex so it sits as a chip-shaped
-   badge to the right of the player name (mirrors the visual weight
-   of the pre-fix `<span>[N]</span>` so the table column geometry
-   stays the same when the disclosure is collapsed). When opened the
-   <ul> body block-flows below the summary inside the same <td>; the
-   row grows to accommodate. No row-spanning trickery / no extra
-   <tr> / no width gymnastics — native <details> handles the toggle. */
-.ban-comments-inline { display: inline-block; margin-top: 0.125rem; }
+   Collapsed: the chip sits on the SAME line as the player name
+   (`.ban-player-cell__head`) so comment presence does not add a
+   second line of row height. The name truncates with ellipsis so
+   the icon+count never wrap alone. Opened: the details flexes to
+   full width below the name (`flex-basis: 100%`) and the <ul> body
+   grows the row — intentional for reading. No extra <tr> / no new
+   column. */
+.ban-player-cell__head {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  column-gap: 0.25rem;
+  row-gap: 0.25rem;
+  min-width: 0;
+}
+.ban-player-cell__name {
+  flex: 1 1 0;
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.ban-comments-inline {
+  display: block;
+  flex: 0 0 auto;
+  margin: 0;
+  max-width: 100%;
+}
+.ban-comments-inline[open] {
+  flex: 1 1 100%;
+}
 .ban-comments-inline__summary {
   display: inline-flex;
   align-items: center;
@@ -1227,6 +1250,7 @@ html.dark .pill--online    { color: #6ee7b7; }
   user-select: none;
   border: 1px solid transparent;
   transition: background-color .15s, color .15s, border-color .15s;
+  flex-shrink: 0;
 }
 .ban-comments-inline__summary::-webkit-details-marker { display: none; }
 .ban-comments-inline__summary:hover {
@@ -1244,7 +1268,6 @@ html.dark .pill--online    { color: #6ee7b7; }
   color: var(--text);
   border-color: var(--border);
 }
-.ban-comments-inline__label { color: inherit; }
 .ban-comments-inline__list {
   display: flex;
   flex-direction: column;
@@ -1356,8 +1379,9 @@ html.dark .table thead tr { background: rgb(255 255 255 / 0.02); }
 .table tbody tr:hover { background: var(--bg-muted); }
 .table.table--clickable-rows tbody tr { cursor: pointer; }
 .table td { padding: 0.75rem; vertical-align: middle; }
-/* Dense row height for checkbox / permission grids where the default
-   0.75rem cell padding leaves too much vertical whitespace. */
+/* Dense row height for checkbox / permission grids and public
+   banlist / commslist desktop tables where the default 0.75rem
+   cell padding leaves too much vertical whitespace. */
 .table.table--compact {
   font-size: var(--fs-sm);
   margin: 0;
@@ -1374,6 +1398,12 @@ html.dark .table thead tr { background: rgb(255 255 255 / 0.02); }
 .table.table--compact td:first-child { padding-left: 0.75rem; }
 .table.table--compact th:last-child,
 .table.table--compact td:last-child { padding-right: 0.75rem; }
+/* Icon actions in dense list rows: default btn--sm / btn--icon
+   (2rem / 2.25rem) would dominate the compacted cell height. */
+.table.table--compact .row-actions--icons .btn--icon.btn--sm {
+  width: 1.75rem;
+  height: 1.75rem;
+}
 
 /* Edit-admin Permissions: Web + Server cards side-by-side when wide. */
 .edit-perms-columns {
diff --git a/web/themes/default/page_bans.tpl b/web/themes/default/page_bans.tpl
index d9392a151..26eb7abb8 100644
--- a/web/themes/default/page_bans.tpl
+++ b/web/themes/default/page_bans.tpl
@@ -70,8 +70,14 @@
     </div>
     <div class="flex gap-2 items-center">
       {if $can_export}
-      <a class="btn btn--secondary btn--sm" href="exportbans.php?type=steam" title="Export permanent SteamID bans">Export Steam</a>
-      <a class="btn btn--secondary btn--sm" href="exportbans.php?type=ip" title="Export permanent IP bans">Export IP</a>
+      <a class="btn btn--secondary btn--sm" href="exportbans.php?type=steam" title="Export permanent SteamID bans" data-testid="banlist-export-steam">
+        <i data-lucide="download" style="width:14px;height:14px"></i>
+        Export Steam
+      </a>
+      <a class="btn btn--secondary btn--sm" href="exportbans.php?type=ip" title="Export permanent IP bans" data-testid="banlist-export-ip">
+        <i data-lucide="download" style="width:14px;height:14px"></i>
+        Export IP
+      </a>
       {/if}
       {* #1230: aria-pressed mirrors whether inactive bans are
          currently being hidden ($hidetext == 'Show' means the
@@ -100,10 +106,16 @@
          role="button"
          aria-pressed="{if $hidetext == 'Show'}true{else}false{/if}"
          href="index.php?p=banlist&hideinactive={if $hidetext == 'Hide'}true{else}false{/if}{$searchlink}"
-         data-testid="toggle-hide-inactive">{$hidetext} inactive</a>
+         data-testid="toggle-hide-inactive">
+        <i data-lucide="{if $hidetext == 'Show'}eye{else}eye-off{/if}" style="width:14px;height:14px"></i>
+        {$hidetext} inactive
+      </a>
       {/if}
       {has_access flag=$smarty.const.ADMIN_ADD_BAN}
-      <a class="btn btn--primary btn--sm" href="index.php?p=admin&c=bans">Add ban</a>
+      <a class="btn btn--primary btn--sm" href="index.php?p=admin&c=bans" data-testid="banlist-add-button">
+        <i data-lucide="plus" style="width:14px;height:14px"></i>
+        Add ban
+      </a>
       {/has_access}
     </div>
   </div>
@@ -128,9 +140,15 @@
     <input type="hidden" name="p" value="banlist">
     <div class="flex gap-3" style="flex-wrap:wrap">
       <div style="flex:1;min-width:14rem;max-width:24rem;position:relative">
-        <input class="input" type="search" name="searchText" data-testid="bans-search"
-          value="{$filters.search|escape}"
-          placeholder="Player, SteamID, or IP&hellip;" aria-label="Search bans">
+        <i data-lucide="search"
+           style="position:absolute;left:0.625rem;top:50%;transform:translateY(-50%);color:var(--text-faint);width:14px;height:14px"></i>
+        <input class="input input--with-icon"
+               type="search"
+               name="searchText"
+               data-testid="bans-search"
+               value="{$filters.search|escape}"
+               placeholder="Player, SteamID, or IP&hellip;"
+               aria-label="Search bans">
       </div>
       <select class="select" name="server" style="width:auto;min-width:11rem" data-testid="bans-server-filter" aria-label="Filter by server">
         <option value="">All servers</option>
@@ -271,7 +289,7 @@
        waste a scroll on a 3-line wrapped date. *}
   <div class="card" style="overflow:hidden">
     <div class="table-scroll">
-    <table class="table">
+    <table class="table table--compact">
       <thead>
         {* Column tier classes (`.col-tier-2` / `.col-tier-3`) are paired
            rules in `theme.css` next to `.table-scroll`. Tier-2 (Server,
@@ -302,87 +320,69 @@
         {foreach from=$ban_list item=ban}
         <tr class="ban-row ban-row--{$ban.state}" data-state="{$ban.state}" data-id="{$ban.bid}" data-testid="ban-row">
           <td>
-            <div class="flex items-center gap-3" style="min-width:0">
+            {* items-start: keep the avatar top-aligned with the
+               player name when the comment disclosure expands
+               (items-center would pin it to the vertical middle
+               of the tall cell). *}
+            <div class="flex items-start gap-3" style="min-width:0">
               {* Inlined avatar markup; the handoff partial is
                  design-only and Phase B can't add files under
                  themes/sbpp2026/{css,js,core}. Initials + hue come
                  from $ban.avatar_initials / $ban.avatar_hue,
                  precomputed in page.banlist.php so the template
                  doesn't depend on Smarty's `%` operator parsing. *}
-              <span class="avatar" style="width:28px;height:28px;background:hsl({$ban.avatar_hue} 55% 45%);font-size:10px" aria-hidden="true">{$ban.avatar_initials|escape}</span>
-              {* No `onclick="event.stopPropagation()"` here even though
-                 the row's action buttons carry it. theme.js wires the
-                 drawer via a delegated `document.addEventListener('click',
-                 …)` on `[data-drawer-href]`; stopping bubble at the
-                 anchor would silently fall back to native href
-                 navigation and bypass the drawer entirely (#1124 Slice 6
-                 found this — tests asserted `[data-drawer-open=true]`
-                 after a row click, the page just navigated to the legacy
-                 `?id=N` href instead). The mobile `.ban-cards` branch
-                 below already follows this no-stopPropagation shape. *}
-              <a class="font-medium truncate" href="?p=banlist&amp;id={$ban.bid}" data-drawer-href="?p=banlist&amp;c=details&amp;id={$ban.bid}" data-testid="drawer-trigger">{if empty($ban.name)}<i class="text-faint">no nickname</i>{else}{$ban.name|escape}{/if}</a>
+              <span class="avatar" style="width:22px;height:22px;background:hsl({$ban.avatar_hue} 55% 45%);font-size:9px" aria-hidden="true">{$ban.avatar_initials|escape}</span>
+              {* Player name + comment chip share one line
+                 (`.ban-player-cell__head`) so comment presence does
+                 not add a second line of row height. No
+                 `onclick="event.stopPropagation()"` on the name
+                 anchor — theme.js wires the drawer via a delegated
+                 click on `[data-drawer-href]`; stopping bubble would
+                 fall through to native href navigation (#1124 Slice 6). *}
+              <div class="ban-player-cell__head" style="flex:1;min-width:0">
+                <a class="font-medium ban-player-cell__name" href="?p=banlist&amp;id={$ban.bid}" data-drawer-href="?p=banlist&amp;c=details&amp;id={$ban.bid}" data-testid="drawer-trigger">{if empty($ban.name)}<i class="text-faint">no nickname</i>{else}{$ban.name|escape}{/if}</a>
+                {* #BANLIST-COMMENTS: native <details> disclosure. Summary
+                   is icon+count only (GitHub/Linear shape); body lists
+                   comments when opened. Drawer Overview still mirrors
+                   the same data via api_bans_detail. *}
+                {if $view_comments && $ban.commentdata != "None" && $ban.commentdata|@count > 0}
+                <details class="ban-comments-inline"
+                         data-testid="ban-comments-inline"
+                         data-bid="{$ban.bid}">
+                  <summary class="ban-comments-inline__summary"
+                           data-testid="ban-comments-toggle"
+                           title="{$ban.commentdata|@count} comment{if $ban.commentdata|@count != 1}s{/if}"
+                           aria-label="{$ban.commentdata|@count} comment{if $ban.commentdata|@count != 1}s{/if}">
+                    <i data-lucide="message-square-text" style="width:11px;height:11px" aria-hidden="true"></i>
+                    <span class="tabular-nums">{$ban.commentdata|@count}</span>
+                  </summary>
+                  <ul class="ban-comments-inline__list" data-testid="ban-comments-list">
+                    {foreach from=$ban.commentdata item=com}
+                    <li class="ban-comments-inline__item" data-testid="ban-comment-item">
+                      <div class="ban-comments-inline__meta">
+                        {* #1500: comment author is an admin username; hide it for public viewers when banlist.hideadminname is on (parity with the unban-meta gate below). *}
+                        {if $hideadminname}
+                          <i class="text-faint">Hidden</i>
+                        {elseif !empty($com.comname)}
+                          <strong>{$com.comname|escape}</strong>
+                        {else}
+                          <i class="text-faint">deleted admin</i>
+                        {/if}
+                        <span class="text-faint">&middot;</span>
+                        <span class="text-xs text-faint tabular-nums">{$com.added}</span>
+                      </div>
+                      {* nofilter: $com.commenttxt is server-built HTML produced by encodePreservingBr (htmlspecialchars per text segment, only `<br/>` survives) plus a URL-wrap regex that wraps already-escaped URLs in `<a>` tags — see page.banlist.php $commentres loop. Same provenance + safety as the existing comment-edit-mode block at the top of this template. *}
+                      <div class="ban-comments-inline__text" data-testid="ban-comment-text">{$com.commenttxt nofilter}</div>
+                      {if !empty($com.edittime)}
+                      <div class="ban-comments-inline__edit text-xs text-faint">last edit {$com.edittime} by {if $hideadminname}<i class="text-faint">Hidden</i>{elseif !empty($com.editname)}{$com.editname|escape}{else}<i>deleted admin</i>{/if}</div>
+                      {/if}
+                    </li>
+                    {/foreach}
+                  </ul>
+                </details>
+                {/if}
+              </div>
             </div>
-            {* #BANLIST-COMMENTS: inline <details> disclosure restoring
-               the per-row comment visibility v1.x shipped (the
-               mooaccordion sliding-panel surface that was deleted with
-               sourcebans.js at #1123 D1). The v2.0 redesign moved the
-               comments off the page and into the right-side drawer
-               (Overview pane → "Comments" section), but the page-level
-               affordance was a silent <span>[N]</span> with no click
-               handler, so users reading the row had no on-page way to
-               see *what* the comments said and no visual cue that the
-               drawer was their new home. The disclosure restores
-               on-page comment text via native <details> semantics: the
-               <summary> is the clickable count badge, the body lists
-               each comment inline so readers don't have to leave the
-               row. The drawer's comments section in `theme.js`
-               `renderOverviewPane` continues to render the SAME data
-               via `api_bans_detail` for users who open the player
-               drawer (clicking the player-name anchor above) — the two
-               surfaces share the gating contract
-               (`Config::getBool('config.enablepubliccomments') ||
-               $userbank->is_admin()`).
-
-               The disclosure stays default-collapsed so a banlist with
-               comment-heavy rows doesn't blow out the table height on
-               first paint; the count is visible inside the summary so
-               admins can scan the list at a glance. *}
-            {if $view_comments && $ban.commentdata != "None" && $ban.commentdata|@count > 0}
-            <details class="ban-comments-inline"
-                     data-testid="ban-comments-inline"
-                     data-bid="{$ban.bid}">
-              <summary class="ban-comments-inline__summary"
-                       data-testid="ban-comments-toggle"
-                       title="{$ban.commentdata|@count} comment{if $ban.commentdata|@count != 1}s{/if} on this ban">
-                <i data-lucide="message-square-text" style="width:11px;height:11px" aria-hidden="true"></i>
-                <span class="tabular-nums">{$ban.commentdata|@count}</span>
-                <span class="ban-comments-inline__label">comment{if $ban.commentdata|@count != 1}s{/if}</span>
-              </summary>
-              <ul class="ban-comments-inline__list" data-testid="ban-comments-list">
-                {foreach from=$ban.commentdata item=com}
-                <li class="ban-comments-inline__item" data-testid="ban-comment-item">
-                  <div class="ban-comments-inline__meta">
-                    {* #1500: comment author is an admin username; hide it for public viewers when banlist.hideadminname is on (parity with the unban-meta gate below). *}
-                    {if $hideadminname}
-                      <i class="text-faint">Hidden</i>
-                    {elseif !empty($com.comname)}
-                      <strong>{$com.comname|escape}</strong>
-                    {else}
-                      <i class="text-faint">deleted admin</i>
-                    {/if}
-                    <span class="text-faint">&middot;</span>
-                    <span class="text-xs text-faint tabular-nums">{$com.added}</span>
-                  </div>
-                  {* nofilter: $com.commenttxt is server-built HTML produced by encodePreservingBr (htmlspecialchars per text segment, only `<br/>` survives) plus a URL-wrap regex that wraps already-escaped URLs in `<a>` tags — see page.banlist.php $commentres loop. Same provenance + safety as the existing comment-edit-mode block at the top of this template. *}
-                  <div class="ban-comments-inline__text" data-testid="ban-comment-text">{$com.commenttxt nofilter}</div>
-                  {if !empty($com.edittime)}
-                  <div class="ban-comments-inline__edit text-xs text-faint">last edit {$com.edittime} by {if $hideadminname}<i class="text-faint">Hidden</i>{elseif !empty($com.editname)}{$com.editname|escape}{else}<i>deleted admin</i>{/if}</div>
-                  {/if}
-                </li>
-                {/foreach}
-              </ul>
-            </details>
-            {/if}
           </td>
           <td class="font-mono text-xs text-muted">
             {if empty($ban.steam)}
@@ -448,25 +448,19 @@
             <span class="pill pill--{$ban.state}">{$_pill_label|escape}</span>
           </td>
           <td class="col-actions">
-            {* #1207 ADM-5 + (this PR): banlist row affordances now mirror
-               the commslist row chrome — Lucide icon + visible text label
-               inside `.btn--ghost` / `.btn--secondary btn--sm` pills
-               (`page_comms.tpl` lines 258-311 is the canonical reference).
-               The bare HTML-entity glyphs the v2.0 cutover shipped
-               (`&#9998;` ✎ / `&#10003;` ✓ / `&#8634;` ↺ / `&#128203;` 📋)
-               are gone — they read as broken icons / a different app
-               next to commslist's affordance set, and the icon-only
-               buttons gave no SR / hover affordance. Edit / Unban / Re-apply
-               / Copy / Remove are gated identically to the v2.0 shape;
-               only the chrome moved. *}
-            <div class="row-actions">
+            {* Icon-only row actions matching `page_admin_admins_list.tpl`:
+               Lucide icon + `data-tooltip` + `aria-label` inside
+               `.row-actions--icons`. Keep `data-testid` / `data-action`
+               / `data-fallback-href` / `data-copy` wiring unchanged. *}
+            <div class="row-actions row-actions--icons">
               {if $view_bans}
                 {if $ban.can_edit_ban && $ban.state != 'unbanned'}
-                <a class="btn btn--ghost btn--sm" data-testid="row-action-edit"
+                <a class="btn btn--ghost btn--icon btn--sm" data-testid="row-action-edit"
                    href="index.php?p=admin&amp;c=bans&amp;o=edit&amp;id={$ban.bid}&amp;key={$admin_postkey|escape}"
+                   data-tooltip="Edit"
+                   aria-label="Edit ban for {$ban.name|escape}"
                    onclick="event.stopPropagation()">
-                    <i data-lucide="pencil" style="width:13px;height:13px"></i>
-                    Edit
+                    <i data-lucide="pencil" style="width:14px;height:14px"></i>
                 </a>
                 {/if}
                 {if $ban.can_unban && $ban.state != 'unbanned' && $ban.state != 'expired'}
@@ -489,83 +483,60 @@
                    bubbled click has nothing to confuse on the drawer
                    side. *}
                 <button type="button"
-                        class="btn btn--secondary btn--sm"
+                        class="btn btn--secondary btn--icon btn--sm"
                         data-testid="row-action-unban"
                         data-action="bans-unban"
                         data-bid="{$ban.bid}"
                         data-name="{$ban.name|escape}"
-                        data-fallback-href="index.php?p=banlist&amp;a=unban&amp;id={$ban.bid}&amp;key={$admin_postkey|escape}">
-                    <i data-lucide="check" style="width:13px;height:13px"></i>
-                    Unban
+                        data-fallback-href="index.php?p=banlist&amp;a=unban&amp;id={$ban.bid}&amp;key={$admin_postkey|escape}"
+                        data-tooltip="Unban"
+                        aria-label="Unban {$ban.name|escape}">
+                    <i data-lucide="check" style="width:14px;height:14px"></i>
                 </button>
                 {/if}
                 {* #1315: Re-apply affordance for expired / unbanned rows.
-                   Mirrors the commslist row's existing Re-apply anchor
-                   (`page_comms.tpl` lines 286-298 desktop, 448-454
-                   mobile). Routes to the admin add-ban form's
-                   `?rebanid=` smart-default block, which
-                   `web/api/handlers/bans.php::api_bans_prepare_reban`
-                   pre-populates with the original ban's parameters.
-                   Gated on $can_add_ban so the affordance only renders
-                   for admins who can act on it. Also gated on
-                   `!$ban.has_active_sibling` so we don't surface a
-                   button that would 4xx as `already_banned` —
-                   `page.banlist.php` flags the row when the same
-                   identity (authid for type=0, ip for type=1) has
-                   another currently-active ban. The v1.x template
-                   honoured the same gate via `$data['reban_link']`;
-                   the v2.0 rewrite (#1315) dropped it, which is the
-                   regression this restores. *}
+                   Mirrors the commslist row's existing Re-apply anchor.
+                   Routes to the admin add-ban form's `?rebanid=`
+                   smart-default block. Gated on $can_add_ban and
+                   `!$ban.has_active_sibling`. *}
                 {if $can_add_ban && ($ban.state == 'expired' || $ban.state == 'unbanned') && !$ban.has_active_sibling}
-                <a class="btn btn--secondary btn--sm" data-testid="row-action-reapply"
+                <a class="btn btn--secondary btn--icon btn--sm" data-testid="row-action-reapply"
                    href="index.php?p=admin&amp;c=bans&amp;section=add-ban&amp;rebanid={$ban.bid}&amp;key={$admin_postkey|escape}"
+                   data-tooltip="Re-apply"
+                   aria-label="Re-apply ban for {$ban.name|escape}"
                    onclick="event.stopPropagation()">
-                    <i data-lucide="rotate-ccw" style="width:13px;height:13px"></i>
-                    Re-apply
+                    <i data-lucide="rotate-ccw" style="width:14px;height:14px"></i>
                 </a>
                 {/if}
               {/if}
               {if !empty($ban.steam)}
               {* #1308: NO `onclick="event.stopPropagation()"` here. The
-                 sibling row-action <a> tags carry it as defensive copy-paste,
-                 but they survive on native href navigation regardless. This
-                 <button>'s ONLY wiring is the document-level [data-copy]
-                 click delegate in theme.js — stopPropagation kills it
-                 silently (no toast, no clipboard write, no console error).
-                 The desktop row's drawer trigger is the player-name anchor
-                 in column 1 (data-drawer-href), not a row-level delegate,
-                 so a bubbling click here has nothing to confuse. *}
-              <button class="btn btn--ghost btn--sm" type="button"
+                 document-level [data-copy] click delegate in theme.js
+                 listens on bubble; stopPropagation kills it silently. *}
+              <button class="btn btn--ghost btn--icon btn--sm" type="button"
                       data-copy="{$ban.steam|escape}"
                       data-testid="row-action-copy-steam"
-                      aria-label="Copy SteamID"
-                      title="Copy SteamID">
-                  <i data-lucide="copy" style="width:13px;height:13px"></i>
-                  Copy
+                      data-tooltip="Copy SteamID"
+                      aria-label="Copy SteamID">
+                  <i data-lucide="copy" style="width:14px;height:14px"></i>
               </button>
               {/if}
               {if $ban.can_delete_ban}
               {* Hard-delete affordance. No JSON `bans.delete` action
                  exists yet — the canonical write path is the legacy
-                 GET handler `?p=banlist&a=delete&id=…&key=…` at the
-                 top of page.banlist.php (DeleteBan-gated, RCON
-                 cleanup + DELETE FROM :prefix_bans). The `data-action`
-                 hook routes through the inline page-tail JS's
-                 `bans-delete` branch, which `confirm()`-prompts and
-                 then navigates to `data-fallback-href`. Mirror of
-                 commslist's Remove button (page_comms.tpl line 299,
-                 `comms-delete` data-action) for visual + interaction
-                 parity. *}
+                 GET handler `?p=banlist&a=delete&id=…&key=…`. The
+                 `data-action` hook routes through the inline page-tail
+                 JS's `bans-delete` branch. *}
               <button type="button"
-                      class="btn btn--ghost btn--sm"
+                      class="btn btn--ghost btn--icon btn--sm"
                       data-testid="row-action-delete"
                       data-action="bans-delete"
                       data-bid="{$ban.bid}"
                       data-name="{$ban.name|escape}"
                       data-fallback-href="index.php?p=banlist&amp;a=delete&amp;id={$ban.bid}&amp;key={$admin_postkey|escape}"
-                      style="color:var(--danger)">
-                  <i data-lucide="trash-2" style="width:13px;height:13px"></i>
-                  Remove
+                      data-tooltip="Remove"
+                      aria-label="Remove ban for {$ban.name|escape}">
+                  <i data-lucide="trash-2" style="width:14px;height:14px;color:var(--danger)"></i>
               </button>
               {/if}
             </div>
@@ -689,58 +660,60 @@
           <span class="text-faint" aria-hidden="true">&rsaquo;</span>
         </a>
         {if $view_bans || !empty($ban.steam) || $ban.can_delete_ban}
-        <div class="row-actions ban-card__actions">
+        <div class="row-actions row-actions--icons ban-card__actions">
           {if $view_bans}
             {if $ban.can_edit_ban && $ban.state != 'unbanned'}
-            <a class="btn btn--ghost btn--sm" data-testid="row-action-edit-mobile"
-               href="index.php?p=admin&amp;c=bans&amp;o=edit&amp;id={$ban.bid}&amp;key={$admin_postkey|escape}">
-                <i data-lucide="pencil" style="width:13px;height:13px"></i>
-                Edit
+            <a class="btn btn--ghost btn--icon btn--sm" data-testid="row-action-edit-mobile"
+               href="index.php?p=admin&amp;c=bans&amp;o=edit&amp;id={$ban.bid}&amp;key={$admin_postkey|escape}"
+               data-tooltip="Edit"
+               aria-label="Edit ban for {$ban.name|escape}">
+                <i data-lucide="pencil" style="width:14px;height:14px"></i>
             </a>
             {/if}
             {if $ban.can_unban && $ban.state != 'unbanned' && $ban.state != 'expired'}
             <button type="button"
-                    class="btn btn--secondary btn--sm"
+                    class="btn btn--secondary btn--icon btn--sm"
                     data-testid="row-action-unban-mobile"
                     data-action="bans-unban"
                     data-bid="{$ban.bid}"
                     data-name="{$ban.name|escape}"
-                    data-fallback-href="index.php?p=banlist&amp;a=unban&amp;id={$ban.bid}&amp;key={$admin_postkey|escape}">
-                <i data-lucide="check" style="width:13px;height:13px"></i>
-                Unban
+                    data-fallback-href="index.php?p=banlist&amp;a=unban&amp;id={$ban.bid}&amp;key={$admin_postkey|escape}"
+                    data-tooltip="Unban"
+                    aria-label="Unban {$ban.name|escape}">
+                <i data-lucide="check" style="width:14px;height:14px"></i>
             </button>
             {/if}
             {* #1315 + this PR: same `has_active_sibling` gate as the
                desktop variant — see the rationale block above. *}
             {if $can_add_ban && ($ban.state == 'expired' || $ban.state == 'unbanned') && !$ban.has_active_sibling}
-            <a class="btn btn--secondary btn--sm" data-testid="row-action-reapply-mobile"
-               href="index.php?p=admin&amp;c=bans&amp;section=add-ban&amp;rebanid={$ban.bid}&amp;key={$admin_postkey|escape}">
-                <i data-lucide="rotate-ccw" style="width:13px;height:13px"></i>
-                Re-apply
+            <a class="btn btn--secondary btn--icon btn--sm" data-testid="row-action-reapply-mobile"
+               href="index.php?p=admin&amp;c=bans&amp;section=add-ban&amp;rebanid={$ban.bid}&amp;key={$admin_postkey|escape}"
+               data-tooltip="Re-apply"
+               aria-label="Re-apply ban for {$ban.name|escape}">
+                <i data-lucide="rotate-ccw" style="width:14px;height:14px"></i>
             </a>
             {/if}
           {/if}
           {if !empty($ban.steam)}
-          <button class="btn btn--ghost btn--sm" type="button"
+          <button class="btn btn--ghost btn--icon btn--sm" type="button"
                   data-copy="{$ban.steam|escape}"
                   data-testid="row-action-copy-steam-mobile"
-                  aria-label="Copy SteamID"
-                  title="Copy SteamID">
-              <i data-lucide="copy" style="width:13px;height:13px"></i>
-              Copy
+                  data-tooltip="Copy SteamID"
+                  aria-label="Copy SteamID">
+              <i data-lucide="copy" style="width:14px;height:14px"></i>
           </button>
           {/if}
           {if $ban.can_delete_ban}
           <button type="button"
-                  class="btn btn--ghost btn--sm"
+                  class="btn btn--ghost btn--icon btn--sm"
                   data-testid="row-action-delete-mobile"
                   data-action="bans-delete"
                   data-bid="{$ban.bid}"
                   data-name="{$ban.name|escape}"
                   data-fallback-href="index.php?p=banlist&amp;a=delete&amp;id={$ban.bid}&amp;key={$admin_postkey|escape}"
-                  style="color:var(--danger)">
-              <i data-lucide="trash-2" style="width:13px;height:13px"></i>
-              Remove
+                  data-tooltip="Remove"
+                  aria-label="Remove ban for {$ban.name|escape}">
+              <i data-lucide="trash-2" style="width:14px;height:14px;color:var(--danger)"></i>
           </button>
           {/if}
           {* #BANLIST-COMMENTS mobile mirror — at-a-glance count indicator
@@ -888,6 +861,30 @@
   </form>
 </dialog>
 
+{* Confirm-only delete modal (no reason field). Hard-delete has no
+   audit-reason surface on the legacy GET path; the dialog replaces
+   the native window.confirm() so banlist row actions share one chrome
+   with Unban. *}
+<dialog id="bans-delete-dialog"
+        class="palette"
+        aria-labelledby="bans-delete-dialog-title"
+        data-testid="bans-delete-dialog"
+        hidden
+        style="max-width:32rem;width:90vw;padding:1.25rem;border-radius:0.75rem;border:1px solid var(--border)">
+  <form method="dialog" data-testid="bans-delete-form">
+    <h2 id="bans-delete-dialog-title" style="font-size:var(--fs-lg);font-weight:600;margin:0 0 0.25rem">Delete ban</h2>
+    <p class="text-sm text-muted m-0" style="margin-bottom:0.75rem">
+      Permanently delete the ban for <strong data-testid="bans-delete-target">this player</strong>? This cannot be undone.
+    </p>
+    <div class="flex gap-2 mt-4" style="justify-content:flex-end">
+      <button type="button" class="btn btn--secondary" data-testid="bans-delete-cancel" value="cancel">Cancel</button>
+      <button type="submit" class="btn btn--danger" data-testid="bans-delete-submit" value="confirm">
+        <i data-lucide="trash-2" style="width:13px;height:13px"></i> Delete ban
+      </button>
+    </div>
+  </form>
+</dialog>
+
 {* banlist.js wires both branches: the chip filter / copy buttons /
    skeleton hook on the listing branch, and the `#banlist-comment-form`
    submit -> sb.api.call(BansAddComment / BansEditComment) on the
@@ -1008,16 +1005,20 @@
     }
 
     /** @returns {HTMLDialogElement|null} */
-    function dialog() {
+    function unbanDialog() {
         return /** @type {HTMLDialogElement|null} */ (document.getElementById('bans-unban-dialog'));
     }
+    /** @returns {HTMLDialogElement|null} */
+    function deleteDialog() {
+        return /** @type {HTMLDialogElement|null} */ (document.getElementById('bans-delete-dialog'));
+    }
     /** @returns {HTMLTextAreaElement|null} */
     function reasonInput() {
         return /** @type {HTMLTextAreaElement|null} */ (document.getElementById('bans-unban-reason'));
     }
     /** @returns {HTMLElement|null} */
     function errorEl() {
-        var d = dialog();
+        var d = unbanDialog();
         return d ? /** @type {HTMLElement|null} */ (d.querySelector('[data-testid="bans-unban-error"]')) : null;
     }
 
@@ -1036,7 +1037,9 @@
     }
 
     /** @type {{bid: string, name: string, fallback: string}|null} */
-    var pending = null;
+    var pendingUnban = null;
+    /** @type {{bid: string, name: string, fallback: string}|null} */
+    var pendingDelete = null;
 
     /**
      * Open the unban dialog for the supplied row data. We use the
@@ -1045,8 +1048,8 @@
      * @param {{bid: string, name: string, fallback: string}} ctx
      */
     function openUnbanDialog(ctx) {
-        pending = ctx;
-        var d = dialog();
+        pendingUnban = ctx;
+        var d = unbanDialog();
         if (!d) {
             // The dialog markup is in the template above; if it's
             // missing the page is in an inconsistent state. Fall back
@@ -1070,23 +1073,56 @@
     }
 
     function closeUnbanDialog() {
-        var d = dialog();
+        var d = unbanDialog();
         if (!d) return;
         try { d.close(); } catch (_e) { /* not opened modally */ }
         d.setAttribute('hidden', '');
-        pending = null;
+        pendingUnban = null;
+    }
+
+    /**
+     * @param {{bid: string, name: string, fallback: string}} ctx
+     */
+    function openDeleteDialog(ctx) {
+        pendingDelete = ctx;
+        var d = deleteDialog();
+        if (!d) {
+            if (ctx.fallback) window.location.href = ctx.fallback;
+            return;
+        }
+        var target = d.querySelector('[data-testid="bans-delete-target"]');
+        if (target) target.textContent = ctx.name || ('ban #' + ctx.bid);
+        d.removeAttribute('hidden');
+        try { d.showModal(); }
+        catch (_e) { d.setAttribute('open', ''); }
+        var submitBtn = /** @type {HTMLButtonElement|null} */ (d.querySelector('[data-testid="bans-delete-submit"]'));
+        if (submitBtn) {
+            try { submitBtn.focus(); } catch (_e) { /* focus may throw if hidden */ }
+        }
+    }
+
+    function closeDeleteDialog() {
+        var d = deleteDialog();
+        if (!d) return;
+        try { d.close(); } catch (_e) { /* not opened modally */ }
+        d.setAttribute('hidden', '');
+        pendingDelete = null;
     }
 
     document.addEventListener('click', function (e) {
         var t = /** @type {Element|null} */ (e.target);
         if (!t || !t.closest) return;
 
-        // Cancel button inside the dialog.
         if (t.closest('[data-testid="bans-unban-cancel"]')) {
             e.preventDefault();
             closeUnbanDialog();
             return;
         }
+        if (t.closest('[data-testid="bans-delete-cancel"]')) {
+            e.preventDefault();
+            closeDeleteDialog();
+            return;
+        }
 
         var actionBtn = /** @type {HTMLElement|null} */ (t.closest('[data-action]'));
         if (!actionBtn) return;
@@ -1102,14 +1138,10 @@
             // No JSON `bans.delete` action exists yet — the canonical
             // write path is the legacy GET handler at the top of
             // page.banlist.php (DeleteBan-gated, RCON cleanup +
-            // hard-delete from :prefix_bans). Confirm + navigate is
-            // the simplest mirror of commslist's Remove flow without
-            // adding a new handler / snapshot / permission-matrix
-            // entry — the in-place row removal lands on the next
-            // page load.
+            // hard-delete from :prefix_bans). Confirm dialog + navigate
+            // mirrors the unban chrome without adding a new handler.
             if (!fallback) return;
-            if (!window.confirm('Permanently delete the ban for "' + name + '"? This cannot be undone.')) return;
-            window.location.href = fallback;
+            openDeleteDialog({ bid: bid, name: name, fallback: fallback });
             return;
         }
 
@@ -1129,9 +1161,20 @@
     document.addEventListener('submit', function (e) {
         var form = /** @type {Element|null} */ (e.target);
         if (!form || !(/** @type {Element} */ (form)).closest) return;
+
+        if (form.matches('[data-testid="bans-delete-form"]')) {
+            e.preventDefault();
+            if (!pendingDelete || !pendingDelete.fallback) return;
+            var delCtx = pendingDelete;
+            var delSubmit = /** @type {HTMLButtonElement|null} */ (form.querySelector('[data-testid="bans-delete-submit"]'));
+            setBusy(delSubmit, true);
+            window.location.href = delCtx.fallback;
+            return;
+        }
+
         if (!form.matches('[data-testid="bans-unban-form"]')) return;
         e.preventDefault();
-        if (!pending) return;
+        if (!pendingUnban) return;
 
         var input = reasonInput();
         var reason = input ? input.value.trim() : '';
@@ -1146,7 +1189,7 @@
         }
         clearError();
 
-        var ctx = pending;
+        var ctx = pendingUnban;
         var submitBtn = /** @type {HTMLButtonElement|null} */ (form.querySelector('[data-testid="bans-unban-submit"]'));
         setBusy(submitBtn, true);
 
@@ -1180,10 +1223,15 @@
     // so a subsequent click reopens cleanly with the next row's data.
     document.addEventListener('cancel', function (e) {
         var t = /** @type {Element|null} */ (e.target);
-        if (!t || t.id !== 'bans-unban-dialog') return;
-        // Let the native close fire too; we just reset our state.
-        pending = null;
-        clearError();
+        if (!t) return;
+        if (t.id === 'bans-unban-dialog') {
+            pendingUnban = null;
+            clearError();
+            return;
+        }
+        if (t.id === 'bans-delete-dialog') {
+            pendingDelete = null;
+        }
     });
 })();
 </script>
diff --git a/web/themes/default/page_comms.tpl b/web/themes/default/page_comms.tpl
index 4ebd5608e..cecbe6127 100644
--- a/web/themes/default/page_comms.tpl
+++ b/web/themes/default/page_comms.tpl
@@ -30,7 +30,7 @@
                 of <span class="tabular-nums">{$total_bans|number_format}</span> blocks
             </p>
         </div>
-        <div class="flex gap-2">
+        <div class="flex gap-2 items-center">
             {* #1230: aria-pressed reflects whether inactive blocks
                are currently being hidden (binary state, not a
                one-shot action). Pair: .btn--secondary[aria-pressed="true"]
@@ -55,14 +55,15 @@
                aria-pressed="{if $is_active_only}true{else}false{/if}"
                href="{$hide_inactive_toggle_url|escape}"
                data-testid="toggle-hide-inactive">
-                <i data-lucide="{if $is_active_only}eye{else}eye-off{/if}"></i>
+                <i data-lucide="{if $is_active_only}eye{else}eye-off{/if}" style="width:14px;height:14px"></i>
                 {if $is_active_only}Show inactive{else}Hide inactive{/if}
             </a>
             {if $can_add_comm}
             <a class="btn btn--primary btn--sm"
                href="index.php?p=admin&amp;c=comms"
                data-testid="comms-add-button">
-                <i data-lucide="plus"></i> Add comm block
+                <i data-lucide="plus" style="width:14px;height:14px"></i>
+                Add block
             </a>
             {/if}
         </div>
@@ -195,7 +196,7 @@
          see (#1363). Same chrome shape as `page_bans.tpl`. *}
     <div class="card" style="overflow:hidden">
         <div class="table-scroll">
-        <table class="table" data-testid="comms-table">
+        <table class="table table--compact" data-testid="comms-table">
             <thead>
                 <tr>
                     <th>Type</th>
@@ -225,87 +226,71 @@
                             </span>
                         </td>
                         <td>
-                            <div class="flex items-center gap-3" style="min-width:0">
+                            {* items-start: keep the avatar top-aligned with the
+                               player name when the comment disclosure expands
+                               (items-center would pin it to the vertical middle
+                               of the tall cell). *}
+                            <div class="flex items-start gap-3" style="min-width:0">
                                 <span class="avatar"
-                                      style="width:28px;height:28px;background:hsl({$comm.avatar_hue} 55% 45%);font-size:10px">
+                                      style="width:22px;height:22px;background:hsl({$comm.avatar_hue} 55% 45%);font-size:9px">
                                     {$comm.name|truncate:2:'':true|upper|escape}
                                 </span>
-                                <div style="min-width:0">
-                                    {* Drawer parity with the banlist desktop row (#COMMS-DRAWER):
-                                       wrap the player nickname in an anchor whose `data-drawer-cid`
-                                       opens the player-detail drawer (theme.js click delegate). The
-                                       `href` is the JS-off fallback: navigates back to the unfiltered
-                                       commslist (Smarty already preserves the `?p=commslist&id=…`
-                                       shape on the URL bar but the page handler doesn't focus the
-                                       row — same documented degradation as the banlist's
-                                       `?p=banlist&id=…` fallback). NO `onclick="event.stopPropagation()"`:
-                                       the drawer click delegate listens on bubble, so stopping
-                                       propagation would silently fall through to native href
-                                       navigation and bypass the drawer entirely (#1124 Slice 6
-                                       found this on the banlist; same shape applies here). *}
-                                    <a class="font-medium truncate"
-                                       href="?p=commslist&amp;id={$comm.cid}"
-                                       data-drawer-cid="{$comm.cid}"
-                                       data-testid="drawer-trigger">{if $comm.name}{$comm.name|escape}{else}<i class="text-faint">no nickname</i>{/if}</a>
+                                <div style="min-width:0;flex:1">
+                                    {* Player name + comment chip share one line
+                                       (`.ban-player-cell__head`) so comment presence does
+                                       not add a second line of row height. Drawer parity
+                                       with the banlist desktop row (#COMMS-DRAWER):
+                                       `data-drawer-cid` opens the player-detail drawer.
+                                       NO `onclick="event.stopPropagation()"` — the drawer
+                                       click delegate listens on bubble. *}
+                                    <div class="ban-player-cell__head">
+                                        <a class="font-medium ban-player-cell__name"
+                                           href="?p=commslist&amp;id={$comm.cid}"
+                                           data-drawer-cid="{$comm.cid}"
+                                           data-testid="drawer-trigger">{if $comm.name}{$comm.name|escape}{else}<i class="text-faint">no nickname</i>{/if}</a>
+                                        {if $view_comments && $comm.commentdata != "None" && isset($comm.commentdata) && $comm.commentdata|@count > 0}
+                                        <details class="ban-comments-inline"
+                                                 data-testid="comm-comments-inline"
+                                                 data-cid="{$comm.cid}">
+                                          <summary class="ban-comments-inline__summary"
+                                                   data-testid="comm-comments-toggle"
+                                                   title="{$comm.commentdata|@count} comment{if $comm.commentdata|@count != 1}s{/if}"
+                                                   aria-label="{$comm.commentdata|@count} comment{if $comm.commentdata|@count != 1}s{/if}">
+                                            <i data-lucide="message-square-text" style="width:11px;height:11px" aria-hidden="true"></i>
+                                            <span class="tabular-nums">{$comm.commentdata|@count}</span>
+                                          </summary>
+                                          <ul class="ban-comments-inline__list" data-testid="comm-comments-list">
+                                            {foreach from=$comm.commentdata item=com}
+                                            <li class="ban-comments-inline__item" data-testid="comm-comment-item">
+                                              <div class="ban-comments-inline__meta">
+                                                {* #1500: comment author is an admin username; hide it for public viewers when banlist.hideadminname is on (parity with the unban-meta gate below). *}
+                                                {if $hideadminname}<i class="text-faint">Hidden</i>{elseif !empty($com.comname)}<strong>{$com.comname|escape}</strong>{else}<i class="text-faint">deleted admin</i>{/if}
+                                                <span class="text-faint">&middot;</span>
+                                                <span class="text-xs text-faint tabular-nums">{$com.added}</span>
+                                              </div>
+                                              {* nofilter: $com.commenttxt is server-built HTML produced by encodePreservingBr (htmlspecialchars per text segment, only `<br/>` survives) plus a URL-wrap regex that wraps already-escaped URLs in `<a>` tags — see page.commslist.php $commentres loop. Same provenance + safety as the banlist disclosure. *}
+                                              <div class="ban-comments-inline__text" data-testid="comm-comment-text">{$com.commenttxt nofilter}</div>
+                                              {if !empty($com.edittime)}
+                                              <div class="ban-comments-inline__edit text-xs text-faint">last edit {$com.edittime} by {if $hideadminname}<i class="text-faint">Hidden</i>{elseif !empty($com.editname)}{$com.editname|escape}{else}<i>deleted admin</i>{/if}</div>
+                                              {/if}
+                                            </li>
+                                            {/foreach}
+                                          </ul>
+                                        </details>
+                                        {/if}
+                                    </div>
                                     {* #1315: surface unban-reason / removed-by line below the
                                        player nickname when the row was lifted by an admin
-                                       (state == 'unmuted'). Higher-priority than the banlist
-                                       equivalent because the commslist has no drawer to fall
-                                       back to (no `data-drawer-href` on `<tr data-testid="comm-row">`).
-                                       Gated on $hideadminname so anonymous viewers under a
-                                       hidden-admins config don't get the admin name leaked
-                                       here either. *}
+                                       (state == 'unmuted'). Stays below the name+chip head
+                                       so lift meta does not fight the comment chip. Gated
+                                       on $hideadminname so anonymous viewers under a
+                                       hidden-admins config don't get the admin name leaked. *}
                                     {if $comm.state == 'unmuted' && !$hideadminname && (!empty($comm.ureason) || !empty($comm.removedby))}
                                         <div class="text-xs text-faint mt-1" data-testid="comm-unban-meta">
                                             {if !empty($comm.removedby)}Lifted by <span class="font-medium">{$comm.removedby|escape}</span>{if !empty($comm.ureason)}: {/if}{/if}
-                                            {* `title=` carries the full lift-reason so a long
-                                               reason that was cropped on the desktop table reads
-                                               in full on hover. Same shape as banlist's
-                                               ban-unban-reason span (issue 5). *}
                                             {if !empty($comm.ureason)}<span data-testid="comm-unban-reason" title="{$comm.ureason|escape}">{$comm.ureason|escape}</span>{/if}
                                         </div>
                                     {/if}
-                                    {* #BANLIST-COMMENTS sister-fix for commslist: this surface
-                                       has the SAME regression as the banlist (page handler
-                                       builds `commentdata` per row but the v2.0 rewrite of
-                                       this template never re-rendered it — see the
-                                       `commslist`-side rationale in AGENTS.md "Per-ban
-                                       comments visibility"). The commslist regression is
-                                       worse than the banlist's because there's no drawer
-                                       fallback (no `data-drawer-href` on `<tr data-testid="comm-row">`),
-                                       so the disclosure here is the ONLY on-page way for
-                                       admins to see the comment text. Same structure +
-                                       gating contract as the banlist disclosure. *}
-                                    {if $view_comments && $comm.commentdata != "None" && isset($comm.commentdata) && $comm.commentdata|@count > 0}
-                                    <details class="ban-comments-inline mt-1"
-                                             data-testid="comm-comments-inline"
-                                             data-cid="{$comm.cid}">
-                                      <summary class="ban-comments-inline__summary"
-                                               data-testid="comm-comments-toggle"
-                                               title="{$comm.commentdata|@count} comment{if $comm.commentdata|@count != 1}s{/if} on this comm-block">
-                                        <i data-lucide="message-square-text" style="width:11px;height:11px" aria-hidden="true"></i>
-                                        <span class="tabular-nums">{$comm.commentdata|@count}</span>
-                                        <span class="ban-comments-inline__label">comment{if $comm.commentdata|@count != 1}s{/if}</span>
-                                      </summary>
-                                      <ul class="ban-comments-inline__list" data-testid="comm-comments-list">
-                                        {foreach from=$comm.commentdata item=com}
-                                        <li class="ban-comments-inline__item" data-testid="comm-comment-item">
-                                          <div class="ban-comments-inline__meta">
-                                            {* #1500: comment author is an admin username; hide it for public viewers when banlist.hideadminname is on (parity with the unban-meta gate above). *}
-                                            {if $hideadminname}<i class="text-faint">Hidden</i>{elseif !empty($com.comname)}<strong>{$com.comname|escape}</strong>{else}<i class="text-faint">deleted admin</i>{/if}
-                                            <span class="text-faint">&middot;</span>
-                                            <span class="text-xs text-faint tabular-nums">{$com.added}</span>
-                                          </div>
-                                          {* nofilter: $com.commenttxt is server-built HTML produced by encodePreservingBr (htmlspecialchars per text segment, only `<br/>` survives) plus a URL-wrap regex that wraps already-escaped URLs in `<a>` tags — see page.commslist.php $commentres loop. Same provenance + safety as the banlist disclosure (template comment up-thread). *}
-                                          <div class="ban-comments-inline__text" data-testid="comm-comment-text">{$com.commenttxt nofilter}</div>
-                                          {if !empty($com.edittime)}
-                                          <div class="ban-comments-inline__edit text-xs text-faint">last edit {$com.edittime} by {if $hideadminname}<i class="text-faint">Hidden</i>{elseif !empty($com.editname)}{$com.editname|escape}{else}<i>deleted admin</i>{/if}</div>
-                                          {/if}
-                                        </li>
-                                        {/foreach}
-                                      </ul>
-                                    </details>
-                                    {/if}
                                 </div>
                             </div>
                         </td>
@@ -328,13 +313,14 @@
                             <span class="pill pill--{$comm.state}" style="text-transform:capitalize">{$comm.state|escape}</span>
                         </td>
                         <td class="col-actions">
-                            <div class="row-actions">
+                            <div class="row-actions row-actions--icons">
                                 {if $can_edit_comm}
-                                    <a class="btn btn--ghost btn--sm"
+                                    <a class="btn btn--ghost btn--icon btn--sm"
                                        href="{$comm.edit_url|escape}"
-                                       data-testid="row-action-edit">
-                                        <i data-lucide="pencil" style="width:13px;height:13px"></i>
-                                        Edit
+                                       data-testid="row-action-edit"
+                                       data-tooltip="Edit"
+                                       aria-label="Edit block for {$comm.name|escape}">
+                                        <i data-lucide="pencil" style="width:14px;height:14px"></i>
                                     </a>
                                 {/if}
                                 {if $can_unmute_gag && $comm.unmute_url}
@@ -345,56 +331,59 @@
                                        toast fires). The href fallback preserves the
                                        legacy GET path for no-JS callers + third-party
                                        themes that haven't migrated. *}
+                                    {if $comm.type == 'mute'}
+                                        {assign var=_lift_label value='Unmute'}
+                                    {elseif $comm.type == 'gag'}
+                                        {assign var=_lift_label value='Ungag'}
+                                    {else}
+                                        {assign var=_lift_label value='Lift block'}
+                                    {/if}
                                     <button type="button"
-                                            class="btn btn--secondary btn--sm"
+                                            class="btn btn--secondary btn--icon btn--sm"
                                             data-testid="row-action-unmute"
                                             data-action="comms-unblock"
                                             data-bid="{$comm.cid}"
                                             data-name="{$comm.name|escape}"
-                                            data-fallback-href="{$comm.unmute_url|escape}">
-                                        <i data-lucide="check" style="width:13px;height:13px"></i>
-                                        {if $comm.type == 'mute'}Unmute{elseif $comm.type == 'gag'}Ungag{else}Lift block{/if}
+                                            data-fallback-href="{$comm.unmute_url|escape}"
+                                            data-tooltip="{$_lift_label|escape}"
+                                            aria-label="{$_lift_label|escape} {$comm.name|escape}">
+                                        <i data-lucide="check" style="width:14px;height:14px"></i>
                                     </button>
                                 {elseif $can_add_comm && ($comm.state == 'unmuted' || $comm.state == 'expired') && !$comm.has_active_sibling}
                                     {* #1207 ADM-6: when a row is no longer active, swap the
                                        lift action for Re-apply. Anchor goes through the
-                                       admin-comms add form's `rebanid` flow (which calls
-                                       comms.prepare_reblock to hydrate every field) so we
-                                       don't need a separate "re-block" handler. The
+                                       admin-comms add form's `rebanid` flow. The
                                        `!has_active_sibling` clause hides the affordance
                                        when the player already has an active block of the
-                                       same type — `comms.add` would 4xx as
-                                       `already_blocked` against the OTHER row, even
-                                       though this row visibly says unmuted/expired (same
-                                       shape as the banlist's `has_active_sibling` gate). *}
-                                    <a class="btn btn--secondary btn--sm"
+                                       same type. *}
+                                    <a class="btn btn--secondary btn--icon btn--sm"
                                        href="index.php?p=admin&amp;c=comms&amp;rebanid={$comm.cid}"
-                                       data-testid="row-action-reapply">
-                                        <i data-lucide="rotate-ccw" style="width:13px;height:13px"></i>
-                                        Re-apply
+                                       data-testid="row-action-reapply"
+                                       data-tooltip="Re-apply"
+                                       aria-label="Re-apply block for {$comm.name|escape}">
+                                        <i data-lucide="rotate-ccw" style="width:14px;height:14px"></i>
                                     </a>
                                 {/if}
                                 {if !empty($comm.steam)}
-                                <button class="btn btn--ghost btn--sm" type="button"
+                                <button class="btn btn--ghost btn--icon btn--sm" type="button"
                                         data-copy="{$comm.steam|escape}"
-                                        data-testid="row-action-copy-steam-mobile"
-                                        aria-label="Copy SteamID"
-                                        title="Copy SteamID">
-                                    <i data-lucide="copy" style="width:13px;height:13px"></i>
-                                    Copy
+                                        data-testid="row-action-copy-steam"
+                                        data-tooltip="Copy SteamID"
+                                        aria-label="Copy SteamID">
+                                    <i data-lucide="copy" style="width:14px;height:14px"></i>
                                 </button>
                                 {/if}
                                 {if $can_delete_comm}
                                     <button type="button"
-                                            class="btn btn--ghost btn--sm"
+                                            class="btn btn--ghost btn--icon btn--sm"
                                             data-testid="row-action-delete"
                                             data-action="comms-delete"
                                             data-bid="{$comm.cid}"
                                             data-name="{$comm.name|escape}"
                                             data-fallback-href="{$comm.delete_url|escape}"
-                                            style="color:var(--danger)">
-                                        <i data-lucide="trash-2" style="width:13px;height:13px"></i>
-                                        Remove
+                                            data-tooltip="Remove"
+                                            aria-label="Remove block for {$comm.name|escape}">
+                                        <i data-lucide="trash-2" style="width:14px;height:14px;color:var(--danger)"></i>
                                     </button>
                                 {/if}
                             </div>
@@ -524,48 +513,67 @@
                         </div>
                         <i data-lucide="chevron-right"></i>
                     </a>
-                    {if $can_edit_comm || ($can_unmute_gag && $comm.unmute_url) || ($can_add_comm && ($comm.state == 'unmuted' || $comm.state == 'expired')) || $can_delete_comm}
-                    <div class="row-actions ban-card__actions">
+                    {if $can_edit_comm || ($can_unmute_gag && $comm.unmute_url) || ($can_add_comm && ($comm.state == 'unmuted' || $comm.state == 'expired')) || $can_delete_comm || !empty($comm.steam)}
+                    <div class="row-actions row-actions--icons ban-card__actions">
                         {if $can_edit_comm}
-                            <a class="btn btn--ghost btn--sm"
+                            <a class="btn btn--ghost btn--icon btn--sm"
                                href="{$comm.edit_url|escape}"
-                               data-testid="row-action-edit-mobile">
-                                <i data-lucide="pencil" style="width:13px;height:13px"></i>
-                                Edit
+                               data-testid="row-action-edit-mobile"
+                               data-tooltip="Edit"
+                               aria-label="Edit block for {$comm.name|escape}">
+                                <i data-lucide="pencil" style="width:14px;height:14px"></i>
                             </a>
                         {/if}
                         {if $can_unmute_gag && $comm.unmute_url}
+                            {if $comm.type == 'mute'}
+                                {assign var=_lift_label_m value='Unmute'}
+                            {elseif $comm.type == 'gag'}
+                                {assign var=_lift_label_m value='Ungag'}
+                            {else}
+                                {assign var=_lift_label_m value='Lift block'}
+                            {/if}
                             <button type="button"
-                                    class="btn btn--secondary btn--sm"
+                                    class="btn btn--secondary btn--icon btn--sm"
                                     data-testid="row-action-unmute-mobile"
                                     data-action="comms-unblock"
                                     data-bid="{$comm.cid}"
                                     data-name="{$comm.name|escape}"
-                                    data-fallback-href="{$comm.unmute_url|escape}">
-                                <i data-lucide="check" style="width:13px;height:13px"></i>
-                                {if $comm.type == 'mute'}Unmute{elseif $comm.type == 'gag'}Ungag{else}Lift block{/if}
+                                    data-fallback-href="{$comm.unmute_url|escape}"
+                                    data-tooltip="{$_lift_label_m|escape}"
+                                    aria-label="{$_lift_label_m|escape} {$comm.name|escape}">
+                                <i data-lucide="check" style="width:14px;height:14px"></i>
                             </button>
                         {elseif $can_add_comm && ($comm.state == 'unmuted' || $comm.state == 'expired') && !$comm.has_active_sibling}
                             {* Same `has_active_sibling` gate as the desktop
                                variant — see the rationale block above. *}
-                            <a class="btn btn--secondary btn--sm"
+                            <a class="btn btn--secondary btn--icon btn--sm"
                                href="index.php?p=admin&amp;c=comms&amp;rebanid={$comm.cid}"
-                               data-testid="row-action-reapply-mobile">
-                                <i data-lucide="rotate-ccw" style="width:13px;height:13px"></i>
-                                Re-apply
+                               data-testid="row-action-reapply-mobile"
+                               data-tooltip="Re-apply"
+                               aria-label="Re-apply block for {$comm.name|escape}">
+                                <i data-lucide="rotate-ccw" style="width:14px;height:14px"></i>
                             </a>
                         {/if}
+                        {if !empty($comm.steam)}
+                        <button class="btn btn--ghost btn--icon btn--sm" type="button"
+                                data-copy="{$comm.steam|escape}"
+                                data-testid="row-action-copy-steam-mobile"
+                                data-tooltip="Copy SteamID"
+                                aria-label="Copy SteamID">
+                            <i data-lucide="copy" style="width:14px;height:14px"></i>
+                        </button>
+                        {/if}
                         {if $can_delete_comm}
                             <button type="button"
-                                    class="btn btn--ghost btn--sm"
+                                    class="btn btn--ghost btn--icon btn--sm"
                                     data-testid="row-action-delete-mobile"
                                     data-action="comms-delete"
                                     data-bid="{$comm.cid}"
                                     data-name="{$comm.name|escape}"
                                     data-fallback-href="{$comm.delete_url|escape}"
-                                    style="color:var(--danger)">
-                                <i data-lucide="trash-2" style="width:13px;height:13px"></i>
-                                Remove
+                                    data-tooltip="Remove"
+                                    aria-label="Remove block for {$comm.name|escape}">
+                                <i data-lucide="trash-2" style="width:14px;height:14px;color:var(--danger)"></i>
                             </button>
                         {/if}
                     </div>
@@ -722,6 +730,26 @@
   </form>
 </dialog>
 
+<dialog id="comms-delete-dialog"
+        class="palette"
+        aria-labelledby="comms-delete-dialog-title"
+        data-testid="comms-delete-dialog"
+        hidden
+        style="max-width:32rem;width:90vw;padding:1.25rem;border-radius:0.75rem;border:1px solid var(--border)">
+  <form method="dialog" data-testid="comms-delete-form">
+    <h2 id="comms-delete-dialog-title" style="font-size:var(--fs-lg);font-weight:600;margin:0 0 0.25rem">Delete block</h2>
+    <p class="text-sm text-muted m-0" style="margin-bottom:0.75rem">
+      Delete the block for <strong data-testid="comms-delete-target">this player</strong>? This cannot be undone.
+    </p>
+    <div class="flex gap-2 mt-4" style="justify-content:flex-end">
+      <button type="button" class="btn btn--secondary" data-testid="comms-delete-cancel" value="cancel">Cancel</button>
+      <button type="submit" class="btn btn--danger" data-testid="comms-delete-submit" value="confirm">
+        <i data-lucide="trash-2" style="width:13px;height:13px"></i> Delete block
+      </button>
+    </div>
+  </form>
+</dialog>
+
 {* ============================================================
    #1207 ADM-5/ADM-6 + #1301 — comms row-action wiring (inline
    page-tail JS).
@@ -847,12 +875,15 @@
             row.querySelectorAll('[data-action="comms-unblock"]'),
             function (btn) {
                 var bid = btn.getAttribute('data-bid') || '';
+                var name = btn.getAttribute('data-name') || '';
                 var a = document.createElement('a');
-                a.className = 'btn btn--secondary btn--sm';
+                a.className = 'btn btn--secondary btn--icon btn--sm';
                 var isMobile = (btn.getAttribute('data-testid') || '').indexOf('mobile') !== -1;
                 a.setAttribute('data-testid', isMobile ? 'row-action-reapply-mobile' : 'row-action-reapply');
                 a.setAttribute('href', 'index.php?p=admin&c=comms&rebanid=' + encodeURIComponent(bid));
-                a.innerHTML = '<i data-lucide="rotate-ccw" style="width:13px;height:13px"></i> Re-apply';
+                a.setAttribute('data-tooltip', 'Re-apply');
+                a.setAttribute('aria-label', name ? ('Re-apply block for ' + name) : 'Re-apply');
+                a.innerHTML = '<i data-lucide="rotate-ccw" style="width:14px;height:14px"></i>';
                 btn.parentNode.replaceChild(a, btn);
             }
         );
@@ -875,16 +906,20 @@
     }
 
     /** @returns {HTMLDialogElement|null} */
-    function dialog() {
+    function unblockDialog() {
         return /** @type {HTMLDialogElement|null} */ (document.getElementById('comms-unblock-dialog'));
     }
+    /** @returns {HTMLDialogElement|null} */
+    function deleteDialog() {
+        return /** @type {HTMLDialogElement|null} */ (document.getElementById('comms-delete-dialog'));
+    }
     /** @returns {HTMLTextAreaElement|null} */
     function reasonInput() {
         return /** @type {HTMLTextAreaElement|null} */ (document.getElementById('comms-unblock-reason'));
     }
     /** @returns {HTMLElement|null} */
     function errorEl() {
-        var d = dialog();
+        var d = unblockDialog();
         return d ? /** @type {HTMLElement|null} */ (d.querySelector('[data-testid="comms-unblock-error"]')) : null;
     }
     /** @param {string} msg */
@@ -892,7 +927,9 @@
     function clearError() { var e = errorEl(); if (!e) return; e.textContent = ''; e.hidden = true; }
 
     /** @type {{bid: string, name: string, fallback: string, type: string}|null} */
-    var pending = null;
+    var pendingUnblock = null;
+    /** @type {{bid: string, name: string, trigger: HTMLElement}|null} */
+    var pendingDelete = null;
 
     /**
      * @param {string} type
@@ -907,8 +944,8 @@
 
     /** @param {{bid: string, name: string, fallback: string, type: string}} ctx */
     function openUnblockDialog(ctx) {
-        pending = ctx;
-        var d = dialog();
+        pendingUnblock = ctx;
+        var d = unblockDialog();
         if (!d) {
             // Dialog markup missing — fall back to the legacy GET path
             // so the action still works (it now also requires
@@ -941,7 +978,7 @@
     }
 
     function closeUnblockDialog() {
-        var d = dialog();
+        var d = unblockDialog();
         if (!d) return;
         try { d.close(); } catch (_e) { /* not opened modally */ }
         d.setAttribute('hidden', '');
@@ -955,19 +992,52 @@
             document.querySelectorAll('[data-action="comms-unblock"][disabled], [data-action="comms-unblock"][data-loading="true"]'),
             function (btn) { setBusy(btn, false); }
         );
-        pending = null;
+        pendingUnblock = null;
+    }
+
+    /**
+     * @param {{bid: string, name: string, trigger: HTMLElement}} ctx
+     */
+    function openDeleteDialog(ctx) {
+        pendingDelete = ctx;
+        var d = deleteDialog();
+        if (!d) {
+            toast('error', 'Delete failed', 'Confirm dialog is unavailable. Reload and try again.');
+            return;
+        }
+        var target = d.querySelector('[data-testid="comms-delete-target"]');
+        if (target) target.textContent = ctx.name || ('block #' + ctx.bid);
+        d.removeAttribute('hidden');
+        try { d.showModal(); }
+        catch (_e) { d.setAttribute('open', ''); }
+        var submitBtn = /** @type {HTMLButtonElement|null} */ (d.querySelector('[data-testid="comms-delete-submit"]'));
+        if (submitBtn) {
+            try { submitBtn.focus(); } catch (_e) { /* focus may throw */ }
+        }
+    }
+
+    function closeDeleteDialog() {
+        var d = deleteDialog();
+        if (!d) return;
+        try { d.close(); } catch (_e) { /* not opened modally */ }
+        d.setAttribute('hidden', '');
+        pendingDelete = null;
     }
 
     document.addEventListener('click', function (e) {
         var t = /** @type {Element|null} */ (e.target);
         if (!t || !t.closest) return;
 
-        // Cancel button inside the dialog.
         if (t.closest('[data-testid="comms-unblock-cancel"]')) {
             e.preventDefault();
             closeUnblockDialog();
             return;
         }
+        if (t.closest('[data-testid="comms-delete-cancel"]')) {
+            e.preventDefault();
+            closeDeleteDialog();
+            return;
+        }
 
         var btn = /** @type {HTMLElement|null} */ (t.closest('[data-action]'));
         if (!btn) return;
@@ -989,19 +1059,7 @@
         }
 
         if (act === 'comms-delete') {
-            if (!window.confirm('Delete the block for "' + name + '"?')) return;
-            setBusy(btn, true);
-            a.call(A.CommsDelete, { bid: Number(bid) }).then(function (r) {
-                if (!r || r.ok === false) {
-                    setBusy(btn, false);
-                    var msg = (r && r.error && r.error.message) || 'Unknown error';
-                    toast('error', 'Delete failed', msg);
-                    return;
-                }
-                rowsForBid(bid).forEach(removeRow);
-                decrementCount();
-                toast('success', 'Block removed', 'The block for ' + name + ' has been deleted.');
-            });
+            openDeleteDialog({ bid: bid, name: name, trigger: btn });
             return;
         }
 
@@ -1019,9 +1077,40 @@
     document.addEventListener('submit', function (e) {
         var form = /** @type {Element|null} */ (e.target);
         if (!form || !(/** @type {Element} */ (form)).closest) return;
+
+        if (form.matches('[data-testid="comms-delete-form"]')) {
+            e.preventDefault();
+            if (!pendingDelete) return;
+            var delCtx = pendingDelete;
+            var delSubmit = /** @type {HTMLButtonElement|null} */ (form.querySelector('[data-testid="comms-delete-submit"]'));
+            setBusy(delSubmit, true);
+            setBusy(delCtx.trigger, true);
+            var aDel = api(), ADel = actions();
+            if (!aDel || !ADel) {
+                setBusy(delSubmit, false);
+                setBusy(delCtx.trigger, false);
+                toast('error', 'Delete failed', 'The API client is unavailable. Reload the page and try again.');
+                return;
+            }
+            aDel.call(ADel.CommsDelete, { bid: Number(delCtx.bid) }).then(function (r) {
+                if (!r || r.ok === false) {
+                    setBusy(delSubmit, false);
+                    setBusy(delCtx.trigger, false);
+                    var msg = (r && r.error && r.error.message) || 'Unknown error';
+                    toast('error', 'Delete failed', msg);
+                    return;
+                }
+                rowsForBid(delCtx.bid).forEach(removeRow);
+                decrementCount();
+                closeDeleteDialog();
+                toast('success', 'Block removed', 'The block for ' + delCtx.name + ' has been deleted.');
+            });
+            return;
+        }
+
         if (!form.matches('[data-testid="comms-unblock-form"]')) return;
         e.preventDefault();
-        if (!pending) return;
+        if (!pendingUnblock) return;
 
         var input = reasonInput();
         var reason = input ? input.value.trim() : '';
@@ -1036,7 +1125,7 @@
         }
         clearError();
 
-        var ctx = pending;
+        var ctx = pendingUnblock;
         var submitBtn = /** @type {HTMLButtonElement|null} */ (form.querySelector('[data-testid="comms-unblock-submit"]'));
         setBusy(submitBtn, true);
 
@@ -1066,9 +1155,15 @@
 
     document.addEventListener('cancel', function (e) {
         var t = /** @type {Element|null} */ (e.target);
-        if (!t || t.id !== 'comms-unblock-dialog') return;
-        pending = null;
-        clearError();
+        if (!t) return;
+        if (t.id === 'comms-unblock-dialog') {
+            pendingUnblock = null;
+            clearError();
+            return;
+        }
+        if (t.id === 'comms-delete-dialog') {
+            pendingDelete = null;
+        }
     });
 })();
 </script>