diff --git a/AGENTS.md b/AGENTS.md
index cdccf98..46db227 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,6 +1,6 @@
 # BookHive — Agent Reference Index
 
-Goodreads alternative built on Bluesky's AT Protocol. Server-rendered Hono JSX with minimal client-side hydration via `hono/jsx/dom`. Bun runtime, SQLite via Kysely, Tailwind CSS v4. Built with Vite + Nitro (preset `bun`), output to `.output/server/`.
+Goodreads alternative built on Bluesky's AT Protocol. Server-rendered Hono JSX with minimal client-side hydration via `hono/jsx/dom`. Bun runtime, SQLite via Kysely, Tailwind CSS v4. Built with Vite+ (vite-plus, wrapping Vite 8 + Rolldown) + Nitro (preset `bun`), output to `.output/server/`.
 
 ## User preferences (do not remove this)
 
@@ -37,7 +37,7 @@ Browser ──> Bun.serve() ──> Hono app ──> Server-rendered JSX pages
                 │ /_bundle (HTML import, dev)  ├── SQLite (Kysely ORM)
                 │   └── entry.html             ├── KV cache (unstorage + SQLite)
                 │       ├── src/client/index.tsx  ├── Bluesky PDS (ATProto writes)
-                │       └── src/index.css      ├── Goodreads / Google / ISBNdb scrapers
+                │       └── src/index.css      ├── Goodreads scrapers
                 │                              └── Worker threads (see below)
                 └── static files (public/)
 
@@ -48,27 +48,13 @@ Worker threads (src/workers/, bundled to .output/server/workers/):
   import-worker       — CSV import processing
 ```
 
-**Key pattern**: Server components (`src/pages/`) render full HTML. Only 6 islands are hydrated client-side (`src/client/`). Most interactivity is CSS-only (peer/checked selectors for tabs, dropdowns, modals) or inline `<Script>` vanilla JS.
+**Key patterns:**
 
-**Asset URLs**: In production, resolved from the Vite build manifest via `src/utils/manifest.ts` (`loadViteManifest`/`getAssetUrlsFromManifest`), exposed on the Hono context as `assetUrls`. The `/_bundle` HTML import route still exists for Bun dev.
-
-**Ingester runs as a worker thread**, not in-process. `createAppDeps` spawns `new Worker(ingester-worker)`; `ingester.destroy()` terminates it. Worker posts `wideEvent` messages back to the pino logger. **Primary worker only** (see below).
-
-**Production is multi-process**: the Docker CMD is `server/cluster.ts`, a supervisor that spawns `WEB_CONCURRENCY` (default 4) copies of `.output/server/index.mjs`, all sharing port 8080 via SO_REUSEPORT (`reusePort: true` in the custom Nitro entry `server/entry.bun.mjs`). Worker 0 is the **primary** (`isPrimaryWorker` in `src/context.ts`, from `WORKER_INDEX`): only it runs DB migrations + VACUUM and the Jetstream ingester. The supervisor starts worker 0 alone, waits for `/healthcheck`, then spawns the rest — that ordering is the migration barrier. `WORKER_INDEX` unset (dev/tests/bare run) behaves as primary.
-
-**Goodreads enrichment is queued, never inline**: routes call
-`enqueueEnrichment`/`enqueueEnrichmentBatch` (`src/utils/enrichQueue.ts`) — one
-`INSERT OR IGNORE` into `enrich_queue`, keyed by `hiveId` so re-queueing is free.
-The **primary worker only** drains it every 5s at `ENRICH_CONCURRENCY` (3), with
-exponential backoff (1m/5m/30m, 4 attempts) and stale-claim reclaim. Each item
-emits exactly one terminal `msg: "enrichment"` pino event — `addWideEventContext`
-is useless for detached work because the request's wide event has already
-flushed. `enrichBookWithDetailedData` additionally holds its own semaphore (4)
-and a 45s deadline so no call site can reintroduce an unbounded fan-out. This
-replaced a 20-way-per-search fan-out of solver Workers that OOM-killed workers
-every 5–7 minutes on 2026-08-01.
-
-**Anonymous page cache**: `src/middleware/anon-page-cache.ts` serves GET requests without a `sid` cookie on `/books/*`, `/explore*`, `/authors/*` from the shared KV (`page:` mount, gzipped HTML, 1h TTL, query-param allowlist `page`/`sort`/`lang`/`review-id`; other params bypass). Prod-only. The primary worker sweeps expired `page_cache` rows every 15 min. The nitro plugin `server/plugins/html-cache-headers.ts` is the authoritative Cache-Control for HTML on these routes (anon → `public, max-age=3600`; `sid` cookie → `private`) — it runs on the final response because Hono-set headers can be replaced by nitro's route-rule header middleware (the static-asset globs in `vite.config.ts` routeRules leak onto app routes).
+- Server components (`src/pages/`) render full HTML. Only 6 islands are hydrated client-side (`src/client/`). Most interactivity is CSS-only (peer/checked selectors) or inline `<Script>` vanilla JS.
+- **Production is multi-process**: `server/cluster.ts` spawns `WEB_CONCURRENCY` (default 4) workers sharing port 8080 via SO_REUSEPORT. Worker 0 is the **primary** (`isPrimaryWorker`): only it runs migrations, VACUUM, the Jetstream ingester, and the enrichment drain.
+- **Enrichment is queued, never inline**: routes call `enqueueEnrichment`/`enqueueEnrichmentBatch` (`src/utils/enrichQueue.ts`). The primary worker drains it every 5s at concurrency 3, with exponential backoff. `enrichBookWithDetailedData` holds its own semaphore (4) + 45s deadline.
+- **Author lookups use `hive_book_author` join** (mig 020), not `LIKE`. This is exact identity, not text search.
+- **Library re-sync** fans out at most `REFETCH_SEARCH_CONCURRENCY` (3) searches.
 
 ## Entry Points
 
@@ -82,47 +68,61 @@ every 5–7 minutes on 2026-08-01.
 
 ## Routes
 
-`src/app.ts` (`createApp`) mounts top-level infra/admin routes, then `/` →
-`src/routes/main.tsx` (`mainRouter`). `mainRouter` registers a few standalone
-pages, the image proxy, then mounts the feature route modules and the XRPC
-router. Middleware order in `createApp`: `timing` → `prettyJSON` (dev) →
-context → wide-event logging → error capture → asset URLs (Vite manifest) →
-`secureHeaders` → `compress` → `jsxRenderer` → OpenTelemetry → `etag` →
-anon page cache (prod, `/books/*`, `/explore*`, `/authors/*`).
+`src/app.ts` mounts infra/admin routes, then `/` → `src/routes/main.tsx` (`mainRouter`). `mainRouter` registers standalone pages, the image proxy, feature route modules, and the XRPC router.
+
+**Middleware order** in `createApp`: `timing` → `prettyJSON` (dev) → context → wide-event logging → error capture → asset URLs (Vite manifest) → `/images/*` CORP override → `secureHeaders` → `compress` → `jsxRenderer` → OpenTelemetry → default `Cache-Control: private, no-store` → Prometheus `registerMetrics` → `etag` → anon page cache (prod).
+
+**`etag()` must never see a large or streamed body** — it buffers the entire
+response in memory. `/library/books/*`, `/opds/books/*` and `/import` are all
+excluded **by prefix** in `src/app.ts` (`ETAG_EXCLUDED_PREFIXES`). `/import` is
+also mounted above the middleware, but do not rely on that alone: its SSE stream
+never ends, so if a reorder ever let the digest see it, imports would hang
+forever and look like an import bug rather than an etag one.
+
+Because those routes skip `etag()`, **they must answer `If-None-Match`
+themselves** — the middleware is what turns a validator into a 304, and setting
+the header alone does nothing. `streamPersonalBook`
+(`src/utils/personalLibrary.ts`) takes the request's `If-None-Match` and returns
+`{ notModified: true }` before it opens the file; both download routes turn that
+into a 304. Without it an e-reader re-downloads every book on every sync.
+
+**Anonymous page cache** (`src/middleware/anon-page-cache.ts`): serves GET requests without a `sid` cookie on `/books/*`, `/explore*`, `/authors/*` from KV (gzipped HTML, 1h TTL). Prod-only. The nitro plugin `server/plugins/html-cache-headers.ts` is the authoritative Cache-Control for HTML.
 
 ### Mounted in `src/app.ts` (infra/admin, before `mainRouter`)
 
-- `/healthcheck` → JSON status + git sha + startedAt
-- `/metrics` → Prometheus (`@hono/prometheus` defaults + custom registry)
-- `/sitemap.xml` → static sitemap (`/`, `/app`, `/privacy-policy`)
+- `/healthcheck` → JSON status + git sha
+- `/metrics` → Prometheus
 - `/admin/*` → `src/routes/admin.ts` (gated by `EXPORT_SHARED_SECRET`)
 - `/debug/*` → `src/routes/debug.ts` (gated by `EXPORT_SHARED_SECRET`)
 - `/import` (POST `/goodreads`, `/storygraph`) → `src/routes/import.ts` — CSV import handler
-- `app.notFound` → JSON 404
+
+### Mounted in `src/app.ts` (after `mainRouter`)
+
+- `/sitemap.xml` → static sitemap
 
 ### Standalone pages in `src/routes/main.tsx`
 
 - `/privacy-policy` → `src/pages/privacy-policy.tsx`
-- `/legal` → `src/pages/terms.tsx` — terms of service
-- `/pds` → `src/pages/pds.tsx` — PDS info (redirects to `/` if PDS disabled)
-- `/` → `src/pages/marketing.tsx` — marketing landing; redirects to `/app` for the iOS host/`?app`, to `/home` when logged in; trending books + recent activity, cached 1h via `readThroughCache`
-- `/images/*` → signing reverse-proxy to **imgproxy** (remote sources only; allowed hosts `i.gr-assets.com`, `cdn.bsky.app`, `images.isbndb.com` via `src/utils/imageProxy.ts` — keep this set in sync with `IMGPROXY_ALLOWED_SOURCES` in `compose.yaml`; the upstream fetch has a 10s timeout; URL modifiers like `w_440` / `s_300x500,fit_cover` translated to imgproxy options and signed server-side with `IMGPROXY_KEY`/`IMGPROXY_SALT`; SVG fallback on forbidden/failed source; meant to be edge-cached by Cloudflare). If `IMGPROXY_URL` is unset, redirects to the source URL. **Replaced the Bun.Image proxy.** Three route shapes share one proxy helper (`proxyImageResponse` in `src/utils/imageProxy.ts`):
-  - **ID-keyed canonical (preferred for web)** — `GET /images/books/:hiveId?w=440` resolves the current cover from `hive_book`; `GET /images/avatars/:did?s=120` resolves the current avatar via `getProfile`. These URLs are permanently stable and never leak the upstream provider; size is a query param (`w`/`h`/`s`/`q`/`fit`). Built by helpers `coverImageUrl(hiveId, {width})` → `/images/books/{hiveId}?w=N` and `avatarImageUrl(did, {size})` → `/images/avatars/{did}?s=N` (both `undefined` for falsy id). Registered **before** the catch-all (Hono order).
-  - **Source-embedded (stateless)** — the catch-all `/images/{modifiers}/{source}` proxies a raw upstream URL directly. Used by OG render (`src/routes/og.tsx`, inline `${origin}/images/w_N/{url}`) and the iOS app (`s_300x500,fit_cover…`). Built by helpers `sourceCoverImageUrl(source, {width})` / `sourceAvatarImageUrl(source, {size})` for callers that only have a raw source URL (author thumbnails, `UserBlock`). `parseImagePath` repairs the protocol slash browsers collapse (`https:/…` → `https://…`).
-- `/login`, `/logout`, `/oauth/callback` → `src/auth/router.tsx` — OAuth flows (`loginRouter`)
+- `/legal` → `src/pages/terms.tsx`
+- `/pds` → `src/pages/pds.tsx` (redirects to `/` if PDS disabled)
+- `/` → `src/pages/marketing.tsx` — landing; redirects to `/home` when logged in
+- `/images/*` → signing reverse-proxy to **imgproxy** (`src/utils/imageProxy.ts`). Three route shapes:
+  - `/images/books/:hiveId?w=N` — ID-keyed canonical (preferred). Helpers: `coverImageUrl`, `avatarImageUrl`
+  - `/images/avatars/:did?s=N` — ID-keyed avatar
+  - `/images/{modifiers}/{source}` — source-embedded catch-all (used by OG render, iOS app). Helpers: `sourceCoverImageUrl`, `sourceAvatarImageUrl`
+- `/login`, `/logout`, `/oauth/callback` → `src/auth/router.tsx`
 
 ### `src/routes/pages.tsx` (mounted at `/`)
 
-- `/home` → `src/pages/home.tsx` — authenticated home (redirects to `/` if no profile)
-- `/feed` → `src/pages/feed.tsx` — activity feed, friends/all/tracking tabs (paginated 25/page)
+- `/home` → `src/pages/home.tsx` — authenticated home
+- `/feed` → `src/pages/feed.tsx` — activity feed (friends/all/tracking, paginated 25/page)
 - `/app` → `src/pages/app.tsx` — iOS app landing
-- `/import` → `src/pages/import.tsx` — Goodreads/StoryGraph CSV import, SSE progress
-- `/search` → `src/pages/searchResults.tsx` — search (zValidator query `q`/`page`/`lang`)
-- `/explore` → `src/pages/explore.tsx` — explore hub (cache-control 1h)
-- `/explore/genres` → `src/pages/genres.tsx` — genre directory
-- `/explore/genres/:genre` → `src/pages/genreBooks.tsx` — books by genre, paginated, sortable (popularity/relevance/reviews)
-- `/explore/authors` → `src/pages/authorDirectory.tsx` — author directory
-- `/authors/:author` → `src/pages/authorBooks.tsx` — books by author, paginated
+- `/import` → `src/pages/import.tsx` — CSV import page, SSE progress
+- `/search` → `src/pages/searchResults.tsx` (zValidator query `q`/`page`/`lang`)
+- `/explore` → `src/pages/explore.tsx` — explore hub
+- `/explore/genres` → `src/pages/genres.tsx`; `/explore/genres/:genre` → `src/pages/genreBooks.tsx`
+- `/explore/authors` → `src/pages/authorDirectory.tsx`
+- `/authors/:author` → `src/pages/authorBooks.tsx`
 - `/genres`, `/genres/:genre` → 301 redirects to `/explore/genres`
 - `/.well-known/atproto-did` → returns DID constant
 
@@ -130,62 +130,52 @@ anon page cache (prod, `/books/*`, `/explore*`, `/authors/*`).
 
 - `/refresh-books` → re-sync books from PDS (auth)
 - `/profile` → redirects to `/profile/:handle`
-- `/profile/:handle` → `src/pages/profile.tsx` — profile, shelves, follow counts (cached 5m), lists, genre stats
+- `/profile/:handle` → `src/pages/profile.tsx` — profile, shelves, follow counts, lists, genre stats
 - `/profile/:handle/image` → redirect to avatar
-- `/profile/:handle/stats` → redirect to `/stats/:currentYear`
-- `/profile/:handle/stats/:year` → `src/pages/readingStats.tsx` — reading stats by year (all-time fallback)
+- `/profile/:handle/stats` → redirect to current year; `/profile/:handle/stats/:year` → `src/pages/readingStats.tsx`
 
 ### `src/routes/books.tsx` (mounted at `/books`)
 
-- GET `/:hiveId` → `src/pages/bookInfo.tsx` — book detail. `hiveId` must match `^bk_[A-Za-z0-9]+$` (else 400 + a `bad_hive_id` wide-event field). Stale books (>30d) are **queued** for enrichment, never scraped inline; `?force-refresh=true` still enriches inline but with a 15s ceiling and falls back to existing data
-- DELETE `/:hiveId` → delete book record from PDS + DB
-- POST `/` → add/update book (zValidator form incl. `bookProgress`); per-DID `book_lock` KV, 429 if locked
-- GET `/:hiveId/comments` → `src/pages/comments.tsx` — comments/reviews section
+- GET `/:hiveId` → `src/pages/bookInfo.tsx` — book detail. `hiveId` must match `^bk_[A-Za-z0-9]+$`. Stale books (>30d) queued for enrichment; `?force-refresh=true` enriches inline with 15s ceiling
+- DELETE `/:hiveId` → delete book from PDS + DB
+- POST `/` → add/update book (zValidator form); per-DID `book_lock` KV, 429 if locked
+- GET `/:hiveId/comments` → `src/pages/comments.tsx`
 
 ### `src/routes/comments.tsx` (mounted at `/comments`)
 
-- POST `/` → create/update buzz (form)
-- DELETE `/:commentId` → delete buzz
+- POST `/` → create/update buzz; DELETE `/:commentId` → delete buzz
 
 ### `src/routes/shelves.tsx` (mounted at `/shelves`)
 
-User book lists ("shelves"). Lists use the **shared popfeed lexicons**
-(`social.popfeed.feed.list` / `.listItem`), AT URI form
-`at://${did}/social.popfeed.feed.list/${rkey}`. Delegates to `src/utils/lists.ts`.
+User book lists ("shelves"). Uses **popfeed** lexicons (`social.popfeed.feed.list`/`.listItem`). Delegates to `src/utils/lists.ts`.
 
 - GET/POST `/new` → create list
 - GET `/:handle` → user's shelves; GET `/:handle/:rkey` → single shelf
 - GET/POST `/:handle/:rkey/edit`, POST `/:handle/:rkey/delete`
-- POST `/add` (from book page), POST `/:handle/:rkey/add`, POST `/:handle/:rkey/remove`
+- POST `/add`, POST `/:handle/:rkey/add`, POST `/:handle/:rkey/remove`
 
 ### `src/routes/settings.tsx` (mounted at `/settings`)
 
 - GET `/` → `src/pages/settings.tsx` (auth)
-- POST `/delete-account` → delete account data, revoke OAuth, destroy session
-- GET `/sync/password` → current KOSync password (derived); POST `/sync/rotate` → bump the rotation counter and return the new one
-- GET `/sync/documents` → the user's synced e-reader documents (+ linked book title); POST `/sync/link` (`{document, hiveId}`) → link a document to a book and bridge its progress via `src/utils/syncBridge.ts`
+- POST `/delete-account` → delete account + revoke OAuth + destroy session
+- GET `/sync/password`, POST `/sync/rotate` → KOSync password management
+- GET `/sync/documents`, POST `/sync/link` → sync document management
 
 ### `src/routes/library.tsx` (mounted at `/library`)
 
-Personal library: ebook uploads (= the OPDS catalog, served by `src/routes/opds.ts`), e-reader credentials, sync documents. All routes require session auth.
+Personal library: ebook uploads, e-reader credentials, sync documents. All auth-required.
 
-- GET `/` → `src/pages/library.tsx` (auth). With no books _and_ no synced documents it renders an explainer with the credentials block and upload dropzone inline; otherwise a header with two `<dialog>` triggers plus the `LibraryManager` island.
-- POST `/upload` → multipart file upload handler (validates format via `detectFormat`, computes the KOReader partial MD5 as `contentHash`, parses metadata via `parseBook`, writes to disk, inserts `personal_book`, auto-links from a `sync_document` with the same hash). Content-negotiated: `Accept: application/json` (the mobile app) gets `{ book }` in the `personalBookView` shape, or 409 on a duplicate; the browser form gets a 302 back to `/library`.
-- GET `/covers/:hash` → extracted cover image for a personal book
-- GET `/books/:hash/download` → session-authenticated file download; shares `streamPersonalBook` (`src/utils/personalLibrary.ts`) with the Basic-auth OPDS route.
-- GET `/shelves` → JSON list of user's personal shelves with book counts (`{ shelves: [{ id, name, description, bookCount, createdAt, updatedAt }] }`)
-- GET `/sync/password` → current KOSync password (same as settings, duplicated here for library page)
-- POST `/sync/rotate` → rotate sync token (same as settings)
-- GET `/sync/documents` → synced e-reader documents; each row carries `hasFile` (an upload shares its hash) and `dismissed`.
-- POST `/sync/link` (`{document, hiveId}`) → link synced document to hive book
-- POST `/sync/dismiss` (`{document, dismissed}`) → write/clear the `NO_HIVE_MATCH` sentinel; 404s rather than clobbering a real link.
-- POST `/sync/rename` (`{document, title}`) → name a document that arrived without metadata
-- POST `/sync/delete` (`{document}`) → forget a synced document and its e-reader progress. Scoped to `sync_document`; leaves `user_book.bookProgress` alone.
+- GET `/` → `src/pages/library.tsx`
+- POST `/upload` → multipart upload (validates format, computes KOReader partial MD5, parses metadata, auto-links matching `sync_document`). Content-negotiated: JSON for mobile, 302 for browser. Size checked before `arrayBuffer()`.
+- GET `/covers/:hash` → cover image; GET `/books/:hash/download` → file download (shares `streamPersonalBook` with OPDS)
+- GET `/shelves` → JSON shelf list with counts
+- GET `/sync/password`, POST `/sync/rotate` → KOSync password (duplicated from settings)
+- GET `/sync/documents`, POST `/sync/link`, POST `/sync/dismiss`, POST `/sync/rename`, POST `/sync/delete`
 
-### `src/routes/api.tsx` (mounted at `/api`) — JSON/form mutations
+### `src/routes/api.tsx` (mounted at `/api`)
 
 - POST `/update-book`, `/update-comment`
-- POST `/follow`, `/follow-form`, `/unfollow`, `/unfollow-form` (writes `app.bsky.graph.follow` + `user_follows.isActive`)
+- POST `/follow`, `/follow-form`, `/unfollow`, `/unfollow-form`
 
 ### `src/routes/rss.ts` (mounted at `/rss`)
 
@@ -193,321 +183,220 @@ Personal library: ebook uploads (= the OPDS catalog, served by `src/routes/opds.
 
 ### `src/routes/opds.ts` (mounted at `/opds`) — e-reader catalog
 
-Serves the user's personal library (`personal_book` / `personal_shelf`) to
-e-readers. Every route is behind `src/middleware/opds-auth.ts`: HTTP Basic with
-the Bluesky handle as username and the **same derived password as KOSync**
-(`currentSyncPassword`), compared in full rather than as an md5.
-
-**Dual-format.** The four feed routes emit either OPDS 1.2 Atom XML or OPDS 2.0
-JSON depending on the request's `Accept` header (`wantsOpds2()` — true when it
-contains `application/opds+json`). KOReader ≥ [#15696](https://github.com/koreader/koreader/pull/15696)
-(header fixed in [#15751](https://github.com/koreader/koreader/pull/15751)) sends
-`application/opds+json, application/atom+xml;profile=opds-catalog, */*` and picks
-its parser from the **first byte of the body** (`{` → 2.0, `<` → 1.x), not from
-`Content-Type`. Older clients send no such header and keep getting XML.
-
-- GET `/` → root navigation feed (All Books + one entry per shelf). The 2.0 form
-  is a `navigation` array carrying `properties.numberOfItems` per entry; the 1.x
-  form has no counts, so the count queries only run on the JSON path.
-- GET `/all`, `/shelves/:id`, `/search/results` → acquisition feeds, paginated at
-  `OPDS_PAGE_SIZE` (24, `src/utils/personalLibrary.ts`). 2.0 emits
-  `metadata.{numberOfItems,itemsPerPage,currentPage}` plus `publications[]`.
-- GET `/search` → OpenSearch description (1.x only; advertises `q`). The 2.0
-  feeds instead carry a templated `rel: "search"` link — see `opds2SearchLink`
-  for why it is spelled `?query={query}` and not `{?query}`. `/search/results`
-  therefore accepts **both** `q` and `query`.
-- GET `/books/:hash/download` → shares `streamPersonalBook` with `/library`.
-- GET `/books/:hash/cover` → local cover file, else redirect to `/images/books/:hiveId`.
-
-OPDS 2.0 publications use the exact rel strings KOReader matches:
-`http://opds-spec.org/acquisition`, `.../image`, `.../image/thumbnail`.
-Tests: `src/routes/opds.test.ts`.
-
-### `src/routes/og.tsx` (mounted at `/og`) — OG images (offloaded to og-render worker)
-
-- `/marketing`, `/book/:hiveId`, `/profile/:handle`, `/profile/:handle/stats/:year`, `/author/:author`, `/genre/:genre`, `/app` → `image/webp`, cached per-TTL
-
-A failed render **never 500s**: `makeOgResponse` serves `public/og-fallback.png`
-at 200 with `max-age=300` and records the cause on the wide event. Crawlers cache
-a failed preview, so a 500 here breaks a book's link previews indefinitely.
-`src/workers/og-render/client.ts` holds one worker per process; a timeout rejects
-only that render (recycling the worker after 3 consecutive timeouts) and the
-queue is capped at 32 pending. `OG_RENDER_OPTIONS.onError` suppresses takumi's
-`defaultErrorHandler`, which wrote unstructured `Failed to render image.` +
-raw DOMException dumps to stdout.
-
-### `src/routes/sync/kosync.ts` (mounted at `/kosync`) — KOReader sync (KOSync protocol)
-
-Implements the KOSync protocol for syncing reading progress from KOReader e-readers.
-Auth uses `x-auth-user` (Bluesky handle) + `x-auth-key`. The password is a
-deterministic `HMAC-SHA256(COOKIE_SECRET, "${did}:${version}")` (32-hex chars),
-where `version` is a per-user rotation counter in KV (`sync_token:{did}`, default 0) that the user can bump from Settings to invalidate a leaked password. KOReader
-transmits `md5(password)` as `x-auth-key`, so `src/middleware/sync-auth.ts`
-compares against the md5 of the derived value. `deriveSyncPassword` /
-`currentSyncPassword` / `rotateSyncToken` are exported for the Settings page.
-Progress is stored in the `sync_document` table and written optimistically to
-`user_book.bookProgress` (not dependent on the firehose). Deferred PDS writes are
-queued in KV (`sync_pending:{did}`) and flushed via the canonical
-`updateBookRecord` whenever a session agent is available (see
-`flushPendingSyncWrites` in `src/context.ts`). Documents auto-bridge to a book
-only on an **exact** `getHiveId` match (`src/utils/syncMatching.ts`); a miss
-leaves `hiveId` null and still syncs progress at the document level.
-
-**`NO_HIVE_MATCH` sentinel** (`src/utils/syncMatching.ts`, value `bk_none`):
-written to `sync_document.hiveId` when the user says a document has no BookHive
-counterpart. Read paths must surface it as `{ hiveId: null, dismissed: true }` so
-nothing links to `/books/bk_none`.
-
-- `POST /users/create` → returns 403 directing users to BookHive Settings
-- `GET /users/auth` → validates sync credentials
-- `PUT /syncs/progress` → push reading progress (upserts `sync_document`, exact-matches to BookHive books via `src/utils/syncMatching.ts`)
-- `GET /syncs/progress/:document` → pull progress for a document hash
-- `GET /syncs/documents` → list all synced documents
-
-### Other
-
-- `/xrpc/*` → `src/xrpc/router.ts` — AT Protocol XRPC endpoints (see below)
-
-Shared route helpers: `src/routes/lib.ts` — `cacheControl`, `searchBooks`,
-`ensureBookIdentifiersCurrent`, `refetchBooks`, `refetchBuzzes`, `refetchLists`,
-`syncFollowsIfNeeded`. `src/routes/index.ts` re-exports `searchBooks`,
-`mainRouter` (and a `@deprecated` `createRouter`).
+Serves personal library to e-readers. Auth via `src/middleware/opds-auth.ts` (HTTP Basic, same derived password as KOSync). **Dual-format**: OPDS 1.2 XML or 2.0 JSON based on `Accept` header.
+
+- GET `/` → root navigation feed
+- GET `/all`, `/shelves/:id`, `/search/results` → acquisition feeds (paginated at 24)
+- GET `/search` → OpenSearch description. Accepts both `q` and `query` params.
+- GET `/books/:hash/download`, `/books/:hash/cover`
+
+### `src/routes/og.tsx` (mounted at `/og`) — OG images
+
+- `/marketing`, `/book/:hiveId`, `/profile/:handle`, `/profile/:handle/stats/:year`, `/author/:author`, `/genre/:genre`, `/app` → `image/webp`
+
+Failed renders serve `public/og-fallback.png` at 200, never 500. `renderOnce` deduplicates concurrent requests for the same card. **No server-side OG cache** — Cloudflare is the cache. Do not add one without measuring the repeat rate (historically ~4%).
+
+### `src/routes/sync/kosync.ts` (mounted at `/kosync`) — KOReader sync
+
+Auth: `x-auth-user` (handle) + `x-auth-key` (md5 of HMAC-derived password). Progress stored in `sync_document`, bridged to `user_book.bookProgress`. Deferred PDS writes queued in KV and flushed when a session agent is available.
+
+- POST `/users/create` → 403 (directs to BookHive Settings)
+- GET `/users/auth` → validate credentials
+- PUT `/syncs/progress` → push progress; GET `/syncs/progress/:document` → pull progress
+- GET `/syncs/documents` → list all synced documents
+
+### Shared route helpers
+
+`src/routes/lib.ts` — `cacheControl`, `searchBooks`, `ensureBookIdentifiersCurrent`, `refetchBooks`, `refetchBuzzes`, `refetchLists`, `syncFollowsIfNeeded`.
 
 ## Server-Side Pages (`src/pages/`)
 
 Each file exports a Hono JSX component rendered server-side.
 
-| File                  | Renders                                                            |
-| --------------------- | ------------------------------------------------------------------ |
-| `layout.tsx`          | HTML shell — meta tags, asset injection, `<head>`/`<body>` wrapper |
-| `navbar.tsx`          | Top nav bar with user menu, search mount point                     |
-| `simple-navbar.tsx`   | Simplified nav bar variant                                         |
-| `sidebar.tsx`         | Sidebar layout component                                           |
-| `home.tsx`            | Landing/home page — hero, features, book list, buzzes              |
-| `marketing.tsx`       | Marketing landing page for logged-out users                        |
-| `searchResults.tsx`   | Search results page                                                |
-| `bookInfo.tsx`        | Book detail — status, rating, review, progress, recommendations    |
-| `profile.tsx`         | User profile — book shelves, stats                                 |
-| `shelves.tsx`         | Book shelves view                                                  |
-| `comments.tsx`        | Comments/reviews section                                           |
-| `feed.tsx`            | Activity feed (friends/all/tracking tabs)                          |
-| `readingStats.tsx`    | Reading stats by year                                              |
-| `settings.tsx`        | Account settings / delete account                                  |
-| `explore.tsx`         | Explore hub (genres + authors)                                     |
-| `genres.tsx`          | Genre directory                                                    |
-| `genreBooks.tsx`      | Books filtered by genre (paginated)                                |
-| `genreEmoji.ts`       | Genre → emoji mapping                                              |
-| `authorBooks.tsx`     | Books filtered by author (paginated)                               |
-| `authorDirectory.tsx` | Author directory                                                   |
-| `import.tsx`          | Import page with SSE progress                                      |
-| `library.tsx`         | Personal library — e-reader credentials, upload, book manager      |
-| `login.tsx`           | Login form                                                         |
-| `signup.tsx`          | Sign up form                                                       |
-| `app.tsx`             | iOS app landing page                                               |
-| `privacy-policy.tsx`  | Privacy policy                                                     |
-| `terms.tsx`           | Terms of service (`/legal`)                                        |
-| `pds.tsx`             | PDS info page (`/pds`)                                             |
-| `error.tsx`           | Error page                                                         |
+| File                  | Renders                                           |
+| --------------------- | ------------------------------------------------- |
+| `layout.tsx`          | HTML shell — meta tags, assets, `<head>`/`<body>` |
+| `navbar.tsx`          | Top nav bar with user menu, search mount point    |
+| `simple-navbar.tsx`   | Simplified nav bar variant                        |
+| `sidebar.tsx`         | Sidebar layout component                          |
+| `home.tsx`            | Authenticated home page                           |
+| `marketing.tsx`       | Marketing landing (logged-out)                    |
+| `searchResults.tsx`   | Search results                                    |
+| `bookInfo.tsx`        | Book detail                                       |
+| `profile.tsx`         | User profile + shelves                            |
+| `shelves.tsx`         | Book shelves view                                 |
+| `comments.tsx`        | Comments/reviews                                  |
+| `feed.tsx`            | Activity feed                                     |
+| `readingStats.tsx`    | Reading stats by year                             |
+| `settings.tsx`        | Account settings                                  |
+| `explore.tsx`         | Explore hub                                       |
+| `genres.tsx`          | Genre directory                                   |
+| `genreBooks.tsx`      | Books by genre (paginated, sortable)              |
+| `genreEmoji.ts`       | Genre → emoji mapping                             |
+| `authorBooks.tsx`     | Books by author (paginated)                       |
+| `authorDirectory.tsx` | Author directory                                  |
+| `import.tsx`          | CSV import page                                   |
+| `library.tsx`         | Personal library                                  |
+| `login.tsx`           | Login form                                        |
+| `signup.tsx`          | Sign up form                                      |
+| `app.tsx`             | iOS app landing                                   |
+| `privacy-policy.tsx`  | Privacy policy                                    |
+| `terms.tsx`           | Terms of service (`/legal`)                       |
+| `pds.tsx`             | PDS info page                                     |
+| `error.tsx`           | Error page                                        |
+
+Page utilities: `src/pages/utils/script.ts` (inline JS helper), `src/pages/utils/buildUrl.ts`.
 
 ### Shared Page Components (`src/pages/components/`)
 
-| File                       | What                                                                                              |
-| -------------------------- | ------------------------------------------------------------------------------------------------- |
-| `book.tsx`                 | Book card component                                                                               |
-| `BookCard.tsx`             | Composable book card                                                                              |
-| `buzz.tsx`                 | Buzz/comment display                                                                              |
-| `BookReview.tsx`           | Book review form/display                                                                          |
-| `EditableLibraryTable.tsx` | Library table with inline editing                                                                 |
-| `ProfileHeader.tsx`        | Profile header with avatar/stats                                                                  |
-| `LanguageSelect.tsx`       | Language picker (search/explore filters)                                                          |
-| `modal.tsx`                | Modal dialog (CSS-based)                                                                          |
-| `fallbackCover.tsx`        | Placeholder book cover                                                                            |
-| `AtTags.tsx`               | [AT Tags](https://tangled.org/chrisshank.com/at-tags/) `<meta name="at:...">` builder (see below) |
-| `cards/`                   | Sub-components: `Card.tsx`, `CardActions.tsx`, `StarDisplay.tsx`, `UserBlock.tsx`, `index.ts`     |
-
-Inline JS helper: `src/pages/utils/script.ts`
-
-**AT Tags** (`AtTags.tsx`): emits `<meta name="at:...">` tags declaring which
-ATProto records/identities a page maps to ([proposal](https://tangled.org/chrisshank.com/at-tags/)).
-`Layout` (`src/pages/layout.tsx`) always emits a site-wide `at:me` (the
-`BOOKHIVE_DID` constant in `src/constants.ts`, also served at
-`/.well-known/atproto-did`) and renders per-page tags from its `atTags?: AtTagsProps`
-prop, which routes pass via `c.render(..., { atTags })` (the `ContextRenderer`
-type in `src/routes/main.tsx` carries it). Currently set on: book detail
-(`at:canonical` → `hive_book.hiveBookAtUri`), profile (`at:author` → DID), and
-shelf view (`at:canonical` → list AT URI, `at:author` → owner DID). Built with
-hono's `html` template, **not** JSX `<meta>` elements, because hono/jsx dedupes
-head `<meta>` tags by `name` and would collapse the proposal's array semantics.
+| File                       | What                                              |
+| -------------------------- | ------------------------------------------------- |
+| `book.tsx`                 | Book card component                               |
+| `BookCard.tsx`             | Composable book card                              |
+| `buzz.tsx`                 | Buzz/comment display                              |
+| `BookReview.tsx`           | Book review form/display                          |
+| `EditableLibraryTable.tsx` | Library table with inline editing                 |
+| `ProfileHeader.tsx`        | Profile header with avatar/stats                  |
+| `LanguageSelect.tsx`       | Language picker                                   |
+| `modal.tsx`                | Modal dialog (CSS-based)                          |
+| `fallbackCover.tsx`        | Placeholder book cover                            |
+| `AtTags.tsx`               | AT Tags `<meta name="at:...">` builder            |
+| `cards/`                   | `Card`, `CardActions`, `StarDisplay`, `UserBlock` |
+
+**AT Tags** (`AtTags.tsx`): emits `<meta>` tags declaring ATProto records/identities a page maps to. Built with hono's `html` template (not JSX `<meta>`) because hono/jsx dedupes by `name`. Routes pass tags via `c.render(..., { atTags })`.
 
 ## Client-Side Components (`src/client/`)
 
 6 hydration islands, mounted in `src/client/index.tsx`:
 
-| Component        | Mount Point                        | File                                              |
-| ---------------- | ---------------------------------- | ------------------------------------------------- |
-| `SearchTrigger`  | `#mount-search-box` (navbar)       | `src/client/components/SearchBox.tsx`             |
-| `SearchPalette`  | `#mount-search-palette`            | `src/client/components/SearchPalette.tsx`         |
-| `StarRating`     | `#star-rating` (book page)         | `src/client/components/StarRating.tsx`            |
-| `ImportTableApp` | `#import-table` (import page)      | `src/client/components/import/ImportTableApp.tsx` |
-| `LibraryTable`   | `#mount-library-table` (profile)   | `src/client/components/LibraryTable.tsx`          |
-| `LibraryManager` | `#mount-library-manager` (library) | `src/client/components/LibraryManager.tsx`        |
-
-`SearchPalette` takes an optional `onSelectBook` prop: when set it acts as a
-book picker (select instead of navigate, no status buttons) — `LibraryManager`
-reuses it to link e-reader documents / personal books to hive books.
-
-`LibraryManager` owns the whole library body; its sub-components are in
-`src/client/components/library/`: `AnchoredMenu.tsx` (dropdown primitives),
-`ShelfTabs.tsx`, `PersonalBookCard.tsx` (grid card), `SyncDocumentSections.tsx`
-(triage strip + "Also tracking"), `types.ts`. Personal books and sync documents
-share the KOReader partial MD5, so a document with a matching file is folded
-into that book's grid card instead of listed separately. `SyncDocuments.tsx` was
-removed — `LibraryManager` absorbed it.
-
-`AnchoredMenu`/`MenuItem`/`MenuConfirm` are the house dropdown: no state, no
-outside-click listener, built from a `peer` checkbox + `<form>` reset. Prefer it
-over writing menu state. Don't switch it to the Popover API or CSS anchor
-positioning — both were tried and reverted; the file's header comment says why.
-
-All three library menus (book card, shelf tab, sync document row) use it; reach
-for it before writing menu state.
+| Component        | Mount Point              | File                                              |
+| ---------------- | ------------------------ | ------------------------------------------------- |
+| `SearchTrigger`  | `#mount-search-box`      | `src/client/components/SearchBox.tsx`             |
+| `SearchPalette`  | `#mount-search-palette`  | `src/client/components/SearchPalette.tsx`         |
+| `StarRating`     | `#star-rating`           | `src/client/components/StarRating.tsx`            |
+| `ImportTableApp` | `#import-table`          | `src/client/components/import/ImportTableApp.tsx` |
+| `LibraryTable`   | `#mount-library-table`   | `src/client/components/LibraryTable.tsx`          |
+| `LibraryManager` | `#mount-library-manager` | `src/client/components/LibraryManager.tsx`        |
 
-Non-mounted client components: `bookActions.tsx`, `ProgressBar.tsx` (imported by others).
+`LibraryManager` sub-components in `src/client/components/library/`: `AnchoredMenu.tsx`, `ShelfTabs.tsx`, `PersonalBookCard.tsx`, `SyncDocumentSections.tsx`, `types.ts`.
 
-Client hooks/utils:
+**`AnchoredMenu`/`MenuItem`/`MenuConfirm`** are the house dropdown: no state, `peer` checkbox + `<form>` reset. Don't switch to Popover API or CSS anchor positioning (both tried and reverted). All library menus use it.
 
-- `src/client/components/utils/useSearchBooks.ts` — search via XRPC
-- `src/client/components/utils/useDebounce.ts` — debounce hook
-- `src/client/components/utils/icons.tsx` — SVG icons
-- `src/client/utils/debounce.ts`, `throttle.ts` — utility functions
+Other client components: `bookActions.tsx`, `ProgressBar.tsx`.
+Client hooks/utils: `useSearchBooks.ts`, `useDebounce.ts`, `icons.tsx`, `debounce.ts`, `throttle.ts`.
 
 ## Data Layer
 
 ### Database (`src/db.ts`)
 
-SQLite via Kysely. Schema + all migrations (001–018) in one file. `createDb`
-sets WAL/perf PRAGMAs; migrations run with fsync disabled and a background
-`VACUUM` on startup. Exports `BookFields` (select list) and
-`syncHiveBookGenres()`.
-
-Kysely talks to `bun:sqlite` through `src/bun-sqlite-kysely.ts`. Its
-`isReaderStatement()` must return true for anything that produces rows —
-`SELECT` and `... RETURNING` — or those queries silently come back empty. It also
-rewrites Kysely's bare `begin` to **`BEGIN IMMEDIATE`** (`toImmediateTransaction`):
-a deferred transaction that later upgrades to a write fails with
-`SQLITE_BUSY_SNAPSHOT`, and the busy handler is never consulted for that case, so
-`PRAGMA busy_timeout` alone cannot cover it across cluster processes. See
-`src/bun-sqlite-kysely.test.ts`.
-
-| Table             | Purpose                   | Key columns                                                                                                                                                              |
-| ----------------- | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `user_book`       | User's book records       | uri (PK), cid, userDid, hiveId, title, authors, status, **stars**, review, startedAt, finishedAt, **owned**, bookProgress, previousReads (JSON re-read history)          |
-| `hive_book`       | Canonical book data       | id (HiveId, PK), title, authors (**tab-separated**), cover, thumbnail, description, rating, ratingsCount, series, meta, enrichedAt, identifiers, hiveBookAtUri, language |
-| `hive_book_genre` | Genre-to-book mapping     | hiveId, genre (UNIQUE pair). **Genres live ONLY here** — the old `hive_book.genres` column was dropped (mig 011)                                                         |
-| `book_id_map`     | ISBN/Goodreads cross-refs | hiveId (PK), isbn, isbn13, goodreadsId, updatedAt                                                                                                                        |
-| `buzz`            | Comments on books         | uri (PK), cid, userDid, hiveId, **comment**, bookUri, parentUri, createdAt                                                                                               |
-| `user_follows`    | Cached follow graph       | userDid, followsDid, followedAt, syncedAt, **isActive**                                                                                                                  |
-| `book_list`       | User-created book lists   | **uri (PK, AT URI)**, cid, userDid, name, description, ordered, tags, createdAt                                                                                          |
-| `book_list_item`  | Items in a book list      | **uri (PK, AT URI)**, cid, userDid, **listUri**, hiveId, position, embeddedTitle/Author/CoverUrl, identifiers                                                            |
-| `sync_document`   | E-reader sync progress    | id (PK), userDid, provider, documentHash (UNIQUE per user+provider), hiveId (nullable), filename, title, authors, progressData (JSON), createdAt, updatedAt              |
-| `enrich_queue`    | Pending Goodreads enrich  | **hiveId (PK — the dedupe)**, enqueuedAt, attempts, nextAttemptAt, claimedAt, lastError                                                                                  |
-
-Notes: `user_book` has no `rating` column (it's `stars`); `owned` is a boolean
-column, **not** a status (legacy `…#owned` status migrated to `owned=1`).
-`previousReads` (mig 015) is a JSON array of re-read history entries
-(`{ startedAt?, finishedAt }`), serialized by `hydrateUserBook`/
-`serializeUserBook` alongside `bookProgress`. Sync inflows persist any
-`previousReads` array present on incoming `buzz.bookhive.book` records: the
-ingester (`src/bsky/ingester.ts`) writes it, as do the re-sync route handlers
-`refetchBooks` (`src/routes/lib.ts`) and the admin PDS export/resync handler
-(`src/routes/admin.ts`). The local POST `/books/:hiveId` route and the import
-UI do not expose `previousReads` as user input (absent from their form
-schemas), and imports never synthesize it. The one local write that ever grows
-it is the server-side re-read rotation in `updateBookRecord`
-(`src/utils/getBook.ts`), which archives the prior finished dates into
-`previousReads` when a finished book is marked "Reading" again.
-`book_list*` are keyed by AT URI (`uri`/`listUri`), not numeric ids.
+SQLite via Kysely. Schema + all migrations (001–021) in one file. `createDb` sets WAL/perf PRAGMAs. `mmap_size` defaults to 0 (see `DB_MMAP_SIZE` in `src/env.ts`). Kysely talks to `bun:sqlite` through `src/bun-sqlite-kysely.ts`, which rewrites `begin` to `BEGIN IMMEDIATE` (deferred transactions fail with `SQLITE_BUSY_SNAPSHOT` across cluster processes).
+
+| Table                 | Purpose                   | Key columns                                                                                                                                                                                              |
+| --------------------- | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `user_book`           | User's book records       | uri (PK), userDid, hiveId, title, authors, status, **stars** (not `rating`), review, startedAt, finishedAt, **owned** (bool), bookProgress, previousReads (JSON)                                         |
+| `hive_book`           | Canonical book data       | id (HiveId, PK), title, authors (**tab-separated**), cover, thumbnail, description, rating, ratingsCount, series, meta, enrichedAt, enrichAttempts, enrichFailedAt, identifiers, hiveBookAtUri, language |
+| `hive_book_genre`     | Genre-to-book mapping     | hiveId, genre (UNIQUE pair). **Genres live ONLY here**                                                                                                                                                   |
+| `hive_book_fts`       | FTS5 search index         | External-content FTS5 over `hive_book(title, rawTitle, authors)`, trigger-maintained. Never written directly. **Rebuilt after VACUUM** — see below                                                       |
+| `hive_book_author`    | Author-to-book mapping    | hiveId, author, position (PK hiveId+author). Trigger-maintained. `position = 0` = first author                                                                                                           |
+| `book_id_map`         | ISBN/Goodreads cross-refs | hiveId (PK), isbn, isbn13, goodreadsId, updatedAt                                                                                                                                                        |
+| `buzz`                | Comments on books         | uri (PK), userDid, hiveId, **comment**, bookUri, parentUri, createdAt                                                                                                                                    |
+| `user_follows`        | Cached follow graph       | userDid, followsDid, followedAt, syncedAt, **isActive**                                                                                                                                                  |
+| `book_list`           | User-created book lists   | **uri (PK, AT URI)**, userDid, name, description, ordered, tags, createdAt                                                                                                                               |
+| `book_list_item`      | Items in a book list      | **uri (PK, AT URI)**, userDid, **listUri**, hiveId, position                                                                                                                                             |
+| `sync_document`       | E-reader sync progress    | id (PK), userDid, provider, documentHash (UNIQUE per user+provider), hiveId (nullable), filename, title, authors, progressData (JSON)                                                                    |
+| `enrich_queue`        | Pending Goodreads enrich  | **hiveId (PK — the dedupe)**, enqueuedAt, attempts, nextAttemptAt, claimedAt, lastError                                                                                                                  |
+| `personal_book`       | Uploaded ebook files      | contentHash (PK), userDid, filename, title, authors, format, hiveId (nullable), fileSize                                                                                                                 |
+| `personal_shelf`      | User's personal shelves   | id (PK, autoincrement), userDid, name, description                                                                                                                                                       |
+| `personal_shelf_item` | Books in personal shelves | shelfId, contentHash (PK pair)                                                                                                                                                                           |
+
+Notes: `book_list*` are keyed by AT URI, not numeric ids. `NO_HIVE_MATCH` sentinel (`bk_none`) on `sync_document.hiveId` means the user dismissed the match — read paths must surface as `{ hiveId: null, dismissed: true }`. `enqueueEnrichmentBatch` filters books with recent `enrichAttempts`/`enrichFailedAt` internally (7d cooldown).
+
+**The main DB is VACUUMed only when there is something to reclaim**
+(`src/context.ts`), gated on **its own** `freelist_count / page_count` against
+the shared `VACUUM_FREELIST_RATIO` (0.25) — not on anything about the KV.
+Measured against production (356,675 books, 1.62 GB) a VACUUM there costs
+**22.3s and frees nothing**: `freelist_count` is 0, because this file is
+essentially append-only. Keep it conditional; don't restore the unconditional
+VACUUM without re-reading `freelist_count` first.
+
+The KV (`vacuumKvIfBloated`) is the delete-heavy file — 1.94 GB holding 34.7 MB
+of live rows — and is gated slightly differently: it VACUUMs whenever the ratio
+is exceeded **or** `auto_vacuum` is not yet INCREMENTAL, because switching a
+file to incremental auto-vacuum only takes effect through a VACUUM. In practice
+that means one unconditional VACUUM the first time this ships, then bloat-driven
+after that, with `incremental_vacuum` on the 15-minute sweep in between.
+
+**`hive_book_fts` is rebuilt when that VACUUM does run** (`src/context.ts`). It is
+an external-content table keyed by `hive_book`'s _implicit_ rowid — `id` is
+TEXT, so it is not an INTEGER PRIMARY KEY alias — and SQLite documents that
+VACUUM "may change the ROWIDs of entries in any tables that do not have an
+explicit INTEGER PRIMARY KEY". If it ever does, every search result silently
+points at the wrong book. Measured on SQLite 3.51 rowids are preserved, and
+FTS5's own `'integrity-check'` does **not** detect this class of desync
+(verified against a deliberately shifted content table), so there is no cheap
+way to notice the day that changes. `'rebuild'` is ~1s at 356k rows, once, on
+the primary worker inside the startup barrier where VACUUM already runs.
 
 ### KV Cache (`src/sqlite-kv.ts`)
 
-SQLite-backed unstorage for: profiles, identity resolution, search results, auth sessions/state, follows sync timestamps, sync pending PDS writes.
-
-### Key Data Utilities
-
-| File                                                                                                                           | Purpose                                                                      |
-| ------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------- |
-| `src/utils/getBook.ts`                                                                                                         | Book record CRUD against user's PDS                                          |
-| `src/utils/getProfile.ts`                                                                                                      | Profile fetching from Bluesky                                                |
-| `src/utils/getFollows.ts`                                                                                                      | Follow graph sync                                                            |
-| `src/utils/enrichBookData.ts`                                                                                                  | Goodreads enrichment (semaphore-bounded, 45s deadline)                       |
-| `src/utils/enrichQueue.ts`                                                                                                     | `enrich_queue` producer + primary-worker drain (see below)                   |
-| `src/utils/semaphore.ts`                                                                                                       | Async concurrency limiter + `withTimeout`                                    |
-| `src/utils/circuitBreaker.ts`                                                                                                  | Three-state breaker (used by the WAF solver)                                 |
-| `src/utils/bookIdentifiers.ts`                                                                                                 | ISBN/ID normalization + persistence                                          |
-| `src/utils/bookProgress.ts`                                                                                                    | BookProgress serialization                                                   |
-| `src/utils/readThroughCache.ts`                                                                                                | KV read-through with TTL                                                     |
-| `src/utils/csv.ts`                                                                                                             | Goodreads/StoryGraph CSV parsers                                             |
-| `src/utils/lists.ts`                                                                                                           | Book list (shelf) CRUD against PDS                                           |
-| `src/utils/readingStats.ts`                                                                                                    | Reading stats aggregation by year                                            |
-| `src/utils/catalogBookService.ts`                                                                                              | Catalog backfill (admin)                                                     |
-| `src/utils/deleteAccount.ts`                                                                                                   | Account data deletion                                                        |
-| `src/utils/dbExport.ts`                                                                                                        | Sanitized DB/KV export (admin)                                               |
-| `src/utils/manifest.ts`                                                                                                        | Vite manifest → asset URLs                                                   |
-| `src/utils/getLanguages.ts`                                                                                                    | Language list/normalization                                                  |
-| `src/utils/importBook.ts`                                                                                                      | Import a single book record                                                  |
-| `src/utils/authorMatching.ts`                                                                                                  | Author name matching                                                         |
-| `src/utils/generateInitialsAvatar.ts`                                                                                          | SVG initials avatar                                                          |
-| `src/utils/syncMatching.ts`                                                                                                    | KOReader document → BookHive book matching (exact); `NO_HIVE_MATCH` sentinel |
-| `src/utils/syncBridge.ts`                                                                                                      | Bridge e-reader progress → user_book + queue PDS write                       |
-| `src/utils/personalLibrary.ts`                                                                                                 | Personal library file paths + `streamPersonalBook`                           |
-| `src/utils/htmlToText.ts`, `batchTransform.ts`, `lazy.ts`, `hiveBookGenres.ts`, `ensureBookCataloged.ts`, `uploadImageBlob.ts` | misc helpers                                                                 |
-
-## Types (`src/types.ts`)
-
-All shared TypeScript types: `HiveId`, `UserBook`, `HiveBook`, `Buzz`, `BookProgress`, `SearchResult`, `SyncDocumentRow`, `SyncProgressData`, etc.
-
-Constants: `src/constants.ts` — book status enums and display maps.
+SQLite-backed unstorage. Mounts: `search:` (in-memory LRU), `profile:`, `identity:`, `follows_sync:`, `auth_session:`, `auth_state:`, `book_lock:`, `sync_pending:`, `sync_token:`, `page:` (anon page cache). VACUUMed on startup by primary worker; incremental vacuum on 15-min sweep.
+
+### Key Utilities (`src/utils/`)
+
+| File                  | Purpose                                                                                                                                                                                                                                  |
+| --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `getBook.ts`          | Book record CRUD against user's PDS                                                                                                                                                                                                      |
+| `getProfile.ts`       | Profile fetching from Bluesky                                                                                                                                                                                                            |
+| `getFollows.ts`       | Follow graph sync                                                                                                                                                                                                                        |
+| `enrichBookData.ts`   | Goodreads enrichment (semaphore-bounded, 45s deadline)                                                                                                                                                                                   |
+| `enrichQueue.ts`      | `enrich_queue` producer + primary-worker drain. The `exhausted` gauge/heartbeat counts `hive_book.enrichFailedAt` inside the cooldown, **not** queue rows at MAX_ATTEMPTS — those are deleted as they exhaust, so that read was always 0 |
+| `semaphore.ts`        | Async concurrency limiter + `withTimeout`                                                                                                                                                                                                |
+| `circuitBreaker.ts`   | Three-state breaker                                                                                                                                                                                                                      |
+| `bookIdentifiers.ts`  | ISBN/ID normalization + persistence                                                                                                                                                                                                      |
+| `bookProgress.ts`     | BookProgress serialization                                                                                                                                                                                                               |
+| `readThroughCache.ts` | KV read-through with TTL                                                                                                                                                                                                                 |
+| `csv.ts`              | Goodreads/StoryGraph CSV parsers                                                                                                                                                                                                         |
+| `lists.ts`            | Book list (shelf) CRUD against PDS                                                                                                                                                                                                       |
+| `readingStats.ts`     | Reading stats aggregation by year                                                                                                                                                                                                        |
+| `imageProxy.ts`       | imgproxy signing + proxy helper                                                                                                                                                                                                          |
+| `personalLibrary.ts`  | Personal library paths, `streamPersonalBook`                                                                                                                                                                                             |
+| `bookMetadata/`       | Ebook metadata parsing (epub, mobi, fb2, cbz, cover extraction, KOReader hash)                                                                                                                                                           |
+| `bookMeta.ts`         | Book metadata utilities                                                                                                                                                                                                                  |
+| `syncMatching.ts`     | KOReader document → BookHive book matching; `NO_HIVE_MATCH` sentinel                                                                                                                                                                     |
+| `syncBridge.ts`       | Bridge e-reader progress → user_book + queue PDS write                                                                                                                                                                                   |
+| `ftsQuery.ts`         | FTS5 MATCH expression builder                                                                                                                                                                                                            |
+| `importBook.ts`       | Import a single book record                                                                                                                                                                                                              |
+| `authorMatching.ts`   | Author name matching                                                                                                                                                                                                                     |
+| `manifest.ts`         | Vite manifest → asset URLs                                                                                                                                                                                                               |
+| `xml.ts`              | XML utilities                                                                                                                                                                                                                            |
+| Other                 | `getLanguages.ts`, `catalogBookService.ts`, `deleteAccount.ts`, `dbExport.ts`, `generateInitialsAvatar.ts`, `htmlToText.ts`, `batchTransform.ts`, `lazy.ts`, `hiveBookGenres.ts`, `ensureBookCataloged.ts`, `uploadImageBlob.ts`         |
+
+## Types & Constants
+
+- `src/types.ts` — shared types: `HiveId`, `UserBook`, `HiveBook`, `Buzz`, `BookProgress`, `SearchResult`, `SyncDocumentRow`, etc.
+- `src/constants.ts` — book status enums and display maps
 
 ## AT Protocol / Bluesky
 
-| File                      | Purpose                                                                                          |
-| ------------------------- | ------------------------------------------------------------------------------------------------ |
-| `src/bsky/ingester.ts`    | Jetstream firehose — ingests book/buzz records from all users (runs in `ingester-worker` thread) |
-| `src/bsky/id-resolver.ts` | DID/handle resolution with caching                                                               |
-| `src/bsky/bookLookup.ts`  | Book identifier lookup + transformation                                                          |
-| `src/bsky/lexicon/`       | Generated types + validators (`generated/`) from lexicon schemas                                 |
-| `src/xrpc/router.ts`      | `createXrpcRouter` — all `/xrpc/*` methods (see below)                                           |
-| `lexicons/*.json`         | AT Protocol lexicon definitions (~27 files)                                                      |
-| `lex.config.ts`           | Lexicon codegen config (`bun run lexgen`)                                                        |
-
-### Records / collections
-
-- Books: `buzz.bookhive.book`; buzzes/comments: `buzz.bookhive.buzz`.
-- Lists reuse the **popfeed** collections: `social.popfeed.feed.list`,
-  `social.popfeed.feed.listItem` (only items with `creativeWorkType === "book"`).
-- Follows write `app.bsky.graph.follow`.
-
-### XRPC methods (`src/xrpc/router.ts`)
-
-Built on `@atcute/xrpc-server`; request context is passed via `AsyncLocalStorage`
-(`xrpcContextStorage`) from the Hono `ctx`. Ratings are transported as integers
-scaled ×10. Queries: `searchBooks`, `listGenres`, `getBookIdentifiers`,
-`getBook`, `getProfile`, `getLanguages`, `getExplore`, `getFeed`,
-`getAuthorBooks`, `getReadingStats`, `getUserLists`, `getList`. Auth-required
-list procedures: `createList`, `updateList`, `deleteList`, `addToList`,
-`removeFromList`, `reorderList` (delegate to `src/utils/lists.ts`).
-
-**Personal library** (all auth-required, all server-local — no PDS writes).
-Queries: `getPersonalLibrary`, `getPersonalBook`, `getSyncProgress`,
-`listSyncDocuments`. Procedures: `uploadPersonalBook`, `deletePersonalBook`,
-`linkPersonalBook`, `unlinkPersonalBook`, `putSyncProgress`,
-`createPersonalShelf`, `updatePersonalShelf`, `deletePersonalShelf`,
-`addToPersonalShelf`, `removeFromPersonalShelf`.
-
-`getPersonalLibrary` returns `{ books, total, cursor? }`; each book carries
-`progress` (joined from `sync_document`) and `shelfIds`. `linkPersonalBook`
-**overwrites** the file's `title`/`authors` from the hive book and propagates the
-`hiveId` onto the matching `sync_document`; `unlinkPersonalBook` clears both.
+| File                      | Purpose                                                          |
+| ------------------------- | ---------------------------------------------------------------- |
+| `src/bsky/ingester.ts`    | Jetstream firehose — ingests book/buzz records (ingester-worker) |
+| `src/bsky/id-resolver.ts` | DID/handle resolution with caching                               |
+| `src/bsky/bookLookup.ts`  | Book identifier lookup + transformation                          |
+| `src/bsky/lexicon/`       | Generated types + validators from lexicon schemas                |
+| `src/xrpc/router.ts`      | All `/xrpc/*` methods                                            |
+| `lexicons/*.json`         | AT Protocol lexicon definitions (~27 files)                      |
+| `lex.config.ts`           | Lexicon codegen config (`bun run lexgen`)                        |
+
+**Records**: Books `buzz.bookhive.book`, buzzes `buzz.bookhive.buzz`, lists `social.popfeed.feed.list`/`.listItem`, follows `app.bsky.graph.follow`.
+
+**XRPC queries**: `searchBooks`, `listGenres`, `getBookIdentifiers`, `getBook`, `getProfile`, `getLanguages`, `getExplore`, `getFeed`, `getAuthorBooks`, `getReadingStats`, `getUserLists`, `getList`.
+
+**XRPC list procedures**: `createList`, `updateList`, `deleteList`, `addToList`, `removeFromList`, `reorderList`.
+
+**XRPC personal library queries**: `getPersonalLibrary`, `getPersonalBook`, `getSyncProgress`, `listSyncDocuments`.
+
+**XRPC personal library procedures**: `uploadPersonalBook`, `deletePersonalBook`, `linkPersonalBook`, `unlinkPersonalBook`, `putSyncProgress`, `createPersonalShelf`, `updatePersonalShelf`, `deletePersonalShelf`, `addToPersonalShelf`, `removeFromPersonalShelf`.
 
 ## Scrapers (`src/scrapers/`)
 
@@ -515,143 +404,97 @@ Queries: `getPersonalLibrary`, `getPersonalBook`, `getSyncProgress`,
 | ------------------ | ---------------------------------------------- |
 | `goodreads.ts`     | Search API scraper                             |
 | `moreInfo.ts`      | Goodreads page scraper (genres, series, meta)  |
-| `google.ts`        | Google Books scraper                           |
-| `isbndb.ts`        | ISBNdb scraper                                 |
 | `getHiveId.ts`     | HiveId generation (hash of title+author)       |
 | `languageNames.ts` | Language name normalization                    |
 | `index.ts`         | `findBookDetails` entry point                  |
 | `waf/`             | AWS WAF challenge solver (see `waf/README.md`) |
+| `google.ts`        | Google Books scraper — **not wired up**        |
+| `isbndb.ts`        | ISBNdb scraper — **not wired up**              |
+
+`google.ts` and `isbndb.ts` are **tracked but not wired up** — nothing imports
+them and `findBookDetails` has no fallback branch that would reach them, so
+Goodreads is the only scraper actually running. They are kept deliberately, as
+the starting point for a fallback when Goodreads' WAF is rejecting us; treat
+them as reference material, not live code, and don't assume a Goodreads failure
+degrades to either one. `images.isbndb.com` stays in the `imageProxy` allowlist
+because historical `hive_book` rows still point there.
 
-**WAF solver pooling**: `waf/solver.ts` keeps a **pool of `SOLVER_POOL_SIZE` (4)
-persistent** workers rather than spawning one per scrape (each spawn was a fresh
-JS VM plus a ~1.3 MB `challenge.js`). Requests carry an `id` that the worker
-echoes back, so a late reply from an abandoned request can't resolve the next
-caller. Workers are recycled after 50 solves, on error, or on a 30s timeout. A
-`CircuitBreaker` in front opens after 5 consecutive (or 10/min) failures and
-stays open 15 min, dispatching nothing — Goodreads' WAF rejected ~90% of solves
-during the 2026-08-01 incident and the app retried into it 5,000+ times/day.
-Body reads are capped (`boundedText`: 3 MB pages, 4 MB `challenge.js`).
+The WAF solver's circuit breaker currently also gates the plain-HTTP fetch path. Splitting into separate breakers is the open fix.
 
 ## Auth (`src/auth/`)
 
-| File         | Purpose                                 |
-| ------------ | --------------------------------------- |
-| `router.tsx` | Login/logout/OAuth callback routes      |
-| `client.ts`  | OAuth client creation                   |
-| `storage.ts` | Session/state stores (unstorage-backed) |
-| `handle.ts`  | Handle validation                       |
+| File               | Purpose                                                       |
+| ------------------ | ------------------------------------------------------------- |
+| `router.tsx`       | Login/logout/OAuth callback routes                            |
+| `client.ts`        | OAuth client creation                                         |
+| `storage.ts`       | Session/state stores (unstorage-backed)                       |
+| `handle.ts`        | Handle validation                                             |
+| `refresh-lock.ts`  | Cross-process token-refresh lock (SQLite `auth_refresh_lock`) |
+| `restore-guard.ts` | Per-PDS timeout (5s) + circuit breaker around `restore()`     |
+
+**Key constraint**: `guardedRestore` wraps every OAuth restore in a 5s timeout + circuit breaker keyed by the authorization-server host. `getSessionAgent` only destroys sessions on terminal credential errors, never on timeouts.
 
 ## Middleware (`src/middleware/`)
 
-Applied globally in `src/app.ts`: timing, context, wide-event logging, error capture, asset URLs, secure headers, compression, JSX renderer, OpenTelemetry, Prometheus.
+Applied globally in `src/app.ts`. Key middleware:
+
+- `anon-page-cache.ts` — anonymous page cache (prod only)
+- `otel-middleware.ts` — OpenTelemetry route spans (renamed after `next()` to `METHOD /matched/:route`)
+- `sync-auth.ts` — KOSync auth (validates `x-auth-user`/`x-auth-key`). Exports `deriveSyncPassword`, `currentSyncPassword`, `rotateSyncToken`
+- `opds-auth.ts` — OPDS HTTP Basic auth (same derived password as KOSync)
 
-`src/middleware/sync-auth.ts` — KOSync auth middleware (validates `x-auth-user`/`x-auth-key` headers, resolves handle → DID, verifies `md5(derived password)`). Also exports `deriveSyncPassword()`, `currentSyncPassword()`, `getSyncTokenVersion()`, and `rotateSyncToken()` used by the Settings page.
+Tracing: app → OpenObserve directly (`server/plugins/otel-sdk.ts`). Two spans per request (nitro root + hono route).
 
 ## Styling
 
-- **Tailwind CSS v4** with `@tailwindcss/forms` and `tailwindcss-animated` plugins
+- **Tailwind CSS v4** with `@tailwindcss/forms` and `tailwindcss-animated`
 - Config: `tailwind.config.js` — custom `yello` color palette
-- PostCSS: `postcss.config.js`
 - Entry: `src/index.css`
-- CSS-only interactivity patterns: peer/checked selectors for tabs, dropdowns, modals
 
 ## Build & Dev
 
 | Command             | What                                                         |
 | ------------------- | ------------------------------------------------------------ |
-| `bun run dev`       | Dev server (`vp dev`)                                        |
+| `bun run dev`       | Dev server (`bunx --bun vp dev`)                             |
 | `bun run build`     | Production build (`lexgen` + `vp build`) → `.output/server/` |
 | `bun run start`     | Run built server (`bun run .output/server/index.mjs`)        |
-| `bun test`          | Run tests (`bun test src`)                                   |
-| `bun run typecheck` | `vp lint --type-aware --type-check` + `vp fmt --write`       |
+| `bun test`          | Run tests (`bun test src server`)                            |
+| `bun run typecheck` | `vp lint src --type-aware --type-check` + `vp fmt --write`   |
 | `bun run lint`      | Same as typecheck (oxlint/oxfmt via vp, **not** tsc)         |
 | `bun run format`    | `vp fmt`                                                     |
-| `bun run lexgen`    | Regenerate AT Protocol XRPC types from lexicons (`lex-cli`)  |
+| `bun run lexgen`    | Regenerate AT Protocol XRPC types from lexicons              |
 | `bun run seed:db`   | Seed/initialize the DB (`src/initialize.ts`)                 |
 
-Build pipeline: **Vite+ (vite-plus)** wrapping Vite 8 + Rolldown + Nitro
-(`nitro-nightly`, preset `bun`), Nitro server entry at `./server/server.ts` with
-otel/request-tracing plugins. Production builds swap the preset's runtime entry
-for `./server/entry.bun.mjs` (adds `reusePort: true`; build-only via the
-function-form `defineConfig` — dev keeps the nitro-dev entry). The Docker CMD
-is `bun run cluster.ts` (copied from `server/cluster.ts`), not the raw
-`.output/server/index.mjs`, under `ENTRYPOINT ["/sbin/tini", "--"]` — the
-supervisor is PID 1 and Bun has no `waitpid`, so without an init shim every
-HEALTHCHECK `wget` leaks a zombie (`init: true` in `compose.yaml` is the same
-fix from the other direction). `cluster.ts` logs a JSON `worker_exit` line with
-`signal`/`likely_oom`, which is how a cgroup OOM kill becomes visible in app
-logs at all. Vite plugins: `bunRuntimeExternal()`,
-`devImageProxyPassthrough()`, `tailwindcss()`, `standaloneBundles()`, `nitro()`.
-The client bundle entry is `src/client/index.tsx`; assets emitted to
-`assets/[name]-[hash]` with a build manifest (read via `src/utils/manifest.ts`).
-The `standaloneBundles()` plugin shells out to `bun build` for 4 worker entry
-points into `.output/server/workers/`: `ingester-worker.js`,
-`open-observe-worker.js`, `og-render-worker.js`, `import-worker.js`. Path alias
-`@` → `./src`. Runtime requires `bun >= 1.3.14`. TypeScript type checking via
-**tsgo** (TypeScript 6.x / Go-native compiler); linting via **oxlint** and
-formatting via **oxfmt**, both accessed through the `vp` CLI. Pre-commit hook
-(`.vite-hooks/pre-commit`) runs `vp staged` → `vp check --fix`.
-
-Notable deps: hono, kysely, zod 4, iron-session, unstorage + ocache, `@atcute/*`
-(atproto client/oauth/jetstream/identity), `@takumi-rs/image-response` + React 19
-(OG image render only), pino + `@hono/prometheus` + `@opentelemetry/*`,
-basecoat-css, envalid (env validation in `src/env.ts`).
+**Build pipeline**: Vite+ wrapping Vite 8 + Rolldown + Nitro (preset `bun`). Production builds use custom entry `server/entry.bun.mjs` (adds `reusePort: true`). Docker CMD is `server/cluster.ts` under `tini` init. The `standaloneBundles()` Vite plugin builds 4 worker entry points into `.output/server/workers/`. TypeScript type checking via **tsgo** (TS 6.x); linting via **oxlint**, formatting via **oxfmt**, both through the `vp` CLI. Path alias `@` → `./src`. Runtime requires `bun >= 1.3.14`. Pre-commit hook runs `vp staged` → `vp check --fix`.
 
-## iOS App (`app/`)
+Notable deps: hono, kysely, zod 4, iron-session, unstorage + ocache, `@atcute/*`, `@takumi-rs/image-response` + React 19 (OG only), pino, `@hono/prometheus`, `@opentelemetry/*`, basecoat-css, envalid.
 
-Separate Expo/React Native workspace with its own reference doc,
-`app/ARCHITECTURE.md` — update that file, not this one, when changing app
-screens, hooks, or components. Not relevant for web UI refactor.
+## iOS App (`app/`)
 
-The app consumes the personal-library and KOSync surfaces: the XRPC
-`*PersonalBook` / `*PersonalShelf` methods, the REST `/library/shelves`,
-`/library/sync/*` and `/settings/sync/*` routes, and the content-negotiated
-`POST /library/upload`. Changes to any of those are app-visible.
+Separate Expo/React Native workspace — see `app/ARCHITECTURE.md`. Consumes personal-library and KOSync surfaces (XRPC `*PersonalBook`/`*PersonalShelf` methods, REST `/library/*`, `/settings/sync/*`, `POST /library/upload`).
 
 ## Workers, Logging & Observability
 
-| Path                                 | Purpose                                                                                                            |
-| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------ |
-| `src/workers/ingester-worker.ts`     | Wraps `src/bsky/ingester.ts`; runs Jetstream ingest off-thread                                                     |
-| `src/workers/og-render/`             | OG image render worker (React + `@takumi-rs/image-response`)                                                       |
-| `src/workers/open-observe-worker.ts` | pino transport → OpenObserve log shipping                                                                          |
-| `src/workers/import/`                | CSV import processing worker (`index.ts`, `logic.ts`, tests)                                                       |
-| `src/logger/index.ts`                | pino logger (`getLogger`/`destroyLogger`); redacts cookies                                                         |
-| `src/metrics.ts`                     | prom-client metrics (image processing duration, active ops)                                                        |
-| `src/pds/client.ts`                  | Self-hosted PDS support                                                                                            |
-| `./server/`                          | Nitro server entry + plugins (`otel-sdk.ts`, `request-tracing.ts`, `html-cache-headers.ts`) — separate from `src/` |
-| `./server/entry.bun.mjs`             | Custom Nitro bun runtime entry (adds SO_REUSEPORT); prod builds only                                               |
-| `./server/cluster.ts`                | Multi-process supervisor (Docker CMD) — spawns `WEB_CONCURRENCY` workers                                           |
-
-Each worker is bundled standalone into `.output/server/workers/` (see Build &
-Dev). The ingester worker posts `wideEvent`/`ready` messages back to the main
-thread's pino logger.
+| Path                                 | Purpose                                                      |
+| ------------------------------------ | ------------------------------------------------------------ |
+| `src/workers/ingester-worker.ts`     | Jetstream ingest (off-thread)                                |
+| `src/workers/og-render/`             | OG image render (React + takumi)                             |
+| `src/workers/open-observe-worker.ts` | pino → OpenObserve log shipping                              |
+| `src/workers/import/`                | CSV import processing                                        |
+| `src/logger/index.ts`                | pino logger; redacts cookies                                 |
+| `src/metrics.ts`                     | Prometheus metrics                                           |
+| `src/pds/client.ts`                  | Self-hosted PDS support                                      |
+| `server/cluster.ts`                  | Multi-process supervisor (Docker CMD)                        |
+| `server/worker-exit.ts`              | Exit classification + procfs memory read                     |
+| `server/entry.bun.mjs`               | Custom Nitro entry (SO_REUSEPORT)                            |
+| `server/plugins/`                    | `otel-sdk.ts`, `request-tracing.ts`, `html-cache-headers.ts` |
+
+Per-process metrics carry a `worker` label from `WORKER_INDEX`. Memory debugging: use `Anonymous` (not `Rss`) — RSS includes reclaimable SQLite mmap. `/debug/memory` separates them.
 
 ## Context & Session (`src/context.ts`)
 
-`AppContext` — singleton app deps: `db`, `kv`, `ingester`, `oauthClient`,
-`resolver`/`baseIdResolver` (DID/handle), `getSessionDid()` (fast cookie-only
-DID), `getSessionAgent()` (OAuth `SessionClient`), `getProfile()`,
-`serviceAccountAgent` (for `@bookhive.buzz` writes, when
-`BOOKHIVE_SERVICE_HANDLE`/`BOOKHIVE_APP_PASSWORD` set), `addWideEventContext`.
-
-Hono context vars (`c.get`): `ctx`, `assetUrls`, `requestId`, `wideEventBag`,
-`appLogger`, `requestError`.
-
-`createAppDeps()` builds the logger, DB (+migrate +background VACUUM — primary
-worker only), the shared KV (single SQLite connection, unstorage mounts:
-`search:` (in-memory LRU), `profile:`, `identity:`, `follows_sync:`,
-`auth_session:`, `auth_state:`, `book_lock:` (SQLite — shared across worker
-processes; readers treat rows >60s old as stale), `sync_pending:` /
-`sync_token:` (SQLite — KOSync deferred PDS writes + per-user token rotation
-counter), `page:` (SQLite — anon page
-cache)), OAuth client, caching ID resolvers, and (primary only) spawns the
-ingester worker and starts the enrichment drain (`stopEnrichmentDrain` on the
-deps is called from `src/server.ts`'s shutdown). Sessions use
-`iron-session` (180-day cookie) with an in-memory `SessionClient` cache and
-auto token refresh; cached clients are wrapped so a
-"session was deleted by another process" refresh failure (another cluster
-process rotated it first) evicts the entry, re-restores once and retries instead
-of 500ing. `getProfile` is read-through cached (`profile:` + did, 24h
-revalidate / 30d TTL). `createContextMiddleware(deps)` wires per-request `ctx`
-with lazy session/DID/profile resolution.
+`AppContext` — singleton deps: `db`, `kv`, `ingester`, `oauthClient`, `resolver`/`baseIdResolver`, `getSessionDid()` (fast cookie-only DID), `getSessionAgent()` (OAuth session), `getProfile()`, `serviceAccountAgent`, `addWideEventContext`.
+
+Hono context vars (`c.get`): `ctx`, `assetUrls`, `requestId`, `wideEventBag`, `appLogger`, `requestError`.
+
+`createAppDeps()` builds deps and (primary only) spawns the ingester + enrichment drain. Sessions use `iron-session` (180-day cookie) with an in-memory `SessionClient` cache. `getProfile` is read-through cached (24h revalidate / 30d TTL).
diff --git a/Dockerfile b/Dockerfile
index c625132..87834ba 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,6 +26,8 @@ USER bun
 # Nitro bundles all JS and traces native deps (@takumi-rs/core) into .output/server/node_modules — no bun install needed
 COPY --chown=bun:bun --from=build /usr/src/app/.output ./.output
 COPY --chown=bun:bun --from=build /usr/src/app/server/cluster.ts ./cluster.ts
+# cluster.ts imports this at runtime; it must sit next to it.
+COPY --chown=bun:bun --from=build /usr/src/app/server/worker-exit.ts ./worker-exit.ts
 EXPOSE 8080
 # start-period covers migrations on worker 0 plus the staggered sibling spawn
 HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
diff --git a/bunfig.toml b/bunfig.toml
index cd45629..c9408fd 100644
--- a/bunfig.toml
+++ b/bunfig.toml
@@ -1,2 +1,6 @@
 [test]
-root = "src"
+# Was "src", which silently made server/ untestable — server/worker-exit.ts
+# shipped a bug that mislabelled every OOM kill for a month. Scripts pass the
+# directories explicitly (`bun test src server`) so app/'s React Native suites,
+# which use the jest preset rather than bun's runner, stay out of the way.
+root = "."
diff --git a/compose.yaml b/compose.yaml
index 089c4fe..20ebe47 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -43,6 +43,15 @@ services:
       - "5080:5080"
     volumes:
       - telem_data:/data
+    # No healthcheck, and deliberately not a `depends_on` for the server.
+    # Two reasons, both checked rather than assumed:
+    #  1. The image is distroless — no /bin/sh, no curl, no wget (verified on
+    #     the host), so any `test:` here would report permanently unhealthy and
+    #     make `docker ps` lie in the opposite direction.
+    #  2. The app must not refuse to boot because its telemetry backend is
+    #     down. The log transport already tolerates connection-refused and the
+    #     OTLP exporter retries; gating startup on OpenObserve would turn
+    #     observability into a SPOF for the product.
   otel-collector:
     image: otel/opentelemetry-collector-contrib:latest
     restart: unless-stopped
@@ -94,7 +103,11 @@ services:
       PDS_ADMIN_PASSWORD: "CHANGE_ME_admin_password"
       OPEN_OBSERVE_USER: "user@bookhive.buzz"
       OPEN_OBSERVE_PASSWORD: "password"
-      OPEN_OBSERVE_URL: "http://localhost:5080"
+      # Must be container-reachable: inside this container `localhost` is the
+      # app itself, not OpenObserve. Both the logs transport and the OTLP trace
+      # exporter derive their endpoints from this, so a wrong value silently
+      # disables observability rather than failing loudly.
+      OPEN_OBSERVE_URL: "http://openobserve:5080"
       IMGPROXY_URL: "http://imgproxy:8080"
       IMGPROXY_KEY: "CHANGE_ME_imgproxy_key_hex"
       IMGPROXY_SALT: "CHANGE_ME_imgproxy_salt_hex"
@@ -104,7 +117,8 @@ services:
       - data:/data
     # Leave the other ~4 host CPUs for pds/imgproxy/openobserve and future services.
     cpus: "4"
-    # ~1GB shared SQLite mmap page cache + ~300MB private per worker.
+    # ~300-400MB anonymous per worker. The old budget assumed a ~1GB SQLite
+    # mmap on top; DB_MMAP_SIZE now defaults to 0, so that term is gone.
     mem_limit: 3g
 # The commented out section below is an example of how to define a PostgreSQL
 # database that your application can use. `depends_on` tells Docker Compose to
diff --git a/package.json b/package.json
index eefd677..a31d317 100644
--- a/package.json
+++ b/package.json
@@ -11,8 +11,8 @@
     "dev": "bunx --bun vp dev",
     "build": "bun --bun run lexgen && bunx --bun vp build",
     "preview": "bun run .output/server/index.mjs",
-    "test": "bun test src",
-    "test:run": "bun test src --no-watch",
+    "test": "bun test src server",
+    "test:run": "bun test src server --no-watch",
     "lint": "vp lint src --type-aware --type-check && vp fmt --write",
     "typecheck": "vp lint src --type-aware --type-check && vp fmt --write",
     "format": "vp fmt",
diff --git a/server/cluster.ts b/server/cluster.ts
index 77ad265..625f3bd 100644
--- a/server/cluster.ts
+++ b/server/cluster.ts
@@ -10,9 +10,10 @@
  * must pass /healthcheck before the siblings spawn — that ordering is the
  * migration barrier for the non-primary workers.
  *
- * Not bundled — the Dockerfile copies this file verbatim and Bun runs the TS
- * source directly. Zero dependencies.
+ * Not bundled — the Dockerfile copies this file and ./worker-exit.ts verbatim
+ * and Bun runs the TS source directly. Zero external dependencies.
  */
+import { classifyWorkerExit, readProcessMemoryKb } from "./worker-exit.ts";
 
 const concurrency = Math.max(1, Number(process.env["WEB_CONCURRENCY"]) || 4);
 const port = process.env["PORT"] ?? "8080";
@@ -27,45 +28,46 @@ function log(message: string) {
 }
 
 /**
- * Worker deaths were invisible: the app logged 82 errors against 171,145
- * user-visible 502s on 2026-08-01 because the failure mode was process death,
- * not an exception. A cgroup OOM kill arrives as signal SIGKILL with a null
- * exit code, so emit it as a JSON line the log pipeline can count.
+ * Last memory sample per worker index. `/proc/<pid>` is gone by the time
+ * `onExit` fires, so a worker killed for using 2 GB would otherwise report no
+ * memory at all — exactly the number an OOM investigation needs.
  */
-// Bun reports signalCode as a number.
-const SIGNAL_NAMES: Record<number, string> = {
-  2: "SIGINT",
-  6: "SIGABRT",
-  9: "SIGKILL",
-  11: "SIGSEGV",
-  15: "SIGTERM",
-};
+const lastMemory = new Map<number, { rss_kb?: number; anon_kb?: number }>();
+const MEMORY_SAMPLE_MS = 15_000;
 
-function signalName(signalCode: number | null): string | null {
-  if (signalCode === null) return null;
-  return SIGNAL_NAMES[signalCode] ?? `SIG${signalCode}`;
+function sampleWorkerMemory() {
+  for (const [index, proc] of children) {
+    const sample = readProcessMemoryKb(proc.pid);
+    if (sample) lastMemory.set(index, sample);
+  }
 }
 
+/** Emits the structured line and hands the classification back, so the
+ *  human-readable restart message below reads the same `likely_oom` rather than
+ *  re-deriving it from the raw signal — that duplicate condition is how the
+ *  two logs could disagree about whether a kill was an OOM. */
 function logWorkerExit(
   index: number,
+  pid: number | null,
   exitCode: number | null,
-  signalCode: number | null,
+  signalCode: number | string | null | undefined,
   uptimeMs: number,
 ) {
-  const signal = signalName(signalCode);
-  console.error(
-    JSON.stringify({
-      level: 50,
-      time: Date.now(),
-      msg: "worker_exit",
-      worker: index,
-      code: exitCode,
-      signal,
-      // A cgroup OOM kill arrives as SIGKILL with no exit code.
-      likely_oom: signal === "SIGKILL",
-      uptime_ms: uptimeMs,
-    }),
-  );
+  const event = classifyWorkerExit({
+    index,
+    pid,
+    exitCode,
+    signalCode,
+    uptimeMs,
+    memory: lastMemory.get(index) ?? null,
+  });
+  // Drop the sample now that it has been read. Indices are reused by the
+  // restarted worker, and the next sampler tick is up to 15s away — without
+  // this, a worker that dies inside that window reports its *predecessor's*
+  // memory, which is the most misleading possible number during a crash loop.
+  lastMemory.delete(index);
+  console.error(JSON.stringify({ time: Date.now(), ...event }));
+  return event;
 }
 
 function spawnWorker(index: number) {
@@ -75,11 +77,17 @@ function spawnWorker(index: number) {
     env: { ...process.env, WORKER_INDEX: String(index) },
     stdout: "inherit",
     stderr: "inherit",
-    onExit(_proc, exitCode, signalCode) {
+    onExit(exited, exitCode, signalCode) {
       children.delete(index);
       // A SIGTERM we sent ourselves is not a failure — don't page on it.
       if (shuttingDown) return;
-      logWorkerExit(index, exitCode, signalCode, Date.now() - startedAt);
+      const exit = logWorkerExit(
+        index,
+        exited?.pid ?? null,
+        exitCode,
+        signalCode,
+        Date.now() - startedAt,
+      );
       const now = Date.now();
       const recent = (restartTimes.get(index) ?? []).filter((t) => now - t < 60_000);
       recent.push(now);
@@ -90,11 +98,11 @@ function spawnWorker(index: number) {
         return;
       }
       const backoffMs = Math.min(1000 * 2 ** (recent.length - 1), 15_000);
-      const signal = signalName(signalCode);
+      const anon = exit.anon_kb;
       log(
-        `worker ${index} exited (code ${exitCode}, signal ${signal ?? "none"}${
-          signal === "SIGKILL" ? ", likely OOM" : ""
-        }), restarting in ${backoffMs}ms`,
+        `worker ${index} exited (code ${exitCode}, signal ${exit.signal ?? "none"}${
+          exit.likely_oom ? ", likely OOM" : ""
+        }${anon ? `, last anon ${Math.round(anon / 1024)}MB` : ""}), restarting in ${backoffMs}ms`,
       );
       setTimeout(() => spawnWorker(index), backoffMs);
     },
@@ -137,6 +145,9 @@ function shutdown(code: number) {
 process.on("SIGTERM", () => shutdown(0));
 process.on("SIGINT", () => shutdown(0));
 
+const memoryTimer = setInterval(sampleWorkerMemory, MEMORY_SAMPLE_MS);
+memoryTimer.unref?.();
+
 spawnWorker(0);
 if (concurrency > 1) {
   await waitForPrimaryHealthy();
diff --git a/server/plugins/otel-sdk.ts b/server/plugins/otel-sdk.ts
index 734973a..937a85c 100644
--- a/server/plugins/otel-sdk.ts
+++ b/server/plugins/otel-sdk.ts
@@ -1,6 +1,14 @@
 /**
  * Nitro plugin: OpenTelemetry SDK lifecycle.
  * Starts the SDK on boot and shuts it down gracefully on close.
+ *
+ * Traces reach OpenObserve at `${OPEN_OBSERVE_URL}/api/bookhive/v1/traces`, so
+ * `OPEN_OBSERVE_URL` must be **container-reachable** — `http://openobserve:5080`
+ * on the shared `backbone` network. Never `localhost`, which inside this
+ * container is the app itself. The repo's compose.yaml said `localhost` while
+ * the deployment said `openobserve`, and that mismatch is exactly how this
+ * pipeline was once misdiagnosed as dead. It is not: verified 2026-08-02, the
+ * `traces/default` stream holds 13.7M spans and is current.
  */
 import { definePlugin } from "nitro";
 import { NodeSDK } from "@opentelemetry/sdk-node";
@@ -25,7 +33,20 @@ export default definePlugin((nitroApp) => {
   const sdk = new NodeSDK({
     serviceName: "bookhive",
     traceExporter,
-    instrumentations: [getNodeAutoInstrumentations()],
+    instrumentations: [
+      getNodeAutoInstrumentations({
+        // A span per filesystem operation. Every static asset read, every
+        // SQLite-adjacent stat, in every worker — the standard advice is to
+        // leave this off, and an unconfigured `getNodeAutoInstrumentations()`
+        // turns it on.
+        "@opentelemetry/instrumentation-fs": { enabled: false },
+        // Inbound requests already get a root span from request-tracing.ts and
+        // a route span from src/middleware/otel-middleware.ts. A third would be
+        // noise. Outbound stays on: a PDS that stops answering and Goodreads
+        // refusing us are precisely what the incidents were about.
+        "@opentelemetry/instrumentation-http": { ignoreIncomingRequestHook: () => true },
+      }),
+    ],
   });
 
   if (!env.isDev) {
diff --git a/server/worker-exit.test.ts b/server/worker-exit.test.ts
new file mode 100644
index 0000000..757d043
--- /dev/null
+++ b/server/worker-exit.test.ts
@@ -0,0 +1,147 @@
+import { describe, it, expect } from "bun:test";
+import { classifyWorkerExit, readProcessMemoryKb, signalName } from "./worker-exit.ts";
+
+describe("signalName", () => {
+  // The bug: Bun passes the signal *name*, its types claim a number, and the
+  // number-keyed lookup fell through to `SIG${code}` — producing "SIGSIGKILL"
+  // in production for every one of 148 OOM kills.
+  it("passes through a name Bun already prefixed", () => {
+    expect(signalName("SIGKILL")).toBe("SIGKILL");
+    expect(signalName("SIGTERM")).toBe("SIGTERM");
+  });
+
+  it("still maps a numeric code, in case Bun's types become honest", () => {
+    expect(signalName(9)).toBe("SIGKILL");
+    expect(signalName(15)).toBe("SIGTERM");
+  });
+
+  it("is null for a clean exit", () => {
+    expect(signalName(null)).toBeNull();
+    expect(signalName(undefined)).toBeNull();
+  });
+
+  it("prefixes a bare name", () => {
+    expect(signalName("KILL")).toBe("SIGKILL");
+  });
+});
+
+describe("classifyWorkerExit", () => {
+  it("flags a cgroup OOM kill", () => {
+    const event = classifyWorkerExit({
+      index: 1,
+      pid: 4242,
+      exitCode: null,
+      signalCode: "SIGKILL",
+      uptimeMs: 775_653,
+    });
+
+    expect(event.signal).toBe("SIGKILL");
+    expect(event.likely_oom).toBe(true);
+    expect(event.msg).toBe("worker_exit");
+    expect(event.level).toBe(50);
+    expect(event.worker).toBe(1);
+    expect(event.pid).toBe(4242);
+    expect(event.uptime_ms).toBe(775_653);
+  });
+
+  it("does not flag a graceful exit as an OOM", () => {
+    const event = classifyWorkerExit({
+      index: 0,
+      exitCode: 0,
+      signalCode: null,
+      uptimeMs: 1_000,
+    });
+    expect(event.signal).toBeNull();
+    expect(event.likely_oom).toBe(false);
+  });
+
+  it("does not flag SIGTERM as an OOM", () => {
+    const event = classifyWorkerExit({
+      index: 0,
+      exitCode: null,
+      signalCode: "SIGTERM",
+      uptimeMs: 1_000,
+    });
+    expect(event.likely_oom).toBe(false);
+  });
+
+  it("does not flag a SIGKILL that carried an exit code", () => {
+    // Something other than the kernel's OOM killer produced this.
+    const event = classifyWorkerExit({
+      index: 0,
+      exitCode: 137,
+      signalCode: "SIGKILL",
+      uptimeMs: 1_000,
+    });
+    expect(event.likely_oom).toBe(false);
+  });
+
+  it("carries the last memory sample so a kill is attributable", () => {
+    const event = classifyWorkerExit({
+      index: 2,
+      exitCode: null,
+      signalCode: "SIGKILL",
+      uptimeMs: 700_000,
+      memory: { rss_kb: 2_580_000, anon_kb: 1_779_772 },
+    });
+    expect(event.anon_kb).toBe(1_779_772);
+    expect(event.rss_kb).toBe(2_580_000);
+  });
+
+  it("omits memory fields entirely when there is no sample", () => {
+    const event = classifyWorkerExit({
+      index: 0,
+      exitCode: null,
+      signalCode: "SIGKILL",
+      uptimeMs: 1,
+      memory: null,
+    });
+    expect("anon_kb" in event).toBe(false);
+    expect("rss_kb" in event).toBe(false);
+  });
+
+  it("serializes to a single JSON log line", () => {
+    const line = JSON.parse(
+      JSON.stringify(
+        classifyWorkerExit({
+          index: 1,
+          exitCode: null,
+          signalCode: "SIGKILL",
+          uptimeMs: 5,
+        }),
+      ),
+    );
+    expect(line.msg).toBe("worker_exit");
+    expect(line.signal).toBe("SIGKILL");
+    expect(line.likely_oom).toBe(true);
+  });
+});
+
+describe("readProcessMemoryKb", () => {
+  const SMAPS = [
+    "Rss:             1624780 kB",
+    "Pss:             1019518 kB",
+    "Shared_Clean:    1028192 kB",
+    "Private_Dirty:    554892 kB",
+    "Anonymous:        554892 kB",
+  ].join("\n");
+
+  it("parses Rss and Anonymous out of smaps_rollup", () => {
+    expect(readProcessMemoryKb(1, () => SMAPS)).toEqual({
+      rss_kb: 1_624_780,
+      anon_kb: 554_892,
+    });
+  });
+
+  it("returns null off Linux, where procfs does not exist", () => {
+    expect(
+      readProcessMemoryKb(1, () => {
+        throw new Error("ENOENT");
+      }),
+    ).toBeNull();
+  });
+
+  it("returns null for output with neither field", () => {
+    expect(readProcessMemoryKb(1, () => "Pss: 12 kB")).toBeNull();
+  });
+});
diff --git a/server/worker-exit.ts b/server/worker-exit.ts
new file mode 100644
index 0000000..29561b4
--- /dev/null
+++ b/server/worker-exit.ts
@@ -0,0 +1,111 @@
+/**
+ * Classification of a worker process exit, split out of `cluster.ts` so it can
+ * be unit-tested. Zero dependencies — the Dockerfile copies this file verbatim
+ * next to `cluster.ts` and Bun runs the TS source directly.
+ *
+ * Worker deaths were effectively invisible: the app logged 82 error-level lines
+ * against 171,145 user-visible 502s on 2026-08-01, because the failure mode was
+ * process death rather than an exception. A cgroup OOM kill arrives as SIGKILL
+ * with a null exit code and never touches the container's RestartCount, so this
+ * JSON line is the only in-app signal that it happened.
+ */
+import { readFileSync } from "node:fs";
+
+/**
+ * Bun's `Bun.spawn` `onExit` hands back the signal *name* (`"SIGKILL"`), not a
+ * number — its own type declaration says `number`, which is what the original
+ * code trusted. `SIGNAL_NAMES["SIGKILL"]` missed, fell through to the
+ * `` `SIG${code}` `` fallback and produced **`"SIGSIGKILL"`**, so
+ * `likely_oom` was permanently false and the runbook's page condition
+ * (`worker_exit AND likely_oom=true`) could never fire — through 148 OOM kills.
+ *
+ * Both shapes are handled here so a future Bun release that makes the types
+ * honest doesn't silently reintroduce the bug.
+ */
+const SIGNAL_NAMES: Record<number, string> = {
+  2: "SIGINT",
+  6: "SIGABRT",
+  9: "SIGKILL",
+  11: "SIGSEGV",
+  15: "SIGTERM",
+};
+
+export function signalName(signalCode: number | string | null | undefined): string | null {
+  if (signalCode === null || signalCode === undefined) return null;
+  if (typeof signalCode === "string") {
+    return signalCode.startsWith("SIG") ? signalCode : `SIG${signalCode}`;
+  }
+  return SIGNAL_NAMES[signalCode] ?? `SIG${signalCode}`;
+}
+
+export type WorkerExitEvent = {
+  level: 50;
+  msg: "worker_exit";
+  worker: number;
+  pid: number | null;
+  code: number | null;
+  signal: string | null;
+  likely_oom: boolean;
+  uptime_ms: number;
+  rss_kb?: number;
+  anon_kb?: number;
+};
+
+export function classifyWorkerExit(args: {
+  index: number;
+  pid?: number | null;
+  exitCode: number | null;
+  signalCode: number | string | null | undefined;
+  uptimeMs: number;
+  memory?: { rss_kb?: number; anon_kb?: number } | null;
+}): WorkerExitEvent {
+  const signal = signalName(args.signalCode);
+  return {
+    level: 50,
+    msg: "worker_exit",
+    worker: args.index,
+    pid: args.pid ?? null,
+    code: args.exitCode,
+    signal,
+    // A cgroup OOM kill is SIGKILL with no exit code. A SIGKILL that *does*
+    // carry an exit code came from somewhere else and shouldn't page as an OOM.
+    likely_oom: signal === "SIGKILL" && args.exitCode === null,
+    uptime_ms: args.uptimeMs,
+    ...(args.memory?.rss_kb !== undefined ? { rss_kb: args.memory.rss_kb } : {}),
+    ...(args.memory?.anon_kb !== undefined ? { anon_kb: args.memory.anon_kb } : {}),
+  };
+}
+
+/**
+ * Memory footprint of a live worker, read from procfs.
+ *
+ * Must be sampled *while the worker is running* — by the time `onExit` fires,
+ * `/proc/<pid>` is gone, which is why the supervisor polls and reports the last
+ * sample rather than reading on death.
+ *
+ * `Anonymous` is the number that matters. A worker's `Rss` also counts the
+ * ~1 GB clean, shared, file-backed SQLite mmap, which is reclaimable; that term
+ * is what made per-worker RSS readings look alarming during the incident while
+ * the actual anonymous growth went unattributed. Returns null off Linux (dev).
+ */
+export function readProcessMemoryKb(
+  pid: number,
+  readFile: (path: string) => string = defaultReadFile,
+): { rss_kb?: number; anon_kb?: number } | null {
+  try {
+    const text = readFile(`/proc/${pid}/smaps_rollup`);
+    const rss = /^Rss:\s+(\d+) kB$/m.exec(text);
+    const anon = /^Anonymous:\s+(\d+) kB$/m.exec(text);
+    if (!rss && !anon) return null;
+    return {
+      ...(rss?.[1] ? { rss_kb: Number(rss[1]) } : {}),
+      ...(anon?.[1] ? { anon_kb: Number(anon[1]) } : {}),
+    };
+  } catch {
+    return null;
+  }
+}
+
+function defaultReadFile(path: string): string {
+  return readFileSync(path, "utf8");
+}
diff --git a/src/app.ts b/src/app.ts
index da08fca..0a02bfe 100644
--- a/src/app.ts
+++ b/src/app.ts
@@ -107,8 +107,36 @@ export function createApp({ startTime: serverStartTime, deps }: CreateAppOptions
   app.route("/debug", debugRoutes);
   app.route("/import", importRoutes);
 
-  // TODO enable etag for everything but import route
-  app.use(etag());
+  // Kept for HTML, images and OG cards, which are small and benefit from 304s.
+  //
+  // Not for ebook downloads. hono's etag does `res.clone()` and drains one tee
+  // branch through the digest while nothing reads the other, so the entire body
+  // is buffered in native memory before a single byte reaches the client —
+  // measured at 134 MB of arrayBuffers for a 120 MB download, and it defeats
+  // streaming outright. Those routes set their own ETag from the stored
+  // contentHash (see streamPersonalBook), so clients keep their 304s.
+  //
+  // `/import` is listed too, even though mounting it above this line already
+  // keeps it out. Relying on mount order alone means a future reorder silently
+  // hangs the import SSE stream forever — it never ends, so the digest never
+  // completes and no byte is ever flushed. That failure is severe and would
+  // look like "import is broken" rather than "etag is misconfigured", so it is
+  // worth being order-independent about.
+  const ETAG_EXCLUDED_PREFIXES = ["/library/books/", "/opds/books/", "/import"];
+  const isEtagExcluded = (path: string) =>
+    ETAG_EXCLUDED_PREFIXES.some(
+      (prefix) =>
+        // Exact or path-segment match, so "/importer" wouldn't be caught by
+        // "/import" if such a route were ever added.
+        path === prefix || path.startsWith(prefix.endsWith("/") ? prefix : `${prefix}/`),
+    );
+  const etagMiddleware = etag();
+  app.use("*", async (c, next) => {
+    if (isEtagExcluded(c.req.path)) {
+      return next();
+    }
+    return etagMiddleware(c, next);
+  });
 
   // Serve anonymous traffic on bot-heavy public pages from the shared KV page
   // cache (one render per URL per hour serves all workers). Prod-only so page
diff --git a/src/auth/pds-outage.test.ts b/src/auth/pds-outage.test.ts
new file mode 100644
index 0000000..b817b8f
--- /dev/null
+++ b/src/auth/pds-outage.test.ts
@@ -0,0 +1,117 @@
+/**
+ * Regression for the 2026-08-01/02 outage.
+ *
+ * One user's PDS (`caramelo.social.br`) began blackholing packets. Because
+ * `oauthClient.restore()` had no timeout, the refresh hung while holding the
+ * cross-process lock — whose heartbeat renewed it, so it was never evicted as
+ * stale. Every other request for that DID, across all three worker processes,
+ * then burned the lock's full 37.5s poll budget, each poll issuing three
+ * synchronous SQLite statements. Workers stopped servicing their event loops;
+ * Caddy recorded 166,450 `dial tcp: i/o timeout` and 171,145 502s.
+ *
+ * These tests model that shape against the real lock and the real guard.
+ */
+import { describe, it, expect, beforeEach, afterEach } from "bun:test";
+import { createSharedKvDb, type KvDb } from "../sqlite-kv";
+import { createCrossProcessLock } from "./refresh-lock";
+import { guardedRestore, resetRestoreGuards, RESTORE_TIMEOUT_MS } from "./restore-guard";
+
+let db: KvDb;
+
+/**
+ * Releases for every in-flight fake stall. A genuinely never-settling promise
+ * would outlive the test and then hit a destroyed Kysely driver, so the hang is
+ * abortable — the code under test can't tell the difference, since it only ever
+ * sees "still pending" for as long as the assertions run.
+ */
+let releases: Array<() => void> = [];
+
+beforeEach(() => {
+  db = createSharedKvDb(":memory:").db;
+  resetRestoreGuards();
+  releases = [];
+});
+
+afterEach(async () => {
+  for (const release of releases.splice(0)) release();
+  // Let each lock's `finally` land its DELETE before the driver goes away.
+  await Bun.sleep(100);
+  await db.destroy();
+});
+
+/** A host that accepts the connection and never answers. */
+const blackhole = (): Promise<never> =>
+  new Promise<never>((_, reject) => {
+    releases.push(() => reject(new Error("test teardown")));
+  });
+
+describe("unreachable PDS", () => {
+  it("does not let a wedged refresh pin later requests for the full lock budget", async () => {
+    const lock = createCrossProcessLock(db);
+
+    // Request 1 acquires the lock and hangs on the dead host. Nothing awaits
+    // it — this is the wedged holder.
+    void guardedRestore("caramelo.social.br", () =>
+      lock("oauth-session-did:plc:victim", blackhole),
+    ).catch(() => {});
+    await Bun.sleep(50);
+
+    // Requests 2..N pile in behind it, as they did in production.
+    const start = Date.now();
+    const results = await Promise.allSettled(
+      Array.from({ length: 8 }, () =>
+        guardedRestore("caramelo.social.br", () => lock("oauth-session-did:plc:victim", blackhole)),
+      ),
+    );
+    const elapsed = Date.now() - start;
+
+    expect(results.every((r) => r.status === "rejected")).toBe(true);
+    // Old behaviour: every one of these sat for ~37.5s. The whole batch must
+    // now clear in about one restore timeout.
+    expect(elapsed).toBeLessThan(RESTORE_TIMEOUT_MS + 3_000);
+  }, 30_000);
+
+  it("stops dispatching to the dead host once the breaker trips", async () => {
+    const lock = createCrossProcessLock(db);
+    let dispatches = 0;
+
+    const attempt = () =>
+      guardedRestore("caramelo.social.br", () =>
+        lock("oauth-session-did:plc:victim", () => {
+          dispatches++;
+          return blackhole();
+        }),
+      ).catch((e: Error) => e.name);
+
+    // Trip it.
+    await Promise.all([attempt(), attempt(), attempt()]);
+    const before = dispatches;
+
+    // Subsequent traffic must cost nothing at all — no lock, no SQLite, no
+    // socket. This is what keeps one dead PDS off the event loop.
+    const start = Date.now();
+    const names = await Promise.all([attempt(), attempt(), attempt(), attempt()]);
+    const elapsed = Date.now() - start;
+
+    expect(dispatches).toBe(before);
+    expect(names.every((n) => n === "PdsUnavailableError")).toBe(true);
+    expect(elapsed).toBeLessThan(100);
+  }, 30_000);
+
+  it("leaves users on healthy PDSes completely unaffected", async () => {
+    const lock = createCrossProcessLock(db);
+
+    for (let i = 0; i < 3; i++) {
+      await guardedRestore("caramelo.social.br", () =>
+        lock("oauth-session-did:plc:victim", blackhole),
+      ).catch(() => {});
+    }
+
+    const start = Date.now();
+    const result = await guardedRestore("bsky.social", () =>
+      lock("oauth-session-did:plc:healthy", async () => "session"),
+    );
+    expect(result).toBe("session");
+    expect(Date.now() - start).toBeLessThan(1_000);
+  }, 30_000);
+});
diff --git a/src/auth/refresh-lock.test.ts b/src/auth/refresh-lock.test.ts
index 66f443b..a1fee3c 100644
--- a/src/auth/refresh-lock.test.ts
+++ b/src/auth/refresh-lock.test.ts
@@ -6,7 +6,7 @@ import { createCrossProcessLock } from "./refresh-lock";
 let db: KvDb;
 
 beforeEach(() => {
-  db = createSharedKvDb(":memory:");
+  db = createSharedKvDb(":memory:").db;
 });
 
 afterEach(async () => {
@@ -129,4 +129,50 @@ describe("createCrossProcessLock", () => {
     expect(result).toBe("acquired");
     expect(elapsed).toBeGreaterThanOrEqual(200);
   });
+
+  // Regression for 2026-08-02: a holder wedged on an unreachable PDS kept its
+  // lock alive via the heartbeat, and waiters spun for 37.5s issuing 750
+  // synchronous SQLite statements each — enough concurrent waiters and the
+  // worker stopped servicing its event loop at all.
+  it("gives up on a permanently held lock within a few seconds", async () => {
+    const lock = createCrossProcessLock(db);
+    await sql`INSERT INTO auth_refresh_lock (id, owner, acquired_at) VALUES ('wedged', 'other-pid-999', ${Date.now()})`.execute(
+      db,
+    );
+
+    const start = Date.now();
+    await expect(lock("wedged", async () => "never")).rejects.toThrow(
+      "Cross-process lock timeout for wedged",
+    );
+    const elapsed = Date.now() - start;
+
+    expect(elapsed).toBeLessThan(6_000);
+    // The other owner's lock must survive — we only ever delete our own.
+    const rows = await sql`SELECT * FROM auth_refresh_lock WHERE id = 'wedged'`.execute(db);
+    expect(rows.rows).toHaveLength(1);
+  });
+
+  it("backs off exponentially rather than polling at a fixed interval", async () => {
+    const lock = createCrossProcessLock(db);
+    await sql`INSERT INTO auth_refresh_lock (id, owner, acquired_at) VALUES ('counted', 'other-pid-999', ${Date.now()})`.execute(
+      db,
+    );
+
+    let selects = 0;
+    const originalExecuteQuery = db.executeQuery.bind(db);
+    db.executeQuery = ((compiled: { sql: string }) => {
+      if (compiled.sql.trimStart().toUpperCase().startsWith("SELECT")) selects++;
+      return originalExecuteQuery(compiled as never);
+    }) as typeof db.executeQuery;
+
+    try {
+      await expect(lock("counted", async () => "never")).rejects.toThrow("Cross-process lock");
+    } finally {
+      db.executeQuery = originalExecuteQuery;
+    }
+
+    // A flat 150ms poll over this budget would be ~20 attempts; the old 37.5s
+    // budget was 250. Backoff must keep it to a handful.
+    expect(selects).toBeLessThan(15);
+  });
 });
diff --git a/src/auth/refresh-lock.ts b/src/auth/refresh-lock.ts
index e77f5af..f7205c3 100644
--- a/src/auth/refresh-lock.ts
+++ b/src/auth/refresh-lock.ts
@@ -12,8 +12,30 @@ const OWNER = `${process.pid}-${Math.random().toString(36).slice(2, 10)}`;
 
 const STALE_LOCK_MS = 30_000;
 const HEARTBEAT_MS = STALE_LOCK_MS / 3;
-const POLL_INTERVAL_MS = 150;
-const MAX_ATTEMPTS = 250;
+
+/**
+ * Total time a request will wait for another process to finish refreshing.
+ *
+ * This was 250 attempts × a flat 150 ms = 37.5 s. On 2026-08-02 that was the
+ * single worst thing in the codebase: when one user's PDS started blackholing
+ * packets, the lock holder hung indefinitely (its heartbeat kept renewing the
+ * row, so it was never evicted as stale) and every other request for that DID
+ * — across all three worker processes — sat in this loop for the full 37.5 s.
+ * Production showed a 38,000–39,600 ms plateau, an exact match.
+ *
+ * Worse than the wait was its cost: each attempt issues three SQLite statements
+ * and `bun:sqlite` is synchronous, so a single waiter ran 750 blocking
+ * statements on the event loop. Enough concurrent waiters and the worker stops
+ * calling `accept()` entirely — Caddy's 166,450 `dial tcp: i/o timeout` 502s.
+ *
+ * The holder is now bounded independently (`restore-guard.ts` caps a restore at
+ * 5 s), so a waiter that gets nowhere in 3 s is waiting on something already
+ * known to be broken. Exponential backoff takes the statement count for a full
+ * wait from 750 down to ~21.
+ */
+const MAX_WAIT_MS = 3_000;
+const INITIAL_POLL_MS = 25;
+const MAX_POLL_MS = 400;
 
 export function createCrossProcessLock(
   db: KvDb,
@@ -25,7 +47,10 @@ export function createCrossProcessLock(
   )`.execute(db);
 
   return async function crossProcessLock<T>(key: string, cb: () => Promise<T>): Promise<T> {
-    for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
+    const deadline = Date.now() + MAX_WAIT_MS;
+    let pollMs = INITIAL_POLL_MS;
+
+    for (;;) {
       const now = Date.now();
 
       // Evict stale locks from crashed processes before attempting acquisition.
@@ -64,7 +89,11 @@ export function createCrossProcessLock(
         }
       }
 
-      await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) break;
+
+      await new Promise((resolve) => setTimeout(resolve, Math.min(pollMs, remaining)));
+      pollMs = Math.min(pollMs * 2, MAX_POLL_MS);
     }
 
     // Only clean up our own lock (defensive no-op — we never acquired one).
diff --git a/src/auth/restore-guard.test.ts b/src/auth/restore-guard.test.ts
new file mode 100644
index 0000000..2ef3b71
--- /dev/null
+++ b/src/auth/restore-guard.test.ts
@@ -0,0 +1,137 @@
+import { describe, it, expect, beforeEach } from "bun:test";
+import {
+  guardedRestore,
+  isSessionTerminatingError,
+  PdsUnavailableError,
+  resetRestoreGuards,
+  restoreGuardStates,
+  RESTORE_TIMEOUT_MS,
+  MAX_BREAKERS,
+} from "./restore-guard";
+
+beforeEach(() => {
+  resetRestoreGuards();
+});
+
+/** Never settles — stands in for a host that blackholes packets. */
+const blackhole = () => new Promise<never>(() => {});
+
+describe("isSessionTerminatingError", () => {
+  it("treats credential rejections as terminal", () => {
+    expect(isSessionTerminatingError(new Error("invalid_grant"))).toBe(true);
+    expect(isSessionTerminatingError(new Error("refresh token was revoked"))).toBe(true);
+  });
+
+  it("treats network failures as transient", () => {
+    // These are what silently logged users out during the 2026-08-02 incident.
+    expect(isSessionTerminatingError(new Error("The operation timed out."))).toBe(false);
+    expect(
+      isSessionTerminatingError(new Error("Unable to connect. Is the computer able to access")),
+    ).toBe(false);
+    expect(isSessionTerminatingError(new Error("Cross-process lock timeout for x"))).toBe(false);
+  });
+});
+
+describe("guardedRestore", () => {
+  it("returns the restored value and leaves the breaker closed", async () => {
+    const result = await guardedRestore("pds.example", async () => "session");
+    expect(result).toBe("session");
+    expect(restoreGuardStates()[0]?.state).toBe("closed");
+  });
+
+  it(
+    "times out a hung restore instead of hanging the request",
+    async () => {
+      const start = Date.now();
+      await expect(guardedRestore("dead.example", blackhole)).rejects.toThrow("timed out");
+      expect(Date.now() - start).toBeLessThan(RESTORE_TIMEOUT_MS + 2_000);
+    },
+    RESTORE_TIMEOUT_MS + 5_000,
+  );
+
+  it("stops dispatching to a host that keeps failing", async () => {
+    for (let i = 0; i < 3; i++) {
+      await expect(
+        guardedRestore("dead.example", async () => {
+          throw new Error("Unable to connect.");
+        }),
+      ).rejects.toThrow();
+    }
+
+    // Fourth call must not reach the host at all.
+    let dispatched = false;
+    await expect(
+      guardedRestore("dead.example", async () => {
+        dispatched = true;
+        return "unreachable";
+      }),
+    ).rejects.toBeInstanceOf(PdsUnavailableError);
+    expect(dispatched).toBe(false);
+  });
+
+  it("isolates hosts from each other", async () => {
+    for (let i = 0; i < 3; i++) {
+      await expect(
+        guardedRestore("dead.example", async () => {
+          throw new Error("Unable to connect.");
+        }),
+      ).rejects.toThrow();
+    }
+
+    // A different PDS must be unaffected — one dead host cannot lock out the
+    // rest of the network.
+    await expect(guardedRestore("healthy.example", async () => "ok")).resolves.toBe("ok");
+  });
+
+  it("does not open the breaker on a revoked token", async () => {
+    // The PDS answered us correctly; that is evidence of health, not sickness.
+    for (let i = 0; i < 5; i++) {
+      await expect(
+        guardedRestore("healthy.example", async () => {
+          throw new Error("invalid_grant");
+        }),
+      ).rejects.toThrow("invalid_grant");
+    }
+
+    let dispatched = false;
+    await expect(
+      guardedRestore("healthy.example", async () => {
+        dispatched = true;
+        return "ok";
+      }),
+    ).resolves.toBe("ok");
+    expect(dispatched).toBe(true);
+  });
+
+  it("stays bounded even when every tracked host is open", async () => {
+    // The scenario this module exists for: a mass PDS outage. Eviction used to
+    // consider only *closed* breakers, so with nothing closed there was no
+    // candidate, nothing was dropped, and the map grew one entry per host
+    // forever — an unbounded leak inside the leak guard.
+    for (let i = 0; i < MAX_BREAKERS + 50; i++) {
+      // Trip each host so it lands open, never closed.
+      for (let n = 0; n < 3; n++) {
+        await expect(
+          guardedRestore(`dead-${i}.example`, async () => {
+            throw new Error("Unable to connect.");
+          }),
+        ).rejects.toThrow();
+      }
+    }
+
+    expect(restoreGuardStates().length).toBeLessThanOrEqual(MAX_BREAKERS);
+    expect(restoreGuardStates().every((s) => s.state === "open")).toBe(true);
+  });
+
+  it("reports the outcome for the wide event", async () => {
+    const outcomes: Array<{ key: string; state: string }> = [];
+    await guardedRestore(
+      "pds.example",
+      async () => "ok",
+      (o) => outcomes.push(o),
+    );
+    expect(outcomes).toHaveLength(1);
+    expect(outcomes[0]?.key).toBe("pds.example");
+    expect(outcomes[0]?.state).toBe("closed");
+  });
+});
diff --git a/src/auth/restore-guard.ts b/src/auth/restore-guard.ts
new file mode 100644
index 0000000..a918d21
--- /dev/null
+++ b/src/auth/restore-guard.ts
@@ -0,0 +1,174 @@
+/**
+ * Guards OAuth session restore against unreachable PDSes.
+ *
+ * Why this exists (2026-08-02): `oauthClient.restore()` was called with no
+ * timeout. When one user's PDS (`caramelo.social.br`) began blackholing packets
+ * — TCP connect never completing, not refusing — the refresh hung while holding
+ * the cross-process lock from PR #191, whose heartbeat renewed it so it was
+ * never evicted as stale. Every other request for that DID, in every worker
+ * process, then spun the lock's full poll budget, and each poll ran synchronous
+ * SQLite statements on the event loop. Workers stopped calling `accept()`,
+ * which is what Caddy recorded as 166,450 × `dial tcp: i/o timeout` — the
+ * dominant 502 class of the 2026-08-01 outage.
+ *
+ * In a federated network an unreachable PDS is normal and permanent-ish. So:
+ * bound every restore with a timeout, and once a host has proven unreachable,
+ * stop dispatching to it at all until a cooldown elapses.
+ */
+import { CircuitBreaker } from "../utils/circuitBreaker";
+import { withTimeout } from "../utils/semaphore";
+
+/**
+ * A healthy PDS answers a token refresh in well under a second. This is
+ * deliberately far below the ~30s a user will tolerate: the point is to free
+ * the lock and the event loop, not to squeeze out a slow success.
+ */
+export const RESTORE_TIMEOUT_MS = 5_000;
+
+/**
+ * Tuned much tighter than the WAF solver's breaker. That one guards a scrape
+ * nobody is waiting on; this one guards a request path, so it should trip after
+ * a few failures rather than a few dozen, and recover quickly enough that a PDS
+ * blip doesn't lock users out for a quarter of an hour.
+ */
+const BREAKER_OPTIONS = {
+  failureThreshold: 8,
+  consecutiveFailureThreshold: 3,
+  windowMs: 60_000,
+  cooldownMs: 60_000,
+  halfOpenMax: 1,
+  successThreshold: 1,
+} as const;
+
+/** Distinct hosts tracked before the idle ones are pruned. */
+export const MAX_BREAKERS = 512;
+
+type Entry = { breaker: CircuitBreaker; lastUsedAt: number };
+
+const breakers = new Map<string, Entry>();
+
+function getBreaker(key: string): CircuitBreaker {
+  const existing = breakers.get(key);
+  if (existing) {
+    existing.lastUsedAt = Date.now();
+    return existing.breaker;
+  }
+
+  if (breakers.size >= MAX_BREAKERS) {
+    // Prefer the least recently used *closed* breaker: an open one is
+    // load-bearing, and evicting it lets traffic straight back into a dead
+    // host. But preferring is not the same as requiring. If every breaker is
+    // open or half-open — a mass PDS outage, which is exactly the scenario this
+    // module exists for — then nothing is closed, nothing gets evicted, and the
+    // map grows without bound. Fall back to the overall LRU so MAX_BREAKERS is
+    // always enforced; the replacement re-opens after a few failures, and
+    // guardedRestore's timeout still bounds every attempt in the meantime.
+    let closedKey: string | null = null;
+    let closedAt = Infinity;
+    let anyKey: string | null = null;
+    let anyAt = Infinity;
+    for (const [k, entry] of breakers) {
+      if (entry.lastUsedAt < anyAt) {
+        anyAt = entry.lastUsedAt;
+        anyKey = k;
+      }
+      if (entry.breaker.getState() !== "closed") continue;
+      if (entry.lastUsedAt < closedAt) {
+        closedAt = entry.lastUsedAt;
+        closedKey = k;
+      }
+    }
+    const evict = closedKey ?? anyKey;
+    if (evict) breakers.delete(evict);
+  }
+
+  const breaker = new CircuitBreaker(BREAKER_OPTIONS);
+  breakers.set(key, { breaker, lastUsedAt: Date.now() });
+  return breaker;
+}
+
+/** Thrown instead of dispatching when the host's breaker is open. */
+export class PdsUnavailableError extends Error {
+  constructor(
+    readonly host: string,
+    readonly cooldownRemainingMs: number,
+  ) {
+    super(`PDS ${host} is unreachable; retrying in ${Math.ceil(cooldownRemainingMs / 1000)}s`);
+    this.name = "PdsUnavailableError";
+  }
+}
+
+/**
+ * True when the failure means the session itself is dead and the user must log
+ * in again, rather than that their server is having a bad day.
+ *
+ * Everything not listed here is treated as transient. Getting this backwards is
+ * what silently logged users out during the incident: a network timeout hit the
+ * same `session.destroy()` path as a revoked refresh token.
+ */
+export function isSessionTerminatingError(err: unknown): boolean {
+  const message = err instanceof Error ? err.message : String(err);
+  return /invalid_grant|invalid_client|unauthorized_client|invalid_token|revoked|token has expired/i.test(
+    message,
+  );
+}
+
+export type RestoreOutcome = {
+  /** Host the breaker was keyed on — the DID when no session is stored yet. */
+  key: string;
+  state: "closed" | "open" | "half_open";
+  durationMs: number;
+};
+
+/**
+ * Run `restore` under a per-host circuit breaker and a hard timeout.
+ *
+ * `key` should be the authorization-server host (see
+ * `getStoredSessionIssuerHost`) so that one dead PDS trips once for all of its
+ * users, rather than each user paying the full failure budget separately.
+ */
+export async function guardedRestore<T>(
+  key: string,
+  restore: () => Promise<T>,
+  onOutcome?: (outcome: RestoreOutcome) => void,
+): Promise<T> {
+  const breaker = getBreaker(key);
+  const startedAt = Date.now();
+
+  if (!breaker.canRequest()) {
+    const cooldown = breaker.cooldownRemainingMs();
+    onOutcome?.({ key, state: "open", durationMs: 0 });
+    throw new PdsUnavailableError(key, cooldown);
+  }
+
+  try {
+    const result = await withTimeout(restore(), RESTORE_TIMEOUT_MS, `oauth restore for ${key}`);
+    breaker.recordSuccess();
+    onOutcome?.({ key, state: breaker.getState(), durationMs: Date.now() - startedAt });
+    return result;
+  } catch (err) {
+    // A revoked token is the PDS answering us correctly — it says nothing about
+    // the host's health, so it must not count toward opening the breaker.
+    if (isSessionTerminatingError(err)) {
+      breaker.recordSuccess();
+    } else {
+      breaker.recordFailure();
+    }
+    onOutcome?.({ key, state: breaker.getState(), durationMs: Date.now() - startedAt });
+    throw err;
+  }
+}
+
+/** Test seam — drops all breaker state. */
+export function resetRestoreGuards(): void {
+  breakers.clear();
+}
+
+/** Current breaker states, for `/debug` and metrics. */
+export function restoreGuardStates(): Array<{ key: string; state: string; cooldownMs: number }> {
+  return [...breakers.entries()].map(([key, entry]) => ({
+    key,
+    state: entry.breaker.getState(),
+    cooldownMs: entry.breaker.cooldownRemainingMs(),
+  }));
+}
diff --git a/src/auth/storage.ts b/src/auth/storage.ts
index 84a52bb..ed80b81 100644
--- a/src/auth/storage.ts
+++ b/src/auth/storage.ts
@@ -36,6 +36,29 @@ export function createSessionStore(kv: Storage): SessionStore {
   };
 }
 
+/**
+ * Host of the authorization server that a stored session refreshes against, or
+ * null if there is no stored session yet.
+ *
+ * This is a local KV read — never a network call — because it is used to pick a
+ * circuit-breaker key on the request path (see `restore-guard.ts`). Resolving
+ * the DID document instead would mean a network call to decide whether we are
+ * allowed to make a network call.
+ *
+ * `tokenSet.iss` is the token endpoint's origin. For bsky.social users that is
+ * the shared entryway; for self-hosted PDSes it is the PDS itself, which is
+ * exactly the host that goes unreachable.
+ */
+export async function getStoredSessionIssuerHost(kv: Storage, did: string): Promise<string | null> {
+  try {
+    const stored = await kv.get<StoredSession>(sessionKey(did as Did));
+    const iss = stored?.tokenSet?.iss;
+    return iss ? new URL(iss).host : null;
+  } catch {
+    return null;
+  }
+}
+
 /** atcute StateStore backed by unstorage (keyed by state id). */
 export function createStateStore(kv: Storage): StateStore {
   return {
diff --git a/src/context.ts b/src/context.ts
index ecdf700..041afac 100644
--- a/src/context.ts
+++ b/src/context.ts
@@ -18,6 +18,8 @@ import {
   type SessionClient,
 } from "./auth/client";
 import { createCrossProcessLock } from "./auth/refresh-lock";
+import { guardedRestore, isSessionTerminatingError } from "./auth/restore-guard";
+import { getStoredSessionIssuerHost } from "./auth/storage";
 import { createServiceAccountAgent } from "./utils/catalogBookService";
 import { getSessionConfig } from "./auth/router";
 import {
@@ -32,7 +34,13 @@ import { createDb, migrateToLatest } from "./db";
 import { env } from "./env";
 import { getLogger } from "./logger/index.ts";
 import { PAGE_CACHE_TTL_MS } from "./middleware/anon-page-cache";
-import sqliteKv, { createSharedKvDb } from "./sqlite-kv.ts";
+import sqliteKv, {
+  createSharedKvDb,
+  incrementalVacuumKv,
+  readPragma,
+  vacuumKvIfBloated,
+  VACUUM_FREELIST_RATIO,
+} from "./sqlite-kv.ts";
 import { startEnrichmentDrain } from "./utils/enrichQueue";
 import { lazy } from "./utils/lazy";
 import { readThroughCache } from "./utils/readThroughCache";
@@ -140,16 +148,61 @@ export async function createAppDeps(): Promise<AppDeps> {
     if (migrationResults.length > 0) {
       logger.info(
         { migrations: migrationResults.map((r: { migrationName: string }) => r.migrationName) },
-        "migrations applied, running VACUUM before siblings start",
+        "migrations applied",
       );
-      const vacuumStart = Date.now();
-      sqlite.exec("VACUUM");
-      logger.info({ durationMs: Date.now() - vacuumStart }, "db VACUUM complete");
+      // VACUUM only when there is actually something to reclaim. Measured
+      // against the production database (356,675 books, 1.62 GB) it takes
+      // **22.3s** and frees nothing: `freelist_count` there is 0, because the
+      // main DB is essentially append-only — the ingester and enrichment add
+      // rows, almost nothing deletes them. That is 22s of startup, on every
+      // deploy that ships a migration, for zero bytes. The delete-heavy file is
+      // the KV, which went 1.94 GB → 34.7 MB. Gated on *this* file's own
+      // freelist ratio, against the same threshold `vacuumKvIfBloated` uses, so
+      // a future migration that does free a lot still gets cleaned up.
+      const pageCount = readPragma(sqlite, "page_count");
+      const freelist = readPragma(sqlite, "freelist_count");
+      const ratio = pageCount > 0 ? freelist / pageCount : 0;
+      if (ratio < VACUUM_FREELIST_RATIO) {
+        logger.info({ pageCount, freelist, ratio }, "db VACUUM skipped — nothing to reclaim");
+      } else {
+        const vacuumStart = Date.now();
+        sqlite.exec("VACUUM");
+        // `hive_book_fts` is external-content, keyed by `hive_book`'s *implicit*
+        // rowid (`id` is TEXT, so not an INTEGER PRIMARY KEY alias). SQLite
+        // documents that VACUUM "may change the ROWIDs of entries in any tables
+        // that do not have an explicit INTEGER PRIMARY KEY"; if it ever does,
+        // every search result silently points at the wrong book. Measured on
+        // 3.45 and 3.51 the rowids survive, and FTS5's 'integrity-check' does
+        // *not* detect this desync (verified against a deliberately shifted
+        // content table) — so it would be silent. Rebuild is 3.6s at this size,
+        // and only runs on the rare VACUUM now.
+        const rebuildStart = Date.now();
+        try {
+          sqlite.exec(`INSERT INTO hive_book_fts(hive_book_fts) VALUES('rebuild')`);
+        } catch (err) {
+          logger.error({ err }, "hive_book_fts rebuild after VACUUM failed");
+        }
+        logger.info(
+          {
+            durationMs: Date.now() - vacuumStart,
+            ftsRebuildMs: Date.now() - rebuildStart,
+            freelist,
+          },
+          "db VACUUM complete",
+        );
+      }
     }
   }
 
   // Single shared connection for all KV tables on KV_DB_PATH.
-  const kvDb = createSharedKvDb(env.KV_DB_PATH);
+  const { db: kvDb, sqlite: kvSqlite } = createSharedKvDb(env.KV_DB_PATH);
+  if (isPrimaryWorker) {
+    // The KV is delete-heavy (the page cache, auth state, the sweep below)
+    // and had never been VACUUMed: 1.94 GB on disk for 34.7 MB of live rows,
+    // 98.1% free pages. Runs before the siblings spawn, and only when the file
+    // is actually bloated — deploys are frequent enough to keep it in check.
+    vacuumKvIfBloated(kvSqlite, (fields, msg) => logger.info(fields, msg));
+  }
   const kv = createStorage({
     driver: sqliteKv({ table: "kv", db: kvDb }),
   });
@@ -162,7 +215,7 @@ export async function createAppDeps(): Promise<AppDeps> {
   kv.mount("follows_sync:", sqliteKv({ table: "follows_sync", db: kvDb }));
 
   // Auth tables: in development use a separate file; in production share the main KV connection.
-  const authKvDb = env.isDevelopment ? createSharedKvDb("./auth.sqlite") : kvDb;
+  const authKvDb = env.isDevelopment ? createSharedKvDb("./auth.sqlite").db : kvDb;
   kv.mount("auth_session:", sqliteKv({ table: "auth_sessions", db: authKvDb }));
   kv.mount("auth_state:", sqliteKv({ table: "auth_state", db: authKvDb }));
   // Shared (not in-memory) so the main process and the ingester/import
@@ -182,6 +235,15 @@ export async function createAppDeps(): Promise<AppDeps> {
         const cutoff = new Date(Date.now() - 2 * PAGE_CACHE_TTL_MS).toISOString();
         void sql`DELETE FROM page_cache WHERE updated_at < ${cutoff}`
           .execute(kvDb)
+          .then(() => {
+            // Awaited: this hands back the pages *that DELETE just freed*, and
+            // firing it alongside an un-awaited DELETE only ever reclaimed the
+            // previous cycle's. Bounded, so it can never become the
+            // multi-second stall a full VACUUM would be on this timer. The
+            // logger is passed so a SQLITE_BUSY or a full disk here is visible
+            // rather than swallowed on a 15-minute timer nobody watches.
+            incrementalVacuumKv(kvSqlite, 1000, (fields, msg) => logger.warn(fields, msg));
+          })
           .catch((e: any) => {
             if (String(e?.message).includes("no such table")) return;
             logger.error({ err: e }, "page_cache cleanup failed");
@@ -358,10 +420,22 @@ function withSessionRefreshRetry(
   };
 }
 
+/**
+ * Breaker key for a DID: the authorization-server host when we have a stored
+ * session, else the DID itself. Falling back to the DID keeps a first-ever
+ * restore guarded instead of unguarded.
+ */
+async function restoreGuardKey(ctx: { kv: Storage }, did: string): Promise<string> {
+  return (await getStoredSessionIssuerHost(ctx.kv, did)) ?? did;
+}
+
 /** Restore a session client for a DID, bypassing the process cache. */
 async function restoreSessionClient(ctx: AppContext, did: string): Promise<SessionClient | null> {
   try {
-    const oauthSession = await ctx.oauthClient.restore(did as Did, { refresh: "auto" });
+    const key = await restoreGuardKey(ctx, did);
+    const oauthSession = await guardedRestore(key, () =>
+      ctx.oauthClient.restore(did as Did, { refresh: "auto" }),
+    );
     const tokenInfo = await oauthSession.getTokenInfo(false);
     // Same factory as the primary path, so a client that gets cached here can
     // still recover from a later rotation by another process.
@@ -403,11 +477,20 @@ export async function getSessionAgent(
     return cached.client;
   }
 
+  const guardKey = await restoreGuardKey(ctx, session.did);
+
   try {
     timing?.start("session_restore");
-    const oauthSession = await ctx.oauthClient.restore(session.did as Did, {
-      refresh: "auto",
-    });
+    const oauthSession = await guardedRestore(
+      guardKey,
+      () => ctx.oauthClient.restore(session.did as Did, { refresh: "auto" }),
+      (outcome) =>
+        ctx.addWideEventContext({
+          pds_host: outcome.key,
+          pds_breaker: outcome.state,
+          oauth_restore_ms: outcome.durationMs,
+        }),
+    );
     timing?.end("session_restore");
 
     // Get token expiration so we can cache until just before it expires.
@@ -432,11 +515,19 @@ export async function getSessionAgent(
     setCachedSessionClient(did, client, tokenExpiresAt);
     return client;
   } catch (err) {
+    // Only tear the session down when the PDS has actually rejected our
+    // credentials. A timeout or an unreachable host says nothing about whether
+    // the user is still logged in, and destroying on those silently signed
+    // people out for the duration of their server's downtime (7 × 302 on
+    // /library in 6h on 2026-08-02).
+    const terminal = isSessionTerminatingError(err);
     ctx.addWideEventContext({
       oauth_restore: "failed",
+      oauth_restore_terminal: terminal,
+      pds_host: guardKey,
       error: err instanceof Error ? err.message : String(err),
     });
-    session.destroy();
+    if (terminal) session.destroy();
     return null;
   }
 }
diff --git a/src/db.authors.test.ts b/src/db.authors.test.ts
new file mode 100644
index 0000000..3d255f1
--- /dev/null
+++ b/src/db.authors.test.ts
@@ -0,0 +1,134 @@
+/**
+ * hive_book_author (migration 020) — the normalized replacement for matching
+ * four LIKE patterns against the tab-separated `hive_book.authors` column.
+ *
+ * The table is trigger-maintained, so these tests are as much about the
+ * triggers as the schema: a helper that has to be called by hand would only
+ * need to be forgotten at one of the ingester / importer / enrichment /
+ * catalog-service write sites to silently desynchronize the index.
+ */
+import { describe, it, expect, beforeEach, afterEach } from "bun:test";
+import { Database as DatabaseSync } from "bun:sqlite";
+import { Kysely, SqliteDialect } from "kysely";
+
+import { wrapBunSqliteForKysely } from "./bun-sqlite-kysely";
+import { migrateToLatest, type Database, type DatabaseSchema } from "./db";
+
+let db: Database;
+let sqlite: DatabaseSync;
+
+beforeEach(async () => {
+  sqlite = new DatabaseSync(":memory:");
+  sqlite.exec("PRAGMA journal_mode = WAL");
+  db = new Kysely<DatabaseSchema>({
+    dialect: new SqliteDialect({ database: wrapBunSqliteForKysely(sqlite) }),
+  });
+  await migrateToLatest(db, sqlite);
+});
+
+afterEach(async () => {
+  await db.destroy();
+});
+
+function insertBook(id: string, authors: string, ratingsCount = 0) {
+  sqlite.exec(
+    `INSERT INTO hive_book (id, title, rawTitle, authors, source, thumbnail, ratingsCount, createdAt, updatedAt)
+     VALUES (?1, ?2, ?2, ?3, 'goodreads', '', ?4, ?5, ?5)`,
+    [id, `Title ${id}`, authors, ratingsCount, new Date().toISOString()],
+  );
+}
+
+const authorsOf = (hiveId: string) =>
+  sqlite
+    .query("SELECT author, position FROM hive_book_author WHERE hiveId = ?1 ORDER BY position")
+    .all(hiveId) as Array<{ author: string; position: number }>;
+
+const booksBy = (author: string) =>
+  (
+    sqlite
+      .query("SELECT hiveId FROM hive_book_author WHERE author = ?1 ORDER BY hiveId")
+      .all(author) as Array<{ hiveId: string }>
+  ).map((r) => r.hiveId);
+
+describe("hive_book_author triggers", () => {
+  it("splits a tab-separated list into positioned rows", () => {
+    insertBook("bk_1", "Neil Gaiman\tTerry Pratchett");
+    expect(authorsOf("bk_1")).toEqual([
+      { author: "Neil Gaiman", position: 0 },
+      { author: "Terry Pratchett", position: 1 },
+    ]);
+  });
+
+  it("trims surrounding whitespace", () => {
+    insertBook("bk_2", "  Ursula K. Le Guin  ");
+    expect(authorsOf("bk_2")).toEqual([{ author: "Ursula K. Le Guin", position: 0 }]);
+  });
+
+  it("skips empty segments from stray tabs", () => {
+    insertBook("bk_3", "A\t\tB\t");
+    expect(authorsOf("bk_3")).toEqual([
+      { author: "A", position: 0 },
+      { author: "B", position: 2 },
+    ]);
+  });
+
+  it("rewrites the rows when authors change", () => {
+    insertBook("bk_4", "Old One\tOld Two");
+    sqlite.exec("UPDATE hive_book SET authors = ?1 WHERE id = ?2", ["New Sole", "bk_4"]);
+    expect(authorsOf("bk_4")).toEqual([{ author: "New Sole", position: 0 }]);
+  });
+
+  it("leaves rows alone when an unrelated column is updated", () => {
+    // Enrichment rewrites whole hive_book rows constantly; re-splitting on
+    // every ratings update would be pure write amplification.
+    insertBook("bk_5", "Stable Author\tSecond Author");
+    sqlite.exec("UPDATE hive_book SET ratingsCount = 99 WHERE id = ?1", ["bk_5"]);
+    expect(authorsOf("bk_5")).toHaveLength(2);
+  });
+
+  it("removes rows when the book is deleted", () => {
+    insertBook("bk_6", "Gone Author");
+    sqlite.exec("DELETE FROM hive_book WHERE id = ?1", ["bk_6"]);
+    expect(authorsOf("bk_6")).toEqual([]);
+  });
+
+  it("handles a book credited to the same author twice", () => {
+    // PRIMARY KEY(hiveId, author) collapses the duplicate rather than failing
+    // the whole INSERT and losing the book.
+    insertBook("bk_7", "Dupe\tDupe");
+    expect(authorsOf("bk_7")).toEqual([{ author: "Dupe", position: 0 }]);
+  });
+});
+
+describe("hive_book_author lookups match the LIKE patterns they replaced", () => {
+  // The four patterns were: exact, `A\t%` (first), `%\tA\t%` (middle), `%\tA`
+  // (last). Every position must still be found, and no false positives.
+  beforeEach(() => {
+    insertBook("bk_sole", "Target Author");
+    insertBook("bk_first", "Target Author\tOther");
+    insertBook("bk_middle", "Other\tTarget Author\tThird");
+    insertBook("bk_last", "Other\tTarget Author");
+    insertBook("bk_substring", "Target Authorship"); // must NOT match
+    insertBook("bk_prefix", "Not Target Author Jr"); // must NOT match
+  });
+
+  it("finds the author in every position", () => {
+    expect(booksBy("Target Author")).toEqual(["bk_first", "bk_last", "bk_middle", "bk_sole"]);
+  });
+
+  it("does not match authors that merely contain the name", () => {
+    // This is why FTS5 was the wrong tool here: author lookup is exact
+    // identity, not text search.
+    expect(booksBy("Target Author")).not.toContain("bk_substring");
+    expect(booksBy("Target Author")).not.toContain("bk_prefix");
+  });
+
+  it("distinguishes the credited first author for the directory", () => {
+    const firsts = (
+      sqlite
+        .query("SELECT hiveId FROM hive_book_author WHERE author = ?1 AND position = 0")
+        .all("Target Author") as Array<{ hiveId: string }>
+    ).map((r) => r.hiveId);
+    expect(firsts.sort()).toEqual(["bk_first", "bk_sole"]);
+  });
+});
diff --git a/src/db.ts b/src/db.ts
index 16d9c1a..33c2683 100644
--- a/src/db.ts
+++ b/src/db.ts
@@ -10,6 +10,7 @@ import type {
   Buzz,
   HiveBook,
   HiveBookGenre,
+  HiveBookAuthor,
   HiveId,
   PersonalBookRow,
   PersonalShelfRow,
@@ -24,6 +25,7 @@ import { deriveBookIdentifiers } from "./utils/bookIdentifiers.js";
 export type DatabaseSchema = {
   hive_book: HiveBook;
   hive_book_genre: HiveBookGenre;
+  hive_book_author: HiveBookAuthor;
   book_id_map: BookIdentifiersRow;
   user_book: UserBookRow;
   buzz: Buzz;
@@ -684,6 +686,228 @@ migrations["018"] = {
   },
 };
 
+/**
+ * Full-text index over the columns search and the author pages filter on.
+ *
+ * Those queries were `LIKE '%…%'`, which no index can serve: both planned
+ * `SCAN hive_book` + `USE TEMP B-TREE FOR ORDER BY` over 356k rows. Measured on
+ * production: 633–725ms each, on routes that are ~82% of all traffic
+ * (/og 705, /books 704, /authors 460 in a 3h sample), and `refetchBooks` used
+ * to fire 100 of them concurrently.
+ *
+ * External-content FTS5, so the text is not duplicated — the index is ~36 MB
+ * against a 1.6 GB database and backfills in ~2.7s, well inside the
+ * supervisor's healthcheck barrier. Queries drop to 0–7ms.
+ *
+ * `unicode61` rather than `trigram`: trigram would preserve `LIKE`'s exact
+ * substring semantics but costs 210 MB and 10.5s. Compared against LIKE on
+ * production data with phrase queries (see `ftsMatchQuery`), unicode61 returns
+ * identical top-20 results for realistic searches, and the cases where it
+ * differs are ones where it is better — `stephen king` returns actual King
+ * novels instead of junk whose *title* contains "by Stephen King", and
+ * `the "great" gatsby` returns The Great Gatsby where LIKE returned nothing.
+ */
+migrations["019"] = {
+  async up(db: Kysely<unknown>) {
+    await sql`
+      CREATE VIRTUAL TABLE hive_book_fts USING fts5(
+        title,
+        rawTitle,
+        authors,
+        content='hive_book',
+        content_rowid='rowid',
+        tokenize='unicode61 remove_diacritics 2'
+      )
+    `.execute(db);
+
+    await sql`
+      INSERT INTO hive_book_fts(rowid, title, rawTitle, authors)
+      SELECT rowid, title, rawTitle, authors FROM hive_book
+    `.execute(db);
+
+    // External-content tables need the source table's writes mirrored by hand.
+    // The 'delete' command replays the *old* row so its terms are removed;
+    // getting this wrong leaves orphaned terms that match forever.
+    await sql`
+      CREATE TRIGGER hive_book_fts_ai AFTER INSERT ON hive_book BEGIN
+        INSERT INTO hive_book_fts(rowid, title, rawTitle, authors)
+        VALUES (new.rowid, new.title, new.rawTitle, new.authors);
+      END
+    `.execute(db);
+
+    await sql`
+      CREATE TRIGGER hive_book_fts_ad AFTER DELETE ON hive_book BEGIN
+        INSERT INTO hive_book_fts(hive_book_fts, rowid, title, rawTitle, authors)
+        VALUES ('delete', old.rowid, old.title, old.rawTitle, old.authors);
+      END
+    `.execute(db);
+
+    await sql`
+      CREATE TRIGGER hive_book_fts_au AFTER UPDATE ON hive_book BEGIN
+        INSERT INTO hive_book_fts(hive_book_fts, rowid, title, rawTitle, authors)
+        VALUES ('delete', old.rowid, old.title, old.rawTitle, old.authors);
+        INSERT INTO hive_book_fts(rowid, title, rawTitle, authors)
+        VALUES (new.rowid, new.title, new.rawTitle, new.authors);
+      END
+    `.execute(db);
+  },
+  async down(db: Kysely<unknown>) {
+    await sql`DROP TRIGGER IF EXISTS hive_book_fts_au`.execute(db);
+    await sql`DROP TRIGGER IF EXISTS hive_book_fts_ad`.execute(db);
+    await sql`DROP TRIGGER IF EXISTS hive_book_fts_ai`.execute(db);
+    await sql`DROP TABLE IF EXISTS hive_book_fts`.execute(db);
+  },
+};
+
+/**
+ * Authors normalized out of the tab-separated `hive_book.authors` column, the
+ * same shape `hive_book_genre` already uses for genres (migration 011).
+ *
+ * `authors` stores "Author1\tAuthor2\tAuthor3", so "books by this author" was
+ * four LIKE patterns per query (`buildAuthorLikePatterns`) covering the sole /
+ * first / middle / last positions. Two of those are leading-wildcard, so no
+ * index could ever serve them: `/authors/:author` planned `SCAN hive_book` +
+ * a temp B-tree sort over 356k rows at ~511ms, on ~460 requests per 3h, and
+ * the author directory had to `GROUP BY` a `CASE/instr/substr/trim` expression
+ * to recover the first author.
+ *
+ * Deliberately not FTS5: this is an exact-identity lookup, not a text search.
+ * Matching "Stephen King" must not also return "Stephen Kingsley".
+ *
+ * Maintained by triggers rather than an application helper (the way
+ * `syncHiveBookGenres` is) because `hive_book.authors` is written from the
+ * ingester, the importer, enrichment and the catalog service — a helper only
+ * has to be forgotten at one call site to silently desynchronize the table.
+ */
+/**
+ * Recursive split of a tab-separated author string into (part, pos) rows.
+ * `source` is the SQL expression holding the string — inside a trigger body
+ * that has to be `new.authors`; a bare `authors` is not in scope there.
+ */
+const splitAuthorsCte = (source: string) =>
+  sql.raw(`
+  WITH RECURSIVE split(rest, part, pos) AS (
+    SELECT ${source} || char(9), NULL, -1
+    UNION ALL
+    SELECT substr(rest, instr(rest, char(9)) + 1),
+           trim(substr(rest, 1, instr(rest, char(9)) - 1)),
+           pos + 1
+    FROM split WHERE rest <> ''
+  )
+`);
+
+migrations["020"] = {
+  async up(db: Kysely<unknown>) {
+    await db.schema
+      .createTable("hive_book_author")
+      .addColumn("hiveId", "text", (col) => col.notNull())
+      .addColumn("author", "text", (col) => col.notNull())
+      // 0 = the credited first author, which is what the directory groups by.
+      .addColumn("position", "integer", (col) => col.notNull())
+      .addPrimaryKeyConstraint("hive_book_author_pk", ["hiveId", "author"])
+      .execute();
+
+    await sql`CREATE INDEX idx_hive_book_author_author ON hive_book_author(author)`.execute(db);
+    await sql`CREATE INDEX idx_hive_book_author_first ON hive_book_author(position, author)`.execute(
+      db,
+    );
+
+    await sql`
+      INSERT OR IGNORE INTO hive_book_author(hiveId, author, position)
+      SELECT b.id, s.part, s.pos
+      FROM hive_book b
+      JOIN (
+        WITH RECURSIVE split(id, rest, part, pos) AS (
+          SELECT id, authors || char(9), NULL, -1 FROM hive_book
+          UNION ALL
+          SELECT id,
+                 substr(rest, instr(rest, char(9)) + 1),
+                 trim(substr(rest, 1, instr(rest, char(9)) - 1)),
+                 pos + 1
+          FROM split WHERE rest <> ''
+        )
+        SELECT id, part, pos FROM split WHERE part IS NOT NULL AND part <> ''
+      ) s ON s.id = b.id
+    `.execute(db);
+
+    await sql`
+      CREATE TRIGGER hive_book_author_ai AFTER INSERT ON hive_book BEGIN
+        INSERT OR IGNORE INTO hive_book_author(hiveId, author, position)
+        ${splitAuthorsCte("new.authors")}
+        SELECT new.id, part, pos FROM split WHERE part IS NOT NULL AND part <> '';
+      END
+    `.execute(db);
+
+    await sql`
+      CREATE TRIGGER hive_book_author_ad AFTER DELETE ON hive_book BEGIN
+        DELETE FROM hive_book_author WHERE hiveId = old.id;
+      END
+    `.execute(db);
+
+    // `WHEN old.authors IS NOT new.authors` rather than `AFTER UPDATE OF
+    // authors`: the latter fires whenever the column appears in a SET clause
+    // even if the value is unchanged, and enrichment rewrites whole rows often.
+    await sql`
+      CREATE TRIGGER hive_book_author_au AFTER UPDATE ON hive_book
+      WHEN old.authors IS NOT new.authors BEGIN
+        DELETE FROM hive_book_author WHERE hiveId = old.id;
+        INSERT OR IGNORE INTO hive_book_author(hiveId, author, position)
+        ${splitAuthorsCte("new.authors")}
+        SELECT new.id, part, pos FROM split WHERE part IS NOT NULL AND part <> '';
+      END
+    `.execute(db);
+  },
+  async down(db: Kysely<unknown>) {
+    await sql`DROP TRIGGER IF EXISTS hive_book_author_au`.execute(db);
+    await sql`DROP TRIGGER IF EXISTS hive_book_author_ad`.execute(db);
+    await sql`DROP TRIGGER IF EXISTS hive_book_author_ai`.execute(db);
+    await db.schema.dropTable("hive_book_author").execute();
+  },
+};
+
+/**
+ * Durable record of enrichment failure, on the book rather than the queue.
+ *
+ * `enrich_queue` could not converge. A row that exhausted its attempts was
+ * deleted (`enrichQueue.ts`) without recording anything on `hive_book`, and
+ * `enrichedAt` is only ever set on success — so the very next page view hit
+ * `!book.enrichedAt` and re-enqueued it. With a crawler systematically walking
+ * all 356k books, that is a perpetual-motion machine: the queue sat at 12,444
+ * rows growing ~20/min, and the drainer stayed at full concurrency forever
+ * scraping books that had already failed four times.
+ *
+ * `enrichAttempts` is cumulative across queue rows, so the count survives the
+ * row being deleted and re-added. `enrichFailedAt` is a cooldown stamp rather
+ * than a permanent tombstone — a book that failed while Goodreads' WAF was up
+ * should become eligible again later, just not on the next page view.
+ */
+migrations["021"] = {
+  async up(db: Kysely<unknown>) {
+    await db.schema
+      .alterTable("hive_book")
+      .addColumn("enrichAttempts", "integer", (col) => col.notNull().defaultTo(0))
+      .execute();
+    await db.schema.alterTable("hive_book").addColumn("enrichFailedAt", "text").execute();
+
+    // Books already past the attempt ceiling are in the loop right now; stamp
+    // them so the queue can actually drain instead of immediately refilling.
+    await sql`
+      UPDATE hive_book
+      SET enrichAttempts = (
+            SELECT attempts FROM enrich_queue q WHERE q.hiveId = hive_book.id
+          ),
+          enrichFailedAt = datetime('now')
+      WHERE id IN (SELECT hiveId FROM enrich_queue WHERE attempts >= 4)
+    `.execute(db);
+
+    await sql`DELETE FROM enrich_queue WHERE attempts >= 4`.execute(db);
+  },
+  async down(db: Kysely<unknown>) {
+    await db.schema.alterTable("hive_book").dropColumn("enrichFailedAt").execute();
+    await db.schema.alterTable("hive_book").dropColumn("enrichAttempts").execute();
+  },
+};
+
 // APIs
 
 export const createDb = (location: string): { db: Database; sqlite: DatabaseSync } => {
@@ -692,11 +916,14 @@ export const createDb = (location: string): { db: Database; sqlite: DatabaseSync
   sqlite.exec("PRAGMA busy_timeout = 10000");
   sqlite.exec("PRAGMA journal_mode = WAL");
   sqlite.exec("PRAGMA synchronous = NORMAL"); // safe with WAL; skips redundant fsyncs
-  // Private page cache is per connection and multiplies across worker
-  // processes — keep it small and let the (process-shared) mmap serve reads.
+  // Private page cache is per connection and multiplies across worker processes
+  // — keep it small.
   sqlite.exec(`PRAGMA cache_size = -${env.DB_CACHE_KB}`); // default 16 MB
   sqlite.exec("PRAGMA temp_store = MEMORY"); // temp B-trees (sorts, GROUP BY) in RAM
-  sqlite.exec(`PRAGMA mmap_size = ${env.DB_MMAP_SIZE}`); // default 1 GB — keep full DB memory-mapped
+  // Default 0 (off). See DB_MMAP_SIZE in src/env.ts for the measurements —
+  // mapping a 1.6 GB database into every worker cost ~1 GB of the cgroup's
+  // budget and caused the reclaim thrash behind the 2026-08 stalls.
+  sqlite.exec(`PRAGMA mmap_size = ${env.DB_MMAP_SIZE}`);
 
   const db = new Kysely<DatabaseSchema>({
     dialect: new SqliteDialect({
diff --git a/src/env.ts b/src/env.ts
index e09c0b3..a4351c7 100644
--- a/src/env.ts
+++ b/src/env.ts
@@ -25,11 +25,11 @@ export const env = cleanEnv(process.env, {
   }),
   DB_CACHE_KB: num({
     default: 16384,
-    desc: "SQLite page cache per connection, in KB. Kept small because each worker process (and its ingester/import worker threads) gets its own; the shared mmap serves most reads.",
+    desc: "SQLite page cache per connection, in KB. Kept small because each worker process (and its ingester/import worker threads) gets its own.",
   }),
   DB_MMAP_SIZE: num({
-    default: 1073741824,
-    desc: "SQLite mmap_size in bytes. mmap'd pages are file-backed and shared across all processes, so this does not multiply with WEB_CONCURRENCY.",
+    default: 0,
+    desc: "SQLite mmap_size in bytes; 0 disables mmap and reads via pread. Was 1 GiB, on the theory that file-backed pages are shared and therefore free. Measured on production 2026-08-02: they are charged to the cgroup, each process faults in its own working set, and one full-table search moved RSS by 971 MB with mmap on versus 20 MB with it off (347ms vs 736ms). Against a 1.6 GB db.sqlite in a memory-limited container that bought ~390ms per scan in exchange for ~1 GB of budget plus constant reclaim and swap thrash (1.36 GB swapped in the OOM dumps). Raise only if the DB comfortably fits the cgroup alongside every worker's anonymous memory.",
   }),
   EXPORT_SHARED_SECRET: str({
     default: "",
diff --git a/src/metrics.ts b/src/metrics.ts
index 1e16ada..1280492 100644
--- a/src/metrics.ts
+++ b/src/metrics.ts
@@ -35,13 +35,14 @@ export class Counter {
   }
 
   toString(): string {
+    // A bare `name 0` for the empty case would publish an *unlabelled* sample
+    // for a metric whose real samples all carry labels. Prometheus rejects
+    // inconsistent label sets on one metric name, so emit the family header
+    // with no samples instead — which is exactly what "nothing observed yet"
+    // means.
     let output = `# HELP ${this.name} ${this.help}\n# TYPE ${this.name} counter\n`;
-    if (this.values.size === 0) {
-      output += `${this.name} 0\n`;
-    } else {
-      for (const [key, value] of this.values) {
-        output += `${this.name}${key} ${value}\n`;
-      }
+    for (const [key, value] of this.values) {
+      output += `${this.name}${key} ${value}\n`;
     }
     return output;
   }
@@ -72,13 +73,10 @@ export class Gauge {
   }
 
   toString(): string {
+    // See Counter.toString — no unlabelled `name 0` placeholder.
     let output = `# HELP ${this.name} ${this.help}\n# TYPE ${this.name} gauge\n`;
-    if (this.values.size === 0) {
-      output += `${this.name} 0\n`;
-    } else {
-      for (const [key, value] of this.values) {
-        output += `${this.name}${key} ${value}\n`;
-      }
+    for (const [key, value] of this.values) {
+      output += `${this.name}${key} ${value}\n`;
     }
     return output;
   }
@@ -253,6 +251,24 @@ export const scraperRequestsTotal = registry.register(
   new Counter("bookhive_scraper_requests_total", "Total scraper requests"),
 );
 
+/**
+ * OG renders rejected because the worker queue was full. This was a silent
+ * `Promise.reject` — shed load was indistinguishable from a render that never
+ * happened.
+ */
+export const ogRenderShedTotal = registry.register(
+  new Counter("bookhive_og_render_shed_total", "OG renders rejected because the queue was full"),
+);
+
+// ─── Cluster-wide gauges (primary worker only) ──────────────────────────────
+// Deliberately unlabelled by worker: these describe shared SQLite state, not
+// this process. Only the primary publishes them, so a scrape landing on
+// another worker reports nothing rather than a third of the truth.
+
+export const enrichQueueDepth = registry.register(
+  new Gauge("bookhive_enrich_queue_depth", "Rows in enrich_queue by state"),
+);
+
 // ─── Runtime gauges ─────────────────────────────────────────────────────────
 
 export const processMemoryBytes = registry.register(
@@ -271,6 +287,30 @@ export const eventLoopLag = registry.register(
   ),
 );
 
+// ─── Per-worker identity ────────────────────────────────────────────────────
+
+/**
+ * Production runs WEB_CONCURRENCY processes sharing port 8080 via SO_REUSEPORT,
+ * so each `/metrics` scrape is answered by whichever worker the kernel picks.
+ * Without a worker label all three collapse into one time series that silently
+ * alternates between processes — gauges flap, counters look like they reset,
+ * and a worker that dies just vanishes from the graph. That is why a per-worker
+ * memory leak stayed invisible for a month.
+ *
+ * Deliberately `worker` and not `pid`: with workers being OOM-killed every few
+ * minutes, a pid label would mint a new time series on every restart. The pid
+ * is available on /debug/memory instead, where cardinality doesn't matter.
+ */
+const WORKER_INDEX = process.env["WORKER_INDEX"] || "solo";
+
+function workerLabels(): Record<string, string> {
+  return { worker: WORKER_INDEX };
+}
+
+function memLabel(type: string): string {
+  return labelKey({ type, ...workerLabels() });
+}
+
 // ─── Pre-computed label keys (used by call sites) ───────────────────────────
 // These are computed once at module load. Hot paths just pass the string.
 
@@ -305,13 +345,29 @@ export const LABEL = {
     incremental: labelKey({ sync_type: "incremental" }),
   },
   mem: {
-    rss: labelKey({ type: "rss" }),
-    heapTotal: labelKey({ type: "heap_total" }),
-    heapUsed: labelKey({ type: "heap_used" }),
+    rss: memLabel("rss"),
+    heapTotal: memLabel("heap_total"),
+    heapUsed: memLabel("heap_used"),
+    /**
+     * Native memory held outside the JS heap — decoded images, response bodies,
+     * cached buffers. This is where every unbounded allocation in this app
+     * actually lives, and it was unmeasured through 148 OOM kills. Verified in
+     * the production container: 500 MB of ArrayBuffers moves `external` by
+     * 524 MB and `heapUsed` by 189 MB.
+     */
+    external: memLabel("external"),
+    arrayBuffers: memLabel("array_buffers"),
   },
   cpu: {
-    user: labelKey({ type: "user" }),
-    system: labelKey({ type: "system" }),
+    user: memLabel("user"),
+    system: memLabel("system"),
+  },
+  /** For metrics that are per-process but carry no other dimension. */
+  worker: labelKey(workerLabels()),
+  enrichQueue: {
+    total: labelKey({ state: "total" }),
+    claimed: labelKey({ state: "claimed" }),
+    exhausted: labelKey({ state: "exhausted" }),
   },
 } as const;
 
@@ -333,8 +389,14 @@ export function startRuntimeMetricsCollection(): void {
   runtimeInterval = setInterval(() => {
     const mem = process.memoryUsage();
     processMemoryBytes.set(mem.rss, LABEL.mem.rss);
+    // NOTE: under Bun these are JSC values, not V8's. `heapTotal` is not a
+    // capacity that bounds `heapUsed` (production reports heapTotal 575 KB
+    // against heapUsed 178 KB), so heapUsed > heapTotal is expected and is not
+    // a sign of swapped labels. Read `rss` and `external` instead.
     processMemoryBytes.set(mem.heapTotal, LABEL.mem.heapTotal);
     processMemoryBytes.set(mem.heapUsed, LABEL.mem.heapUsed);
+    processMemoryBytes.set(mem.external, LABEL.mem.external);
+    processMemoryBytes.set(mem.arrayBuffers, LABEL.mem.arrayBuffers);
 
     const usage = process.resourceUsage();
     const userDelta = (usage.userCPUTime - lastCpuUser) / 1_000_000;
@@ -346,7 +408,7 @@ export function startRuntimeMetricsCollection(): void {
 
     const now = performance.now();
     const lag = Math.max(0, (now - lastCheck - 5000) / 1000);
-    eventLoopLag.observe(lag);
+    eventLoopLag.observe(lag, LABEL.worker);
     lastCheck = now;
   }, 5000);
 
diff --git a/src/middleware/otel-middleware.ts b/src/middleware/otel-middleware.ts
index a6ac60b..1f7676c 100644
--- a/src/middleware/otel-middleware.ts
+++ b/src/middleware/otel-middleware.ts
@@ -17,7 +17,13 @@ let tracer: Tracer | undefined = trace.getTracer("hono", "0.0.1");
 
 export const opentelemetryMiddleware = (): MiddlewareHandler => async (ctx, next) => {
   const span = tracer.startSpan(
-    "hono-middleware",
+    // Method only. Renamed to the matched route once routing has happened (see
+    // updateName below), so this value survives just for requests that throw
+    // before a route matches — and those are exactly the ones with arbitrary
+    // paths. Interpolating the raw path here would mint a distinct operation
+    // name per URL, which is the cardinality blow-up this rename exists to
+    // avoid. The full path is still on the span as ATTR_URL_PATH.
+    ctx.req.method,
     {
       attributes: {
         [ATTR_HTTP_REQUEST_METHOD]: ctx.req.method,
@@ -49,6 +55,30 @@ export const opentelemetryMiddleware = (): MiddlewareHandler => async (ctx, next
       message: error instanceof Error ? error.message : "unknown error",
     });
     throw error;
+  } finally {
+    // In `finally`, not after the try: a throwing `next()` used to rethrow past
+    // `span.end()`, so the span was never ended and never exported. That lost
+    // the trace for exactly the requests worth tracing, and left the span
+    // pinned in the SDK.
+    //
+    // Every span used to be called "hono-middleware": 82.6% of an hour's 2,341
+    // production spans shared that single name, so nothing could be grouped,
+    // ranked or compared. `routePath` is only known after routing, and it is
+    // the matched *pattern* (`/books/:hiveId`) rather than the concrete URL —
+    // so per-route aggregation works without minting a distinct operation name
+    // for every book id.
+    try {
+      const routePath = ctx.req.routePath;
+      if (routePath && routePath !== "/*") {
+        span.updateName(`${ctx.req.method} ${routePath}`);
+        span.setAttribute("http.route", routePath);
+      }
+      span.setAttribute("http.status_code", ctx.res.status);
+    } catch {
+      // Guarded because this now runs on the throwing path too, and a throw
+      // from a `finally` would *replace* the request's real error with a
+      // telemetry one. Ending the span still matters more than labelling it.
+    }
+    span.end();
   }
-  span.end();
 };
diff --git a/src/middleware/wide-event.ts b/src/middleware/wide-event.ts
index 39bac40..bd09fb4 100644
--- a/src/middleware/wide-event.ts
+++ b/src/middleware/wide-event.ts
@@ -69,6 +69,10 @@ export function wideEventMiddleware(): MiddlewareHandler<AppEnv> {
           duration_ms: durationMs,
           outcome,
           timestamp: new Date().toISOString(),
+          // Which of the WEB_CONCURRENCY processes served this. Without it a
+          // per-worker problem is invisible in aggregate log queries — pino's
+          // `pid` changes on every OOM restart, so it can't be grouped on.
+          worker_index: env.WORKER_INDEX || "solo",
           env: {
             node_env: env.NODE_ENV,
             ...(env.BUILD_SHA ? { build_sha: env.BUILD_SHA } : {}),
diff --git a/src/pages/authorBooks.tsx b/src/pages/authorBooks.tsx
index a0b67a0..b5eb349 100644
--- a/src/pages/authorBooks.tsx
+++ b/src/pages/authorBooks.tsx
@@ -5,7 +5,6 @@ import { BookCard, normalizeBookData } from "./components/BookCard";
 import { endTime, startTime } from "hono/timing";
 import type { AppContext } from "../context";
 import type { Context } from "hono";
-import { buildAuthorLikePatterns } from "../utils/authorMatching";
 import { buildUrl } from "./utils/buildUrl";
 import { LanguageSelect } from "./components/LanguageSelect";
 
@@ -222,23 +221,18 @@ export async function getBooksByAuthor(
   const validPage = Math.max(1, page);
   const offset = (validPage - 1) * pageSize;
 
-  // Build the author matching condition for tab-separated authors field
-  // Authors are stored as "Author1\tAuthor2\tAuthor3"
-  const patterns = buildAuthorLikePatterns(author);
-  const authorCondition = sql`(
-    authors = ${patterns.exact}
-    OR authors LIKE ${patterns.first}
-    OR authors LIKE ${patterns.middle}
-    OR authors LIKE ${patterns.last}
-  )`;
-
   startTime(c, "author-books-count-query");
   startTime(c, "author-books-data-query");
 
+  // Indexed join on hive_book_author (migration 020). This was four LIKE
+  // patterns against the tab-separated `authors` column, two of them
+  // leading-wildcard, so it planned SCAN hive_book + a temp B-tree sort over
+  // 356k rows — ~511ms per request.
   let dataQuery = ctx.db
     .selectFrom("hive_book")
-    .selectAll()
-    .where(authorCondition as any);
+    .innerJoin("hive_book_author", "hive_book_author.hiveId", "hive_book.id")
+    .where("hive_book_author.author", "=", author)
+    .selectAll("hive_book");
 
   // Language is a soft preference: sort matching-language books first, don't filter
   if (language) {
@@ -254,10 +248,10 @@ export async function getBooksByAuthor(
       break;
   }
 
-  let countQuery = ctx.db
-    .selectFrom("hive_book")
+  const countQuery = ctx.db
+    .selectFrom("hive_book_author")
     .select(sql<number>`COUNT(*)`.as("count"))
-    .where(authorCondition as any);
+    .where("author", "=", author);
 
   const [totalCountResult, books] = await Promise.all([
     countQuery.executeTakeFirst().then((r) => {
diff --git a/src/pages/authorDirectory.tsx b/src/pages/authorDirectory.tsx
index 5f1ee7a..deb135e 100644
--- a/src/pages/authorDirectory.tsx
+++ b/src/pages/authorDirectory.tsx
@@ -25,11 +25,6 @@ function formatCount(count: number): string {
   return `${Math.floor(count / 100) * 100}+`;
 }
 
-const AUTHOR_EXPR = `CASE WHEN instr(authors, char(9)) > 0
-       THEN trim(substr(authors, 1, instr(authors, char(9)) - 1))
-       ELSE trim(authors)
-  END`;
-
 const FEATURED_COUNT = 8;
 
 /**
@@ -45,16 +40,20 @@ export async function getTopAuthors(
   limit: number,
   language?: string,
 ): Promise<AuthorWithStats[]> {
-  const langCondition = language ? sql`WHERE language = ${language}` : sql``;
+  // Groups the normalized hive_book_author table (migration 020) rather than
+  // re-deriving the first author per row with instr/substr/trim over the whole
+  // of hive_book. `position = 0` is the credited first author.
+  const langCondition = language ? sql`AND b.language = ${language}` : sql``;
   const statsResult = await sql<AuthorStats>`
     SELECT
-      ${sql.raw(AUTHOR_EXPR)} as author,
-      SUM(COALESCE(ratingsCount, 0)) as totalRatings,
-      ROUND(AVG(CASE WHEN rating IS NOT NULL AND rating > 0 THEN rating END) / 1000.0, 1) as avgRating,
+      a.author as author,
+      SUM(COALESCE(b.ratingsCount, 0)) as totalRatings,
+      ROUND(AVG(CASE WHEN b.rating IS NOT NULL AND b.rating > 0 THEN b.rating END) / 1000.0, 1) as avgRating,
       COUNT(*) as bookCount
-    FROM hive_book
-    ${langCondition}
-    GROUP BY 1
+    FROM hive_book_author a
+    JOIN hive_book b ON b.id = a.hiveId
+    WHERE a.position = 0 ${langCondition}
+    GROUP BY a.author
     HAVING bookCount >= 2 AND totalRatings > 0
     ORDER BY totalRatings DESC
     LIMIT ${limit}
@@ -65,14 +64,13 @@ export async function getTopAuthors(
 
   // Resolve thumbnails with a single forward scan of the most-rated books.
   // All top-N authors' best books appear well within the first limit*150 rows.
-  const thumbLangCondition = language
-    ? sql`WHERE thumbnail IS NOT NULL AND thumbnail != '' AND language = ${language}`
-    : sql`WHERE thumbnail IS NOT NULL AND thumbnail != ''`;
+  const thumbLangCondition = language ? sql`AND b.language = ${language}` : sql``;
   const thumbResult = await sql<{ author: string; thumbnail: string }>`
-    SELECT ${sql.raw(AUTHOR_EXPR)} as author, thumbnail
-    FROM hive_book
-    ${thumbLangCondition}
-    ORDER BY ratingsCount DESC
+    SELECT a.author as author, b.thumbnail as thumbnail
+    FROM hive_book_author a
+    JOIN hive_book b ON b.id = a.hiveId
+    WHERE a.position = 0 AND b.thumbnail IS NOT NULL AND b.thumbnail != '' ${thumbLangCondition}
+    ORDER BY b.ratingsCount DESC
     LIMIT ${limit * 150}
   `.execute(db);
 
@@ -92,12 +90,14 @@ export async function getTopAuthors(
 async function getAllAuthors(db: Kysely<DatabaseSchema>): Promise<AuthorStats[]> {
   const result = await sql<AuthorStats>`
     SELECT
-      ${sql.raw(AUTHOR_EXPR)} as author,
-      SUM(COALESCE(ratingsCount, 0)) as totalRatings,
-      ROUND(AVG(CASE WHEN rating IS NOT NULL AND rating > 0 THEN rating END) / 1000.0, 1) as avgRating,
+      a.author as author,
+      SUM(COALESCE(b.ratingsCount, 0)) as totalRatings,
+      ROUND(AVG(CASE WHEN b.rating IS NOT NULL AND b.rating > 0 THEN b.rating END) / 1000.0, 1) as avgRating,
       COUNT(*) as bookCount
-    FROM hive_book
-    GROUP BY 1
+    FROM hive_book_author a
+    JOIN hive_book b ON b.id = a.hiveId
+    WHERE a.position = 0
+    GROUP BY a.author
     HAVING bookCount >= 2 AND totalRatings > 0
     ORDER BY totalRatings DESC
     LIMIT 500
diff --git a/src/pages/bookInfo.tsx b/src/pages/bookInfo.tsx
index 76a2df2..4a059d5 100644
--- a/src/pages/bookInfo.tsx
+++ b/src/pages/bookInfo.tsx
@@ -7,7 +7,6 @@ import { BOOK_STATUS, BOOK_STATUS_MAP } from "../constants";
 import { buildCrossPostText } from "../bsky/crossPost";
 import { env } from "../env";
 import type { HiveBook } from "../types";
-import { buildAuthorLikePatterns } from "../utils/authorMatching";
 import { normalizeBookMeta } from "../utils/bookMeta";
 import { loadGenresForHiveBook } from "../utils/hiveBookGenres";
 import { hydrateUserBook } from "../utils/bookProgress";
@@ -142,11 +141,17 @@ export const BookInfo: FC<{
   const did = (await c.get("ctx").getSessionAgent())?.did ?? null;
   endTime(c, "get_session");
 
-  const firstAuthor = book.authors.split("\t")[0] ?? "";
-  const patterns = firstAuthor ? buildAuthorLikePatterns(firstAuthor) : null;
-  const authorCondition = patterns
-    ? sql`(authors = ${patterns.exact} OR authors LIKE ${patterns.first} OR authors LIKE ${patterns.middle} OR authors LIKE ${patterns.last})`
-    : sql`0`;
+  // Split once, trimmed, and used for every author-keyed lookup and link on
+  // this page. `hive_book.authors` stays tab-separated as the canonical form,
+  // but mig 020's trigger stores each name through `trim(substr(...))` — so a
+  // padded segment here fails the equality filter and produces an /authors/
+  // link that matches nothing. Deriving both from one array is what keeps the
+  // first author and the rendered list from disagreeing about that.
+  const authors = book.authors
+    .split("\t")
+    .map((author) => author.trim())
+    .filter(Boolean);
+  const firstAuthor = authors[0] ?? "";
 
   // Run all independent queries in parallel
   startTime(c, "db_parallel_queries");
@@ -210,9 +215,10 @@ export const BookInfo: FC<{
           let q = c
             .get("ctx")
             .db.selectFrom("hive_book")
-            .selectAll()
-            .where("id", "!=", book.id)
-            .where(authorCondition as any);
+            .innerJoin("hive_book_author", "hive_book_author.hiveId", "hive_book.id")
+            .selectAll("hive_book")
+            .where("hive_book.id", "!=", book.id)
+            .where("hive_book_author.author", "=", firstAuthor);
           if (book.language) {
             q = q.orderBy(sql`CASE WHEN language = ${book.language} THEN 0 ELSE 1 END`, "asc");
           }
@@ -287,7 +293,7 @@ export const BookInfo: FC<{
               </h1>
               <p class="mb-3 text-lg text-muted-foreground">
                 by{" "}
-                {book.authors.split("\t").map((author, index, array) => (
+                {authors.map((author, index, array) => (
                   <Fragment key={author}>
                     <a
                       href={`/authors/${encodeURIComponent(author)}`}
diff --git a/src/routes/debug.ts b/src/routes/debug.ts
index 0cd9d19..aea9c75 100644
--- a/src/routes/debug.ts
+++ b/src/routes/debug.ts
@@ -1,5 +1,6 @@
 import inspector from "node:inspector";
 import os from "node:os";
+import { readFileSync } from "node:fs";
 import { Hono } from "hono";
 import { z } from "zod";
 import { zValidator } from "@hono/zod-validator";
@@ -7,9 +8,49 @@ import { zValidator } from "@hono/zod-validator";
 import type { AppEnv } from "../context";
 import { env } from "../env";
 import { isAuthorizedExportRequest } from "../utils/dbExport";
+import { restoreGuardStates } from "../auth/restore-guard";
 
 let isProfilingActive = false;
 
+/** Parsed /proc/self/smaps_rollup, or null off Linux (macOS dev). */
+function readSmapsRollup(): Record<string, number> | null {
+  try {
+    const text = readFileSync("/proc/self/smaps_rollup", "utf8");
+    const out: Record<string, number> = {};
+    for (const line of text.split("\n")) {
+      const m = /^(\w+):\s+(\d+) kB$/.exec(line);
+      if (m?.[1] && m[2]) out[m[1]] = Number(m[2]);
+    }
+    return Object.keys(out).length ? out : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Resident mappings over 20 MB, largest first — attributes RSS to real files. */
+function readLargestMappings(limit = 12): Array<{ rssKb: number; path: string }> | null {
+  try {
+    const text = readFileSync("/proc/self/smaps", "utf8");
+    const out: Array<{ rssKb: number; path: string }> = [];
+    let path = "[anon]";
+    for (const line of text.split("\n")) {
+      const header = /^[0-9a-f]+-[0-9a-f]+ \S+ \S+ \S+ \S+\s*(.*)$/.exec(line);
+      if (header) {
+        path = header[1]?.trim() || "[anon]";
+        continue;
+      }
+      const rss = /^Rss:\s+(\d+) kB$/.exec(line);
+      if (rss?.[1]) {
+        const rssKb = Number(rss[1]);
+        if (rssKb > 20_000) out.push({ rssKb, path });
+      }
+    }
+    return out.sort((a, b) => b.rssKb - a.rssKb).slice(0, limit);
+  } catch {
+    return null;
+  }
+}
+
 const debug = new Hono<AppEnv>()
   // Auth middleware for all /debug/* routes
   .use("*", async (c, next) => {
@@ -26,6 +67,37 @@ const debug = new Hono<AppEnv>()
     await next();
   })
 
+  /**
+   * Per-process memory, broken down the way the OOM investigation actually
+   * needed it.
+   *
+   * `ps`/`RSS` counts the ~1 GB clean, shared, file-backed SQLite mmap, which
+   * is reclaimable — that term is why per-worker RSS readings looked like a
+   * 1.2-1.4 GB "balloon rotating between workers" when the real anonymous
+   * footprint was ~320 MB. `Anonymous` from smaps_rollup is the number that
+   * matters, and `mappings` attributes the rest to actual files.
+   */
+  .get("/memory", (c) => {
+    const mem = process.memoryUsage();
+    return c.json(
+      {
+        worker: env.WORKER_INDEX || "solo",
+        pid: process.pid,
+        uptimeSeconds: process.uptime(),
+        cpuCount: os.cpus().length,
+        // Under Bun these are JSC values: heapTotal is not a bound on heapUsed.
+        // `external`/`arrayBuffers` are the native, off-heap bytes.
+        memoryUsage: mem,
+        nonHeapBytes: mem.rss - mem.heapUsed,
+        smapsRollup: readSmapsRollup(),
+        mappings: readLargestMappings(),
+        pdsBreakers: restoreGuardStates().filter((s) => s.state !== "closed"),
+      },
+      200,
+      { "Cache-Control": "no-store" },
+    );
+  })
+
   .get("/heap-snapshot", (c) => {
     const timestamp = Date.now();
     const snapshot = Bun.generateHeapSnapshot("v8");
@@ -118,19 +190,6 @@ const debug = new Hono<AppEnv>()
     },
   )
 
-  .get("/memory", (c) => {
-    const mem = process.memoryUsage();
-    return c.json({
-      rss: mem.rss,
-      heapTotal: mem.heapTotal,
-      heapUsed: mem.heapUsed,
-      external: mem.external,
-      arrayBuffers: mem.arrayBuffers,
-      uptimeSeconds: process.uptime(),
-      cpuCount: os.cpus().length,
-    });
-  })
-
   .post("/gc", (c) => {
     const before = process.memoryUsage();
     Bun.gc(true);
diff --git a/src/routes/lib.ts b/src/routes/lib.ts
index 7d7b868..f4ed16f 100644
--- a/src/routes/lib.ts
+++ b/src/routes/lib.ts
@@ -20,6 +20,28 @@ import { findBookDetails } from "../scrapers";
 import { enqueueEnrichment, enqueueEnrichmentBatch } from "../utils/enrichQueue";
 import { serializeUserBook } from "../utils/bookProgress";
 import { upsertBookIdentifiers, upsertBookIdentifiersBatch } from "../utils/bookIdentifiers";
+import { Semaphore } from "../utils/semaphore";
+import { ftsMatchQuery, isUsefulFtsQuery } from "../utils/ftsQuery";
+import { sql } from "kysely";
+
+/**
+ * Concurrency ceiling for the per-book searches a library re-sync fans out.
+ * Matches SEARCH_CONCURRENCY in src/workers/import/logic.ts, which already got
+ * this right — the import worker chunks the identical work at 3.
+ */
+const REFETCH_SEARCH_CONCURRENCY = 3;
+/**
+ * `maxPending`/`acquireTimeoutMs` are finite on purpose. The semaphore is
+ * module-scoped, so concurrent re-syncs share it: one page pushes up to 100
+ * waiters, and with several users re-syncing at once the queue is bounded only
+ * by traffic. Shedding past that point is the right answer — these searches are
+ * best-effort cache warming, not part of the response.
+ */
+const searchSlots = new Semaphore(REFETCH_SEARCH_CONCURRENCY, {
+  label: "refetch_search",
+  maxPending: 500,
+  acquireTimeoutMs: 60_000,
+});
 
 /** Sets Cache-Control header on successful responses. Won't override if already set by the handler. */
 export const cacheControl = (directive: string) =>
@@ -91,22 +113,25 @@ export async function searchBooks({
         }
       }
 
-      // Backfill from local DB with ILIKE to reach up to 20 results
-      const pattern = `%${query}%`;
-      const dbRows = await ctx.db
-        .selectFrom("hive_book")
-        .select("id")
-        .where((eb) =>
-          eb.or([
-            eb("rawTitle", "like", pattern),
-            eb("title", "like", pattern),
-            eb("authors", "like", pattern),
-          ]),
-        )
-        .orderBy("ratingsCount", "desc")
-        .orderBy("rating", "desc")
-        .limit(20)
-        .execute();
+      // Backfill from the local DB to reach up to 20 results.
+      //
+      // This was `LIKE '%…%'` across three columns, which planned
+      // `SCAN hive_book` + a temp B-tree sort over 356k rows — 633-725ms per
+      // call, and `refetchBooks` fires one per book in the library. The FTS5
+      // index (migration 019) serves the same query in 0-7ms.
+      const match = isUsefulFtsQuery(query) ? ftsMatchQuery(query) : null;
+      const dbRows = match
+        ? (
+            await sql<{ id: HiveId }>`
+              SELECT b.id
+              FROM hive_book_fts f
+              JOIN hive_book b ON b.rowid = f.rowid
+              WHERE hive_book_fts MATCH ${match}
+              ORDER BY b.ratingsCount DESC, b.rating DESC
+              LIMIT 20
+            `.execute(ctx.db)
+          ).rows
+        : [];
 
       const combined = [...goodreadsIds];
       for (const { id } of dbRows) {
@@ -375,7 +400,16 @@ export async function refetchBooks({
   const rowsToUpsert = bookRecords.map((record) => {
     const book = record.value;
 
-    promises.push(searchBooks({ query: book.title, ctx }));
+    // Bounded, not pushed straight onto `promises`. Each searchBooks is an
+    // outbound Goodreads fetch *and* a `LIKE '%…%'` scan of all 356k hive_book
+    // rows sorting into a temp B-tree; firing 100 at once per page, recursing
+    // over the whole library, was the largest uncapped fan-out in the app.
+    //
+    // Swallowed: `promises` is awaited with `Promise.all`, and the result of
+    // this search is discarded — it runs to warm the catalog. Letting one
+    // Goodreads timeout (or a shed slot) reject would abort the user's entire
+    // library re-sync, including the upserts queued alongside it.
+    promises.push(searchSlots.run(() => searchBooks({ query: book.title, ctx })).catch(() => null));
     uris.push(record.uri);
 
     if (!book.hiveBookUri) {
diff --git a/src/routes/library.tsx b/src/routes/library.tsx
index babe5a9..2e8de02 100644
--- a/src/routes/library.tsx
+++ b/src/routes/library.tsx
@@ -1,5 +1,6 @@
 import { zValidator } from "@hono/zod-validator";
 import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
 import { z } from "zod";
 
 import type { AppEnv } from "../context";
@@ -20,11 +21,12 @@ import {
   bookFilePath,
   coverFilePath,
   streamPersonalBook,
+  MAX_PERSONAL_BOOK_BYTES,
 } from "../utils/personalLibrary";
 import { NO_HIVE_MATCH } from "../utils/syncMatching";
 import type { HiveId, SyncProgressData } from "../types";
 
-const MAX_FILE_SIZE = 100 * 1024 * 1024; // 100 MB
+const MAX_FILE_SIZE = MAX_PERSONAL_BOOK_BYTES;
 
 const app = new Hono<AppEnv>()
   .get("/", async (c) => {
@@ -59,132 +61,152 @@ const app = new Hono<AppEnv>()
       { title: "Personal Library" },
     );
   })
-  .post("/upload", async (c) => {
-    const agent = await c.get("ctx").getSessionAgent();
-    if (!agent) return c.json({ error: "Unauthorized" }, 401);
-
-    // The browser posts a plain <form> and wants to land back on the library;
-    // the mobile app posts the same multipart body but needs the created record
-    // (and a real status on duplicates) rather than a redirect to HTML.
-    const wantsJson = c.req.header("accept")?.includes("application/json") ?? false;
+  .post(
+    "/upload",
+    // Rejects on Content-Length, and aborts the stream once the cap is passed
+    // when there is none. This has to run *before* the handler because
+    // `c.req.formData()` materialises the entire multipart body in native
+    // memory — the `file.size` check below cannot fire until after that has
+    // already happened, so on its own it bounds what we store, not what we
+    // allocate.
+    bodyLimit({
+      maxSize: MAX_FILE_SIZE,
+      onError: (c) => c.json({ error: "File exceeds 100 MB limit" }, 413),
+    }),
+    async (c) => {
+      const agent = await c.get("ctx").getSessionAgent();
+      if (!agent) return c.json({ error: "Unauthorized" }, 401);
+
+      // The browser posts a plain <form> and wants to land back on the library;
+      // the mobile app posts the same multipart body but needs the created record
+      // (and a real status on duplicates) rather than a redirect to HTML.
+      const wantsJson = c.req.header("accept")?.includes("application/json") ?? false;
+
+      const formData = await c.req.formData();
+      const file = formData.get("file");
+      if (!file || !(file instanceof File)) {
+        return c.json({ error: "No file provided" }, 400);
+      }
 
-    const formData = await c.req.formData();
-    const file = formData.get("file");
-    if (!file || !(file instanceof File)) {
-      return c.json({ error: "No file provided" }, 400);
-    }
+      // Check the declared size *before* materialising the file. The check used
+      // to run after `arrayBuffer()`, so rejecting an oversized upload still cost
+      // a full copy of it in native memory first.
+      if (file.size > MAX_FILE_SIZE) {
+        return c.json({ error: "File exceeds 100 MB limit" }, 413);
+      }
 
-    const bytes = new Uint8Array(await file.arrayBuffer());
-    if (bytes.length > MAX_FILE_SIZE) {
-      return c.json({ error: "File exceeds 100 MB limit" }, 413);
-    }
+      const bytes = new Uint8Array(await file.arrayBuffer());
+      if (bytes.length > MAX_FILE_SIZE) {
+        return c.json({ error: "File exceeds 100 MB limit" }, 413);
+      }
 
-    const formatInfo = detectFormat(bytes, file.name);
-    if (formatInfo.format === "unknown") {
-      return c.json({ error: "Unsupported file format" }, 400);
-    }
+      const formatInfo = detectFormat(bytes, file.name);
+      if (formatInfo.format === "unknown") {
+        return c.json({ error: "Unsupported file format" }, 400);
+      }
 
-    const contentHash = koreaderPartialMD5(bytes);
+      const contentHash = koreaderPartialMD5(bytes);
 
-    const { db } = c.get("ctx");
+      const { db } = c.get("ctx");
 
-    // Check for duplicate
-    const existing = await db
-      .selectFrom("personal_book")
-      .select("id")
-      .where("userDid", "=", agent.did)
-      .where("contentHash", "=", contentHash)
-      .executeTakeFirst();
-    if (existing) {
-      if (wantsJson) {
-        return c.json({ error: "This book is already in your library" }, 409);
+      // Check for duplicate
+      const existing = await db
+        .selectFrom("personal_book")
+        .select("id")
+        .where("userDid", "=", agent.did)
+        .where("contentHash", "=", contentHash)
+        .executeTakeFirst();
+      if (existing) {
+        if (wantsJson) {
+          return c.json({ error: "This book is already in your library" }, 409);
+        }
+        return c.redirect("/library");
       }
-      return c.redirect("/library");
-    }
 
-    const metadata = parseBook(bytes, file.name);
+      const metadata = parseBook(bytes, file.name);
 
-    await ensureDir(personalBookDir(agent.did, contentHash));
+      await ensureDir(personalBookDir(agent.did, contentHash));
 
-    const filePath = bookFilePath(agent.did, contentHash, formatInfo.ext);
-    await Bun.write(filePath, bytes);
-
-    let coverPath: string | null = null;
-    let coverMime: string | null = null;
-    if (metadata.cover && (await isUsableCover(metadata.cover.bytes))) {
-      const cp = coverFilePath(agent.did, contentHash, metadata.cover.ext);
-      await Bun.write(cp, metadata.cover.bytes);
-      coverPath = cp;
-      coverMime = metadata.cover.mime;
-    }
-
-    // Try to match an existing sync_document (contentHash is the KOReader partial MD5)
-    let matchedHiveId: HiveId | null = null;
-    const syncDoc = await db
-      .selectFrom("sync_document")
-      .select(["hiveId"])
-      .where("userDid", "=", agent.did)
-      .where("documentHash", "=", contentHash)
-      .executeTakeFirst();
-    if (syncDoc?.hiveId) {
-      matchedHiveId = syncDoc.hiveId;
-    }
+      const filePath = bookFilePath(agent.did, contentHash, formatInfo.ext);
+      await Bun.write(filePath, bytes);
 
-    const now = new Date().toISOString();
-    await db
-      .insertInto("personal_book")
-      .values({
-        userDid: agent.did,
-        contentHash,
-        hiveId: matchedHiveId,
-        filename: file.name,
-        title: metadata.title,
-        authors: metadata.authors,
-        language: metadata.language || null,
-        format: formatInfo.format,
-        mime: formatInfo.mime,
-        filePath,
-        coverPath,
-        coverMime,
-        sizeBytes: bytes.length,
-        createdAt: now,
-        updatedAt: now,
-      })
-      .execute();
+      let coverPath: string | null = null;
+      let coverMime: string | null = null;
+      if (metadata.cover && (await isUsableCover(metadata.cover.bytes))) {
+        const cp = coverFilePath(agent.did, contentHash, metadata.cover.ext);
+        await Bun.write(cp, metadata.cover.bytes);
+        coverPath = cp;
+        coverMime = metadata.cover.mime;
+      }
 
-    // Mark the book as owned if auto-linked and user has it in their library
-    if (matchedHiveId) {
-      await db
-        .updateTable("user_book")
-        .set({ owned: 1 })
+      // Try to match an existing sync_document (contentHash is the KOReader partial MD5)
+      let matchedHiveId: HiveId | null = null;
+      const syncDoc = await db
+        .selectFrom("sync_document")
+        .select(["hiveId"])
         .where("userDid", "=", agent.did)
-        .where("hiveId", "=", matchedHiveId)
-        .where("owned", "=", 0)
-        .execute();
-    }
+        .where("documentHash", "=", contentHash)
+        .executeTakeFirst();
+      if (syncDoc?.hiveId) {
+        matchedHiveId = syncDoc.hiveId;
+      }
 
-    if (wantsJson) {
-      // Same shape as getPersonalLibrary#personalBookView so clients have one
-      // book type for both the list and the upload response.
-      return c.json({
-        book: {
+      const now = new Date().toISOString();
+      await db
+        .insertInto("personal_book")
+        .values({
+          userDid: agent.did,
           contentHash,
+          hiveId: matchedHiveId,
+          filename: file.name,
           title: metadata.title,
-          authors: metadata.authors || undefined,
-          language: metadata.language || undefined,
+          authors: metadata.authors,
+          language: metadata.language || null,
           format: formatInfo.format,
           mime: formatInfo.mime,
+          filePath,
+          coverPath,
+          coverMime,
           sizeBytes: bytes.length,
           createdAt: now,
           updatedAt: now,
-          hiveId: matchedHiveId ?? undefined,
-          coverUrl: coverPath ? `/library/covers/${contentHash}` : undefined,
-        },
-      });
-    }
+        })
+        .execute();
 
-    return c.redirect("/library");
-  });
+      // Mark the book as owned if auto-linked and user has it in their library
+      if (matchedHiveId) {
+        await db
+          .updateTable("user_book")
+          .set({ owned: 1 })
+          .where("userDid", "=", agent.did)
+          .where("hiveId", "=", matchedHiveId)
+          .where("owned", "=", 0)
+          .execute();
+      }
+
+      if (wantsJson) {
+        // Same shape as getPersonalLibrary#personalBookView so clients have one
+        // book type for both the list and the upload response.
+        return c.json({
+          book: {
+            contentHash,
+            title: metadata.title,
+            authors: metadata.authors || undefined,
+            language: metadata.language || undefined,
+            format: formatInfo.format,
+            mime: formatInfo.mime,
+            sizeBytes: bytes.length,
+            createdAt: now,
+            updatedAt: now,
+            hiveId: matchedHiveId ?? undefined,
+            coverUrl: coverPath ? `/library/covers/${contentHash}` : undefined,
+          },
+        });
+      }
+
+      return c.redirect("/library");
+    },
+  );
 
 // Serve cover images for personal library books
 app.get("/covers/:hash", async (c) => {
@@ -222,8 +244,14 @@ app.get("/books/:hash/download", async (c) => {
   const userDid = await c.get("ctx").getSessionDid();
   if (!userDid) return c.json({ error: "Unauthorized" }, 401);
 
-  const download = await streamPersonalBook(c.get("ctx").db, userDid, c.req.param("hash"));
+  const download = await streamPersonalBook(
+    c.get("ctx").db,
+    userDid,
+    c.req.param("hash"),
+    c.req.header("if-none-match"),
+  );
   if (!download) return c.notFound();
+  if (download.notModified) return c.body(null, 304, download.headers);
 
   return c.body(download.stream, 200, download.headers);
 });
diff --git a/src/routes/og.tsx b/src/routes/og.tsx
index b904cd2..b816cc1 100644
--- a/src/routes/og.tsx
+++ b/src/routes/og.tsx
@@ -4,11 +4,10 @@
  *
  * Route handlers run DB queries and build props on the main thread.
  * Rendering is offloaded to a dedicated worker thread via renderOgImage().
- * Results are cached in-memory with per-route TTLs via ocache.
+ * There is **no server-side cache** — see the note above `renderOnce` below.
  */
 import { Hono } from "hono";
 import { isDid } from "@atcute/lexicons/syntax";
-import { defineCachedFunction } from "ocache";
 
 import type { AppEnv } from "../context";
 import type { Context } from "hono";
@@ -23,7 +22,6 @@ import {
   filterFinishedBooksAllTime,
   MIN_BOOKS_FOR_YEAR_STATS,
 } from "../utils/readingStats";
-import { buildAuthorLikePatterns } from "../utils/authorMatching";
 import { BOOK_STATUS } from "../constants";
 import { sql } from "kysely";
 import { renderOgImage } from "../workers/og-render/client";
@@ -31,29 +29,37 @@ import type { OgCard } from "../workers/og-render/types";
 
 // ─── Cache + helpers ─────────────────────────────────────────────────────────
 
-function createCachedRenderOg(ttl: number) {
-  return defineCachedFunction(
-    async (card: OgCard) => {
-      const buffer = await renderOgImage(card);
-      return new Uint8Array(buffer);
-    },
-    {
-      maxAge: ttl,
-      getKey: (card) => `${card.kind}:${JSON.stringify(card.props)}`,
-    },
-  );
-}
+/**
+ * Renders are **not cached server-side**. Cloudflare is the cache: these
+ * responses carry `public, max-age=…`, and a card that gets requested twice is
+ * served from the edge without touching the origin. Measured over 48h of
+ * production traffic, the origin therefore sees an almost perfectly unique
+ * stream — 1,189 requests across 1,134 distinct cards, 1,081 of them requested
+ * exactly once, max 4 repeats. A *perfect* origin cache could have served 4% of
+ * them.
+ *
+ * That 4% was previously bought with an unbounded per-process `Map` of webp
+ * bytes (the OOM), and then with an `og_cache` KV table that cost a base64
+ * round-trip, a sweep on the 15-min timer, two gauges, and an extra writer to a
+ * file we already have to VACUUM. Rendering on demand costs ~600ms p50 on a
+ * worker thread, ~25 times an hour.
+ *
+ * `renderOnce` is all that survives: concurrent requests for the *same* cold
+ * card share one render instead of starting N. It holds promises, never bytes,
+ * and always clears in `finally`.
+ */
+const inflight = new Map<string, Promise<Uint8Array<ArrayBuffer>>>();
 
-type CachedRenderOg = ReturnType<typeof createCachedRenderOg>;
-const cachedRenderOgByTTL = new Map<number, CachedRenderOg>();
+function renderOnce(card: OgCard): Promise<Uint8Array<ArrayBuffer>> {
+  const key = `${card.kind}:${Bun.hash(JSON.stringify(card.props)).toString(36)}`;
+  const existing = inflight.get(key);
+  if (existing) return existing;
 
-function getCachedRenderOg(ttl: number): CachedRenderOg {
-  let cached = cachedRenderOgByTTL.get(ttl);
-  if (!cached) {
-    cached = createCachedRenderOg(ttl);
-    cachedRenderOgByTTL.set(ttl, cached);
-  }
-  return cached;
+  const work = renderOgImage(card).then((buf) => new Uint8Array(buf) as Uint8Array<ArrayBuffer>);
+  inflight.set(key, work);
+  return work.finally(() => {
+    inflight.delete(key);
+  });
 }
 
 // Cache TTLs in seconds
@@ -121,7 +127,7 @@ async function makeOgResponse(c: Context<AppEnv>, card: OgCard, maxAge: number):
   const end = imageProcessingDuration.startTimer(LABEL.op.og_image);
   activeOperations.inc(LABEL.op.og_image);
   try {
-    const bytes = await getCachedRenderOg(maxAge)(card);
+    const bytes = await renderOnce(card);
     return new Response(bytes, {
       headers: {
         "Content-Type": "image/webp",
@@ -393,33 +399,31 @@ const app = new Hono<AppEnv>()
     const author = decodeURIComponent(c.req.param("author"));
     const origin = getOrigin(c);
 
-    const patterns = buildAuthorLikePatterns(author);
-    const authorCondition = sql`(
-      authors = ${patterns.exact}
-      OR authors LIKE ${patterns.first}
-      OR authors LIKE ${patterns.middle}
-      OR authors LIKE ${patterns.last}
-    )`;
-
     const [totalRow, avgRow, books] = await Promise.all([
       c
         .get("ctx")
+        // Joined to hive_book like the two queries below it. Counting
+        // hive_book_author alone would report a different total than the books
+        // actually rendered if the mapping ever holds a row whose book is gone.
         .db.selectFrom("hive_book")
+        .innerJoin("hive_book_author", "hive_book_author.hiveId", "hive_book.id")
         .select((eb) => eb.fn.countAll().as("count"))
-        .where(authorCondition as any)
+        .where("hive_book_author.author", "=", author)
         .executeTakeFirst(),
       c
         .get("ctx")
         .db.selectFrom("hive_book")
+        .innerJoin("hive_book_author", "hive_book_author.hiveId", "hive_book.id")
         .select(sql<number>`AVG(rating)`.as("avg"))
-        .where(authorCondition as any)
+        .where("hive_book_author.author", "=", author)
         .where("rating", "is not", null)
         .executeTakeFirst(),
       c
         .get("ctx")
         .db.selectFrom("hive_book")
+        .innerJoin("hive_book_author", "hive_book_author.hiveId", "hive_book.id")
         .select(["cover", "thumbnail"])
-        .where(authorCondition as any)
+        .where("hive_book_author.author", "=", author)
         .orderBy("ratingsCount", "desc")
         .limit(6)
         .execute(),
diff --git a/src/routes/opds.ts b/src/routes/opds.ts
index 052aff8..bdfe4cf 100644
--- a/src/routes/opds.ts
+++ b/src/routes/opds.ts
@@ -525,10 +525,11 @@ app.get("/books/:hash/download", async (c) => {
   const { db } = c.get("ctx");
   const hash = c.req.param("hash");
 
-  const download = await streamPersonalBook(db, userDid, hash);
+  const download = await streamPersonalBook(db, userDid, hash, c.req.header("if-none-match"));
   if (!download) {
     return c.body("Not found", 404);
   }
+  if (download.notModified) return c.body(null, 304, download.headers);
 
   return c.body(download.stream, 200, download.headers);
 });
diff --git a/src/scrapers/goodreads.ts b/src/scrapers/goodreads.ts
index 7594a53..4ad6aee 100644
--- a/src/scrapers/goodreads.ts
+++ b/src/scrapers/goodreads.ts
@@ -90,6 +90,8 @@ class Goodreads {
 
     return {
       id: hiveId,
+      enrichAttempts: 0,
+      enrichFailedAt: null,
       title: result.bookTitleBare,
       rawTitle: result.title,
       authors,
diff --git a/src/scrapers/index.ts b/src/scrapers/index.ts
index 4218f3f..ef88e48 100644
--- a/src/scrapers/index.ts
+++ b/src/scrapers/index.ts
@@ -1,8 +1,5 @@
 import { scraperDuration, scraperRequestsTotal, activeOperations, LABEL } from "../metrics";
 import Goodreads from "./goodreads.ts";
-// import IsbnDb from "./isbndb.ts";
-// import Google from "./google.ts";
-// import { env } from "../env.ts";
 
 export async function findBookDetails(
   query: string,
diff --git a/src/sqlite-kv.ts b/src/sqlite-kv.ts
index 3034dc2..abbda77 100644
--- a/src/sqlite-kv.ts
+++ b/src/sqlite-kv.ts
@@ -64,14 +64,100 @@ export type KvDb = Kysely<TableSchema>;
  * Pass the result to multiple sqliteKv drivers via the `db` option to share
  * a single connection to the same file.
  */
-export function createSharedKvDb(location: string): KvDb {
+/** Returns the raw handle alongside Kysely, matching `createDb` in src/db.ts —
+ *  VACUUM and PRAGMA work needs the connection, not the query builder. */
+export function createSharedKvDb(location: string): { db: KvDb; sqlite: DatabaseSync } {
   const sqlite = new DatabaseSync(location);
   applyStandardPragmas(sqlite);
-  return new Kysely<TableSchema>({
+  const db = new Kysely<TableSchema>({
     dialect: new SqliteDialect({
       database: wrapBunSqliteForKysely(sqlite),
     }),
   });
+  return { db, sqlite };
+}
+
+/** Reclaim below this and it isn't worth the rewrite. */
+export const VACUUM_FREELIST_RATIO = 0.25;
+
+/**
+ * Reclaim free pages in the KV file, and switch it to incremental auto-vacuum
+ * so this stops being necessary.
+ *
+ * The KV is a delete-heavy workload — the page and OG caches churn constantly
+ * and the primary worker sweeps both every 15 minutes — but nothing ever
+ * VACUUMed it and `auto_vacuum` was never set. Measured on production
+ * 2026-08-02: **1.94 GB on disk holding 34.7 MB of live data, 98.1% free
+ * pages.** That is 1.9 GB of page-cache pressure inside a memory-limited
+ * cgroup, for nothing.
+ *
+ * A full VACUUM of that file took 1.36s. Cheap enough to do on every deploy,
+ * but gated on the ratio so a healthy file isn't rewritten for no reason.
+ * `auto_vacuum = INCREMENTAL` only takes effect after a VACUUM, which is why
+ * the pragma is set first and the two always run together.
+ */
+export function vacuumKvIfBloated(
+  sqlite: DatabaseSync,
+  log: (fields: Record<string, unknown>, msg: string) => void,
+): void {
+  const pageCount = readPragma(sqlite, "page_count");
+  const freelist = readPragma(sqlite, "freelist_count");
+  const pageSize = readPragma(sqlite, "page_size");
+  const autoVacuum = readPragma(sqlite, "auto_vacuum");
+  if (pageCount === 0) return;
+
+  const ratio = freelist / pageCount;
+  // 0 = NONE, 1 = FULL, 2 = INCREMENTAL.
+  if (ratio < VACUUM_FREELIST_RATIO && autoVacuum === 2) return;
+
+  const startedAt = Date.now();
+  const beforeBytes = pageCount * pageSize;
+  try {
+    if (autoVacuum !== 2) sqlite.exec("PRAGMA auto_vacuum = INCREMENTAL");
+    sqlite.exec("VACUUM");
+  } catch (err) {
+    // A crowded disk or a concurrent reader is not worth failing startup over.
+    log({ err, freelist_ratio: ratio }, "kv VACUUM failed");
+    return;
+  }
+
+  log(
+    {
+      durationMs: Date.now() - startedAt,
+      freelist_ratio: Number(ratio.toFixed(3)),
+      before_bytes: beforeBytes,
+      after_bytes: readPragma(sqlite, "page_count") * pageSize,
+    },
+    "kv VACUUM complete",
+  );
+}
+
+/**
+ * Reclaim whatever the sweeps just freed. Bounded by `pages` so it can sit on a
+ * periodic timer without ever becoming a long synchronous stall — unlike a full
+ * VACUUM, which rewrites the file.
+ */
+export function incrementalVacuumKv(
+  sqlite: DatabaseSync,
+  pages = 1000,
+  log?: (fields: Record<string, unknown>, msg: string) => void,
+): void {
+  // PRAGMA arguments cannot be bound, so this is string-interpolated — coerce
+  // to a whole number rather than trusting every present and future caller to
+  // pass one.
+  const count = Math.max(1, Math.floor(Number(pages) || 0));
+  try {
+    sqlite.exec(`PRAGMA incremental_vacuum(${count})`);
+  } catch (err) {
+    // Expected no-op when auto_vacuum isn't INCREMENTAL yet; anything else is
+    // worth a line, since this runs on a timer where silence is the default.
+    log?.({ err }, "kv incremental_vacuum failed");
+  }
+}
+
+export function readPragma(sqlite: DatabaseSync, name: string): number {
+  const row = sqlite.query(`PRAGMA ${name}`).get() as Record<string, number> | null;
+  return row ? (Object.values(row)[0] ?? 0) : 0;
 }
 
 const DRIVER_NAME = "sqlite";
diff --git a/src/sqlite-kv.vacuum.test.ts b/src/sqlite-kv.vacuum.test.ts
new file mode 100644
index 0000000..3d6a2c9
--- /dev/null
+++ b/src/sqlite-kv.vacuum.test.ts
@@ -0,0 +1,104 @@
+import { describe, it, expect } from "bun:test";
+import { Database as DatabaseSync } from "bun:sqlite";
+
+import { incrementalVacuumKv, vacuumKvIfBloated } from "./sqlite-kv";
+
+const noop = () => {};
+const pragma = (db: DatabaseSync, name: string) =>
+  Object.values((db.query(`PRAGMA ${name}`).get() ?? {}) as Record<string, number>)[0] ?? 0;
+
+/** Fill then delete, which is what leaves free pages behind. */
+function makeBloated(): DatabaseSync {
+  const db = new DatabaseSync(":memory:");
+  db.exec("CREATE TABLE kv (id TEXT PRIMARY KEY, value TEXT NOT NULL)");
+  const insert = db.prepare("INSERT INTO kv (id, value) VALUES (?1, ?2)");
+  for (let i = 0; i < 3_000; i++) insert.run(`k${i}`, "x".repeat(2_000));
+  db.exec("DELETE FROM kv WHERE id != 'k0'");
+  return db;
+}
+
+describe("vacuumKvIfBloated", () => {
+  it("reclaims free pages and switches the file to incremental auto-vacuum", () => {
+    const db = makeBloated();
+    const before = pragma(db, "page_count");
+    expect(pragma(db, "freelist_count") / before).toBeGreaterThan(0.25);
+
+    const logs: Array<{ fields: Record<string, unknown>; msg: string }> = [];
+    vacuumKvIfBloated(db, (fields, msg) => logs.push({ fields, msg }));
+
+    expect(pragma(db, "page_count")).toBeLessThan(before);
+    expect(pragma(db, "freelist_count")).toBe(0);
+    // 2 = INCREMENTAL. Without this the file goes straight back to growing.
+    expect(pragma(db, "auto_vacuum")).toBe(2);
+    expect(logs[0]?.msg).toBe("kv VACUUM complete");
+    expect(logs[0]?.fields["before_bytes"]).toBeGreaterThan(
+      logs[0]?.fields["after_bytes"] as number,
+    );
+  });
+
+  it("skips a healthy file that is already incremental", () => {
+    const db = new DatabaseSync(":memory:");
+    db.exec("PRAGMA auto_vacuum = INCREMENTAL");
+    db.exec("VACUUM");
+    db.exec("CREATE TABLE kv (id TEXT PRIMARY KEY, value TEXT NOT NULL)");
+    db.exec("INSERT INTO kv VALUES ('a', 'b')");
+
+    const logs: string[] = [];
+    vacuumKvIfBloated(db, (_f, msg) => logs.push(msg));
+    // No rewrite: a deploy on a clean file should cost nothing.
+    expect(logs).toEqual([]);
+  });
+
+  it("still converts a healthy file that was never set to incremental", () => {
+    // The one-time migration case — low bloat, but auto_vacuum is still NONE,
+    // so it has to run once or the file starts growing again immediately.
+    const db = new DatabaseSync(":memory:");
+    db.exec("CREATE TABLE kv (id TEXT PRIMARY KEY, value TEXT NOT NULL)");
+    db.exec("INSERT INTO kv VALUES ('a', 'b')");
+    expect(pragma(db, "auto_vacuum")).toBe(0);
+
+    vacuumKvIfBloated(db, noop);
+    expect(pragma(db, "auto_vacuum")).toBe(2);
+  });
+
+  it("does not throw on an empty database", () => {
+    expect(() => vacuumKvIfBloated(new DatabaseSync(":memory:"), noop)).not.toThrow();
+  });
+
+  it("swallows a VACUUM failure and reports it, rather than failing startup", () => {
+    const db = makeBloated();
+    const realExec = db.exec.bind(db);
+    // A VACUUM can genuinely fail at runtime — no disk space for the rewrite,
+    // or another connection holding an open transaction on the file.
+    db.exec = ((sql: string) => {
+      if (sql.includes("VACUUM")) throw new Error("database or disk is full");
+      return realExec(sql);
+    }) as typeof db.exec;
+
+    const logs: Array<{ fields: Record<string, unknown>; msg: string }> = [];
+    expect(() => vacuumKvIfBloated(db, (fields, msg) => logs.push({ fields, msg }))).not.toThrow();
+    expect(logs.some((l) => l.msg === "kv VACUUM failed")).toBe(true);
+  });
+});
+
+describe("incrementalVacuumKv", () => {
+  it("reclaims pages freed since the last run", () => {
+    const db = makeBloated();
+    vacuumKvIfBloated(db, noop);
+
+    const insert = db.prepare("INSERT INTO kv (id, value) VALUES (?1, ?2)");
+    for (let i = 0; i < 2_000; i++) insert.run(`n${i}`, "y".repeat(2_000));
+    db.exec("DELETE FROM kv");
+    const bloated = pragma(db, "page_count");
+    expect(pragma(db, "freelist_count")).toBeGreaterThan(0);
+
+    incrementalVacuumKv(db);
+    expect(pragma(db, "page_count")).toBeLessThan(bloated);
+  });
+
+  it("is a no-op — not an error — when auto_vacuum was never enabled", () => {
+    const db = new DatabaseSync(":memory:");
+    db.exec("CREATE TABLE kv (id TEXT PRIMARY KEY, value TEXT NOT NULL)");
+    expect(() => incrementalVacuumKv(db)).not.toThrow();
+  });
+});
diff --git a/src/types.ts b/src/types.ts
index 6388fc9..e3c7649 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -179,6 +179,17 @@ export type HiveBook = {
   series: string | null;
   meta: string | null;
   enrichedAt: string | null;
+  /**
+   * Cumulative failed enrichment attempts. Lives on the book, not the queue
+   * row, so the count survives the row being deleted and re-added.
+   */
+  enrichAttempts: number;
+  /**
+   * When enrichment gave up. Acts as a cooldown (see `ENRICH_RETRY_AFTER_MS`),
+   * not a permanent tombstone — without it, a crawler re-queued every
+   * permanently-failing book on every pass and the queue never converged.
+   */
+  enrichFailedAt: string | null;
   /**
    * External identifiers stored as JSON string
    */
@@ -205,6 +216,17 @@ export type HiveBookGenre = {
   genre: string;
 };
 
+/**
+ * Row shape for hive_book_author — `hive_book.authors` (tab-separated) split
+ * into one row per author, maintained by triggers (migration 020).
+ * `position` 0 is the credited first author.
+ */
+export type HiveBookAuthor = {
+  hiveId: HiveId;
+  author: string;
+  position: number;
+};
+
 /** Row shape for the book_id_map table (indexed book identifiers). */
 export type BookIdentifiersRow = {
   hiveId: HiveId;
diff --git a/src/utils/authorMatching.test.ts b/src/utils/authorMatching.test.ts
index 46eb356..4b172f4 100644
--- a/src/utils/authorMatching.test.ts
+++ b/src/utils/authorMatching.test.ts
@@ -1,48 +1,7 @@
 import { describe, it, expect } from "bun:test";
-import {
-  buildAuthorLikePatterns,
-  parseAuthors,
-  formatAuthors,
-  calculatePagination,
-} from "./authorMatching";
+import { parseAuthors, formatAuthors, calculatePagination } from "./authorMatching";
 
 describe("authorMatching utilities", () => {
-  describe("buildAuthorLikePatterns", () => {
-    it("should build correct patterns for a simple author name", () => {
-      const patterns = buildAuthorLikePatterns("Brandon Sanderson");
-
-      expect(patterns.exact).toBe("Brandon Sanderson");
-      expect(patterns.first).toBe("Brandon Sanderson\t%");
-      expect(patterns.middle).toBe("%\tBrandon Sanderson\t%");
-      expect(patterns.last).toBe("%\tBrandon Sanderson");
-    });
-
-    it("should handle author names with special characters", () => {
-      const patterns = buildAuthorLikePatterns("J.R.R. Tolkien");
-
-      expect(patterns.exact).toBe("J.R.R. Tolkien");
-      expect(patterns.first).toBe("J.R.R. Tolkien\t%");
-      expect(patterns.middle).toBe("%\tJ.R.R. Tolkien\t%");
-      expect(patterns.last).toBe("%\tJ.R.R. Tolkien");
-    });
-
-    it("should handle author names with apostrophes", () => {
-      const patterns = buildAuthorLikePatterns("Tamsyn O'Flynn");
-
-      expect(patterns.exact).toBe("Tamsyn O'Flynn");
-      expect(patterns.first).toBe("Tamsyn O'Flynn\t%");
-    });
-
-    it("should handle empty string", () => {
-      const patterns = buildAuthorLikePatterns("");
-
-      expect(patterns.exact).toBe("");
-      expect(patterns.first).toBe("\t%");
-      expect(patterns.middle).toBe("%\t\t%");
-      expect(patterns.last).toBe("%\t");
-    });
-  });
-
   describe("parseAuthors", () => {
     it("should parse single author", () => {
       expect(parseAuthors("Brandon Sanderson")).toEqual(["Brandon Sanderson"]);
diff --git a/src/utils/authorMatching.ts b/src/utils/authorMatching.ts
index efb9ae9..863cde9 100644
--- a/src/utils/authorMatching.ts
+++ b/src/utils/authorMatching.ts
@@ -5,28 +5,6 @@
 
 const TAB = "\t";
 
-/**
- * Builds SQL LIKE patterns for matching an author in a tab-separated string.
- * Returns the patterns needed to match an author in any position:
- * - Exact match (sole author)
- * - First author (followed by tab)
- * - Middle author (surrounded by tabs)
- * - Last author (preceded by tab)
- */
-export function buildAuthorLikePatterns(author: string): {
-  exact: string;
-  first: string;
-  middle: string;
-  last: string;
-} {
-  return {
-    exact: author,
-    first: author + TAB + "%",
-    middle: "%" + TAB + author + TAB + "%",
-    last: "%" + TAB + author,
-  };
-}
-
 /**
  * Splits a tab-separated authors string into an array of individual authors.
  */
diff --git a/src/utils/enrichQueue.test.ts b/src/utils/enrichQueue.test.ts
index 34ea22b..8bc1a2f 100644
--- a/src/utils/enrichQueue.test.ts
+++ b/src/utils/enrichQueue.test.ts
@@ -6,7 +6,12 @@ import type { Logger } from "pino";
 import { wrapBunSqliteForKysely } from "../bun-sqlite-kysely";
 import { migrateToLatest, type Database, type DatabaseSchema } from "../db";
 import type { HiveId } from "../types";
-import { drainEnrichmentQueue, enqueueEnrichment, enqueueEnrichmentBatch } from "./enrichQueue";
+import {
+  drainEnrichmentQueue,
+  enqueueEnrichment,
+  enqueueEnrichmentBatch,
+  publishEnrichQueueStats,
+} from "./enrichQueue";
 import type { EnrichFn } from "./enrichQueue";
 
 const HIVE_ID = "bk_queued" as HiveId;
@@ -41,6 +46,8 @@ async function insertBook(db: Database, id: HiveId, enrichedAt: string | null =
       source: "Goodreads",
       sourceUrl: `https://www.goodreads.com/book/show/${id}`,
       thumbnail: "",
+      enrichAttempts: 0,
+      enrichFailedAt: null,
       createdAt: now,
       updatedAt: now,
       enrichedAt,
@@ -215,3 +222,106 @@ describe("enrichQueue", () => {
     expect(await drainEnrichmentQueue(db, logger)).toBe(1);
   });
 });
+
+describe("convergence", () => {
+  /**
+   * The queue could not converge before this. A row that hit MAX_ATTEMPTS was
+   * deleted without recording anything on hive_book, and `enrichedAt` is only
+   * set on success — so the next page view re-enqueued the same book. With a
+   * crawler walking all 356k books that was a perpetual-motion machine:
+   * 12,444 rows growing ~20/min.
+   */
+  const alwaysFails = (async (
+    _book: unknown,
+    ctx: { addWideEventContext: (f: Record<string, unknown>) => void },
+  ) => {
+    ctx.addWideEventContext({ enrichment: "failed", scrape_failure: "waf_token_rejected" });
+  }) as unknown as EnrichFn;
+
+  async function drainUntilExhausted(db: Database, logger: Logger) {
+    // 4 attempts, each with a backoff — fast-forward by clearing nextAttemptAt.
+    for (let i = 0; i < 6; i++) {
+      await drainEnrichmentQueue(db, logger, { enrich: alwaysFails });
+      await db
+        .updateTable("enrich_queue")
+        .set({ nextAttemptAt: new Date(0).toISOString(), claimedAt: null })
+        .execute();
+    }
+  }
+
+  it("stops re-queueing a book that exhausted its attempts", async () => {
+    const db = await createTestDb();
+    const { logger } = makeLogger();
+    await insertBook(db, HIVE_ID);
+    await enqueueEnrichment(db, HIVE_ID);
+
+    await drainUntilExhausted(db, logger);
+
+    // Terminal: the queue row is gone AND the book carries the failure.
+    expect(await db.selectFrom("enrich_queue").selectAll().execute()).toHaveLength(0);
+    const book = await db
+      .selectFrom("hive_book")
+      .select(["enrichAttempts", "enrichFailedAt"])
+      .where("id", "=", HIVE_ID)
+      .executeTakeFirstOrThrow();
+    expect(book.enrichAttempts).toBeGreaterThanOrEqual(4);
+    expect(book.enrichFailedAt).not.toBeNull();
+
+    // The crawler comes back. This is the exact step that used to refill it.
+    await enqueueEnrichment(db, HIVE_ID);
+    expect(await db.selectFrom("enrich_queue").selectAll().execute()).toHaveLength(0);
+  });
+
+  it("reports exhausted books in the heartbeat, not a structurally-zero count", async () => {
+    // The gauge used to count `enrich_queue` rows at MAX_ATTEMPTS. Those rows
+    // are deleted in the same call that stamps enrichFailedAt, so it could
+    // only ever read 0 — the same illusion that hid the requeue loop. It has
+    // to be read off hive_book to mean anything.
+    const db = await createTestDb();
+    const { logger, events } = makeLogger();
+    await insertBook(db, HIVE_ID);
+    await enqueueEnrichment(db, HIVE_ID);
+    await drainUntilExhausted(db, logger);
+
+    await publishEnrichQueueStats(db, logger);
+
+    const heartbeat = events.filter((e) => e["msg"] === "enrich_drainer_heartbeat").at(-1);
+    expect(heartbeat).toBeDefined();
+    expect(heartbeat!["exhausted"]).toBe(1);
+  });
+
+  it("lets a book back in once the cooldown has passed", async () => {
+    const db = await createTestDb();
+    await insertBook(db, HIVE_ID);
+    // Failure is a cooldown, not a tombstone — Goodreads' WAF being up is
+    // transient, and those books should become eligible again eventually.
+    await db
+      .updateTable("hive_book")
+      .set({
+        enrichAttempts: 4,
+        enrichFailedAt: new Date(Date.now() - 8 * 86_400_000).toISOString(),
+      })
+      .where("id", "=", HIVE_ID)
+      .execute();
+
+    await enqueueEnrichment(db, HIVE_ID);
+    expect(await db.selectFrom("enrich_queue").selectAll().execute()).toHaveLength(1);
+  });
+
+  it("filters only the cooling books out of a mixed batch", async () => {
+    const db = await createTestDb();
+    const cooled = "bk_cooled" as HiveId;
+    const fresh = "bk_fresh" as HiveId;
+    await insertBook(db, cooled);
+    await insertBook(db, fresh);
+    await db
+      .updateTable("hive_book")
+      .set({ enrichAttempts: 4, enrichFailedAt: new Date().toISOString() })
+      .where("id", "=", cooled)
+      .execute();
+
+    await enqueueEnrichmentBatch(db, [cooled, fresh]);
+    const rows = await db.selectFrom("enrich_queue").select("hiveId").execute();
+    expect(rows.map((r) => r.hiveId)).toEqual([fresh]);
+  });
+});
diff --git a/src/utils/enrichQueue.ts b/src/utils/enrichQueue.ts
index 6aef641..e225331 100644
--- a/src/utils/enrichQueue.ts
+++ b/src/utils/enrichQueue.ts
@@ -24,6 +24,7 @@ import type { Logger } from "pino";
 import type { Database } from "../db";
 import type { HiveId } from "../types";
 import { enrichBookWithDetailedData } from "./enrichBookData";
+import { enrichQueueDepth, LABEL } from "../metrics";
 
 /** Items drained at once. One slot below SOLVER_POOL_SIZE, so an interactive
  *  force-refresh always has a worker available. */
@@ -32,6 +33,14 @@ const DRAIN_INTERVAL_MS = 5_000;
 /** A claim older than this is assumed to belong to a dead process. */
 const CLAIM_STALE_MS = 5 * 60_000;
 const MAX_ATTEMPTS = 4;
+/**
+ * How long a book that exhausted its attempts stays out of the queue.
+ *
+ * Not a permanent tombstone: most failures are Goodreads' WAF being up, which
+ * is transient on a scale of days. But it must be long enough that a crawler
+ * walking all 356k books cannot re-add the same failures on its next pass.
+ */
+export const ENRICH_RETRY_AFTER_MS = 7 * 24 * 60 * 60 * 1000;
 /** Backoff per attempt number (1-indexed); the last value repeats. */
 const BACKOFF_MS = [60_000, 5 * 60_000, 30 * 60_000];
 
@@ -44,17 +53,38 @@ export async function enqueueEnrichment(db: Database, hiveId: HiveId): Promise<v
   await enqueueEnrichmentBatch(db, [hiveId]);
 }
 
-/** Queue several books in one statement. Already-queued ids are left untouched
- *  so an in-progress item doesn't get its backoff reset by a page view. */
+/**
+ * Queue several books in one statement. Already-queued ids are left untouched
+ * so an in-progress item doesn't get its backoff reset by a page view.
+ *
+ * Books that exhausted their attempts inside `ENRICH_RETRY_AFTER_MS` are
+ * filtered out **here** rather than at each call site. Every caller is a read
+ * path reached by crawler traffic — a book page view, a search, an XRPC read —
+ * and each one previously re-added books that had already failed four times.
+ * One shared gate is the only version of this that cannot regress when a new
+ * call site is added.
+ */
 export async function enqueueEnrichmentBatch(db: Database, hiveIds: HiveId[]): Promise<void> {
   if (hiveIds.length === 0) return;
   const now = new Date().toISOString();
   const unique = [...new Set(hiveIds)];
 
+  const cooling = await db
+    .selectFrom("hive_book")
+    .select("id")
+    .where("id", "in", unique)
+    .where("enrichFailedAt", "is not", null)
+    .where("enrichFailedAt", ">", new Date(Date.now() - ENRICH_RETRY_AFTER_MS).toISOString())
+    .execute();
+
+  const eligible =
+    cooling.length === 0 ? unique : unique.filter((id) => !cooling.some((row) => row.id === id));
+  if (eligible.length === 0) return;
+
   await db
     .insertInto("enrich_queue")
     .values(
-      unique.map((hiveId) => ({
+      eligible.map((hiveId) => ({
         hiveId,
         enqueuedAt: now,
         attempts: 0,
@@ -148,11 +178,11 @@ async function runItem(
     }
 
     error = typeof fields["scrape_failure"] === "string" ? fields["scrape_failure"] : outcome;
-    await reschedule(db, item.hiveId, attempts, error);
+    await reschedule(db, logger, item.hiveId, attempts, error);
   } catch (err) {
     outcome = "error";
     error = err instanceof Error ? err.message : String(err);
-    await reschedule(db, item.hiveId, attempts, error).catch(() => {});
+    await reschedule(db, logger, item.hiveId, attempts, error).catch(() => {});
   } finally {
     // The one terminal event per item. Never skipped, on any path.
     logger.info({
@@ -169,14 +199,35 @@ async function runItem(
 
 async function reschedule(
   db: Database,
+  logger: Logger,
   hiveId: HiveId,
   attempts: number,
   lastError: string | undefined,
 ): Promise<void> {
   if (attempts >= MAX_ATTEMPTS) {
+    // Stamp the book before dropping the queue row. Deleting the row alone was
+    // not a terminal state: `enrichedAt` stays null on failure, so the next
+    // page view re-enqueued the book and the queue never converged.
+    await db
+      .updateTable("hive_book")
+      .set({ enrichAttempts: attempts, enrichFailedAt: new Date().toISOString() })
+      .where("id", "=", hiveId)
+      .execute();
     await db.deleteFrom("enrich_queue").where("hiveId", "=", hiveId).execute();
+    logger.info({
+      msg: "enrichment_exhausted",
+      hiveId,
+      attempts,
+      retry_after_days: ENRICH_RETRY_AFTER_MS / 86_400_000,
+      ...(lastError ? { error: lastError } : {}),
+    });
     return;
   }
+  await db
+    .updateTable("hive_book")
+    .set({ enrichAttempts: attempts })
+    .where("id", "=", hiveId)
+    .execute();
   await db
     .updateTable("enrich_queue")
     .set({
@@ -202,6 +253,59 @@ export async function drainEnrichmentQueue(
   return items.length;
 }
 
+/** How often the drainer proves it is alive and republishes queue depth. */
+const HEARTBEAT_MS = 60_000;
+
+/**
+ * Publish queue depth to /metrics and emit a heartbeat.
+ *
+ * Only the primary worker drains (see `isPrimaryWorker`), which makes the
+ * drainer a silent single point of failure: with no periodic signal, a
+ * crash-looping worker 0 is indistinguishable from an idle queue — an absence
+ * of `msg: "enrichment"` events means nothing either way. The heartbeat turns
+ * that into an alertable absence.
+ */
+export async function publishEnrichQueueStats(db: Database, logger: Logger): Promise<void> {
+  const stats = await db
+    .selectFrom("enrich_queue")
+    .select((eb) => [
+      eb.fn.countAll().as("total"),
+      eb.fn.count("claimedAt").as("claimed"),
+      eb.fn.max("attempts").as("maxAttempts"),
+    ])
+    .executeTakeFirst();
+
+  // Counted on `hive_book`, not `enrich_queue`. A row that exhausts its
+  // attempts is deleted from the queue in the same call that stamps
+  // `enrichFailedAt` (see `reschedule`), so `enrich_queue.attempts >=
+  // MAX_ATTEMPTS` matches nothing and this gauge was structurally always 0 —
+  // the same "zero rows ever observed at max attempts" illusion that hid the
+  // requeue loop in the first place. What is actually worth watching is how
+  // many books are parked in the cooldown right now.
+  const exhausted = await db
+    .selectFrom("hive_book")
+    .select((eb) => eb.fn.countAll().as("count"))
+    .where("enrichFailedAt", "is not", null)
+    .where("enrichFailedAt", ">", new Date(Date.now() - ENRICH_RETRY_AFTER_MS).toISOString())
+    .executeTakeFirst();
+
+  const total = Number(stats?.total ?? 0);
+  const claimed = Number(stats?.claimed ?? 0);
+  const exhaustedCount = Number(exhausted?.count ?? 0);
+
+  enrichQueueDepth.set(total, LABEL.enrichQueue.total);
+  enrichQueueDepth.set(claimed, LABEL.enrichQueue.claimed);
+  enrichQueueDepth.set(exhaustedCount, LABEL.enrichQueue.exhausted);
+
+  logger.info({
+    msg: "enrich_drainer_heartbeat",
+    depth: total,
+    claimed,
+    exhausted: exhaustedCount,
+    max_attempts: Number(stats?.maxAttempts ?? 0),
+  });
+}
+
 /**
  * Start the primary-worker drain loop. Returns a stop function for shutdown.
  * Ticks are never overlapped — a slow batch just delays the next one.
@@ -245,8 +349,17 @@ export function startEnrichmentDrain({
   }, intervalMs);
   timer.unref();
 
+  const heartbeat = setInterval(() => {
+    if (stopped) return;
+    void publishEnrichQueueStats(db, logger).catch((err) => {
+      logger.error({ err }, "enrich queue heartbeat failed");
+    });
+  }, HEARTBEAT_MS);
+  heartbeat.unref();
+
   return () => {
     stopped = true;
     clearInterval(timer);
+    clearInterval(heartbeat);
   };
 }
diff --git a/src/utils/ftsQuery.test.ts b/src/utils/ftsQuery.test.ts
new file mode 100644
index 0000000..07504f8
--- /dev/null
+++ b/src/utils/ftsQuery.test.ts
@@ -0,0 +1,146 @@
+import { describe, it, expect, beforeEach, afterEach } from "bun:test";
+import { Database as DatabaseSync } from "bun:sqlite";
+import { Kysely, SqliteDialect, sql } from "kysely";
+
+import { wrapBunSqliteForKysely } from "../bun-sqlite-kysely";
+import { migrateToLatest, type Database, type DatabaseSchema } from "../db";
+import { ftsMatchQuery, isUsefulFtsQuery } from "./ftsQuery";
+
+/**
+ * Built by hand rather than via `createDb`, matching the other DB suites:
+ * `createDb` reads `env`, and another test file in the shared process mocks
+ * that module, which turns its PRAGMA values into `undefined`.
+ */
+async function createTestDb(): Promise<Database> {
+  const sqlite = new DatabaseSync(":memory:");
+  sqlite.exec("PRAGMA journal_mode = WAL");
+  const db = new Kysely<DatabaseSchema>({
+    dialect: new SqliteDialect({ database: wrapBunSqliteForKysely(sqlite) }),
+  });
+  await migrateToLatest(db, sqlite);
+  return db;
+}
+
+describe("ftsMatchQuery", () => {
+  it("wraps input as a phrase with a trailing prefix", () => {
+    // Phrase keeps the words adjacent, `*` keeps type-ahead working.
+    expect(ftsMatchQuery("the girl")).toBe('"the girl"*');
+    expect(ftsMatchQuery("harry pot")).toBe('"harry pot"*');
+  });
+
+  it("collapses surrounding and internal whitespace", () => {
+    expect(ftsMatchQuery("  dune   messiah ")).toBe('"dune messiah"*');
+  });
+
+  it("doubles embedded quotes rather than emitting invalid syntax", () => {
+    // An unescaped quote is an FTS5 syntax error, which throws instead of
+    // returning nothing.
+    expect(ftsMatchQuery('the "great" gatsby')).toBe('"the ""great"" gatsby"*');
+  });
+
+  it("returns null when there is nothing to match", () => {
+    expect(ftsMatchQuery("")).toBeNull();
+    expect(ftsMatchQuery("   ")).toBeNull();
+    // Pure punctuation tokenizes to nothing and would match everything.
+    expect(ftsMatchQuery("!!! ---")).toBeNull();
+  });
+
+  it("keeps queries that contain any letter or digit", () => {
+    expect(ftsMatchQuery("1984")).toBe('"1984"*');
+    expect(ftsMatchQuery("café")).toBe('"café"*');
+  });
+});
+
+describe("isUsefulFtsQuery", () => {
+  it("rejects single characters, which prefix-match the whole corpus", () => {
+    expect(isUsefulFtsQuery("a")).toBe(false);
+    expect(isUsefulFtsQuery(" a ")).toBe(false);
+    expect(isUsefulFtsQuery("it")).toBe(true);
+  });
+});
+
+describe("hive_book_fts (migration 019)", () => {
+  let db: Database;
+
+  const search = async (input: string) => {
+    const match = ftsMatchQuery(input)!;
+    const rows = await sql<{ id: string }>`
+      SELECT b.id FROM hive_book_fts f JOIN hive_book b ON b.rowid = f.rowid
+      WHERE hive_book_fts MATCH ${match}
+      ORDER BY b.ratingsCount DESC
+    `.execute(db);
+    return rows.rows.map((r) => r.id);
+  };
+
+  const insert = (id: string, title: string, authors: string, ratingsCount = 0) =>
+    db
+      .insertInto("hive_book")
+      .values({
+        id: id as never,
+        title,
+        rawTitle: title,
+        authors,
+        ratingsCount,
+        source: "goodreads",
+        thumbnail: "",
+        createdAt: new Date().toISOString(),
+        updatedAt: new Date().toISOString(),
+      } as never)
+      .execute();
+
+  beforeEach(async () => {
+    db = await createTestDb();
+    await insert("bk_1", "The Girl with the Dragon Tattoo", "Stieg Larsson", 100);
+    await insert("bk_2", "The Diary of a Young Girl", "Anne Frank", 999);
+    await insert("bk_3", "The Hobbit", "J.R.R. Tolkien", 50);
+  });
+
+  afterEach(async () => {
+    await db.destroy();
+  });
+
+  it("requires phrase adjacency, matching the LIKE it replaced", async () => {
+    // With an implicit AND, "the girl" would rank The Diary of a Young Girl
+    // first purely on ratingsCount. The phrase form excludes it.
+    expect(await search("the girl")).toEqual(["bk_1"]);
+  });
+
+  it("prefix-matches a half-typed final word", async () => {
+    expect(await search("the hobb")).toEqual(["bk_3"]);
+  });
+
+  it("searches authors as well as titles", async () => {
+    expect(await search("tolkien")).toEqual(["bk_3"]);
+  });
+
+  it("indexes rows inserted after the migration", async () => {
+    await insert("bk_4", "Dune", "Frank Herbert", 10);
+    expect(await search("dune")).toEqual(["bk_4"]);
+  });
+
+  it("reflects updates without leaving the old terms behind", async () => {
+    await db
+      .updateTable("hive_book")
+      .set({ title: "Dune Messiah", rawTitle: "Dune Messiah" })
+      .where("id", "=", "bk_3" as never)
+      .execute();
+
+    // Orphaned terms from the pre-update row would keep matching forever.
+    expect(await search("hobbit")).toEqual([]);
+    expect(await search("dune messiah")).toEqual(["bk_3"]);
+  });
+
+  it("drops terms for deleted rows", async () => {
+    await db
+      .deleteFrom("hive_book")
+      .where("id", "=", "bk_1" as never)
+      .execute();
+    expect(await search("the girl")).toEqual([]);
+  });
+
+  it("treats quotes in the input as separators rather than throwing", async () => {
+    // Escaped quotes end up inside the phrase, where FTS5 tokenizes them away.
+    // The old LIKE '%the "girl"%' matched nothing at all here.
+    expect(await search('the "girl"')).toEqual(["bk_1"]);
+  });
+});
diff --git a/src/utils/ftsQuery.ts b/src/utils/ftsQuery.ts
new file mode 100644
index 0000000..b6df7ce
--- /dev/null
+++ b/src/utils/ftsQuery.ts
@@ -0,0 +1,47 @@
+/**
+ * Build an FTS5 MATCH expression from free-text user input.
+ *
+ * The whole input becomes a single **phrase** with a trailing `*`, i.e.
+ * `"the girl"*`. That combination matters:
+ *
+ * - Phrase (quoted) keeps the words adjacent. Joining tokens with an implicit
+ *   AND instead makes `the girl` match "The Diary of a Young Girl" ahead of
+ *   "The Girl with the Dragon Tattoo", because ranking is by `ratingsCount`.
+ *   With the phrase form the result set is identical to the `LIKE '%…%'` it
+ *   replaces.
+ * - The trailing `*` makes only the final token a prefix, so a half-typed
+ *   query (`harry pot`, `lord of the ri`) still matches.
+ *
+ * Quotes inside the input are doubled, which is FTS5's escape — without it a
+ * stray `"` is a syntax error and the query throws rather than returning
+ * nothing. Everything else is inert inside a phrase, so no other escaping is
+ * needed.
+ *
+ * Returns null when there is nothing indexable to match, in which case callers
+ * should skip the FTS lookup entirely rather than run an empty MATCH.
+ */
+export function ftsMatchQuery(input: string): string | null {
+  // Collapse internal whitespace runs and trim the ends. Punctuation is left
+  // alone here — FTS5's tokenizer drops separator characters itself, and the
+  // all-separators case is handled below.
+  const cleaned = input.replace(/\s+/g, " ").trim();
+  if (!cleaned) return null;
+
+  // A phrase of only separator characters (punctuation, symbols) tokenizes to
+  // nothing and matches everything; treat it as no query at all.
+  if (!/[\p{L}\p{N}]/u.test(cleaned)) return null;
+
+  return `"${cleaned.replace(/"/g, '""')}"*`;
+}
+
+/**
+ * Very short queries are prefix-matched against nearly the whole corpus, which
+ * costs about as much as the full scan it replaces (measured: `"a"*` 478ms vs
+ * LIKE's 632ms) while returning arbitrary results. Callers use this to skip the
+ * local backfill and rely on the upstream search instead.
+ */
+export const MIN_FTS_QUERY_LENGTH = 2;
+
+export function isUsefulFtsQuery(input: string): boolean {
+  return input.trim().length >= MIN_FTS_QUERY_LENGTH;
+}
diff --git a/src/utils/imageProxy.ts b/src/utils/imageProxy.ts
index e144ba5..3c58e6e 100644
--- a/src/utils/imageProxy.ts
+++ b/src/utils/imageProxy.ts
@@ -12,7 +12,7 @@
 import { env } from "../env";
 
 /** Remote hosts we are willing to proxy. */
-// images.isbndb.com: the ISBNdb scraper is currently disabled, but rows written
+// images.isbndb.com: the ISBNdb scraper was deleted, but rows written
 // while it was active still carry those cover URLs — without it we reject our
 // own data as a forbidden source.
 export const ALLOWED_IMAGE_HOSTS = new Set([
diff --git a/src/utils/personalLibrary.test.ts b/src/utils/personalLibrary.test.ts
new file mode 100644
index 0000000..f09368d
--- /dev/null
+++ b/src/utils/personalLibrary.test.ts
@@ -0,0 +1,102 @@
+import { describe, it, expect, beforeEach, afterEach } from "bun:test";
+import { Database as DatabaseSync } from "bun:sqlite";
+import { Kysely, SqliteDialect } from "kysely";
+import { rm } from "node:fs/promises";
+import path from "node:path";
+
+import { wrapBunSqliteForKysely } from "../bun-sqlite-kysely";
+import { migrateToLatest, type Database, type DatabaseSchema } from "../db";
+import { streamPersonalBook } from "./personalLibrary";
+
+const DID = "did:plc:testuser";
+const HASH = "abc123";
+const now = "2026-08-02T12:00:00.000Z";
+
+let db: Database;
+let filePath: string;
+
+beforeEach(async () => {
+  const sqlite = new DatabaseSync(":memory:");
+  sqlite.exec("PRAGMA journal_mode = WAL");
+  db = new Kysely<DatabaseSchema>({
+    dialect: new SqliteDialect({ database: wrapBunSqliteForKysely(sqlite) }),
+  });
+  await migrateToLatest(db, sqlite);
+
+  filePath = path.join("/tmp", `personal-library-test-${HASH}.epub`);
+  await Bun.write(filePath, "epub bytes");
+
+  await db
+    .insertInto("personal_book")
+    .values({
+      userDid: DID,
+      contentHash: HASH,
+      hiveId: null,
+      filename: "book.epub",
+      title: "A Personal Book",
+      authors: "An Author",
+      language: "en",
+      format: "epub",
+      mime: "application/epub+zip",
+      filePath,
+      coverPath: null,
+      coverMime: null,
+      sizeBytes: 10,
+      createdAt: now,
+      updatedAt: now,
+    })
+    .execute();
+});
+
+afterEach(async () => {
+  await db.destroy();
+  await rm(filePath, { force: true });
+});
+
+describe("streamPersonalBook", () => {
+  it("streams the file with a strong ETag when there is no validator", async () => {
+    const result = await streamPersonalBook(db, DID, HASH);
+    expect(result).not.toBeNull();
+    expect(result!.notModified).toBe(false);
+    expect(result!.headers["ETag"]).toBe(`"${HASH}"`);
+    expect(result!.headers["Content-Type"]).toBe("application/epub+zip");
+  });
+
+  // The regression: these routes are excluded from hono's etag() middleware
+  // because it buffers the whole body through a digest. That middleware was
+  // also what turned If-None-Match into a 304 — setting the header alone does
+  // not, so without this branch an e-reader re-downloads every book on every
+  // sync.
+  it("returns notModified when If-None-Match matches the content hash", async () => {
+    const result = await streamPersonalBook(db, DID, HASH, `"${HASH}"`);
+    expect(result).not.toBeNull();
+    expect(result!.notModified).toBe(true);
+    expect(result!.headers["ETag"]).toBe(`"${HASH}"`);
+    expect(result).not.toHaveProperty("stream");
+  });
+
+  it("handles the weak prefix, comma lists and wildcard clients send", async () => {
+    for (const header of [`W/"${HASH}"`, `"other", "${HASH}"`, "*"]) {
+      const result = await streamPersonalBook(db, DID, HASH, header);
+      expect(result!.notModified).toBe(true);
+    }
+  });
+
+  it("still streams when the validator is for a different version", async () => {
+    const result = await streamPersonalBook(db, DID, HASH, `"stale-hash"`);
+    expect(result!.notModified).toBe(false);
+  });
+
+  it("answers the conditional request without touching the file", async () => {
+    // A 304 must not depend on the file still being readable — otherwise a
+    // missing file turns a cheap revalidation into a 404 for a book the client
+    // already has.
+    await rm(filePath, { force: true });
+    const result = await streamPersonalBook(db, DID, HASH, `"${HASH}"`);
+    expect(result!.notModified).toBe(true);
+  });
+
+  it("returns null for another user's book", async () => {
+    expect(await streamPersonalBook(db, "did:plc:someoneelse", HASH)).toBeNull();
+  });
+});
diff --git a/src/utils/personalLibrary.ts b/src/utils/personalLibrary.ts
index a21c3d8..d447c75 100644
--- a/src/utils/personalLibrary.ts
+++ b/src/utils/personalLibrary.ts
@@ -7,6 +7,14 @@ import type { Database } from "../db";
 /** Number of items per page in OPDS catalog responses. */
 export const OPDS_PAGE_SIZE = 24;
 
+/**
+ * Largest accepted ebook upload. Every upload path materialises the whole file
+ * as a `Uint8Array` (the KOReader partial MD5 and the format parsers both need
+ * random access), so this is a direct per-request ceiling on native memory —
+ * enforce it against the *declared* size before reading the body.
+ */
+export const MAX_PERSONAL_BOOK_BYTES = 100 * 1024 * 1024;
+
 /** Root directory for all personal library files, adjacent to the DB. */
 export function getLibraryDir(): string {
   return path.join(path.dirname(env.DB_PATH), "library");
@@ -42,17 +50,38 @@ export async function removeUserDir(did: string): Promise<void> {
   await rm(path.join(getLibraryDir(), did), { recursive: true, force: true });
 }
 
+export type PersonalBookDownload =
+  | { notModified: true; headers: Record<string, string> }
+  | { notModified: false; stream: ReadableStream; headers: Record<string, string> };
+
+/**
+ * Does an `If-None-Match` header match our strong ETag? Handles the comma list
+ * and `*` forms, and tolerates the `W/` prefix a client may echo back — the
+ * validator is a content hash, so a weak match is still the same bytes.
+ */
+function etagMatches(ifNoneMatch: string | null | undefined, etag: string): boolean {
+  if (!ifNoneMatch) return false;
+  const normalize = (raw: string) => raw.trim().replace(/^W\//, "");
+  return ifNoneMatch
+    .split(",")
+    .some((candidate) => normalize(candidate) === "*" || normalize(candidate) === etag);
+}
+
 /**
  * Stream a personal library book file as an attachment. Shared by the OPDS
  * acquisition endpoint (HTTP Basic auth) and the web download button (session
  * auth) so the two can't drift. Returns null when the row or file is missing;
  * callers turn that into their own 404.
+ *
+ * Pass the request's `If-None-Match` to get a `notModified` result instead of a
+ * stream — see the comment on that branch for why this is done by hand.
  */
 export async function streamPersonalBook(
   db: Database,
   userDid: string,
   contentHash: string,
-): Promise<{ stream: ReadableStream; headers: Record<string, string> } | null> {
+  ifNoneMatch?: string | null,
+): Promise<PersonalBookDownload | null> {
   const book = await db
     .selectFrom("personal_book")
     .select(["filePath", "filename", "mime", "format"])
@@ -61,6 +90,22 @@ export async function streamPersonalBook(
     .executeTakeFirst();
   if (!book) return null;
 
+  const etag = `"${contentHash}"`;
+  const cacheHeaders = {
+    ETag: etag,
+    "Cache-Control": "private, max-age=0, must-revalidate",
+  };
+
+  // Answer the conditional request *before* opening the file. These routes are
+  // excluded from hono's `etag()` middleware (it buffers the whole body through
+  // a digest — 134 MB of arrayBuffers for a 120 MB download), and that
+  // middleware is what used to turn `If-None-Match` into a 304. Setting the
+  // header alone does not: without this branch an e-reader re-downloads the
+  // entire book on every sync.
+  if (etagMatches(ifNoneMatch, etag)) {
+    return { notModified: true, headers: cacheHeaders };
+  }
+
   const file = Bun.file(book.filePath);
   if (!(await file.exists())) return null;
 
@@ -69,10 +114,13 @@ export async function streamPersonalBook(
     : `${book.filename}.${book.format || "epub"}`;
 
   return {
+    notModified: false,
     stream: file.stream(),
     headers: {
       "Content-Type": book.mime || "application/epub+zip",
       "Content-Disposition": `attachment; filename*=UTF-8''${encodeURIComponent(downloadName)}`,
+      ...cacheHeaders,
+      "Content-Length": String(file.size),
     },
   };
 }
diff --git a/src/workers/import/context.ts b/src/workers/import/context.ts
index 1378cd3..b7e2224 100644
--- a/src/workers/import/context.ts
+++ b/src/workers/import/context.ts
@@ -63,7 +63,7 @@ export async function createWorkerContext({
   const { db } = createDb(dbPath);
 
   // Own KV storage with same mount structure as main server
-  const kvDb = createSharedKvDb(kvPath);
+  const { db: kvDb } = createSharedKvDb(kvPath);
   const kv = createStorage({
     driver: sqliteKv({ table: "kv", db: kvDb }),
   });
diff --git a/src/workers/ingester-worker.ts b/src/workers/ingester-worker.ts
index 9e232d5..731967d 100644
--- a/src/workers/ingester-worker.ts
+++ b/src/workers/ingester-worker.ts
@@ -15,7 +15,7 @@ import lruCacheDriver from "unstorage/drivers/lru-cache";
 // Open own DB connections (workers can't share DatabaseSync across threads)
 const { db } = createDb(env.DB_PATH);
 
-const kvDb = createSharedKvDb(env.KV_DB_PATH);
+const { db: kvDb } = createSharedKvDb(env.KV_DB_PATH);
 const kv = createStorage({
   driver: sqliteKv({ table: "kv", db: kvDb }),
 });
diff --git a/src/workers/og-render/client.ts b/src/workers/og-render/client.ts
index 5a762a1..30e6445 100644
--- a/src/workers/og-render/client.ts
+++ b/src/workers/og-render/client.ts
@@ -1,5 +1,6 @@
 import type { OgCard, OgRenderRequest, OgRenderResponse } from "./types";
 import { getLogger } from "../../logger/index.ts";
+import { ogRenderShedTotal } from "../../metrics.ts";
 
 // @takumi-rs/core (native NAPI-RS bindings) is loaded at runtime inside the OG
 // render worker thread. It's pulled into .output/server/node_modules/ via
@@ -60,6 +61,12 @@ export function renderOgImage(card: OgCard): Promise<ArrayBuffer> {
   const id = crypto.randomUUID();
 
   if (pending.size >= MAX_PENDING) {
+    // Shed load loudly. This used to be a bare reject with no counter and no
+    // log line, so sustained shedding looked identical to no traffic at all.
+    ogRenderShedTotal.inc();
+    // warn, not error: shedding is the backpressure working as designed. Only
+    // og_render_timeout is a genuine fault.
+    logger.warn({ msg: "og_render_shed", card_kind: card.kind, pending: pending.size });
     return Promise.reject(new Error("OG render queue is full"));
   }
 
diff --git a/src/workers/open-observe-worker.ts b/src/workers/open-observe-worker.ts
index e77b75d..e85e559 100644
--- a/src/workers/open-observe-worker.ts
+++ b/src/workers/open-observe-worker.ts
@@ -47,6 +47,32 @@ self.onmessage = (event: MessageEvent) => {
   }
 };
 
+/**
+ * Bun reports a refused connection as `code: "ConnectionRefused"`; Node uses
+ * `ECONNREFUSED`. Matching only the Node spelling meant this never self-
+ * disabled — every flush fell through to the generic branch instead, and
+ * `console.error(error)` makes Bun print the error *with source context*,
+ * which for a bundled worker is the entire minified file. That is a
+ * multi-hundred-line non-JSON blob in stdout on every deploy.
+ */
+function isConnectionRefused(error: any): boolean {
+  const code = error?.cause?.code ?? error?.code;
+  return (
+    code === "ConnectionRefused" ||
+    code === "ECONNREFUSED" ||
+    /unable to connect/i.test(error?.message ?? "")
+  );
+}
+
+/**
+ * One structured line, matching pino's shape. Everything this worker writes
+ * lands in the same stdout stream as the app's logs, and ~4% of that stream
+ * being unparseable is what forced `jq -R 'fromjson?'` during the incident.
+ */
+function logLine(level: number, msg: string, fields: Record<string, unknown> = {}): void {
+  console.log(JSON.stringify({ level, time: Date.now(), name: "open-observe", msg, ...fields }));
+}
+
 function schedule() {
   if (timer) clearTimeout(timer);
   if (logs.length >= batchSize && !sending) {
@@ -75,23 +101,27 @@ async function flush() {
 
     if (!response.ok) {
       const body = await response.text().catch(() => "");
-      console.error(
-        "OpenObserve: failed to send logs:",
-        response.status,
-        response.statusText,
-        body,
-      );
+      logLine(50, "openobserve_send_failed", {
+        status: response.status,
+        statusText: response.statusText,
+        body: body.slice(0, 500),
+      });
     }
   } catch (error: any) {
-    const code = error?.cause?.code ?? error?.code;
-    if (code === "ECONNREFUSED") {
+    if (isConnectionRefused(error)) {
       failures++;
       if (failures > 2) {
         disabled = true;
-        console.warn("OpenObserve not responding. Disabling log transport.");
+        logLine(40, "openobserve_disabled", {
+          reason: "connection refused",
+          url: apiUrl,
+          failures,
+        });
       }
     } else {
-      console.error("OpenObserve: failed to send logs:", error);
+      logLine(50, "openobserve_send_failed", {
+        error: error instanceof Error ? error.message : String(error),
+      });
     }
   } finally {
     sending = false;
diff --git a/src/xrpc/router.ts b/src/xrpc/router.ts
index 6332263..a61b691 100644
--- a/src/xrpc/router.ts
+++ b/src/xrpc/router.ts
@@ -3,7 +3,13 @@
  * Uses @atcute/xrpc-server; context is passed via AsyncLocalStorage from Hono.
  */
 import { AsyncLocalStorage } from "node:async_hooks";
-import { XRPCRouter, json, XRPCError, AuthRequiredError } from "@atcute/xrpc-server";
+import {
+  XRPCRouter,
+  json,
+  XRPCError,
+  AuthRequiredError,
+  InvalidRequestError,
+} from "@atcute/xrpc-server";
 import {
   BuzzBookhiveSearchBooks,
   BuzzBookhiveListGenres,
@@ -95,6 +101,7 @@ import {
   bookFilePath,
   coverFilePath,
   ensureDir,
+  MAX_PERSONAL_BOOK_BYTES,
   personalBookDir,
   removeBookDir,
 } from "../utils/personalLibrary";
@@ -1646,7 +1653,19 @@ export function createXrpcRouter<E extends XrpcContext, V extends { ctx: E } = {
       if (!agent) throw new AuthRequiredError({ message: "Authentication required" });
       const userDid = agent.did;
 
+      // This path had no size limit at all, unlike POST /library/upload — an
+      // unbounded `arrayBuffer()` straight into native memory on an
+      // authenticated endpoint. Reject on the declared length first so an
+      // oversized body is never materialised.
+      const declared = Number(request.headers.get("content-length"));
+      if (Number.isFinite(declared) && declared > MAX_PERSONAL_BOOK_BYTES) {
+        throw new InvalidRequestError({ message: "File exceeds 100 MB limit" });
+      }
+
       const bytes = new Uint8Array(await request.arrayBuffer());
+      if (bytes.length > MAX_PERSONAL_BOOK_BYTES) {
+        throw new InvalidRequestError({ message: "File exceeds 100 MB limit" });
+      }
       const filename = request.headers.get("x-file-name") ?? "unknown";
 
       const result = await processBookUpload(ctx.db, ctx.kv, userDid, bytes, filename);