diff --git a/.env.example b/.env.example
index 4ffae83bb..f55df2038 100644
--- a/.env.example
+++ b/.env.example
@@ -10,6 +10,8 @@ DATA_DIR=.openmuse
 TASK_WORKER_ENABLED=true
 # Rate limiting keys on the socket address. Set true only behind a reverse proxy that
 # overwrites X-Forwarded-For; otherwise callers can spoof it.
+# The per-client sign-in budget (10/min) and shared API budget depend on this:
+# behind a proxy without TRUST_PROXY=true every user shares one bucket.
 # TRUST_PROXY=false
 
 # General delegated work: select AGENT_BACKEND=model and a provider/model.
diff --git a/apps/mobile/src/PdfReader.web.tsx b/apps/mobile/src/PdfReader.web.tsx
index 017fdf562..4eccbb0de 100644
--- a/apps/mobile/src/PdfReader.web.tsx
+++ b/apps/mobile/src/PdfReader.web.tsx
@@ -44,6 +44,9 @@ export default function PdfReader({ url, pageCount }: PdfReaderProps) {
         key={`${page}:${zoom}`}
         title="PDF document reader"
         src={`${url}#page=${page}&zoom=${zoom}`}
+        // The file-download Permissions-Policy leaves fullscreen to this
+        // origin; the iframe still needs the delegation for the viewer button.
+        allow="fullscreen"
         style={{ height: 570, width: "100%", border: 0, borderRadius: 12, background: "#e7e9e3" }}
       />
       <Text style={s.small}>Use the reader toolbar to download or print a copy.</Text>
diff --git a/apps/server/src/app.ts b/apps/server/src/app.ts
index 258d7a22b..bf130264e 100644
--- a/apps/server/src/app.ts
+++ b/apps/server/src/app.ts
@@ -24,7 +24,8 @@ import { AgentService } from "./engine/service.ts";
 import { AppError } from "./errors.ts";
 import { Files } from "./files.ts";
 import { GoogleAuth } from "./google-auth.ts";
-import { rateLimit } from "./rate-limit.ts";
+import { createRateLimitStore, rateLimit, resolveRequestKey } from "./rate-limit.ts";
+import { createEdgeHeaders, isSignedRoute } from "./security-headers.ts";
 import { WorkspaceService } from "./workspace.ts";
 
 export async function createApp(
@@ -51,12 +52,16 @@ export async function createApp(
   const runtime = makeRuntime(config, agent, auth, intelligence);
   const app = new Hono<{ Variables: { owner: string } }>();
   const origins = new Set([...config.allowedOrigins, new URL(config.publicUrl).origin]);
+  // One prebuilt policy for both response paths: the middleware below and the
+  // CopilotKit raw-Response passthrough share headersFor(), so a change to one
+  // cannot silently miss the other.
+  const edgeHeaders = createEdgeHeaders(config);
+  // Hardening first so rejected requests (origin gate, rate limits, validation)
+  // carry the same headers as successful ones.
+  app.use("*", edgeHeaders.middleware);
   app.use("*", async (c, next) => {
     const origin = c.req.header("origin");
     if (origin && !origins.has(origin)) return c.json({ error: "Origin is not allowed" }, 403);
-    c.header("X-Content-Type-Options", "nosniff");
-    c.header("Referrer-Policy", "no-referrer");
-    c.header("Cache-Control", "no-store");
     await next();
   });
   app.use(
@@ -75,6 +80,53 @@ export async function createApp(
       onError: (c) => c.json({ error: "Request is too large; PDFs must be 10 MB or smaller" }, 413),
     }),
   );
+  // Health probes stay outside the shared budget so load-balancer checks are
+  // never turned away on a busy minute: they are registered before the
+  // `/api/*` limiter, which is the single exemption mechanism.
+  app.get("/api/health", (c) =>
+    c.json({
+      ok: true,
+      mode: config.mode,
+      agentConfigured: agentConfigured(config),
+      browserConfigured: Boolean(config.workerUrl && config.workerToken),
+    }),
+  );
+  // Coalesced probe: PGlite runs one query at a time, so concurrent Render
+  // checks share a single in-flight ping instead of queueing behind each other
+  // and making recovery slower. The per-request timeout still bounds the HTTP
+  // response; the shared ping keeps waiting once and is reused, never piled up.
+  let readyInFlight: Promise<void> | null = null;
+  app.get("/api/ready", async (c) => {
+    // Load balancers cannot authenticate, so readiness stays open like health.
+    // With the default embedded PGlite store this only proves the process is
+    // alive; with DATABASE_URL set it proves Postgres actually answers.
+    // PGlite runs one query at a time, so bound the probe: a slow query
+    // elsewhere must not make Render restart a healthy server.
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const timeout = new Promise<never>(
+      (_, reject) => (timer = setTimeout(() => reject(new Error("readiness timeout")), 1500)),
+    );
+    // Attach a noop handler up front so the rejection is never unhandled when
+    // the probe wins the race and the timer fires later (cleared below anyway).
+    timeout.catch(() => {});
+    try {
+      if (!readyInFlight) {
+        readyInFlight = db.ping().finally(() => {
+          readyInFlight = null;
+        });
+      }
+      const probe = readyInFlight;
+      // A late timer rejection after the probe wins must not surface as an
+      // unhandled rejection on the shared promise.
+      probe.catch(() => {});
+      await Promise.race([probe, timeout]);
+      return c.json({ ok: true, mode: config.mode, database: "up" });
+    } catch {
+      return c.json({ ok: false, mode: config.mode, database: "down" }, 503);
+    } finally {
+      if (timer !== undefined) clearTimeout(timer);
+    }
+  });
   app.use("/api/*", rateLimit(Boolean(config.trustProxy)));
   app.onError((error, c) => {
     if (error instanceof z.ZodError)
@@ -95,23 +147,30 @@ export async function createApp(
       502,
     );
   });
-  app.get("/api/health", (c) =>
-    c.json({
-      ok: true,
-      mode: config.mode,
-      agentConfigured: agentConfigured(config),
-      browserConfigured: Boolean(config.workerUrl && config.workerToken),
-    }),
-  );
-  let loginWindow = 0,
-    loginAttempts = 0;
+  // Sign-in attempts are cheap for an attacker (one JSON body) and expensive to
+  // get wrong, so each client gets its own small bucket (10/min). A hard
+  // overall cap would pull against that goal — one address burning through it
+  // would lock everyone else out — so the flood monitor below only logs a
+  // warning instead of blocking. It counts only attempts that pass the
+  // per-client check, so already-rejected floods cannot consume it. Per-client
+  // keys depend on TRUST_PROXY: behind a proxy without it, every user shares
+  // one bucket, so deploy with TRUST_PROXY=true (see render.yaml / .env.example).
+  const signInPerClient = createRateLimitStore({
+    windowMs: 60_000,
+    maxRequests: 10,
+    maxEntries: 5_000,
+  });
+  const signInFlood = createRateLimitStore({
+    windowMs: 60_000,
+    maxRequests: 100,
+    maxEntries: 2,
+  });
   app.post("/api/session", async (c) => {
-    if (Date.now() - loginWindow > 60000) {
-      loginWindow = Date.now();
-      loginAttempts = 0;
-    }
-    if (++loginAttempts > 30)
+    const now = Date.now();
+    if (!signInPerClient.take(resolveRequestKey(c, Boolean(config.trustProxy)), now))
       throw new AppError("Too many sign-in attempts. Try again in a minute.", 429);
+    if (!signInFlood.take("global", now))
+      console.warn("[OpenMuse] sign-in flood: over 100 attempts in a minute");
     const body = z.object({ accessKey: z.string().optional() }).parse(await c.req.json());
     const session = await auth.session(body.accessKey);
     await workspace.ensureSample("local-user", actions);
@@ -131,10 +190,9 @@ export async function createApp(
     );
   });
   app.use("/api/*", async (c, next) => {
-    const signedRoute =
-      /^\/api\/files\/[^/]+\/content$|^\/api\/browsers\/[^/]+\/(?:preview|console)$/.test(
-        c.req.path,
-      );
+    // Shared with security-headers.ts so a new signed route cannot get the
+    // strictest CSP by forgetting one of the two lists.
+    const signedRoute = isSignedRoute(c.req.path);
     const owner =
       signedRoute && c.req.query("signature")
         ? auth.verify(new URL(c.req.url))
@@ -319,10 +377,8 @@ export async function createApp(
   });
   app.get("/api/browsers/:id/console", async (c) => {
     await browser.get(c.get("owner"), c.req.param("id"));
-    c.header(
-      "Content-Security-Policy",
-      "default-src 'self'; img-src 'self' blob:; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'",
-    );
+    // Content-Security-Policy for this page comes from the security-headers
+    // middleware, which preserves these allowances and adds framing protection.
     return c.html(browser.console(c.get("owner"), c.req.param("id")));
   });
   app.post("/api/browsers/:id/console", async (c) => {
@@ -345,7 +401,13 @@ export async function createApp(
         },
       }),
     );
-    return new Response(body, { status: response.status, headers: response.headers });
+    // A returned Response bypasses context headers, so apply the same edge
+    // policy the middleware sets instead of inheriting whatever the runtime
+    // happened to set.
+    const headers = new Headers(response.headers);
+    for (const [name, value] of Object.entries(edgeHeaders.headersFor(c.req.method, c.req.path)))
+      if (!headers.has(name)) headers.set(name, value);
+    return new Response(body, { status: response.status, headers });
   });
   app.get("/", (c) =>
     c.json({ name: "OpenMuse", app: "http://localhost:8081", health: "/api/health" }),
diff --git a/apps/server/src/db.ts b/apps/server/src/db.ts
index 4f057b6c9..2034e548a 100644
--- a/apps/server/src/db.ts
+++ b/apps/server/src/db.ts
@@ -131,6 +131,10 @@ export class Store {
       `UPDATE records SET data=data || '{"status":"outcome_unknown","error":"Server restarted during execution. Check the provider before creating another action."}'::jsonb WHERE kind='actions' AND data->>'status'='executing'`,
     );
   }
+  /** Liveness probe for the readiness endpoint; rejects when the database is unreachable. */
+  async ping(): Promise<void> {
+    await this.db.query("SELECT 1");
+  }
   async take<T>(owner: string, kind: string, id: string): Promise<T | null> {
     const result = await this.db.query(
       "DELETE FROM records WHERE owner=$1 AND kind=$2 AND id=$3 RETURNING data",
diff --git a/apps/server/src/rate-limit.ts b/apps/server/src/rate-limit.ts
index 95c1f5ff6..2b5777d76 100644
--- a/apps/server/src/rate-limit.ts
+++ b/apps/server/src/rate-limit.ts
@@ -26,17 +26,38 @@ export function createRateLimitStore(options: RateLimitStoreOptions = {}) {
   }
 
   function take(key: string, now: number): boolean {
-    let entry = entries.get(key);
-    if (entry && entry.expiresAt <= now) entry = undefined;
-    if (!entry) {
+    const existing = entries.get(key);
+    if (existing && existing.expiresAt > now) {
+      // Active hit: refresh recency so eviction drops the
+      // least-recently-active bucket, not merely the earliest-inserted one.
+      existing.count += 1;
+      entries.delete(key);
+      entries.set(key, existing);
+      return existing.count <= maxRequests;
+    }
+    // New key or expired renewal. Renewals must move to the back: Map.set() on
+    // an existing key keeps its original (front) position, so an actively
+    // signing-in client would otherwise be evicted before long-gone entries.
+    const hadExpired = existing !== undefined;
+    if (hadExpired) {
+      entries.delete(key);
+      // The window turned over for this key, so peers likely expired too:
+      // reclaim them now instead of leaving stale buckets behind.
+      cleanupExpired(now);
+    }
+    if (entries.size >= maxEntries) {
+      cleanupExpired(now);
       if (entries.size >= maxEntries) {
-        cleanupExpired(now);
-        if (entries.size >= maxEntries) return false;
+        // Evict the least-recently-used entry instead of locking new keys out.
+        // Failing closed here would reintroduce the lockout a per-client
+        // limiter is meant to prevent (one crowded window blocks newcomers).
+        const oldest = entries.keys().next();
+        if (!oldest.done) entries.delete(oldest.value);
+        else return false;
       }
-      entry = { count: 0, expiresAt: now + windowMs };
-      entries.set(key, entry);
     }
-    entry.count += 1;
+    const entry = { count: 1, expiresAt: now + windowMs };
+    entries.set(key, entry);
     return entry.count <= maxRequests;
   }
 
@@ -45,6 +66,8 @@ export function createRateLimitStore(options: RateLimitStoreOptions = {}) {
 
 // This limiter runs before authentication, so the key must never be derived from
 // caller-supplied credentials (e.g. Authorization): any string would mint a new bucket.
+// When trusted, the client address is the hop our own proxy appended (the last
+// entry in X-Forwarded-For), not the leftmost entry, which any caller can spoof.
 export function resolveClientKey(input: {
   trustProxy: boolean;
   forwardedFor?: string;
@@ -52,8 +75,12 @@ export function resolveClientKey(input: {
   connectionAddress?: string;
 }): string {
   if (input.trustProxy) {
-    const forwarded = input.forwardedFor?.split(",")[0]?.trim();
-    if (forwarded) return `proxy:${forwarded}`;
+    const hops = input.forwardedFor
+      ?.split(",")
+      .map((hop) => hop.trim())
+      .filter(Boolean);
+    const lastHop = hops?.length ? hops[hops.length - 1] : undefined;
+    if (lastHop) return `proxy:${lastHop}`;
     if (input.realIp) return `proxy:${input.realIp}`;
   }
   return `conn:${input.connectionAddress ?? "unknown"}`;
@@ -70,6 +97,20 @@ function connectionAddress(c: Context): string | undefined {
   }
 }
 
+/** Per-client bucket key for routes with their own limiter (e.g. sign-in). */
+export function resolveRequestKey(
+  c: Context,
+  trustProxy: boolean,
+  getAddress: (c: Context) => string | undefined = connectionAddress,
+): string {
+  return resolveClientKey({
+    trustProxy,
+    forwardedFor: c.req.header("x-forwarded-for"),
+    realIp: c.req.header("x-real-ip"),
+    connectionAddress: getAddress(c),
+  });
+}
+
 export function rateLimit(
   trustProxy: boolean,
   options: RateLimitStoreOptions & { getAddress?: (c: Context) => string | undefined } = {},
@@ -77,12 +118,9 @@ export function rateLimit(
   const store = createRateLimitStore(options);
   const getAddress = options.getAddress ?? connectionAddress;
   return async (c: Context, next: () => Promise<void>) => {
-    const key = resolveClientKey({
-      trustProxy,
-      forwardedFor: c.req.header("x-forwarded-for"),
-      realIp: c.req.header("x-real-ip"),
-      connectionAddress: getAddress(c),
-    });
+    // Health/readiness exemption lives in app.ts registration order (probes are
+    // registered before this middleware), so this limiter stays route-agnostic.
+    const key = resolveRequestKey(c, trustProxy, getAddress);
     if (!store.take(key, Date.now()))
       throw new AppError("Too many requests. Try again in a minute.", 429);
     await next();
diff --git a/apps/server/src/security-headers.ts b/apps/server/src/security-headers.ts
new file mode 100644
index 000000000..9b48272e8
--- /dev/null
+++ b/apps/server/src/security-headers.ts
@@ -0,0 +1,167 @@
+import type { Context } from "hono";
+import type { Config } from "./config.ts";
+
+/**
+ * Response hardening for the API edge.
+ *
+ * The API previously sent only `X-Content-Type-Options`, `Referrer-Policy`
+ * and `Cache-Control`. Signed file/preview/console links are bearer-equivalent
+ * URLs that users open in a browser, so without framing and content policies
+ * any third-party page could embed them (clickjacking) and any injected markup
+ * in an HTML response would run unsandboxed.
+ *
+ * Two first-party embeds constrain the design, both verified in the clients:
+ * - `apps/mobile/src/BrowserConsole.web.tsx` loads `/api/browsers/:id/console`
+ *   in an `<iframe>` from the web-app origin.
+ * - `apps/mobile/src/PdfReader.web.tsx` loads `/api/files/:id/content` (PDF)
+ *   in an `<iframe>` from the web-app origin.
+ * A blanket `DENY`/`SAMEORIGIN` would break those embeds because the web app
+ * runs on a different origin than the API, so framing is restricted with a
+ * `frame-ancestors` allowlist built from the configured clients instead, and
+ * byte responses (PDF/PNG) carry framing protection only — no content
+ * directives that could interfere with plugin/image rendering.
+ */
+
+/** First-party origins permitted to frame API responses. */
+export function frameAncestorSources(config: Config): string[] {
+  const sources = ["'self'"];
+  for (const entry of [...config.allowedOrigins, config.publicUrl]) {
+    const trimmed = entry.trim();
+    if (!trimmed) continue;
+    try {
+      const origin = new URL(trimmed).origin;
+      if (origin !== "null" && !sources.includes(origin)) sources.push(origin);
+    } catch {
+      // Unparseable entries never match an Origin header either; leaving them
+      // out keeps the directive valid instead of breaking the whole header.
+    }
+  }
+  return sources;
+}
+
+export function frameAncestorsDirective(config: Config): string {
+  return `frame-ancestors ${frameAncestorSources(config).join(" ")}`;
+}
+
+/** Single source of truth for bearer-equivalent signed routes (see app.ts auth gate). */
+export const signedFileContentPattern = /^\/api\/files\/[^/]+\/content$/;
+export const browserPreviewPattern = /^\/api\/browsers\/[^/]+\/preview$/;
+export const browserConsolePattern = /^\/api\/browsers\/[^/]+\/console$/;
+
+export function isSignedRoute(path: string): boolean {
+  return (
+    signedFileContentPattern.test(path) ||
+    browserPreviewPattern.test(path) ||
+    browserConsolePattern.test(path)
+  );
+}
+
+export function isConsolePage(method: string, path: string): boolean {
+  return method === "GET" && browserConsolePattern.test(path);
+}
+
+export function isByteRoute(method: string, path: string): boolean {
+  return (
+    method === "GET" && (signedFileContentPattern.test(path) || browserPreviewPattern.test(path))
+  );
+}
+
+export function isFileDownload(method: string, path: string): boolean {
+  return method === "GET" && signedFileContentPattern.test(path);
+}
+
+/** Directives preserved from the browser-console route when it is centralized here. */
+export const consoleContentPolicyBase =
+  "default-src 'self'; img-src 'self' blob:; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'";
+
+export function contentSecurityPolicy(method: string, path: string, config: Config): string {
+  const framing = frameAncestorsDirective(config);
+  // The console is an HTML page that fetches its preview over the network, so
+  // it keeps its script/style allowances and only gains framing protection.
+  if (isConsolePage(method, path)) return `${consoleContentPolicyBase}; ${framing}`;
+  // Byte responses: framing protection only, so plugin/image rendering is untouched.
+  if (isByteRoute(method, path)) return framing;
+  // JSON, OAuth pages, and everything else: nothing may load or submit anywhere.
+  return `default-src 'none'; base-uri 'none'; form-action 'none'; ${framing}`;
+}
+
+/** File downloads render in an iframe PDF viewer on web (PdfReader.web.tsx),
+ * whose fullscreen button needs the delegation, so `fullscreen` stays enabled there. */
+const defaultPermissionsPolicy =
+  "camera=(), microphone=(), geolocation=(), payment=(), usb=(), bluetooth=(), " +
+  "magnetometer=(), gyroscope=(), accelerometer=(), ambient-light-sensor=(), " +
+  "autoplay=(), encrypted-media=(), fullscreen=(), picture-in-picture=()";
+const filePermissionsPolicy =
+  "camera=(), microphone=(), geolocation=(), payment=(), usb=(), bluetooth=(), " +
+  "magnetometer=(), gyroscope=(), accelerometer=(), ambient-light-sensor=(), " +
+  "autoplay=(), encrypted-media=(), picture-in-picture=()";
+
+export function permissionsPolicy(method: string, path: string): string {
+  return isFileDownload(method, path) ? filePermissionsPolicy : defaultPermissionsPolicy;
+}
+
+/** Headers that are identical on every response. */
+export function baseSecurityHeaders(config: Config): Record<string, string> {
+  const headers: Record<string, string> = {
+    "X-Content-Type-Options": "nosniff",
+    "Referrer-Policy": "no-referrer",
+    "Cache-Control": "no-store",
+  };
+  // Browsers ignore HSTS on plaintext, and emitting it there would be a lie in
+  // local/sample setups, so only advertise it when the public URL is https.
+  try {
+    if (new URL(config.publicUrl).protocol === "https:")
+      headers["Strict-Transport-Security"] = "max-age=15552000; includeSubDomains";
+  } catch {
+    // An invalid public URL fails fast in createApp before this ever matters.
+  }
+  return headers;
+}
+
+/**
+ * Single builder for both response paths. The framing directive only depends
+ * on config, so it (and every policy derived from it) is built once at
+ * startup instead of on every request.
+ *
+ * Handlers that return a raw `Response` (the CopilotKit stream passthrough)
+ * bypass context headers, so they use `headersFor()` to apply the exact same
+ * policy the middleware sets.
+ */
+export function createEdgeHeaders(config: Config) {
+  const framing = frameAncestorsDirective(config);
+  const strictCsp = `default-src 'none'; base-uri 'none'; form-action 'none'; ${framing}`;
+  const consoleCsp = `${consoleContentPolicyBase}; ${framing}`;
+  const byteCsp = framing;
+  const base = baseSecurityHeaders(config);
+
+  const cspFor = (method: string, path: string): string => {
+    if (isConsolePage(method, path)) return consoleCsp;
+    if (isByteRoute(method, path)) return byteCsp;
+    return strictCsp;
+  };
+
+  const headersFor = (method: string, path: string): Record<string, string> => ({
+    ...base,
+    // The API serves data, never media capture: deny the powerful features outright.
+    "Permissions-Policy": permissionsPolicy(method, path),
+    "Content-Security-Policy": cspFor(method, path),
+  });
+
+  const middleware = async (c: Context, next: () => Promise<void>) => {
+    for (const [name, value] of Object.entries(headersFor(c.req.method, c.req.path)))
+      c.header(name, value);
+    await next();
+  };
+
+  return { base, cspFor, headersFor, middleware };
+}
+
+/**
+ * Sets hardening headers on every response, including error responses produced
+ * by `onError`. Handlers that return a raw `Response` (the CopilotKit stream
+ * passthrough) bypass context headers and must apply these explicitly via
+ * `createEdgeHeaders(config).headersFor()`.
+ */
+export function securityHeaders(config: Config) {
+  return createEdgeHeaders(config).middleware;
+}
diff --git a/render.yaml b/render.yaml
index 62999493c..201ce5f83 100644
--- a/render.yaml
+++ b/render.yaml
@@ -9,7 +9,10 @@ services:
     # `corepack enable` dies with EROFS. Render's pnpm honors packageManager.
     buildCommand: pnpm install --frozen-lockfile && pnpm build:server
     startCommand: pnpm start
-    healthCheckPath: /api/health
+    # Liveness + readiness: with the default embedded PGlite store this only
+    # proves the process is alive; with DATABASE_URL set it additionally gates
+    # traffic on Postgres actually answering.
+    healthCheckPath: /api/ready
     disk:
       name: openmuse-data
       mountPath: /var/data
@@ -18,6 +21,11 @@ services:
       # HOST must be 0.0.0.0 on Render, and OpenMuse only allows that in live mode.
       - key: HOST
         value: 0.0.0.0
+      # Behind Render's proxy every connection comes from the proxy address, so
+      # per-client rate limits (sign-in budget, shared API budget) must read the
+      # client IP our proxy appended to X-Forwarded-For.
+      - key: TRUST_PROXY
+        value: true
       - key: WORKSPACE_MODE
         value: live
       - key: AGENT_BACKEND
diff --git a/tests/rate-limit.test.ts b/tests/rate-limit.test.ts
index 30ed7871e..2663b3b33 100644
--- a/tests/rate-limit.test.ts
+++ b/tests/rate-limit.test.ts
@@ -26,9 +26,17 @@ test("resolveClientKey ignores forwarding headers unless trustProxy is enabled",
   });
   assert.equal(untrustedA, untrustedB, "spoofed X-Forwarded-For must not change the bucket");
 
+  // Only the hop our own proxy appended (the last entry) is trusted: the
+  // leftmost entry is caller-controlled and must not mint a new bucket.
   const trustedA = resolveClientKey({ trustProxy: true, forwardedFor: "1.2.3.4, 10.0.0.1" });
   const trustedB = resolveClientKey({ trustProxy: true, forwardedFor: "5.6.7.8, 10.0.0.1" });
-  assert.notEqual(trustedA, trustedB, "a trusted proxy header should pick the first (client) hop");
+  assert.equal(
+    trustedA,
+    trustedB,
+    "spoofed leftmost entries sharing one proxy hop must share one bucket",
+  );
+  const trustedC = resolveClientKey({ trustProxy: true, forwardedFor: "1.2.3.4, 10.0.0.2" });
+  assert.notEqual(trustedA, trustedC, "distinct proxy-appended hops get distinct buckets");
 
   assert.equal(resolveClientKey({ trustProxy: true, realIp: "1.2.3.4" }), "proxy:1.2.3.4");
 });
@@ -54,11 +62,12 @@ test("createRateLimitStore caps total entries and evicts expired ones to make ro
   assert.equal(store.take("a", 0), true);
   assert.equal(store.take("b", 0), true);
   assert.equal(store.size(), 2);
-  assert.equal(store.take("c", 500), false, "a brand-new key must be rejected once at capacity");
+  // At capacity the oldest entry is evicted so newcomers are never locked out.
+  assert.equal(store.take("c", 500), true, "a brand-new key evicts the oldest entry");
   assert.equal(store.size(), 2, "the map must never exceed maxEntries");
 
-  // Once "a" and "b" expire, capacity should be reclaimed for a new key.
-  assert.equal(store.take("c", 2000), true);
+  // Once "b" and "c" expire, capacity should be reclaimed for a new key.
+  assert.equal(store.take("d", 2000), true);
   assert.equal(store.size(), 1);
 });
 
@@ -99,7 +108,9 @@ test("session token rotation does not create new pre-auth buckets", async () =>
 test("unauthenticated requests cannot multiply buckets by spoofing X-Forwarded-For", async () => {
   let lastStatus = 200;
   for (let i = 0; i < 121; i++) {
-    const response = await app.request("/api/health", {
+    // /api/health and /api/ready are exempt (load-balancer probes), so exercise
+    // a rate-limited route instead.
+    const response = await app.request("/api/workspace", {
       headers: { "X-Forwarded-For": `10.0.0.${i % 255}` },
     });
     lastStatus = response.status;
@@ -140,7 +151,7 @@ test("spoofed bearer tokens from one connection share a single bucket", async ()
   assert.equal(other.status, 200);
 });
 
-test("capacity exhaustion fails closed and recovers once entries expire", async () => {
+test("capacity exhaustion evicts the oldest entry instead of locking out", async () => {
   const addresses = ["10.0.0.1", "10.0.0.2", "10.0.0.3", "10.0.0.4"];
   let current = 0;
   const app = limitedApp({ maxEntries: 3, windowMs: 60_000, getAddress: () => addresses[current] });
@@ -148,15 +159,45 @@ test("capacity exhaustion fails closed and recovers once entries expire", async
   for (current = 0; current < 4; current++) {
     statuses.push((await app.request("/api/ping")).status);
   }
-  assert.deepEqual(statuses, [200, 200, 200, 429], "the fourth connection is rejected");
-  current = 0;
+  assert.deepEqual(
+    statuses,
+    [200, 200, 200, 200],
+    "the fourth connection evicts the oldest entry instead of locking out",
+  );
+  current = 1;
   assert.equal((await app.request("/api/ping")).status, 200, "existing entries keep working");
 });
 
+test("an evicted entry restarts with a fresh budget", () => {
+  const store = createRateLimitStore({ windowMs: 60_000, maxRequests: 1, maxEntries: 2 });
+  assert.equal(store.take("a", 0), true);
+  assert.equal(store.take("b", 0), true);
+  // At capacity "c" evicts "a" (least recently used).
+  assert.equal(store.take("c", 1), true);
+  // The dropped key gets a fresh bucket rather than inheriting its old count.
+  assert.equal(store.take("a", 2), true, "evicted key restarts at count 1");
+  assert.equal(store.take("a", 3), false, "but the fresh bucket still enforces its limit");
+});
+
+test("recently active entries survive eviction over idle ones", () => {
+  const store = createRateLimitStore({ windowMs: 60_000, maxRequests: 2, maxEntries: 3 });
+  assert.equal(store.take("a", 0), true);
+  assert.equal(store.take("a", 1), true, "a is now at its limit (count 2)");
+  assert.equal(store.take("b", 2), true);
+  assert.equal(store.take("c", 3), true);
+  // Touch "b" so recency order is a, c, b; the next newcomer must evict "a".
+  assert.equal(store.take("b", 4), true, "b reaches its limit (count 2)");
+  assert.equal(store.take("d", 5), true, "newcomer evicts least-recently-active entry");
+  // "a" was evicted and restarts fresh; "b" kept its exhausted count.
+  assert.equal(store.take("a", 6), true, "evicted entry restarts fresh");
+  assert.equal(store.take("b", 6), false, "recently active entry keeps its count");
+});
+
 test("capacity exhaustion reclaims expired entries", () => {
   const store = createRateLimitStore({ windowMs: 1000, maxEntries: 3 });
   for (const key of ["conn:a", "conn:b", "conn:c"]) assert.equal(store.take(key, 0), true);
-  assert.equal(store.take("conn:d", 500), false);
+  // At capacity the oldest entry is evicted for the newcomer.
+  assert.equal(store.take("conn:d", 500), true);
   assert.equal(store.take("conn:d", 1500), true);
   assert.equal(store.size(), 1);
 });
diff --git a/tests/server-edge.test.ts b/tests/server-edge.test.ts
new file mode 100644
index 000000000..70f889d36
--- /dev/null
+++ b/tests/server-edge.test.ts
@@ -0,0 +1,336 @@
+import assert from "node:assert/strict";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { after, before, test } from "node:test";
+import type { Context } from "hono";
+import { createApp } from "../apps/server/src/app.ts";
+import type { Config } from "../apps/server/src/config.ts";
+import { createStore, type Store } from "../apps/server/src/db.ts";
+import { resolveRequestKey } from "../apps/server/src/rate-limit.ts";
+import {
+  baseSecurityHeaders,
+  contentSecurityPolicy,
+  frameAncestorSources,
+  isSignedRoute,
+  permissionsPolicy,
+} from "../apps/server/src/security-headers.ts";
+import { createSamplePdf } from "../packages/integrations/src/pdf.ts";
+
+let db: Store,
+  app: Awaited<ReturnType<typeof createApp>>["app"],
+  auth: Awaited<ReturnType<typeof createApp>>["auth"],
+  agent: Awaited<ReturnType<typeof createApp>>["agent"],
+  config: Config,
+  token: string,
+  directory: string;
+
+const headers = () => ({ Authorization: `Bearer ${token}`, "Content-Type": "application/json" });
+
+before(async () => {
+  directory = await mkdtemp(join(tmpdir(), "openmuse-server-edge-"));
+  db = await createStore();
+  config = {
+    mode: "sample",
+    port: 8787,
+    host: "127.0.0.1",
+    publicUrl: "http://localhost:8787",
+    dataDir: directory,
+    agentBackend: "sample",
+    intelligenceApiKey: "test-project-key-never-sent",
+    googleRedirectUri: "http://localhost:8787/api/google/callback",
+    allowedOrigins: ["http://localhost:8081"],
+  };
+  ({ app, auth, agent } = await createApp(db, config));
+  const response = await app.request("/api/session", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: "{}",
+  });
+  assert.equal(response.status, 200);
+  token = (await response.json()).token;
+});
+
+after(async () => {
+  await db.close();
+  await rm(directory, { recursive: true, force: true });
+});
+
+const framing = "frame-ancestors 'self' http://localhost:8081 http://localhost:8787";
+const strictCsp = `default-src 'none'; base-uri 'none'; form-action 'none'; ${framing}`;
+
+test("JSON responses carry the full hardening headers and no HSTS on plaintext", async () => {
+  const response = await app.request("/api/health", { headers: headers() });
+  assert.equal(response.status, 200);
+  assert.equal(response.headers.get("x-content-type-options"), "nosniff");
+  assert.equal(response.headers.get("referrer-policy"), "no-referrer");
+  assert.equal(response.headers.get("cache-control"), "no-store");
+  assert.equal(response.headers.get("content-security-policy"), strictCsp);
+  assert.ok(
+    response.headers.get("permissions-policy")?.includes("camera=()"),
+    "powerful features are denied",
+  );
+  assert.equal(response.headers.get("strict-transport-security"), null);
+});
+
+test("rejected origins still receive the hardening headers", async () => {
+  const response = await app.request("/api/workspace", {
+    headers: { ...headers(), Origin: "https://unrelated.example" },
+  });
+  assert.equal(response.status, 403);
+  assert.equal(response.headers.get("x-content-type-options"), "nosniff");
+  assert.equal(response.headers.get("content-security-policy"), strictCsp);
+});
+
+test("signed file bytes allow first-party framing but no content directives", async () => {
+  const bytes = await createSamplePdf();
+  const file = await agent.files.import("local-user", "edge.pdf", bytes, "fixture");
+  const url = new URL(auth.sign("local-user", `/api/files/${file.id}/content`));
+  const response = await app.request(`${url.pathname}${url.search}`);
+  assert.equal(response.status, 200);
+  assert.equal(response.headers.get("content-type"), "application/pdf");
+  assert.equal(response.headers.get("content-security-policy"), framing);
+  // The iframe PDF viewer needs fullscreen; JSON responses keep it denied.
+  assert.equal(
+    response.headers.get("permissions-policy")?.includes("fullscreen"),
+    false,
+    "file downloads must not deny fullscreen",
+  );
+  const json = await app.request("/api/health", { headers: headers() });
+  assert.ok(json.headers.get("permissions-policy")?.includes("fullscreen=()"));
+});
+
+test("readiness reports the database instead of a static ok", async () => {
+  const response = await app.request("/api/ready");
+  assert.equal(response.status, 200);
+  assert.deepEqual(await response.json(), { ok: true, mode: "sample", database: "up" });
+});
+
+test("readiness fails closed when the database is unreachable", async (t) => {
+  t.mock.method(db, "ping", async () => {
+    throw new Error("postgres gone");
+  });
+  const response = await app.request("/api/ready");
+  assert.equal(response.status, 503);
+  assert.deepEqual(await response.json(), { ok: false, mode: "sample", database: "down" });
+});
+
+test("readiness times out instead of queueing behind a slow query", async (t) => {
+  t.mock.method(db, "ping", () => new Promise<void>(() => {}));
+  const started = Date.now();
+  const response = await app.request("/api/ready");
+  assert.equal(response.status, 503);
+  assert.deepEqual(await response.json(), { ok: false, mode: "sample", database: "down" });
+  assert.ok(Date.now() - started < 5000, "the probe must be bounded");
+});
+
+test("concurrent readiness checks share one in-flight probe", async (t) => {
+  // Fresh app: the timeout test above leaves the shared app's coalesced probe
+  // pending forever (its mocked ping never resolves), so isolation matters here.
+  let sharedDb: Store | undefined;
+  let sharedDirectory = "";
+  try {
+    sharedDirectory = await mkdtemp(join(tmpdir(), "openmuse-server-edge-shared-"));
+    sharedDb = await createStore();
+    const sharedConfig: Config = { ...config, dataDir: sharedDirectory };
+    const { app: shared } = await createApp(sharedDb, sharedConfig);
+    let calls = 0;
+    let release: (() => void) | undefined;
+    const gate = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    t.mock.method(sharedDb, "ping", async () => {
+      calls += 1;
+      await gate;
+    });
+    const first = shared.request("/api/ready");
+    const second = shared.request("/api/ready");
+    setTimeout(() => release?.(), 50);
+    const [r1, r2] = await Promise.all([first, second]);
+    assert.equal(r1.status, 200);
+    assert.equal(r2.status, 200);
+    assert.equal(calls, 1, "concurrent checks must not queue extra database queries");
+  } finally {
+    await sharedDb?.close();
+    if (sharedDirectory) await rm(sharedDirectory, { recursive: true, force: true });
+  }
+});
+
+test("health and readiness stay outside the shared rate budget", async () => {
+  let probeDb: Store | undefined;
+  let probeDirectory = "";
+  try {
+    probeDirectory = await mkdtemp(join(tmpdir(), "openmuse-server-edge-probe-"));
+    probeDb = await createStore();
+    const probeConfig: Config = { ...config, dataDir: probeDirectory };
+    const { app: probe } = await createApp(probeDb, probeConfig);
+    for (let i = 0; i < 130; i += 1) await probe.request("/api/workspace");
+    assert.equal((await probe.request("/api/workspace")).status, 429);
+    assert.equal((await probe.request("/api/health")).status, 200);
+    assert.equal((await probe.request("/api/ready")).status, 200);
+  } finally {
+    await probeDb?.close();
+    if (probeDirectory) await rm(probeDirectory, { recursive: true, force: true });
+  }
+});
+
+test("sign-in attempts are budgeted per client instead of globally", async () => {
+  let liveDb: Store | undefined;
+  let liveDirectory = "";
+  try {
+    liveDirectory = await mkdtemp(join(tmpdir(), "openmuse-server-edge-live-"));
+    liveDb = await createStore();
+    const liveConfig: Config = {
+      ...config,
+      mode: "live",
+      agentBackend: "model",
+      dataDir: liveDirectory,
+      accessKey: "a".repeat(24),
+      trustProxy: true,
+    };
+    const { app: live } = await createApp(liveDb, liveConfig);
+    const signIn = (ip: string) =>
+      live.request("/api/session", {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "X-Forwarded-For": ip },
+        body: "{}",
+      });
+    // Wrong keys still count (the limiter runs before auth), but cheaply: no
+    // workspace warmup happens on a 401 path.
+    for (let attempt = 0; attempt < 10; attempt += 1)
+      assert.equal((await signIn("203.0.113.7")).status, 401);
+    assert.equal((await signIn("203.0.113.7")).status, 429);
+    // A different address is unaffected: the old global limiter would have
+    // locked this client out too.
+    assert.equal((await signIn("198.51.100.9")).status, 401);
+    // Spoofed leftmost entries share the proxy-appended hop, so no new bucket.
+    for (let attempt = 0; attempt < 10; attempt += 1)
+      assert.equal((await signIn(`10.9.9.${attempt}, 198.51.100.77`)).status, 401);
+    assert.equal((await signIn("198.51.100.77")).status, 429);
+  } finally {
+    await liveDb?.close();
+    if (liveDirectory) await rm(liveDirectory, { recursive: true, force: true });
+  }
+});
+
+test("sign-in flood monitor warns instead of locking everyone out", async () => {
+  let capDb: Store | undefined;
+  let capDirectory = "";
+  try {
+    capDirectory = await mkdtemp(join(tmpdir(), "openmuse-server-edge-cap-"));
+    capDb = await createStore();
+    const capConfig: Config = {
+      ...config,
+      mode: "live",
+      agentBackend: "model",
+      dataDir: capDirectory,
+      accessKey: "a".repeat(24),
+      trustProxy: true,
+    };
+    const { app: capped } = await createApp(capDb, capConfig);
+    const signIn = (ip: string) =>
+      capped.request("/api/session", {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "X-Forwarded-For": ip },
+        body: "{}",
+      });
+    // A hard overall cap would let a few addresses lock everyone else out, so
+    // the flood monitor only logs: 101 distinct clients all still get through
+    // to auth (401), and per-client budgets still block repeat offenders.
+    for (let i = 0; i < 100; i += 1) assert.equal((await signIn(`198.51.100.${i}`)).status, 401);
+    assert.equal((await signIn("203.0.113.99")).status, 401);
+    for (let attempt = 0; attempt < 10; attempt += 1)
+      assert.equal((await signIn("203.0.113.7")).status, 401);
+    assert.equal((await signIn("203.0.113.7")).status, 429);
+  } finally {
+    await capDb?.close();
+    if (capDirectory) await rm(capDirectory, { recursive: true, force: true });
+  }
+});
+
+test("HSTS is advertised only when the public URL is https", async () => {
+  let httpsDb: Store | undefined;
+  let httpsDirectory = "";
+  try {
+    httpsDirectory = await mkdtemp(join(tmpdir(), "openmuse-server-edge-https-"));
+    httpsDb = await createStore();
+    const httpsConfig: Config = {
+      ...config,
+      publicUrl: "https://example.com",
+      googleRedirectUri: "https://example.com/api/google/callback",
+      dataDir: httpsDirectory,
+    };
+    const { app: https } = await createApp(httpsDb, httpsConfig);
+    const response = await https.request("/api/health");
+    assert.equal(
+      response.headers.get("strict-transport-security"),
+      "max-age=15552000; includeSubDomains",
+    );
+    assert.equal(
+      response.headers.get("content-security-policy"),
+      `default-src 'none'; base-uri 'none'; form-action 'none'; ` +
+        `frame-ancestors 'self' http://localhost:8081 https://example.com`,
+    );
+  } finally {
+    await httpsDb?.close();
+    if (httpsDirectory) await rm(httpsDirectory, { recursive: true, force: true });
+  }
+});
+
+test("contentSecurityPolicy keeps console allowances and framing per route", () => {
+  const consolePolicy = contentSecurityPolicy("GET", "/api/browsers/abc/console", config);
+  assert.ok(consolePolicy.includes("script-src 'unsafe-inline'"));
+  assert.ok(consolePolicy.includes(framing));
+  assert.equal(contentSecurityPolicy("GET", "/api/browsers/abc/preview", config), framing);
+  assert.equal(contentSecurityPolicy("GET", "/api/files/abc/content", config), framing);
+  assert.equal(contentSecurityPolicy("POST", "/api/browsers/abc/console", config), strictCsp);
+  assert.equal(contentSecurityPolicy("GET", "/api/workspace", config), strictCsp);
+});
+
+test("frameAncestorSources trims, dedupes, and drops unparseable entries", () => {
+  assert.deepEqual(frameAncestorSources(config), [
+    "'self'",
+    "http://localhost:8081",
+    "http://localhost:8787",
+  ]);
+  assert.deepEqual(
+    frameAncestorSources({
+      ...config,
+      allowedOrigins: [" https://a.example/extra ,", "https://a.example", "not a url", ""],
+    }),
+    ["'self'", "https://a.example", "http://localhost:8787"],
+  );
+});
+
+test("baseSecurityHeaders gates HSTS on the public scheme", () => {
+  assert.equal(baseSecurityHeaders(config)["Strict-Transport-Security"], undefined);
+  assert.equal(
+    baseSecurityHeaders({ ...config, publicUrl: "https://example.com" })[
+      "Strict-Transport-Security"
+    ],
+    "max-age=15552000; includeSubDomains",
+  );
+});
+
+test("resolveRequestKey honors proxy headers only when trusted", () => {
+  const context = (forwardedFor?: string) =>
+    ({
+      req: { header: (name: string) => (name === "x-forwarded-for" ? forwardedFor : null) },
+    }) as unknown as Context;
+  assert.ok(resolveRequestKey(context("203.0.113.7"), true).includes("203.0.113.7"));
+  assert.equal(resolveRequestKey(context("203.0.113.7"), false).includes("203.0.113.7"), false);
+});
+
+test("signed routes share one list between auth and headers", () => {
+  assert.equal(isSignedRoute("/api/files/abc/content"), true);
+  assert.equal(isSignedRoute("/api/browsers/abc/preview"), true);
+  assert.equal(isSignedRoute("/api/browsers/abc/console"), true);
+  assert.equal(isSignedRoute("/api/workspace"), false);
+  assert.equal(isSignedRoute("/api/files/abc/fill"), false);
+});
+
+test("permissionsPolicy keeps fullscreen for file downloads only", () => {
+  assert.equal(permissionsPolicy("GET", "/api/files/abc/content").includes("fullscreen"), false);
+  assert.ok(permissionsPolicy("GET", "/api/workspace").includes("fullscreen=()"));
+  assert.ok(permissionsPolicy("GET", "/api/browsers/abc/preview").includes("fullscreen=()"));
+});