diff --git a/.env.example b/.env.example
index 300181a98b..c944ae71c3 100644
--- a/.env.example
+++ b/.env.example
@@ -86,6 +86,12 @@ EMAIL_SES_REGION=
 # Format (no quotes): Your App <noreply@yourdomain.com>
 EMAIL_FROM=
 
+# Product name shown inside transactional emails — the sign-in, invite, welcome,
+# and password-reset subjects and headings. Defaults to "Quackback". Set this if
+# you run under your own brand so those emails say your name, not ours. This is
+# the product name, separate from each workspace's own name.
+# EMAIL_BRAND_NAME=Your App
+
 # ============================================================================
 # Inbound email (optional) — conversation email channel
 # ============================================================================
diff --git a/.env.prod.example b/.env.prod.example
index 9d5729fd8e..a9bc3bea57 100644
--- a/.env.prod.example
+++ b/.env.prod.example
@@ -52,6 +52,9 @@ EMAIL_SMTP_PORT=587
 EMAIL_SMTP_USER=
 EMAIL_SMTP_PASS=
 EMAIL_FROM=Quackback <noreply@example.com>
+# Product name shown inside transactional emails (subjects and headings).
+# Defaults to "Quackback"; set it to run those emails under your own brand.
+# EMAIL_BRAND_NAME=Quackback
 # Or use the Amazon SES API instead of SMTP. All three are required: the
 # region is the one the sending identity is verified in, and there is no
 # default because a verified identity is regional.
diff --git a/SELF-IMPROVE.md b/SELF-IMPROVE.md
index 52f350a35e..f2ed9d97b4 100644
--- a/SELF-IMPROVE.md
+++ b/SELF-IMPROVE.md
@@ -5,7 +5,7 @@ when the same thing bites again and re-sort the list by counter, descending.
 Entries that have actually been fixed move to **Resolved** at the end, with what
 fixed them — they are the record of what the counters bought.
 
-## 7x — Test suites are flaky under parallel load
+## 8x — Test suites are flaky under parallel load
 
 `principals/__tests__/seat-usage.db.test.ts` and
 `tickets/__tests__/ticket-convergence-1b.test.ts` each fail intermittently when
@@ -90,6 +90,19 @@ Raising `hookTimeout` to match is the obvious fix; not done inside the
 back-merge, for the reason above -- a change to shared test infrastructure
 needs its own run to be falsifiable.
 
+Eighth hit, on the back-merge of upstream #506–#520: a run over 345 suites with
+coverage ended on one red test, `policy/module-state/__tests__/module-state.test.ts`
+(`Test timed out in 20000ms` on the scanner walk), and the same file passed alone in
+under a second of test time. Another scanner-shaped suite that walks the source tree
+and lives close to the 20s ceiling under contention; nothing in the change touched it.
+The re-run of the same set, capped at six workers, went red on a different file
+instead: `jobs/__tests__/runner.test.ts` ("reaps a stranded lease and prunes an aged
+terminal row in one pass") saw `pruned` come back 0 for a row it had just aged
+400 days, and passed three times in a row alone. `job-queue.test.ts` and
+`worker.test.ts` prune the same shared `job_queue` table from their own workers,
+so whichever process prunes first takes the other's row and its count. Same
+shape as `seat-usage`: a database-wide count asserted across parallel suites.
+
 ## 1x — A line that is only an arrow function passed as a JSX prop reads as uncovered until the handler actually fires
 
 Filling a diff-coverage hole for `onEdit={() => onEdit(row)}`-shaped lines
diff --git a/apps/web/e2e/tests/admin/settings-tags.spec.ts b/apps/web/e2e/tests/admin/settings-tags.spec.ts
index e062b5a9e0..d4ea19e3e1 100644
--- a/apps/web/e2e/tests/admin/settings-tags.spec.ts
+++ b/apps/web/e2e/tests/admin/settings-tags.spec.ts
@@ -73,6 +73,11 @@ test.describe('Admin Tags Settings', () => {
     // Color section label
     await expect(dialog.getByText('Color')).toBeVisible()
 
+    // Portal visibility switch, on by default for new tags
+    const portalSwitch = dialog.getByRole('switch', { name: /show on portal/i })
+    await expect(portalSwitch).toBeVisible()
+    await expect(portalSwitch).toHaveAttribute('aria-checked', 'true')
+
     // Create and Cancel buttons
     await expect(dialog.getByRole('button', { name: /cancel/i })).toBeVisible()
     await expect(dialog.getByRole('button', { name: /create tag/i })).toBeVisible()
diff --git a/apps/web/src/components/admin/settings/imports/__tests__/import-csv.test.tsx b/apps/web/src/components/admin/settings/imports/__tests__/import-csv.test.tsx
index d619c56d1b..0553c0bfa2 100644
--- a/apps/web/src/components/admin/settings/imports/__tests__/import-csv.test.tsx
+++ b/apps/web/src/components/admin/settings/imports/__tests__/import-csv.test.tsx
@@ -115,6 +115,12 @@ afterEach(() => {
 })
 
 describe('<ImportCsv>', () => {
+  it('explains how author_email and author_name are applied', () => {
+    renderCsv()
+    expect(screen.getByText(/Every row needs author_email or author_name/)).toBeTruthy()
+    expect(screen.getByText(/name-only contact/)).toBeTruthy()
+  })
+
   it('walks upload -> dry-run review -> commit -> done', async () => {
     const fetchMock = vi.fn((input: RequestInfo | URL, init?: RequestInit) => {
       const url = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url
diff --git a/apps/web/src/components/admin/settings/imports/import-csv.tsx b/apps/web/src/components/admin/settings/imports/import-csv.tsx
index 17927cc497..aeafe789be 100644
--- a/apps/web/src/components/admin/settings/imports/import-csv.tsx
+++ b/apps/web/src/components/admin/settings/imports/import-csv.tsx
@@ -202,7 +202,8 @@ export function ImportCsv() {
           </span>
           <span className="text-xs text-muted-foreground">
             Must use the template columns — title and content are required. Up to 10MB / 10,000
-            rows.
+            rows. Every row needs author_email or author_name: email matches or creates a person;
+            name without an email creates a name-only contact.
           </span>
           <input
             ref={fileInputRef}
diff --git a/apps/web/src/components/admin/settings/tags/__tests__/tag-list.test.tsx b/apps/web/src/components/admin/settings/tags/__tests__/tag-list.test.tsx
new file mode 100644
index 0000000000..40067a3ba2
--- /dev/null
+++ b/apps/web/src/components/admin/settings/tags/__tests__/tag-list.test.tsx
@@ -0,0 +1,122 @@
+// @vitest-environment happy-dom
+/**
+ * Tag settings — "Show on portal" visibility control.
+ *
+ * Covers the admin-facing half of tag portal visibility: the create/edit
+ * dialog exposes a switch that defaults to public for new tags, mirrors the
+ * saved flag when editing, and sends `isPublic` on save; internal tags are
+ * marked in the list so the state is visible without opening the dialog.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { render, screen, fireEvent, waitFor, within } from '@testing-library/react'
+import type { PostTag } from '@/lib/shared/db-types'
+
+const mockCreate = vi.fn()
+const mockUpdate = vi.fn()
+vi.mock('@/lib/server/functions/post-tags', () => ({
+  createPostTagFn: (...args: unknown[]) => mockCreate(...args),
+  updatePostTagFn: (...args: unknown[]) => mockUpdate(...args),
+  deletePostTagFn: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  useRouter: () => ({ invalidate: vi.fn() }),
+}))
+
+vi.mock('sonner', () => ({ toast: { success: vi.fn(), error: vi.fn() } }))
+
+import { TagList } from '../tag-list'
+
+const PUBLIC_TAG = {
+  id: 'post_tag_public',
+  name: 'Bug',
+  color: '#ef4444',
+  description: 'Broken behaviour',
+  aiPrompt: null,
+  isPublic: true,
+  createdAt: new Date('2026-01-01'),
+  deletedAt: null,
+} as PostTag
+
+const INTERNAL_TAG = {
+  ...PUBLIC_TAG,
+  id: 'post_tag_internal',
+  name: 'Churn risk',
+  description: null,
+  isPublic: false,
+} as PostTag
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mockCreate.mockImplementation(async ({ data }) => ({
+    ...PUBLIC_TAG,
+    id: 'post_tag_new',
+    ...data,
+  }))
+  mockUpdate.mockImplementation(async ({ data }) => ({ ...PUBLIC_TAG, ...data }))
+})
+
+function portalSwitch() {
+  return screen.getByRole('switch', { name: /show on portal/i })
+}
+
+describe('<TagList> — portal visibility', () => {
+  it('marks internal tags in the list and leaves public tags unmarked', () => {
+    render(<TagList initialTags={[PUBLIC_TAG, INTERNAL_TAG]} />)
+
+    const internalRow = screen.getByText('Churn risk').closest('div')!
+    expect(within(internalRow).getByText('Internal')).toBeTruthy()
+
+    const publicRow = screen.getByText('Bug').closest('div')!
+    expect(within(publicRow).queryByText('Internal')).toBeNull()
+  })
+
+  it('defaults a new tag to public and sends isPublic on create', async () => {
+    render(<TagList initialTags={[]} />)
+
+    fireEvent.click(screen.getByRole('button', { name: /add new tag/i }))
+    expect(portalSwitch()).toHaveAttribute('aria-checked', 'true')
+
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'Design' } })
+    fireEvent.click(screen.getByRole('button', { name: /create tag/i }))
+
+    await waitFor(() =>
+      expect(mockCreate).toHaveBeenCalledWith({
+        data: expect.objectContaining({ name: 'Design', isPublic: true }),
+      })
+    )
+  })
+
+  it('lets an admin create an internal tag by turning the switch off', async () => {
+    render(<TagList initialTags={[]} />)
+
+    fireEvent.click(screen.getByRole('button', { name: /add new tag/i }))
+    fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'Churn risk' } })
+    fireEvent.click(portalSwitch())
+    expect(portalSwitch()).toHaveAttribute('aria-checked', 'false')
+
+    fireEvent.click(screen.getByRole('button', { name: /create tag/i }))
+
+    await waitFor(() =>
+      expect(mockCreate).toHaveBeenCalledWith({
+        data: expect.objectContaining({ name: 'Churn risk', isPublic: false }),
+      })
+    )
+  })
+
+  it('reflects the saved flag when editing and sends the toggled value', async () => {
+    render(<TagList initialTags={[INTERNAL_TAG]} />)
+
+    fireEvent.click(screen.getByRole('button', { name: /edit tag/i }))
+    expect(portalSwitch()).toHaveAttribute('aria-checked', 'false')
+
+    fireEvent.click(portalSwitch())
+    fireEvent.click(screen.getByRole('button', { name: /save changes/i }))
+
+    await waitFor(() =>
+      expect(mockUpdate).toHaveBeenCalledWith({
+        data: expect.objectContaining({ id: 'post_tag_internal', isPublic: true }),
+      })
+    )
+  })
+})
diff --git a/apps/web/src/components/admin/settings/tags/tag-list.tsx b/apps/web/src/components/admin/settings/tags/tag-list.tsx
index b21544b812..af299ba689 100644
--- a/apps/web/src/components/admin/settings/tags/tag-list.tsx
+++ b/apps/web/src/components/admin/settings/tags/tag-list.tsx
@@ -1,9 +1,16 @@
 import { useState, useEffect, useTransition } from 'react'
 import { useRouter } from '@tanstack/react-router'
 import { toast } from 'sonner'
-import { PlusIcon, TrashIcon, PencilSquareIcon, ArrowPathIcon } from '@heroicons/react/24/solid'
+import {
+  PlusIcon,
+  TrashIcon,
+  PencilSquareIcon,
+  ArrowPathIcon,
+  EyeSlashIcon,
+} from '@heroicons/react/24/solid'
 import { Button } from '@/components/ui/button'
 import { Input } from '@/components/ui/input'
+import { Switch } from '@/components/ui/switch'
 import {
   Dialog,
   DialogContent,
@@ -164,6 +171,7 @@ function TagDialog({ open, onOpenChange, tag, onSaved }: TagDialogProps) {
   const [name, setName] = useState('')
   const [description, setDescription] = useState('')
   const [color, setColor] = useState('#6b7280')
+  const [isPublic, setIsPublic] = useState(true)
   const [error, setError] = useState<string | null>(null)
   const [isSaving, setIsSaving] = useState(false)
 
@@ -175,10 +183,12 @@ function TagDialog({ open, onOpenChange, tag, onSaved }: TagDialogProps) {
         setName(tag.name)
         setDescription(tag.description ?? '')
         setColor(tag.color)
+        setIsPublic(tag.isPublic)
       } else {
         setName('')
         setDescription('')
         setColor(randomColor())
+        setIsPublic(true)
       }
       setError(null)
     }
@@ -211,6 +221,7 @@ function TagDialog({ open, onOpenChange, tag, onSaved }: TagDialogProps) {
             name: trimmedName,
             color,
             description: description.trim() || null,
+            isPublic,
           },
         })
       } else {
@@ -219,6 +230,7 @@ function TagDialog({ open, onOpenChange, tag, onSaved }: TagDialogProps) {
             name: trimmedName,
             color,
             description: description.trim() || undefined,
+            isPublic,
           },
         })
       }
@@ -280,6 +292,17 @@ function TagDialog({ open, onOpenChange, tag, onSaved }: TagDialogProps) {
           <ColorHexInput color={color} onColorChange={setColor} />
         </div>
 
+        <div className="flex items-center justify-between gap-4">
+          <div>
+            <Label htmlFor="tag-is-public">Show on portal</Label>
+            <p className="text-xs text-muted-foreground">
+              Customers can see this tag on posts and filter by it in the public portal. Turn off to
+              keep it internal to your team.
+            </p>
+          </div>
+          <Switch id="tag-is-public" checked={isPublic} onCheckedChange={setIsPublic} />
+        </div>
+
         {error && <p className="text-sm text-destructive">{error}</p>}
 
         <DialogFooter>
@@ -365,7 +388,7 @@ export function TagList({ initialTags }: TagListProps) {
     <div className="space-y-8">
       <SettingsCard
         title="Tags"
-        description="Label posts across boards for filtering and organization. Tags appear as colored badges throughout the app."
+        description="Label posts across boards for filtering and organization. Tags appear as colored badges throughout the app, and on the public portal unless marked internal."
         contentClassName="p-4"
       >
         <div className="space-y-1">
@@ -403,6 +426,16 @@ export function TagList({ initialTags }: TagListProps) {
               {/* Name */}
               <span className="text-sm font-medium">{tag.name}</span>
 
+              {!tag.isPublic && (
+                <span
+                  className="inline-flex items-center gap-1 rounded-md bg-muted px-1.5 py-0.5 text-[11px] font-medium text-muted-foreground shrink-0"
+                  title="Hidden from the public portal"
+                >
+                  <EyeSlashIcon className="h-3 w-3" />
+                  Internal
+                </span>
+              )}
+
               {/* Description */}
               <span className="text-xs text-muted-foreground truncate flex-1">
                 {tag.description ?? ''}
diff --git a/apps/web/src/components/portal/__tests__/portal-access-gate.intl.test.tsx b/apps/web/src/components/portal/__tests__/portal-access-gate.intl.test.tsx
index cdb44a0c49..c89532e532 100644
--- a/apps/web/src/components/portal/__tests__/portal-access-gate.intl.test.tsx
+++ b/apps/web/src/components/portal/__tests__/portal-access-gate.intl.test.tsx
@@ -9,7 +9,7 @@ vi.mock('@tanstack/react-router', () => ({
 
 // GateCard invalidates portal queries on sign-out.
 vi.mock('@tanstack/react-query', () => ({
-  useQueryClient: () => ({ invalidateQueries: vi.fn() }),
+  useQueryClient: () => ({ invalidateQueries: vi.fn(), removeQueries: vi.fn() }),
 }))
 
 // GateCard listens for cross-tab auth broadcasts.
diff --git a/apps/web/src/components/portal/__tests__/portal-access-gate.signin-bridge.test.tsx b/apps/web/src/components/portal/__tests__/portal-access-gate.signin-bridge.test.tsx
index a5fdac1f60..30529e6d34 100644
--- a/apps/web/src/components/portal/__tests__/portal-access-gate.signin-bridge.test.tsx
+++ b/apps/web/src/components/portal/__tests__/portal-access-gate.signin-bridge.test.tsx
@@ -20,7 +20,7 @@ vi.mock('@tanstack/react-router', () => ({
 }))
 
 vi.mock('@tanstack/react-query', () => ({
-  useQueryClient: () => ({ invalidateQueries: vi.fn() }),
+  useQueryClient: () => ({ invalidateQueries: vi.fn(), removeQueries: vi.fn() }),
 }))
 
 // GateCard subscribes without an `enabled` flag.
diff --git a/apps/web/src/components/portal/__tests__/portal-access-gate.test.tsx b/apps/web/src/components/portal/__tests__/portal-access-gate.test.tsx
index 7c5014d9be..2946156d26 100644
--- a/apps/web/src/components/portal/__tests__/portal-access-gate.test.tsx
+++ b/apps/web/src/components/portal/__tests__/portal-access-gate.test.tsx
@@ -1,5 +1,5 @@
 // @vitest-environment happy-dom
-import { render, screen, act } from '@testing-library/react'
+import { render, screen, act, fireEvent } from '@testing-library/react'
 import { vi, describe, it, expect, beforeEach } from 'vitest'
 
 const navigate = vi.fn()
@@ -18,8 +18,10 @@ vi.mock('@/lib/client/hooks/use-auth-broadcast', () => ({
   postAuthSuccess: vi.fn(),
 }))
 
+const invalidateQueries = vi.fn().mockResolvedValue(undefined)
+const removeQueries = vi.fn()
 vi.mock('@tanstack/react-query', () => ({
-  useQueryClient: () => ({ invalidateQueries: vi.fn() }),
+  useQueryClient: () => ({ invalidateQueries, removeQueries }),
 }))
 
 vi.mock('@/lib/client/auth-client', () => ({ signOut: vi.fn() }))
@@ -37,6 +39,8 @@ vi.mock('@/lib/client/post-auth-navigation', () => ({ navigateAfterAuth: vi.fn()
 
 import { PortalAccessGate } from '../portal-access-gate'
 import { navigateAfterAuth } from '@/lib/client/post-auth-navigation'
+import { signOut } from '@/lib/client/auth-client'
+import { VIEWER_SCOPED_PORTAL_QUERY_KEYS } from '@/lib/client/queries/portal'
 
 const baseProps = {
   reason: 'unauthenticated' as const,
@@ -52,6 +56,9 @@ const baseProps = {
 beforeEach(() => {
   navigate.mockClear()
   invalidate.mockClear()
+  invalidateQueries.mockClear()
+  removeQueries.mockClear()
+  vi.mocked(signOut).mockClear()
   vi.mocked(navigateAfterAuth).mockClear()
   broadcastOnSuccess = undefined
   formProps = {}
@@ -70,6 +77,26 @@ describe('PortalAccessGate — inline auth form', () => {
     expect(screen.getByRole('button', { name: /sign out/i })).toBeInTheDocument()
   })
 
+  it('signing out from the unauthorized screen drops the viewer-scoped portal caches before the loaders re-run', async () => {
+    render(<PortalAccessGate {...baseProps} reason="unauthorized" userEmail="alice@example.com" />)
+
+    await act(async () => {
+      fireEvent.click(screen.getByRole('button', { name: /sign out/i }))
+    })
+
+    expect(signOut).toHaveBeenCalledTimes(1)
+    const removedKeys = removeQueries.mock.calls.map(
+      (call) => (call as unknown as [{ queryKey: unknown[] }])[0].queryKey
+    )
+    expect(removedKeys).toEqual(expect.arrayContaining([...VIEWER_SCOPED_PORTAL_QUERY_KEYS]))
+    expect(invalidateQueries).toHaveBeenCalledWith({ queryKey: ['votedPosts'] })
+    expect(invalidate).toHaveBeenCalledTimes(1)
+    // The caches must be gone before the loaders re-run, or ensureQueryData
+    // hands the next viewer the previous session's payload.
+    const lastRemoval = Math.max(...removeQueries.mock.invocationCallOrder)
+    expect(lastRemoval).toBeLessThan(invalidate.mock.invocationCallOrder[0])
+  })
+
   it('seeds the form mode from autoOpenSignin', () => {
     render(<PortalAccessGate {...baseProps} autoOpenSignin="signup" />)
     expect(formProps.mode).toBe('signup')
diff --git a/apps/web/src/components/portal/__tests__/portal-access-gate.two-factor-abandon.test.tsx b/apps/web/src/components/portal/__tests__/portal-access-gate.two-factor-abandon.test.tsx
index 52c5dfec36..573f96a417 100644
--- a/apps/web/src/components/portal/__tests__/portal-access-gate.two-factor-abandon.test.tsx
+++ b/apps/web/src/components/portal/__tests__/portal-access-gate.two-factor-abandon.test.tsx
@@ -10,7 +10,7 @@ vi.mock('@tanstack/react-router', async (orig) => ({
 }))
 
 vi.mock('@tanstack/react-query', () => ({
-  useQueryClient: () => ({ invalidateQueries: vi.fn() }),
+  useQueryClient: () => ({ invalidateQueries: vi.fn(), removeQueries: vi.fn() }),
 }))
 
 // Hoisted so the spy exists when the (hoisted) mock factory runs.
diff --git a/apps/web/src/components/portal/portal-access-gate.tsx b/apps/web/src/components/portal/portal-access-gate.tsx
index 594b2bd125..6ef12d26ce 100644
--- a/apps/web/src/components/portal/portal-access-gate.tsx
+++ b/apps/web/src/components/portal/portal-access-gate.tsx
@@ -18,6 +18,7 @@ import { useQueryClient } from '@tanstack/react-query'
 import { FormattedMessage } from 'react-intl'
 import { toast } from 'sonner'
 import { escapeInlineStyle } from '@/lib/shared/safe-inline-content'
+import { removeViewerScopedPortalQueries } from '@/lib/client/queries/portal'
 import {
   ArrowPathIcon,
   ChevronUpIcon,
@@ -407,6 +408,8 @@ function GateCard({
   useAuthBroadcast({
     onSuccess: () => {
       setSigningIn(true)
+      // Anything cached while gated was fetched as the previous viewer.
+      removeViewerScopedPortalQueries(queryClient)
       if (safeCallback) {
         // Team surfaces full-navigate (re-bootstrap the admin shell); a
         // portal-local destination invalidates so the gate clears, then routes.
@@ -436,8 +439,8 @@ function GateCard({
     setSigningOut(true)
     try {
       await signOut()
+      removeViewerScopedPortalQueries(queryClient)
       await Promise.all([
-        queryClient.invalidateQueries({ queryKey: ['portal', 'post'] }),
         queryClient.invalidateQueries({ queryKey: ['votedPosts'] }),
         router.invalidate(),
       ])
diff --git a/apps/web/src/components/public/__tests__/comment-form.test.tsx b/apps/web/src/components/public/__tests__/comment-form.test.tsx
new file mode 100644
index 0000000000..77e6c93a91
--- /dev/null
+++ b/apps/web/src/components/public/__tests__/comment-form.test.tsx
@@ -0,0 +1,114 @@
+// @vitest-environment happy-dom
+/**
+ * Upstream #520 ("per-tag portal visibility") made the default comment
+ * composer drop the viewer-scoped react-query caches when the commenter
+ * signs out, so a team member's internal-tag view cannot leak into the next
+ * anonymous visitor's read of the same thread.
+ *
+ * Contract for this suite:
+ *
+ * V1 A signed-in, non-anonymous commenter sees "Posting as <name>" and a
+ *    "sign out" control, and the wording comes from the catalogue rather than
+ *    the English text baked into the source — proven under German, since an
+ *    English render looks identical whether or not the catalogue was
+ *    consulted.
+ * V2 Clicking "sign out" calls `signOut` with a success callback, and once
+ *    that callback runs, every viewer-scoped portal query is gone from the
+ *    cache while an unrelated query is untouched.
+ * V3 After signing out, the router is told to invalidate, so the surrounding
+ *    loaders rebuild against the fresh (now anonymous) session instead of
+ *    serving back the team-scoped data they already hold.
+ */
+import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest'
+import { screen, fireEvent, cleanup, waitFor } from '@testing-library/react'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { renderInGerman } from '@/test/render-with-intl'
+import type { PostId } from '@quackback/ids'
+
+interface SignOutOptions {
+  fetchOptions: { onSuccess: () => void }
+}
+
+// vi.hoisted so these are ready before the vi.mock factories below run.
+const { mockSignOut, mockInvalidate, mockRouteContext } = vi.hoisted(() => ({
+  mockSignOut: vi.fn((options: SignOutOptions) => {
+    options.fetchOptions.onSuccess()
+    return Promise.resolve()
+  }),
+  mockInvalidate: vi.fn(),
+  mockRouteContext: vi.fn(),
+}))
+
+vi.mock('@/lib/client/auth-client', () => ({
+  signOut: mockSignOut,
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  useRouter: () => ({ invalidate: mockInvalidate }),
+  useRouteContext: () => mockRouteContext(),
+}))
+
+vi.mock('@/lib/client/hooks/use-auth-broadcast', () => ({
+  useAuthBroadcast: () => {},
+}))
+
+vi.mock('@/components/ui/rich-text-editor', () => ({
+  RichTextEditor: () => <textarea data-testid="comment-editor" />,
+}))
+
+import { CommentForm } from '../comment-form'
+import { VIEWER_SCOPED_PORTAL_QUERY_KEYS } from '@/lib/client/queries/portal'
+
+function renderCommentForm(queryClient: QueryClient) {
+  return renderInGerman(
+    <QueryClientProvider client={queryClient}>
+      <CommentForm postId={'post_1' as PostId} />
+    </QueryClientProvider>
+  )
+}
+
+describe('CommentForm — sign-out cache hygiene', () => {
+  beforeEach(() => {
+    mockSignOut.mockClear()
+    mockInvalidate.mockClear()
+    mockRouteContext.mockReturnValue({
+      session: {
+        user: { name: 'Ada Lovelace', email: 'ada@example.com', principalType: 'user' },
+      },
+    })
+  })
+
+  afterEach(() => cleanup())
+
+  it('shows "Posting as <name>" and a German sign-out control for a signed-in commenter (V1)', () => {
+    renderCommentForm(new QueryClient())
+
+    const signOutButton = screen.getByRole('button', { name: 'abmelden' })
+    const paragraph = signOutButton.closest('p')
+    expect(paragraph?.textContent).toContain('Sie kommentieren als')
+    expect(paragraph?.textContent).toContain('Ada Lovelace')
+  })
+
+  it('signing out drops the viewer-scoped portal caches and refreshes the route (V2, V3)', async () => {
+    const queryClient = new QueryClient()
+    const [scopedKey] = VIEWER_SCOPED_PORTAL_QUERY_KEYS
+    queryClient.setQueryData(scopedKey, ['internal-tag'])
+    queryClient.setQueryData(['votedPosts'], ['post_1'])
+
+    renderCommentForm(queryClient)
+
+    fireEvent.click(screen.getByRole('button', { name: 'abmelden' }))
+
+    // (V2) signOut is called with a fetchOptions.onSuccess the real client
+    // invokes once the sign-out request completes.
+    expect(mockSignOut).toHaveBeenCalledWith(
+      expect.objectContaining({
+        fetchOptions: expect.objectContaining({ onSuccess: expect.any(Function) }),
+      })
+    )
+    await waitFor(() => expect(queryClient.getQueryData(scopedKey)).toBeUndefined())
+    expect(queryClient.getQueryData(['votedPosts'])).toEqual(['post_1'])
+    // (V3)
+    await waitFor(() => expect(mockInvalidate).toHaveBeenCalled())
+  })
+})
diff --git a/apps/web/src/components/public/__tests__/portal-header-help-links.test.tsx b/apps/web/src/components/public/__tests__/portal-header-help-links.test.tsx
index 31e0d2d707..5a3ac5f301 100644
--- a/apps/web/src/components/public/__tests__/portal-header-help-links.test.tsx
+++ b/apps/web/src/components/public/__tests__/portal-header-help-links.test.tsx
@@ -46,7 +46,7 @@ vi.mock('@/components/auth/oauth-buttons', () => ({
 
 vi.mock('@tanstack/react-query', () => ({
   useQuery: () => ({ data: null }),
-  useQueryClient: () => ({ invalidateQueries: vi.fn() }),
+  useQueryClient: () => ({ invalidateQueries: vi.fn(), removeQueries: vi.fn() }),
 }))
 
 vi.mock('@/lib/server/functions/conversation', () => ({
diff --git a/apps/web/src/components/public/__tests__/portal-header.test.tsx b/apps/web/src/components/public/__tests__/portal-header.test.tsx
index 91ef8fc593..ca187deb13 100644
--- a/apps/web/src/components/public/__tests__/portal-header.test.tsx
+++ b/apps/web/src/components/public/__tests__/portal-header.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment happy-dom
 import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest'
-import { render, screen, fireEvent, cleanup } from '@testing-library/react'
+import { render, screen, fireEvent, cleanup, act } from '@testing-library/react'
 import { IntlProvider } from 'react-intl'
 import { GermanIntlWrapper } from '@/test/render-with-intl'
 
@@ -13,6 +13,9 @@ const {
   mockResolveSole,
   mockHasAny,
   mockHasDistinctSignup,
+  mockInvalidateQueries,
+  mockRemoveQueries,
+  mockSignOut,
 } = vi.hoisted(() => ({
   mockGetRouteContext: vi.fn(),
   mockOpenAuthPopover: vi.fn(),
@@ -20,6 +23,9 @@ const {
   mockResolveSole: vi.fn((): string | null => null),
   mockHasAny: vi.fn((): boolean => false),
   mockHasDistinctSignup: vi.fn((): boolean => true),
+  mockInvalidateQueries: vi.fn(() => Promise.resolve()),
+  mockRemoveQueries: vi.fn(() => Promise.resolve()),
+  mockSignOut: vi.fn(() => Promise.resolve()),
 }))
 
 vi.mock('@tanstack/react-router', () => ({
@@ -60,19 +66,27 @@ vi.mock('@/components/auth/oauth-buttons', () => ({
 
 vi.mock('@tanstack/react-query', () => ({
   useQuery: () => ({ data: null }),
-  useQueryClient: () => ({ invalidateQueries: vi.fn() }),
+  useQueryClient: () => ({
+    invalidateQueries: mockInvalidateQueries,
+    removeQueries: mockRemoveQueries,
+  }),
 }))
 
 vi.mock('@/lib/server/functions/conversation', () => ({
   getMyConversationsFn: vi.fn(),
 }))
 
+// Captures the header's broadcast onSuccess so a test can play the
+// "signed in from another tab" event without a BroadcastChannel.
+let broadcastOnSuccess: (() => void) | undefined
 vi.mock('@/lib/client/hooks/use-auth-broadcast', () => ({
-  useAuthBroadcast: () => {},
+  useAuthBroadcast: (opts: { onSuccess?: () => void }) => {
+    broadcastOnSuccess = opts.onSuccess
+  },
 }))
 
 vi.mock('@/lib/client/auth-client', () => ({
-  signOut: vi.fn(),
+  signOut: mockSignOut,
   authClient: { signIn: { oauth2: mockOauth2 } },
 }))
 
@@ -85,6 +99,7 @@ vi.mock('@/components/shared/user-stats', () => ({
 }))
 
 import { PortalHeader } from '../portal-header'
+import { VIEWER_SCOPED_PORTAL_QUERY_KEYS } from '@/lib/client/queries/portal'
 
 const loggedInSession = {
   user: {
@@ -142,6 +157,43 @@ describe('PortalHeader — Admin dropdown item', () => {
   })
 })
 
+describe('PortalHeader — sign-out cache hygiene', () => {
+  beforeEach(() => {
+    mockInvalidateQueries.mockClear()
+    mockRemoveQueries.mockClear()
+    mockSignOut.mockClear()
+    broadcastOnSuccess = undefined
+  })
+  afterEach(() => cleanup())
+
+  it('removes (not merely invalidates) every viewer-scoped cache so internal tags do not outlive a team session', async () => {
+    renderHeader({ userRole: 'admin', isLoggedIn: true })
+    fireEvent.pointerDown(screen.getByRole('button'), { button: 0, ctrlKey: false })
+    fireEvent.click(await screen.findByRole('menuitem', { name: /log out|sign out/i }))
+    await vi.waitFor(() => expect(mockSignOut).toHaveBeenCalled())
+
+    // Loaders read through ensureQueryData, which serves retained-but-stale
+    // data, and a reset would restore initialData; only removal actually
+    // drops the team-scoped payloads.
+    await vi.waitFor(() => {
+      const removedKeys = mockRemoveQueries.mock.calls.map(
+        (call) => (call as unknown as [{ queryKey: unknown[] }])[0].queryKey
+      )
+      expect(removedKeys).toEqual(expect.arrayContaining([...VIEWER_SCOPED_PORTAL_QUERY_KEYS]))
+    })
+    expect(VIEWER_SCOPED_PORTAL_QUERY_KEYS).toEqual(
+      expect.arrayContaining([
+        ['portal', 'tags'],
+        ['portal', 'data'],
+        ['portal', 'post'],
+        ['portal', 'roadmaps'],
+        ['portal', 'roadmapPosts'],
+        ['publicPosts'],
+      ])
+    )
+  })
+})
+
 describe('PortalHeader — single-IdP redirect', () => {
   beforeEach(() => {
     mockOpenAuthPopover.mockClear()
@@ -237,4 +289,16 @@ describe('PortalHeader — Sign up button visibility', () => {
     expect(screen.getByRole('button', { name: /log in/i })).toBeInTheDocument()
     expect(screen.queryByRole('button', { name: /sign up/i })).toBeNull()
   })
+  it('a sign-in completed in another tab drops the viewer-scoped caches so a team member gains internal tags', () => {
+    renderHeader({ userRole: null, isLoggedIn: false })
+    expect(broadcastOnSuccess).toBeDefined()
+
+    act(() => broadcastOnSuccess?.())
+
+    const removedKeys = mockRemoveQueries.mock.calls.map(
+      (call) => (call as unknown as [{ queryKey: unknown[] }])[0].queryKey
+    )
+    expect(removedKeys).toEqual(expect.arrayContaining([...VIEWER_SCOPED_PORTAL_QUERY_KEYS]))
+    expect(mockInvalidateQueries).toHaveBeenCalledWith({ queryKey: ['votedPosts'] })
+  })
 })
diff --git a/apps/web/src/components/public/comment-form.tsx b/apps/web/src/components/public/comment-form.tsx
index a2c01c4c3f..7ded588bef 100644
--- a/apps/web/src/components/public/comment-form.tsx
+++ b/apps/web/src/components/public/comment-form.tsx
@@ -1,7 +1,7 @@
 import { useRef, useState } from 'react'
 import { useIntl } from 'react-intl'
 import { useForm } from 'react-hook-form'
-import type { UseMutationResult } from '@tanstack/react-query'
+import { useQueryClient, type UseMutationResult } from '@tanstack/react-query'
 import { standardSchemaResolver } from '@hookform/resolvers/standard-schema'
 import { commentSchema, type CommentInput } from '@/lib/shared/schemas/comments'
 import { Button } from '@/components/ui/button'
@@ -18,6 +18,7 @@ import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@/comp
 import { StatusBadge } from '@/components/ui/status-badge'
 import { CheckIcon, LockClosedIcon } from '@heroicons/react/24/solid'
 import { signOut } from '@/lib/client/auth-client'
+import { removeViewerScopedPortalQueries } from '@/lib/client/queries/portal'
 import { useRouter, useRouteContext } from '@tanstack/react-router'
 import { useAuthBroadcast } from '@/lib/client/hooks/use-auth-broadcast'
 import { cn } from '@/lib/shared/utils'
@@ -77,6 +78,7 @@ export function CommentForm({
 }: CommentFormProps) {
   const intl = useIntl()
   const router = useRouter()
+  const queryClient = useQueryClient()
   const { session } = useRouteContext({ from: '__root__' })
   const [error, setError] = useState<string | null>(null)
   const [selectedStatusId, setSelectedStatusId] = useState<string | null>(null)
@@ -505,6 +507,7 @@ export function CommentForm({
                     signOut({
                       fetchOptions: {
                         onSuccess: () => {
+                          removeViewerScopedPortalQueries(queryClient)
                           router.invalidate()
                         },
                       },
diff --git a/apps/web/src/components/public/feedback/__tests__/feedback-header-animated.test.tsx b/apps/web/src/components/public/feedback/__tests__/feedback-header-animated.test.tsx
new file mode 100644
index 0000000000..59e69310e2
--- /dev/null
+++ b/apps/web/src/components/public/feedback/__tests__/feedback-header-animated.test.tsx
@@ -0,0 +1,188 @@
+// @vitest-environment happy-dom
+/**
+ * Upstream #520 ("per-tag portal visibility") made the animated feedback
+ * header drop the viewer-scoped react-query caches when the poster signs
+ * out, so a team member's internal-tag view cannot leak into the next
+ * anonymous visitor's read of the same board.
+ *
+ * Contract for this suite:
+ *
+ * V1 A signed-in, non-anonymous poster sees "Posting as <name>" and a
+ *    "sign out" control, and the wording comes from the catalogue rather than
+ *    the English text baked into the source — proven under German, since an
+ *    English render looks identical whether or not the catalogue was
+ *    consulted.
+ * V2 Clicking "sign out" awaits `signOut`, and once it resolves, every
+ *    viewer-scoped portal query is gone from the cache while an unrelated
+ *    query is untouched.
+ * V3 After signing out, the router is told to invalidate, so the surrounding
+ *    loaders rebuild against the fresh (now anonymous) session instead of
+ *    serving back the team-scoped data they already hold.
+ */
+import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest'
+import { screen, fireEvent, cleanup, waitFor } from '@testing-library/react'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { renderInGerman } from '@/test/render-with-intl'
+import type { ComponentProps, ReactNode } from 'react'
+
+// vi.hoisted so these are ready before the vi.mock factories below run.
+const { mockSignOut, mockInvalidate, mockRouteContext } = vi.hoisted(() => ({
+  mockSignOut: vi.fn(() => Promise.resolve(undefined)),
+  mockInvalidate: vi.fn(),
+  mockRouteContext: vi.fn(),
+}))
+
+vi.mock('@/lib/client/auth-client', () => ({
+  signOut: mockSignOut,
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  useRouter: () => ({ invalidate: mockInvalidate }),
+  useRouteContext: () => mockRouteContext(),
+}))
+
+vi.mock('@/lib/client/hooks/use-auth-broadcast', () => ({
+  useAuthBroadcast: () => {},
+}))
+
+vi.mock('@/components/ui/rich-text-editor', () => ({
+  RichTextEditor: () => <textarea data-testid="feedback-editor" />,
+}))
+
+vi.mock('sonner', () => ({
+  toast: { success: vi.fn() },
+}))
+
+vi.mock('@/lib/client/hooks/use-image-upload', () => ({
+  usePortalImageUpload: () => ({ upload: vi.fn() }),
+}))
+
+vi.mock('@/lib/client/mutations/portal-posts', () => ({
+  useCreatePublicPost: () => ({ mutateAsync: vi.fn(), isPending: false }),
+}))
+
+vi.mock('@/components/auth/auth-popover-context', () => ({
+  useAuthPopover: () => ({ openAuthPopover: vi.fn() }),
+}))
+
+vi.mock('@/lib/client/hooks/use-similar-posts', () => ({
+  useSimilarPosts: () => ({ posts: [] }),
+}))
+
+vi.mock('@/lib/client/hooks/use-ensure-anon-session', () => ({
+  useEnsureAnonSession: () => vi.fn(() => Promise.resolve(true)),
+}))
+
+// The header nests motion.div/motion.input inside AnimatePresence; neither
+// animates in happy-dom, and both would otherwise pass unknown `initial` /
+// `animate` / `exit` / `transition` props straight onto the DOM node.
+vi.mock('framer-motion', () => {
+  function MotionDiv({
+    children,
+    initial: _initial,
+    animate: _animate,
+    exit: _exit,
+    transition: _transition,
+    ...rest
+  }: ComponentProps<'div'> & {
+    initial?: unknown
+    animate?: unknown
+    exit?: unknown
+    transition?: unknown
+  }) {
+    return <div {...rest}>{children}</div>
+  }
+
+  function MotionInput({
+    initial: _initial,
+    animate: _animate,
+    exit: _exit,
+    transition: _transition,
+    ...rest
+  }: ComponentProps<'input'> & {
+    initial?: unknown
+    animate?: unknown
+    exit?: unknown
+    transition?: unknown
+  }) {
+    return <input {...rest} />
+  }
+
+  return {
+    motion: { div: MotionDiv, input: MotionInput },
+    AnimatePresence: ({ children }: { children: ReactNode }) => <>{children}</>,
+  }
+})
+
+import { FeedbackHeaderAnimated } from '../feedback-header-animated'
+import { VIEWER_SCOPED_PORTAL_QUERY_KEYS } from '@/lib/client/queries/portal'
+
+function renderHeader(queryClient: QueryClient) {
+  return renderInGerman(
+    <QueryClientProvider client={queryClient}>
+      <FeedbackHeaderAnimated
+        workspaceName="Acme"
+        boards={[]}
+        defaultBoardId="board_1"
+        boardPermissions={{ board_1: { canSubmit: true, canVote: true } }}
+      />
+    </QueryClientProvider>
+  )
+}
+
+/**
+ * The sign-out footer only renders once the composer is expanded, which
+ * happens on the title input's onChange handler. `boards={[]}` above keeps
+ * the board-picker and custom-field sections from mounting at all, so
+ * expanding needs nothing beyond typing a short title (short so
+ * `SimilarPostsCard`'s `show` stays false).
+ */
+function expandComposer(container: HTMLElement) {
+  const titleInput = container.querySelector('input[type="text"]') as HTMLInputElement
+  fireEvent.change(titleInput, { target: { value: 'A' } })
+}
+
+describe('FeedbackHeaderAnimated — sign-out cache hygiene', () => {
+  beforeEach(() => {
+    mockSignOut.mockClear()
+    mockInvalidate.mockClear()
+    mockRouteContext.mockReturnValue({
+      session: {
+        user: { name: 'Ada Lovelace', email: 'ada@example.com', principalType: 'user' },
+      },
+    })
+  })
+
+  afterEach(() => cleanup())
+
+  it('shows "Posting as <name>" and a German sign-out control for a signed-in poster (V1)', async () => {
+    const { container } = renderHeader(new QueryClient())
+    expandComposer(container)
+
+    const signOutButton = await screen.findByRole('button', { name: 'abmelden' })
+    const paragraph = signOutButton.closest('p')
+    expect(paragraph?.textContent).toContain('Sie posten als')
+    expect(paragraph?.textContent).toContain('Ada Lovelace')
+  })
+
+  it('signing out drops the viewer-scoped portal caches and refreshes the route (V2, V3)', async () => {
+    const queryClient = new QueryClient()
+    const [scopedKey] = VIEWER_SCOPED_PORTAL_QUERY_KEYS
+    queryClient.setQueryData(scopedKey, ['internal-tag'])
+    queryClient.setQueryData(['votedPosts'], ['post_1'])
+
+    const { container } = renderHeader(queryClient)
+    expandComposer(container)
+
+    const signOutButton = await screen.findByRole('button', { name: 'abmelden' })
+    fireEvent.click(signOutButton)
+
+    expect(mockSignOut).toHaveBeenCalled()
+    // (V2) The reset runs after `await signOut()` resolves, in a microtask
+    // this test has to wait for rather than assert on synchronously.
+    await waitFor(() => expect(queryClient.getQueryData(scopedKey)).toBeUndefined())
+    expect(queryClient.getQueryData(['votedPosts'])).toEqual(['post_1'])
+    // (V3)
+    await waitFor(() => expect(mockInvalidate).toHaveBeenCalled())
+  })
+})
diff --git a/apps/web/src/components/public/feedback/feedback-header-animated.tsx b/apps/web/src/components/public/feedback/feedback-header-animated.tsx
index 7edac97adf..18142cefbc 100644
--- a/apps/web/src/components/public/feedback/feedback-header-animated.tsx
+++ b/apps/web/src/components/public/feedback/feedback-header-animated.tsx
@@ -3,6 +3,7 @@ import { useState, useCallback, useEffect, useRef } from 'react'
 import { useIntl, FormattedMessage } from 'react-intl'
 import { useKeyboardSubmit } from '@/lib/client/hooks/use-keyboard-submit'
 import { useRouter, useRouteContext } from '@tanstack/react-router'
+import { useQueryClient } from '@tanstack/react-query'
 import { toast } from 'sonner'
 import { motion, AnimatePresence } from 'framer-motion'
 import { PencilIcon } from '@heroicons/react/24/solid'
@@ -20,6 +21,7 @@ import { PostingToBoard } from '@/components/public/feedback/posting-to-board'
 import { validatePostCustomFieldValues } from '@/lib/shared/post-custom-fields'
 import type { BoardSettings } from '@/lib/shared/db-types'
 import { signOut } from '@/lib/client/auth-client'
+import { removeViewerScopedPortalQueries } from '@/lib/client/queries/portal'
 import { resolveSubmitState } from '@/components/public/feedback/submit-permission'
 import type { JSONContent } from '@tiptap/react'
 
@@ -60,6 +62,7 @@ export function FeedbackHeaderAnimated({
 }: FeedbackHeaderProps) {
   const intl = useIntl()
   const router = useRouter()
+  const queryClient = useQueryClient()
   const { session } = useRouteContext({ from: '__root__' })
   const [expanded, setExpanded] = useState(false)
   const [error, setError] = useState('')
@@ -439,6 +442,7 @@ export function FeedbackHeaderAnimated({
                     className="text-primary hover:underline"
                     onClick={async () => {
                       await signOut()
+                      removeViewerScopedPortalQueries(queryClient)
                       router.invalidate()
                     }}
                   >
diff --git a/apps/web/src/components/public/portal-header.tsx b/apps/web/src/components/public/portal-header.tsx
index 03d858cddd..d3080e217a 100644
--- a/apps/web/src/components/public/portal-header.tsx
+++ b/apps/web/src/components/public/portal-header.tsx
@@ -40,6 +40,7 @@ import {
 import { useQuery, useQueryClient } from '@tanstack/react-query'
 import { getMyConversationsFn } from '@/lib/server/functions/conversation'
 import { PORTAL_MY_CONVERSATIONS_QUERY_KEY } from '@/lib/client/queries/portal-support'
+import { removeViewerScopedPortalQueries } from '@/lib/client/queries/portal'
 import { useAuthBroadcast } from '@/lib/client/hooks/use-auth-broadcast'
 import { NotificationBell } from '@/components/notifications'
 
@@ -146,9 +147,10 @@ export function PortalHeader({
   // Listen for auth success to refetch session and role via router invalidation
   useAuthBroadcast({
     onSuccess: () => {
-      // Invalidate user-scoped queries so reaction highlights and vote data refresh
-      queryClient.invalidateQueries({ queryKey: ['portal', 'post'] })
+      // Refresh vote highlights and drop viewer-scoped data (post detail,
+      // feed, tag catalog) so a team sign-in gains internal tags.
       queryClient.invalidateQueries({ queryKey: ['votedPosts'] })
+      removeViewerScopedPortalQueries(queryClient)
       // Refetch loaders (includes session and userRole) for the new session.
       void router.invalidate()
     },
@@ -201,9 +203,10 @@ export function PortalHeader({
 
   const handleSignOut = async () => {
     await signOut()
-    // Clear user-scoped caches so stale reaction/vote highlights don't persist
-    queryClient.invalidateQueries({ queryKey: ['portal', 'post'] })
+    // Clear user-scoped caches: vote highlights, and every viewer-scoped
+    // payload (a team member's internal tags must not outlive their session).
     queryClient.invalidateQueries({ queryKey: ['votedPosts'] })
+    removeViewerScopedPortalQueries(queryClient)
     router.invalidate() // Refetch session
     router.navigate({ to: '/' })
   }
diff --git a/apps/web/src/lib/client/queries/portal-viewer-scope.test.ts b/apps/web/src/lib/client/queries/portal-viewer-scope.test.ts
new file mode 100644
index 0000000000..1a30580abc
--- /dev/null
+++ b/apps/web/src/lib/client/queries/portal-viewer-scope.test.ts
@@ -0,0 +1,104 @@
+import { describe, expect, it, vi } from 'vitest'
+import { QueryClient } from '@tanstack/react-query'
+
+vi.mock('@/lib/server/functions/portal', () => ({
+  fetchPublicBoards: vi.fn(),
+  fetchPublicPosts: vi.fn(),
+  fetchPublicStatuses: vi.fn(),
+  fetchPublicTags: vi.fn(),
+  fetchAvatars: vi.fn(),
+  fetchPublicRoadmaps: vi.fn(),
+  fetchPublicRoadmapPosts: vi.fn(),
+  fetchPortalData: vi.fn(),
+}))
+
+import { removeViewerScopedPortalQueries, VIEWER_SCOPED_PORTAL_QUERY_KEYS } from './portal'
+
+const teamCatalog = [{ id: 'tag_internal', name: 'Churn risk', isPublic: false }]
+const anonymousCatalog: unknown[] = []
+const teamFeedPage = { pages: [{ items: [{ id: 'post_1', tags: teamCatalog }] }], pageParams: [1] }
+const feedKey = ['publicPosts', 'list', { sort: 'trending' }]
+
+function newClient() {
+  return new QueryClient({ defaultOptions: { queries: { retry: false } } })
+}
+
+/** Mirrors usePublicPosts seeding an inactive feed query from the SSR payload. */
+function buildFeedQueryWithInitialData(queryClient: QueryClient) {
+  return queryClient
+    .getQueryCache()
+    .build(queryClient, { queryKey: feedKey, initialData: teamFeedPage, queryFn: async () => null })
+}
+
+describe('removeViewerScopedPortalQueries', () => {
+  it('drops retained data so a later ensureQueryData refetches as the new viewer', async () => {
+    const queryClient = newClient()
+    // Team member loaded the portal: tag catalog (with an internal tag), the
+    // feed, a roadmap column filtered by that tag and a post detail are cached,
+    // then become inactive.
+    queryClient.setQueryData(['portal', 'tags'], teamCatalog)
+    queryClient.setQueryData(
+      ['portal', 'roadmapPosts', 'rm_1', 'st_1', { tags: ['tag_internal'] }],
+      { items: [{ id: 'post_1' }] }
+    )
+    queryClient.setQueryData(['portal', 'post', 'post_1'], { tags: teamCatalog })
+    queryClient.setQueryData(
+      ['portal', 'roadmaps'],
+      [{ id: 'rm_1', baseFilter: { tagIds: ['tag_internal'] } }]
+    )
+    buildFeedQueryWithInitialData(queryClient)
+
+    removeViewerScopedPortalQueries(queryClient)
+
+    for (const key of VIEWER_SCOPED_PORTAL_QUERY_KEYS) {
+      expect(
+        queryClient.getQueryCache().findAll({ queryKey: key }),
+        `${key.join('/')} still cached`
+      ).toEqual([])
+    }
+
+    // The next loader read goes to the network instead of serving the team copy.
+    const queryFn = vi.fn(async () => anonymousCatalog)
+    const served = await queryClient.ensureQueryData({ queryKey: ['portal', 'tags'], queryFn })
+    expect(queryFn).toHaveBeenCalledTimes(1)
+    expect(served).toBe(anonymousCatalog)
+  })
+
+  it('guards against invalidateQueries, which leaves the team catalog servable', async () => {
+    const queryClient = newClient()
+    queryClient.setQueryData(['portal', 'tags'], teamCatalog)
+
+    await queryClient.invalidateQueries({ queryKey: ['portal', 'tags'] })
+
+    const queryFn = vi.fn(async () => anonymousCatalog)
+    const served = await queryClient.ensureQueryData({ queryKey: ['portal', 'tags'], queryFn })
+    expect(served).toBe(teamCatalog)
+    expect(queryFn).not.toHaveBeenCalled()
+  })
+
+  it('guards against resetQueries, which restores a feed page seeded via initialData', async () => {
+    const queryClient = newClient()
+    const query = buildFeedQueryWithInitialData(queryClient)
+    expect(query.state.data).toEqual(teamFeedPage)
+
+    await queryClient.resetQueries({ queryKey: ['publicPosts'] })
+    expect(queryClient.getQueryData(feedKey)).toEqual(teamFeedPage)
+
+    removeViewerScopedPortalQueries(queryClient)
+    expect(queryClient.getQueryData(feedKey)).toBeUndefined()
+  })
+
+  it('covers every family whose payload depends on the viewer', () => {
+    expect(VIEWER_SCOPED_PORTAL_QUERY_KEYS).toEqual(
+      expect.arrayContaining([
+        ['portal', 'tags'],
+        ['portal', 'data'],
+        ['portal', 'posts'],
+        ['portal', 'post'],
+        ['portal', 'roadmaps'],
+        ['portal', 'roadmapPosts'],
+        ['publicPosts'],
+      ])
+    )
+  })
+})
diff --git a/apps/web/src/lib/client/queries/portal.ts b/apps/web/src/lib/client/queries/portal.ts
index a3af49ba43..851638ecc8 100644
--- a/apps/web/src/lib/client/queries/portal.ts
+++ b/apps/web/src/lib/client/queries/portal.ts
@@ -1,4 +1,4 @@
-import { queryOptions } from '@tanstack/react-query'
+import { queryOptions, type QueryClient } from '@tanstack/react-query'
 import type { PrincipalId, RoadmapId, PostStatusId, BoardId } from '@quackback/ids'
 import type { RespondedFilter } from '@/lib/shared/types/filters'
 import {
@@ -12,6 +12,46 @@ import {
   fetchPortalData,
 } from '@/lib/server/functions/portal'
 
+/**
+ * Query families whose payload depends on who the viewer is: the tag catalog
+ * hides internal tags from non-team viewers; portal data, the infinite feed
+ * (`publicPostsKeys`, see use-portal-posts-query), post lists and post detail
+ * embed that filtered catalog; public roadmap results honour the same guard
+ * for caller-supplied tag filters; and the roadmap catalog's `baseFilter` has
+ * internal tag ids redacted for non-team viewers.
+ */
+export const VIEWER_SCOPED_PORTAL_QUERY_KEYS: readonly (readonly string[])[] = [
+  ['portal', 'tags'],
+  ['portal', 'data'],
+  ['portal', 'posts'],
+  ['portal', 'post'],
+  ['portal', 'roadmaps'],
+  ['portal', 'roadmapPosts'],
+  ['publicPosts'],
+]
+
+/**
+ * Remove every viewer-scoped portal cache entry on an auth transition, so a
+ * team member signing out does not keep seeing internal tags and a team member
+ * signing in gains them.
+ *
+ * This must *remove*, not invalidate or reset: `invalidateQueries` keeps the
+ * data and route loaders read it back through `ensureQueryData` without
+ * waiting for a refetch; `resetQueries` restores a query's `initialData`, and
+ * the feed (`usePublicPosts`) seeds its pages from the SSR payload that way, so
+ * a reset would put the team-scoped page straight back. `removeQueries` drops
+ * the entries outright. Callers follow up with `router.invalidate()`, which
+ * re-runs loaders and re-renders observers so they rebuild against fresh
+ * queries as the new viewer.
+ *
+ * Call from every portal sign-out control and sign-in success handler.
+ */
+export function removeViewerScopedPortalQueries(queryClient: QueryClient): void {
+  for (const queryKey of VIEWER_SCOPED_PORTAL_QUERY_KEYS) {
+    queryClient.removeQueries({ queryKey })
+  }
+}
+
 /**
  * Query options factory for portal/public routes.
  * Uses server functions (createServerFn) to keep database code server-only.
diff --git a/apps/web/src/lib/server/domains/api/schemas/tags.ts b/apps/web/src/lib/server/domains/api/schemas/tags.ts
index 7953c108c6..0218242af0 100644
--- a/apps/web/src/lib/server/domains/api/schemas/tags.ts
+++ b/apps/web/src/lib/server/domains/api/schemas/tags.ts
@@ -19,10 +19,17 @@ import {
 } from './common'
 
 // PostTag schema
+const IsPublicSchema = z.boolean().meta({
+  description:
+    'Whether customers can see this tag on the public portal. False keeps the tag internal to your team.',
+  example: true,
+})
+
 const TagSchema = z.object({
   id: TypeIdSchema.meta({ example: 'post_tag_01h455vb4pex5vsknk084sn02q' }),
   name: z.string().meta({ example: 'Bug' }),
   color: HexColorSchema.meta({ example: '#ef4444' }),
+  isPublic: IsPublicSchema,
   createdAt: TimestampSchema,
 })
 
@@ -31,6 +38,7 @@ const CreateTagSchema = z
   .object({
     name: z.string().min(1).max(50).meta({ description: 'PostTag name', example: 'Bug' }),
     color: HexColorSchema.optional().meta({ description: 'PostTag color', default: '#6b7280' }),
+    isPublic: IsPublicSchema.optional().meta({ default: true }),
   })
   .meta({ description: 'Create tag request body' })
 
@@ -38,6 +46,7 @@ const UpdateTagSchema = z
   .object({
     name: z.string().min(1).max(50).optional(),
     color: HexColorSchema.optional(),
+    isPublic: IsPublicSchema.optional(),
   })
   .meta({ description: 'Update tag request body' })
 
diff --git a/apps/web/src/lib/server/domains/export/__tests__/entities.test.ts b/apps/web/src/lib/server/domains/export/__tests__/entities.test.ts
index 007e4e5110..c9fea4ca06 100644
--- a/apps/web/src/lib/server/domains/export/__tests__/entities.test.ts
+++ b/apps/web/src/lib/server/domains/export/__tests__/entities.test.ts
@@ -42,7 +42,7 @@ vi.mock('@/lib/server/domains/companies', () => ({
   listCompanies: vi.fn(),
 }))
 
-import { boardsExporter } from '../entities/taxonomy'
+import { boardsExporter, tagsExporter } from '../entities/taxonomy'
 import { postsExporter } from '../entities/posts'
 import { commentsExporter } from '../entities/comments'
 import { votesExporter } from '../entities/votes'
@@ -181,10 +181,40 @@ describe('kbArticlesExporter.serialize', () => {
   })
 })
 
+describe('tagsExporter.serialize', () => {
+  it('writes the portal visibility as the last column so an internal tag survives an export and re-import', () => {
+    const internalTag = {
+      id: 'tag_1',
+      name: 'Churn risk',
+      color: '#ff0000',
+      description: 'Only the team sees this',
+      isPublic: false,
+    }
+    expect(tagsExporter.header).toBe('id,name,color,description,is_public')
+    expect(tagsExporter.serialize(internalTag as never)).toBe(
+      'tag_1,"Churn risk",#ff0000,"Only the team sees this",false'
+    )
+  })
+
+  it('a tag shown on the portal reads true', () => {
+    const publicTag = {
+      id: 'tag_2',
+      name: 'Bug',
+      color: '#00ff00',
+      description: 'Something is broken',
+      isPublic: true,
+    }
+    expect(tagsExporter.serialize(publicTag as never)).toBe(
+      'tag_2,"Bug",#00ff00,"Something is broken",true'
+    )
+  })
+})
+
 describe('boardsExporter / headers', () => {
   it('every entity declares a manifest key and archive file name', () => {
     for (const entity of [
       boardsExporter,
+      tagsExporter,
       postsExporter,
       commentsExporter,
       votesExporter,
diff --git a/apps/web/src/lib/server/domains/export/entities/taxonomy.ts b/apps/web/src/lib/server/domains/export/entities/taxonomy.ts
index 603a7a95f9..0816c2e882 100644
--- a/apps/web/src/lib/server/domains/export/entities/taxonomy.ts
+++ b/apps/web/src/lib/server/domains/export/entities/taxonomy.ts
@@ -80,7 +80,7 @@ async function fetchTags(offset: number, limit: number) {
     orderBy: asc(postTags.createdAt),
     offset,
     limit,
-    columns: { id: true, name: true, color: true, description: true },
+    columns: { id: true, name: true, color: true, description: true, isPublic: true },
   })
 }
 type TagRow = Awaited<ReturnType<typeof fetchTags>>[number]
@@ -89,7 +89,10 @@ export const tagsExporter: EntityExporter<TagRow> = {
   key: 'tags',
   fileName: 'tags.csv',
   pageSize: 5000,
-  header: 'id,name,color,description',
+  header: 'id,name,color,description,is_public',
   fetchPage: fetchTags,
-  serialize: (t) => [t.id, escapeCSV(t.name), t.color, escapeCSV(t.description ?? '')].join(','),
+  serialize: (t) =>
+    [t.id, escapeCSV(t.name), t.color, escapeCSV(t.description ?? ''), String(t.isPublic)].join(
+      ','
+    ),
 }
diff --git a/apps/web/src/lib/server/domains/import/__tests__/csv-row-created-at.test.ts b/apps/web/src/lib/server/domains/import/__tests__/csv-row-created-at.test.ts
new file mode 100644
index 0000000000..2c0e94e1b7
--- /dev/null
+++ b/apps/web/src/lib/server/domains/import/__tests__/csv-row-created-at.test.ts
@@ -0,0 +1,47 @@
+/**
+ * The created_at CSV column. Contract, written before the tests:
+ *
+ * V1 A parseable timestamp is kept exactly, so imported posts keep the order
+ *    they had in the source system.
+ * V2 An unparseable timestamp falls back to the import time instead of
+ *    failing the row — a bad date must not cost the post.
+ * V3 A blank or absent column falls back to the import time the same way.
+ */
+import { describe, it, expect } from 'vitest'
+import fc from 'fast-check'
+import { csvRowSchema } from '../import-row-resolver'
+
+const baseRow = { title: 'A title', content: 'Some content', author_name: 'Ada' }
+
+describe('csvRowSchema created_at', () => {
+  it('keeps a parseable timestamp so imported posts keep their original order (V1)', () => {
+    const parsed = csvRowSchema.parse({ ...baseRow, created_at: '2024-03-05T10:15:00Z' })
+    expect(parsed.created_at.toISOString()).toBe('2024-03-05T10:15:00.000Z')
+  })
+
+  it('round-trips every ISO timestamp between 2000 and 2035 to the same instant (V1)', () => {
+    fc.assert(
+      fc.property(
+        fc.date({ min: new Date('2000-01-01T00:00:00Z'), max: new Date('2035-12-31T23:59:59Z') }),
+        (date) => {
+          const parsed = csvRowSchema.parse({ ...baseRow, created_at: date.toISOString() })
+          expect(parsed.created_at.getTime()).toBe(date.getTime())
+        }
+      )
+    )
+  })
+
+  it('falls back to the import time for an unparseable timestamp instead of failing the row (V2)', () => {
+    const before = Date.now()
+    const parsed = csvRowSchema.parse({ ...baseRow, created_at: 'last tuesday' })
+    expect(parsed.created_at.getTime()).toBeGreaterThanOrEqual(before)
+    expect(parsed.created_at.getTime()).toBeLessThanOrEqual(Date.now())
+  })
+
+  it('falls back to the import time when the column is blank (V3)', () => {
+    const before = Date.now()
+    const parsed = csvRowSchema.parse({ ...baseRow, created_at: '' })
+    expect(parsed.created_at.getTime()).toBeGreaterThanOrEqual(before)
+    expect(parsed.created_at.getTime()).toBeLessThanOrEqual(Date.now())
+  })
+})
diff --git a/apps/web/src/lib/server/domains/import/__tests__/import-email-verified.test.ts b/apps/web/src/lib/server/domains/import/__tests__/import-email-verified.test.ts
index 5c62e3a26f..450cb45f05 100644
--- a/apps/web/src/lib/server/domains/import/__tests__/import-email-verified.test.ts
+++ b/apps/web/src/lib/server/domains/import/__tests__/import-email-verified.test.ts
@@ -10,6 +10,7 @@ import {
   parseCsvEmailVerified,
   csvRowSchema,
   resolveRows,
+  AUTHOR_REQUIRED_MESSAGE,
   type RowContext,
 } from '../import-row-resolver'
 import type { ImportUserResolver } from '../user-resolver'
@@ -28,7 +29,7 @@ describe('parseCsvEmailVerified', () => {
 })
 
 describe('csvRowSchema email_verified', () => {
-  const baseRow = { title: 'A title', content: 'Some content' }
+  const baseRow = { title: 'A title', content: 'Some content', author_name: 'Ada' }
 
   it('defaults to true when the column is absent', () => {
     const parsed = csvRowSchema.parse(baseRow)
@@ -48,9 +49,39 @@ describe('csvRowSchema email_verified', () => {
   })
 })
 
-describe('resolveRows email_verified plumb', () => {
-  const FALLBACK = 'principal_fallback' as PrincipalId
+describe('csvRowSchema author', () => {
+  it('rejects a row with neither author_name nor author_email', () => {
+    const parsed = csvRowSchema.safeParse({ title: 'A title', content: 'Some content' })
+    expect(parsed.success).toBe(false)
+    if (parsed.success) return
+    expect(parsed.error.issues[0].message).toBe(AUTHOR_REQUIRED_MESSAGE)
+  })
+
+  it('rejects whitespace-only author_name without an email', () => {
+    const parsed = csvRowSchema.safeParse({
+      title: 'A title',
+      content: 'Some content',
+      author_name: '   ',
+    })
+    expect(parsed.success).toBe(false)
+  })
 
+  it('accepts author_name alone or author_email alone', () => {
+    expect(
+      csvRowSchema.safeParse({ title: 'A title', content: 'Some content', author_name: 'Ada' })
+        .success
+    ).toBe(true)
+    expect(
+      csvRowSchema.safeParse({
+        title: 'A title',
+        content: 'Some content',
+        author_email: 'ada@example.com',
+      }).success
+    ).toBe(true)
+  })
+})
+
+describe('resolveRows email_verified plumb', () => {
   function stubCtx(): RowContext {
     return {
       defaultStatusId: 'post_status_default' as PostStatusId,
@@ -87,7 +118,6 @@ describe('resolveRows email_verified plumb', () => {
       'board_1' as never,
       0,
       resolver,
-      FALLBACK,
       stubCtx(),
       new Set(),
       new Map(),
@@ -96,8 +126,8 @@ describe('resolveRows email_verified plumb', () => {
 
     expect(errors).toEqual([])
     expect(validRows).toHaveLength(3)
-    expect(resolve).toHaveBeenNthCalledWith(1, 'a@example.com', null, FALLBACK, true)
-    expect(resolve).toHaveBeenNthCalledWith(2, 'b@example.com', null, FALLBACK, false)
-    expect(resolve).toHaveBeenNthCalledWith(3, 'c@example.com', null, FALLBACK, true)
+    expect(resolve).toHaveBeenNthCalledWith(1, 'a@example.com', null, true)
+    expect(resolve).toHaveBeenNthCalledWith(2, 'b@example.com', null, false)
+    expect(resolve).toHaveBeenNthCalledWith(3, 'c@example.com', null, true)
   })
 })
diff --git a/apps/web/src/lib/server/domains/import/__tests__/import-preview.test.ts b/apps/web/src/lib/server/domains/import/__tests__/import-preview.test.ts
index 8976fc9b01..aa57b589f4 100644
--- a/apps/web/src/lib/server/domains/import/__tests__/import-preview.test.ts
+++ b/apps/web/src/lib/server/domains/import/__tests__/import-preview.test.ts
@@ -35,20 +35,32 @@ vi.mock('@/lib/server/db', () => ({
 }))
 
 // previewImport constructs its own resolver internally (no injection point),
-// so the resolver itself is faked: a brand-new email increments pendingCount
-// exactly once, mirroring the real class's queue-for-creation behavior.
+// so the resolver itself is faked: a brand-new email or name increments
+// pendingCount exactly once, mirroring the real class's queue-for-creation
+// behavior.
 vi.mock('../user-resolver', () => {
   class FakeImportUserResolver {
     private seen = new Map<string, string>()
     private pending = 0
-    async resolve(email: string | null, _name: string | null, fallback: string) {
-      if (!email) return fallback
-      const key = email.toLowerCase()
-      if (this.seen.has(key)) return this.seen.get(key)!
-      this.pending++
-      const id = `principal_${key}`
-      this.seen.set(key, id)
-      return id
+    async resolve(email: string | null, name: string | null, fallback: string) {
+      const normalizedEmail = email?.toLowerCase().trim() ?? ''
+      if (normalizedEmail) {
+        if (this.seen.has(normalizedEmail)) return this.seen.get(normalizedEmail)!
+        this.pending++
+        const id = `principal_${normalizedEmail}`
+        this.seen.set(normalizedEmail, id)
+        return id
+      }
+      const trimmedName = name?.trim() ?? ''
+      if (trimmedName) {
+        const key = `name:${trimmedName.toLowerCase()}`
+        if (this.seen.has(key)) return this.seen.get(key)!
+        this.pending++
+        const id = `principal_${key}`
+        this.seen.set(key, id)
+        return id
+      }
+      return fallback
     }
     async flushPendingCreates() {
       return 0
@@ -85,7 +97,7 @@ describe('previewImport', () => {
   })
 
   it('never writes to the database', async () => {
-    const csv = 'title,content\nFirst,Body\n'
+    const csv = 'title,content,author_name\nFirst,Body,Jane\n'
     await previewImport({ ...BASE_INPUT, csvContent: csvContent(csv), totalRows: 1 })
     expect(hoisted.insert).not.toHaveBeenCalled()
   })
@@ -132,7 +144,7 @@ describe('previewImport', () => {
   })
 
   it('reports per-row validation errors without throwing', async () => {
-    const csv = 'title,content\n,Body without a title\n'
+    const csv = 'title,content,author_name\n,Body without a title,Jane\n'
     const preview = await previewImport({
       ...BASE_INPUT,
       csvContent: csvContent(csv),
@@ -145,9 +157,9 @@ describe('previewImport', () => {
 
   it('reports to-be-created statuses, boards, and tags without writing them', async () => {
     const csv =
-      'title,content,status,board,tags\n' +
-      'First,Body one,In Progress,Feature Requests,"ui,theme"\n' +
-      'Second,Body two,open,bugs,ui\n'
+      'title,content,status,board,tags,author_name\n' +
+      'First,Body one,In Progress,Feature Requests,"ui,theme",Jane\n' +
+      'Second,Body two,open,bugs,ui,Jane\n'
 
     const preview = await previewImport({
       ...BASE_INPUT,
@@ -173,7 +185,7 @@ describe('previewImport', () => {
     hoisted.findManyPostExternalLinks.mockResolvedValue([
       { externalId: 'ext-1', postId: 'post_existing' },
     ])
-    const csv = 'title,content,source_id\nExisting,Body,ext-1\n'
+    const csv = 'title,content,source_id,author_name\nExisting,Body,ext-1,Jane\n'
 
     const preview = await previewImport({
       ...BASE_INPUT,
@@ -184,4 +196,41 @@ describe('previewImport', () => {
     expect(preview.sample[0].action).toBe('update')
     expect(preview.updatedCount).toBe(1)
   })
+
+  it('treats author_name without email as a new author and reuses it on repeats', async () => {
+    const csv =
+      'title,content,author_name\n' + 'First,Body one,Jane Doe\n' + 'Second,Body two,jane doe\n'
+
+    const preview = await previewImport({
+      ...BASE_INPUT,
+      csvContent: csvContent(csv),
+      totalRows: 2,
+    })
+
+    expect(preview.counts.byAuthor).toEqual({ 'Jane Doe': 1, 'jane doe': 1 })
+    expect(preview.sample[0]).toMatchObject({
+      author: 'Jane Doe',
+      isNewAuthor: true,
+    })
+    expect(preview.sample[1]).toMatchObject({
+      author: 'jane doe',
+      isNewAuthor: false,
+    })
+  })
+
+  it('skips rows with neither author_name nor author_email', async () => {
+    const csv = 'title,content\nFirst,Body\n'
+
+    const preview = await previewImport({
+      ...BASE_INPUT,
+      csvContent: csvContent(csv),
+      totalRows: 1,
+    })
+
+    expect(preview.sample).toEqual([])
+    expect(preview.counts.byAuthor).toEqual({})
+    expect(preview.errors).toEqual([
+      { row: 1, message: 'Author name or email is required', field: 'author_name' },
+    ])
+  })
 })
diff --git a/apps/web/src/lib/server/domains/import/__tests__/import-service.test.ts b/apps/web/src/lib/server/domains/import/__tests__/import-service.test.ts
index fbafc6dafe..e6612c7c68 100644
--- a/apps/web/src/lib/server/domains/import/__tests__/import-service.test.ts
+++ b/apps/web/src/lib/server/domains/import/__tests__/import-service.test.ts
@@ -94,6 +94,25 @@ function emailKeyedResolver(fallback: PrincipalId): ImportUserResolver {
   } as unknown as ImportUserResolver
 }
 
+/** Resolves each distinct author name (when email is empty) to its own principal. */
+function nameKeyedResolver(fallback: PrincipalId): ImportUserResolver {
+  const byName = new Map<string, PrincipalId>()
+  return {
+    resolve: vi.fn(async (email: string | null, name: string | null) => {
+      if (email) return fallback
+      const trimmed = name?.trim()
+      if (!trimmed) return fallback
+      const key = trimmed.toLowerCase()
+      if (!byName.has(key)) byName.set(key, `principal_${key}` as PrincipalId)
+      return byName.get(key)!
+    }),
+    flushPendingCreates: vi.fn().mockResolvedValue(0),
+    get pendingCount() {
+      return byName.size
+    },
+  } as unknown as ImportUserResolver
+}
+
 describe('processBatch', () => {
   beforeEach(() => {
     vi.clearAllMocks()
@@ -107,16 +126,47 @@ describe('processBatch', () => {
     hoisted.deleteWhere.mockResolvedValue(undefined)
   })
 
+  describe('name-only authors', () => {
+    it('attributes a name-only row to the resolved author, not the importer', async () => {
+      const rows = [{ title: 'Row one', content: 'Body one', author_name: 'Jane Doe' }]
+
+      await processBatch(
+        rows,
+        'board_1' as never,
+        0,
+        nameKeyedResolver('principal_fallback' as PrincipalId)
+      )
+
+      const postsInsert = hoisted.insertValues.mock.calls[0][0] as { principalId: string }[]
+      expect(postsInsert[0].principalId).toBe('principal_jane doe')
+    })
+
+    it('skips a row with neither author_name nor author_email', async () => {
+      const result = await processBatch(
+        [{ title: 'Row one', content: 'Body one' }],
+        'board_1' as never,
+        0,
+        fakeResolver('principal_fallback' as PrincipalId)
+      )
+
+      expect(result.imported).toBe(0)
+      expect(result.skipped).toBe(1)
+      expect(result.errors).toEqual([
+        { row: 1, message: 'Author name or email is required', field: 'author_name' },
+      ])
+      expect(hoisted.insertValues).not.toHaveBeenCalled()
+    })
+  })
+
   describe('batch auto-tag', () => {
     it('applies the batch tag to every created post alongside its own tags', async () => {
-      const rows = [{ title: 'Row one', content: 'Body one', tags: 'feature' }]
+      const rows = [{ title: 'Row one', content: 'Body one', tags: 'feature', author_name: 'Jane' }]
 
       await processBatch(
         rows,
         'board_1' as never,
         0,
         fakeResolver('principal_fallback' as PrincipalId),
-        'principal_fallback' as PrincipalId,
         'post_tag_batch' as never
       )
 
@@ -132,14 +182,13 @@ describe('processBatch', () => {
     })
 
     it('omits the batch tag entirely when none is passed (dry-run / legacy path)', async () => {
-      const rows = [{ title: 'Row one', content: 'Body one' }]
+      const rows = [{ title: 'Row one', content: 'Body one', author_name: 'Jane' }]
 
       await processBatch(
         rows,
         'board_1' as never,
         0,
-        fakeResolver('principal_fallback' as PrincipalId),
-        'principal_fallback' as PrincipalId
+        fakeResolver('principal_fallback' as PrincipalId)
       )
 
       // No row tags and no batch tag: the assignments insert never runs, so
@@ -159,6 +208,7 @@ describe('processBatch', () => {
           content: 'Body one',
           status: 'In Progress',
           board: 'Feature Requests',
+          author_name: 'Jane',
         },
       ]
 
@@ -166,8 +216,7 @@ describe('processBatch', () => {
         rows,
         'board_default' as never,
         0,
-        fakeResolver('principal_fallback' as PrincipalId),
-        'principal_fallback' as PrincipalId
+        fakeResolver('principal_fallback' as PrincipalId)
       )
 
       expect(result.createdStatuses).toEqual(['In Progress'])
@@ -193,16 +242,15 @@ describe('processBatch', () => {
       ])
       hoisted.findManyBoards.mockResolvedValue([{ id: 'board_bugs', slug: 'bugs', name: 'Bugs' }])
       const rows = [
-        { title: 'A', content: 'Body', status: 'Open', board: 'Bugs' },
-        { title: 'B', content: 'Body', status: 'open', board: 'bugs' },
+        { title: 'A', content: 'Body', status: 'Open', board: 'Bugs', author_name: 'Jane' },
+        { title: 'B', content: 'Body', status: 'open', board: 'bugs', author_name: 'Jane' },
       ]
 
       const result = await processBatch(
         rows,
         'board_bugs' as never,
         0,
-        fakeResolver('principal_fallback' as PrincipalId),
-        'principal_fallback' as PrincipalId
+        fakeResolver('principal_fallback' as PrincipalId)
       )
 
       expect(result.createdStatuses).toEqual([])
@@ -219,14 +267,15 @@ describe('processBatch', () => {
   describe('source-id idempotence', () => {
     it('creates a new post and an external link when the source_id has not been seen before', async () => {
       hoisted.findManyPostExternalLinks.mockResolvedValue([])
-      const rows = [{ title: 'Row one', content: 'Body one', source_id: 'ext-1' }]
+      const rows = [
+        { title: 'Row one', content: 'Body one', source_id: 'ext-1', author_name: 'Jane' },
+      ]
 
       const result = await processBatch(
         rows,
         'board_1' as never,
         0,
-        fakeResolver('principal_fallback' as PrincipalId),
-        'principal_fallback' as PrincipalId
+        fakeResolver('principal_fallback' as PrincipalId)
       )
 
       expect(result.imported).toBe(1)
@@ -245,14 +294,20 @@ describe('processBatch', () => {
       hoisted.findManyPostExternalLinks.mockResolvedValue([
         { externalId: 'ext-1', postId: 'post_existing' },
       ])
-      const rows = [{ title: 'Updated title', content: 'Updated body', source_id: 'ext-1' }]
+      const rows = [
+        {
+          title: 'Updated title',
+          content: 'Updated body',
+          source_id: 'ext-1',
+          author_name: 'Jane',
+        },
+      ]
 
       const result = await processBatch(
         rows,
         'board_1' as never,
         0,
-        fakeResolver('principal_fallback' as PrincipalId),
-        'principal_fallback' as PrincipalId
+        fakeResolver('principal_fallback' as PrincipalId)
       )
 
       expect(result.imported).toBe(0)
@@ -268,7 +323,13 @@ describe('processBatch', () => {
     it('creates real post_votes rows and sets voteCount from the deduped voter count', async () => {
       hoisted.findManyPostExternalLinks.mockResolvedValue([])
       const rows = [
-        { title: 'Dark mode', content: 'Please', source_id: 'idea-1', vote_count: '99' },
+        {
+          title: 'Dark mode',
+          content: 'Please',
+          source_id: 'idea-1',
+          vote_count: '99',
+          author_name: 'Jane',
+        },
       ]
       const voters = {
         'idea-1': [
@@ -283,7 +344,6 @@ describe('processBatch', () => {
         'board_1' as never,
         0,
         emailKeyedResolver('principal_fallback' as PrincipalId),
-        'principal_fallback' as PrincipalId,
         undefined,
         voters
       )
@@ -308,7 +368,13 @@ describe('processBatch', () => {
     it('falls back to vote-count backfill when no voters entry exists for the row', async () => {
       hoisted.findManyPostExternalLinks.mockResolvedValue([])
       const rows = [
-        { title: 'No voters here', content: 'Body', source_id: 'idea-2', vote_count: '5' },
+        {
+          title: 'No voters here',
+          content: 'Body',
+          source_id: 'idea-2',
+          vote_count: '5',
+          author_name: 'Jane',
+        },
       ]
 
       await processBatch(
@@ -316,7 +382,6 @@ describe('processBatch', () => {
         'board_1' as never,
         0,
         emailKeyedResolver('principal_fallback' as PrincipalId),
-        'principal_fallback' as PrincipalId,
         undefined,
         { 'idea-1': [{ email: 'alice@example.com' }] } // keyed to a different row
       )
@@ -332,7 +397,9 @@ describe('processBatch', () => {
       hoisted.findManyPostExternalLinks.mockResolvedValue([
         { externalId: 'idea-1', postId: 'post_existing' },
       ])
-      const rows = [{ title: 'Dark mode v2', content: 'Please', source_id: 'idea-1' }]
+      const rows = [
+        { title: 'Dark mode v2', content: 'Please', source_id: 'idea-1', author_name: 'Jane' },
+      ]
       const voters = { 'idea-1': [{ email: 'carol@example.com' }] }
 
       const result = await processBatch(
@@ -340,7 +407,6 @@ describe('processBatch', () => {
         'board_1' as never,
         0,
         emailKeyedResolver('principal_fallback' as PrincipalId),
-        'principal_fallback' as PrincipalId,
         undefined,
         voters
       )
@@ -354,5 +420,32 @@ describe('processBatch', () => {
       })
       expect(voteInsertCall).toBeDefined()
     })
+
+    it('skips voters that have neither email nor name rather than attributing them to the importer', async () => {
+      hoisted.findManyPostExternalLinks.mockResolvedValue([])
+      const rows = [
+        { title: 'Dark mode', content: 'Please', source_id: 'idea-1', author_name: 'Jane' },
+      ]
+      const voters = {
+        'idea-1': [{ email: 'alice@example.com' }, { email: '', name: '' }],
+      }
+
+      await processBatch(
+        rows,
+        'board_1' as never,
+        0,
+        emailKeyedResolver('principal_fallback' as PrincipalId),
+        undefined,
+        voters
+      )
+
+      const voteInsertCall = hoisted.insertValues.mock.calls.find((call) => {
+        const arg = call[0] as { sourceType?: string }[]
+        return Array.isArray(arg) && arg[0]?.sourceType === 'import'
+      })
+      const voteRows = voteInsertCall![0] as { principalId: string }[]
+      expect(voteRows).toHaveLength(1)
+      expect(voteRows[0].principalId).toBe('principal_alice@example.com')
+    })
   })
 })
diff --git a/apps/web/src/lib/server/domains/import/__tests__/sample-csv-imports.test.ts b/apps/web/src/lib/server/domains/import/__tests__/sample-csv-imports.test.ts
new file mode 100644
index 0000000000..4f06f1ae81
--- /dev/null
+++ b/apps/web/src/lib/server/domains/import/__tests__/sample-csv-imports.test.ts
@@ -0,0 +1,49 @@
+/**
+ * `bun run db:generate-csv` writes the sample file people use to try the CSV
+ * import. Since #518 the importer skips a row that names no author, so the
+ * generator must never produce one — otherwise the sample import silently
+ * loses posts. The generator runs as a process (it reads argv and writes at
+ * module scope), so this test spawns it the way an operator would and feeds
+ * its output to the importer's own parser and row schema.
+ */
+import { describe, it, expect } from 'vitest'
+import { spawnSync } from 'node:child_process'
+import path from 'node:path'
+import Papa from 'papaparse'
+import { csvRowSchema } from '../import-row-resolver'
+
+const generator = path.resolve(
+  __dirname,
+  '../../../../../../../../packages/db/src/generate-sample-csv.ts'
+)
+
+function generateSampleCsv(rowCount: number): string {
+  const run = spawnSync('bun', [generator, String(rowCount)], {
+    encoding: 'utf8',
+    timeout: 60_000,
+  })
+  expect(run.status, run.stderr).toBe(0)
+  return run.stdout
+}
+
+describe('the sample CSV the generator ships', () => {
+  it('names an author on every row, so the importer skips none of them', () => {
+    const csv = generateSampleCsv(40)
+    const parsed = Papa.parse<Record<string, string>>(csv, { header: true, skipEmptyLines: true })
+
+    expect(parsed.errors).toEqual([])
+    expect(parsed.data).toHaveLength(40)
+    for (const row of parsed.data) {
+      expect(row.author_name, JSON.stringify(row)).not.toBe('')
+      expect(row.author_email, JSON.stringify(row)).toMatch(/^[^@\s]+@[^@\s]+$/)
+      expect(csvRowSchema.safeParse(row).success, JSON.stringify(row)).toBe(true)
+    }
+  })
+
+  it('writes the columns the importer reads, in the documented order', () => {
+    const csv = generateSampleCsv(1)
+    expect(csv.split('\n')[0]).toBe(
+      'title,content,status,tags,board,author_name,author_email,vote_count,created_at'
+    )
+  })
+})
diff --git a/apps/web/src/lib/server/domains/import/__tests__/user-resolver-name.db.test.ts b/apps/web/src/lib/server/domains/import/__tests__/user-resolver-name.db.test.ts
new file mode 100644
index 0000000000..863aba82f1
--- /dev/null
+++ b/apps/web/src/lib/server/domains/import/__tests__/user-resolver-name.db.test.ts
@@ -0,0 +1,154 @@
+/**
+ * Real-DB coverage for ImportUserResolver name-only authors: a CSV
+ * author_name with no email creates (or reuses) a name-only portal
+ * person, never the importer, and never an identified user who happens
+ * to share the display name.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach, afterAll } from 'vitest'
+import { createId, type PrincipalId, type UserId } from '@quackback/ids'
+import { createDbTestFixture, testDb } from '@/lib/server/__tests__/db-test-fixture'
+import { eq, and, isNull, principal, user } from '@/lib/server/db'
+
+vi.mock('@/lib/server/db', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@/lib/server/db')>()),
+  db: (await import('@/lib/server/__tests__/db-test-fixture')).testDb,
+}))
+
+vi.mock('@/lib/server/cache', () => ({
+  cacheDel: vi.fn(),
+  CACHE_KEYS: { PRINCIPAL_BY_USER: (id: string) => `principal:user:${id}` },
+}))
+
+import { ImportUserResolver } from '../user-resolver'
+
+const fixture = await createDbTestFixture({
+  probe: async (db) => {
+    await db
+      .select({ id: user.id, email: user.email, verified: user.emailVerified })
+      .from(user)
+      .limit(0)
+    await db.select({ id: principal.id }).from(principal).limit(0)
+  },
+})
+
+const runSuffix = () => `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`
+
+async function seedIdentifiedUser(name: string, email: string): Promise<UserId> {
+  const userId = createId('user') as UserId
+  await testDb.insert(user).values({ id: userId, name, email })
+  await testDb.insert(principal).values({
+    id: createId('principal') as PrincipalId,
+    userId,
+    role: 'user',
+    type: 'user',
+    displayName: name,
+    createdAt: new Date(),
+  })
+  return userId
+}
+
+async function seedNameOnlyPerson(name: string, createdAt = new Date()): Promise<PrincipalId> {
+  const userId = createId('user') as UserId
+  const principalId = createId('principal') as PrincipalId
+  await testDb.insert(user).values({ id: userId, name, email: null })
+  await testDb.insert(principal).values({
+    id: principalId,
+    userId,
+    role: 'user',
+    type: 'user',
+    displayName: name,
+    createdAt,
+  })
+  return principalId
+}
+
+describe.skipIf(!fixture.available)('ImportUserResolver name-only authors', () => {
+  beforeEach(() => fixture.begin())
+  afterEach(() => fixture.rollback())
+  afterAll(() => fixture.close())
+
+  it('creates a name-only portal person when email is empty', async () => {
+    const resolver = new ImportUserResolver()
+    const name = `Jane ${runSuffix()}`
+
+    const principalId = await resolver.resolve(null, name)
+    expect(resolver.pendingCount).toBe(1)
+
+    await resolver.flushPendingCreates()
+
+    const [userRow] = await testDb.select().from(user).where(eq(user.name, name))
+    expect(userRow.email).toBeNull()
+    expect(userRow.emailVerified).toBe(false)
+
+    const [principalRow] = await testDb
+      .select()
+      .from(principal)
+      .where(eq(principal.userId, userRow.id))
+    expect(principalRow.id).toBe(principalId)
+    expect(principalRow.displayName).toBe(name)
+    expect(principalRow.role).toBe('user')
+    expect(principalRow.type).toBe('user')
+  })
+
+  it('reuses the same pending create for the same name with different casing or whitespace', async () => {
+    const resolver = new ImportUserResolver()
+    const suffix = runSuffix()
+
+    const first = await resolver.resolve('', `  Jane ${suffix}  `)
+    const second = await resolver.resolve(null, `jane ${suffix}`)
+
+    expect(first).toBe(second)
+    expect(resolver.pendingCount).toBe(1)
+
+    await resolver.flushPendingCreates()
+
+    const rows = await testDb
+      .select()
+      .from(user)
+      .where(and(isNull(user.email), eq(user.name, `Jane ${suffix}`)))
+    expect(rows).toHaveLength(1)
+  })
+
+  it('reuses an existing name-only person with that display name', async () => {
+    const name = `Pat ${runSuffix()}`
+    const existing = await seedNameOnlyPerson(name)
+
+    const resolver = new ImportUserResolver()
+    const resolved = await resolver.resolve(null, name.toUpperCase())
+
+    expect(resolved).toBe(existing)
+    expect(resolver.pendingCount).toBe(0)
+    await resolver.flushPendingCreates()
+
+    const rows = await testDb.select().from(user).where(eq(user.name, name))
+    expect(rows).toHaveLength(1)
+  })
+
+  it('does not reuse an identified user who shares the display name', async () => {
+    const name = `Sam ${runSuffix()}`
+    await seedIdentifiedUser(name, `sam-${runSuffix()}@example.com`)
+
+    const resolver = new ImportUserResolver()
+    const resolved = await resolver.resolve(null, name)
+
+    expect(resolver.pendingCount).toBe(1)
+    await resolver.flushPendingCreates()
+
+    const [principalRow] = await testDb.select().from(principal).where(eq(principal.id, resolved))
+    expect(principalRow.displayName).toBe(name)
+
+    const nameOnly = await testDb
+      .select()
+      .from(user)
+      .where(and(isNull(user.email), eq(user.name, name)))
+    expect(nameOnly).toHaveLength(1)
+  })
+
+  it('throws and queues nothing when email and name are both empty', async () => {
+    const resolver = new ImportUserResolver()
+
+    await expect(resolver.resolve(null, null)).rejects.toThrow(/name or email/)
+    await expect(resolver.resolve('', '   ')).rejects.toThrow(/name or email/)
+    expect(resolver.pendingCount).toBe(0)
+  })
+})
diff --git a/apps/web/src/lib/server/domains/import/__tests__/user-resolver-verified.db.test.ts b/apps/web/src/lib/server/domains/import/__tests__/user-resolver-verified.db.test.ts
index ae0eecc5e7..1c0f8d156e 100644
--- a/apps/web/src/lib/server/domains/import/__tests__/user-resolver-verified.db.test.ts
+++ b/apps/web/src/lib/server/domains/import/__tests__/user-resolver-verified.db.test.ts
@@ -32,7 +32,6 @@ const fixture = await createDbTestFixture({
 })
 
 const runSuffix = () => `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`
-const FALLBACK = createId('principal') as PrincipalId
 
 async function seedExistingUser(email: string): Promise<UserId> {
   const userId = createId('user') as UserId
@@ -58,8 +57,8 @@ describe.skipIf(!fixture.available)('ImportUserResolver emailVerified', () => {
     const verifiedEmail = `import-v-${runSuffix()}@example.com`
     const plainEmail = `import-p-${runSuffix()}@example.com`
 
-    await resolver.resolve(verifiedEmail, 'Verified Vic', FALLBACK, true)
-    await resolver.resolve(plainEmail, 'Plain Pat', FALLBACK, false)
+    await resolver.resolve(verifiedEmail, 'Verified Vic', true)
+    await resolver.resolve(plainEmail, 'Plain Pat', false)
 
     await resolver.flushPendingCreates()
 
@@ -74,7 +73,7 @@ describe.skipIf(!fixture.available)('ImportUserResolver emailVerified', () => {
     const existingId = await seedExistingUser(email)
 
     const resolver = new ImportUserResolver()
-    await resolver.resolve(email, 'Someone', FALLBACK, true)
+    await resolver.resolve(email, 'Someone', true)
 
     expect(resolver.pendingCount).toBe(0)
     await resolver.flushPendingCreates()
@@ -87,8 +86,8 @@ describe.skipIf(!fixture.available)('ImportUserResolver emailVerified', () => {
     const email = `import-first-${runSuffix()}@example.com`
     const resolver = new ImportUserResolver()
 
-    await resolver.resolve(email, 'First Row', FALLBACK, false)
-    await resolver.resolve(email.toUpperCase(), 'Second Row', FALLBACK, true)
+    await resolver.resolve(email, 'First Row', false)
+    await resolver.resolve(email.toUpperCase(), 'Second Row', true)
 
     expect(resolver.pendingCount).toBe(1)
     await resolver.flushPendingCreates()
diff --git a/apps/web/src/lib/server/domains/import/import-preview.ts b/apps/web/src/lib/server/domains/import/import-preview.ts
index 63034c6a01..eff10fda9c 100644
--- a/apps/web/src/lib/server/domains/import/import-preview.ts
+++ b/apps/web/src/lib/server/domains/import/import-preview.ts
@@ -47,7 +47,6 @@ export async function previewImport(data: ImportInput): Promise<ImportPreview> {
       data.boardId,
       i,
       userResolver,
-      data.initiatedByPrincipalId,
       ctx,
       tagsToCreate,
       statusesToCreate,
@@ -60,7 +59,7 @@ export async function previewImport(data: ImportInput): Promise<ImportPreview> {
       byBoard[boardKey] = (byBoard[boardKey] ?? 0) + 1
       const statusKey = row.statusLabel ?? 'default'
       byStatus[statusKey] = (byStatus[statusKey] ?? 0) + 1
-      const authorKey = row.authorEmail ?? row.authorName ?? 'Imported user'
+      const authorKey = row.authorEmail ?? row.authorName ?? 'unknown'
       byAuthor[authorKey] = (byAuthor[authorKey] ?? 0) + 1
       if (row.sourceId) {
         allSourceIds.push(row.sourceId)
@@ -73,7 +72,7 @@ export async function previewImport(data: ImportInput): Promise<ImportPreview> {
           title: row.title,
           board: row.boardSlug,
           status: row.statusLabel,
-          author: row.authorEmail ?? row.authorName ?? 'Imported user',
+          author: row.authorEmail ?? row.authorName ?? 'unknown',
           isNewAuthor: row.isNewAuthor,
           voteCount: row.voteCount,
           action: 'create',
@@ -97,8 +96,7 @@ export async function previewImport(data: ImportInput): Promise<ImportPreview> {
   const finalSample = sample.map(({ sourceId, ...rest }) => ({
     ...rest,
     action: (sourceId && matchedSourceIds.has(sourceId) ? 'update' : 'create') as
-      | 'create'
-      | 'update',
+      'create' | 'update',
   }))
 
   return {
diff --git a/apps/web/src/lib/server/domains/import/import-row-resolver.ts b/apps/web/src/lib/server/domains/import/import-row-resolver.ts
index 9b12453f38..6edce44db2 100644
--- a/apps/web/src/lib/server/domains/import/import-row-resolver.ts
+++ b/apps/web/src/lib/server/domains/import/import-row-resolver.ts
@@ -39,41 +39,52 @@ export function parseCsvEmailVerified(value: string | undefined): boolean {
 /**
  * CSV row validation schema
  */
-export const csvRowSchema = z.object({
-  title: z.string().min(1, 'Title is required').max(200, 'Title must be 200 characters or less'),
-  content: z.string().max(10000, 'Content must be 10000 characters or less'),
-  status: z.string().optional(),
-  tags: z.string().optional(),
-  board: z.string().optional(),
-  author_name: z.string().optional(),
-  author_email: z.string().email().optional().or(z.literal('')),
-  // Whether the author's email is verified when this row CREATES the user
-  // (default true — claimable shell). Existing users are never flipped.
-  email_verified: z
-    .string()
-    .optional()
-    .transform((val) => parseCsvEmailVerified(val)),
-  vote_count: z
-    .string()
-    .optional()
-    .transform((val) => {
-      if (!val) return 0
-      const num = parseInt(val, 10)
-      return isNaN(num) || num < 0 ? 0 : num
-    }),
-  created_at: z
-    .string()
-    .optional()
-    .transform((val) => {
-      if (!val) return new Date()
-      const date = new Date(val)
-      return isNaN(date.getTime()) ? new Date() : date
-    }),
-  // Optional stable identifier from the source system (§I2). When present,
-  // re-importing the same row updates the post it previously created instead
-  // of creating a duplicate.
-  source_id: z.string().max(200).optional(),
-})
+export const AUTHOR_REQUIRED_MESSAGE = 'Author name or email is required'
+
+export const csvRowSchema = z
+  .object({
+    title: z.string().min(1, 'Title is required').max(200, 'Title must be 200 characters or less'),
+    content: z.string().max(10000, 'Content must be 10000 characters or less'),
+    status: z.string().optional(),
+    tags: z.string().optional(),
+    board: z.string().optional(),
+    author_name: z.string().optional(),
+    author_email: z.string().email().optional().or(z.literal('')),
+    // Whether the author's email is verified when this row CREATES the user
+    // (default true — claimable shell). Existing users are never flipped.
+    email_verified: z
+      .string()
+      .optional()
+      .transform((val) => parseCsvEmailVerified(val)),
+    vote_count: z
+      .string()
+      .optional()
+      .transform((val) => {
+        if (!val) return 0
+        const num = parseInt(val, 10)
+        return isNaN(num) || num < 0 ? 0 : num
+      }),
+    created_at: z
+      .string()
+      .optional()
+      .transform((val) => {
+        if (!val) return new Date()
+        const date = new Date(val)
+        return isNaN(date.getTime()) ? new Date() : date
+      }),
+    // Optional stable identifier from the source system (§I2). When present,
+    // re-importing the same row updates the post it previously created instead
+    // of creating a duplicate.
+    source_id: z.string().max(200).optional(),
+  })
+  .superRefine((data, ctx) => {
+    if (data.author_name?.trim() || data.author_email?.trim()) return
+    ctx.addIssue({
+      code: 'custom',
+      message: AUTHOR_REQUIRED_MESSAGE,
+      path: ['author_name'],
+    })
+  })
 
 export interface ProcessedRow {
   title: string
@@ -197,7 +208,6 @@ export async function resolveRows(
   defaultBoardId: BoardId,
   startIndex: number,
   userResolver: ImportUserResolver,
-  fallbackPrincipalId: PrincipalId,
   ctx: RowContext,
   tagsToCreate: Set<string>,
   statusesToCreate: Map<string, string>,
@@ -291,7 +301,6 @@ export async function resolveRows(
     const principalId = await userResolver.resolve(
       row.author_email || null,
       row.author_name || null,
-      fallbackPrincipalId,
       row.email_verified
     )
     const isNewAuthor = userResolver.pendingCount > pendingBefore
diff --git a/apps/web/src/lib/server/domains/import/import-service.ts b/apps/web/src/lib/server/domains/import/import-service.ts
index cba5f4edc4..78236594b9 100644
--- a/apps/web/src/lib/server/domains/import/import-service.ts
+++ b/apps/web/src/lib/server/domains/import/import-service.ts
@@ -118,7 +118,6 @@ export async function processBatch(
   defaultBoardId: BoardId,
   startIndex: number,
   userResolver: ImportUserResolver,
-  fallbackPrincipalId: PrincipalId,
   batchTagId?: PostTagId | null,
   voters?: Record<string, ImportVoterRecord[]>
 ): Promise<BatchResult> {
@@ -142,7 +141,6 @@ export async function processBatch(
     defaultBoardId,
     startIndex,
     userResolver,
-    fallbackPrincipalId,
     ctx,
     tagsToCreate,
     statusesToCreate,
@@ -246,11 +244,8 @@ export async function processBatch(
       const seen = new Set<PrincipalId>()
       const resolved: { principalId: PrincipalId; createdAt: Date | null }[] = []
       for (const voter of rowVoters) {
-        const principalId = await userResolver.resolve(
-          voter.email,
-          voter.name ?? null,
-          fallbackPrincipalId
-        )
+        if (!voter.email?.trim() && !voter.name?.trim()) continue
+        const principalId = await userResolver.resolve(voter.email, voter.name ?? null)
         if (seen.has(principalId)) continue
         seen.add(principalId)
         resolved.push({
@@ -444,7 +439,6 @@ export async function processImport(data: ImportInput): Promise<ImportResult> {
       data.boardId,
       i,
       userResolver,
-      data.initiatedByPrincipalId,
       data.batchTagId,
       data.voters
     )
diff --git a/apps/web/src/lib/server/domains/import/types.ts b/apps/web/src/lib/server/domains/import/types.ts
index fda6c2b0fa..34118ea1cf 100644
--- a/apps/web/src/lib/server/domains/import/types.ts
+++ b/apps/web/src/lib/server/domains/import/types.ts
@@ -78,7 +78,7 @@ export interface ImportPreviewRow {
   board: string | null
   /** Resolved status name, or null when the row falls back to the default status */
   status: string | null
-  /** Author email/name, or "Imported user" when unattributed */
+  /** Author email or author name from the CSV. Rows with neither are skipped. */
   author: string
   /** True when this author does not exist yet and would be created on commit */
   isNewAuthor: boolean
diff --git a/apps/web/src/lib/server/domains/import/user-resolver.ts b/apps/web/src/lib/server/domains/import/user-resolver.ts
index fa5d22025d..bc9ced0770 100644
--- a/apps/web/src/lib/server/domains/import/user-resolver.ts
+++ b/apps/web/src/lib/server/domains/import/user-resolver.ts
@@ -1,64 +1,87 @@
 /**
  * User resolution for CSV import.
  *
- * Resolves email addresses to existing member IDs,
- * creating new user+member records when needed.
+ * Resolves CSV authors to principal IDs, creating new user+principal
+ * records when needed. Email is the identity when present; a name with
+ * no email creates a name-only portal contact (same shape as
+ * createPortalUser). Rows with neither are rejected — the importer is
+ * never used as the author.
  *
  * Adapted from scripts/import/core/user-resolver.ts for
  * use within the in-app CSV import flow.
  */
 
-import { db, eq, user, principal } from '@/lib/server/db'
+import { db, eq, and, isNull, sql, asc, user, principal } from '@/lib/server/db'
 import { createId, type PrincipalId, type UserId } from '@quackback/ids'
 import { createPrincipals } from '@/lib/server/domains/principals/principal.factory'
 
 interface PendingUser {
   principalId: PrincipalId
   userId: UserId
-  email: string
+  email: string | null
   name: string
   emailVerified: boolean
 }
 
+function nameCacheKey(name: string): string {
+  return `name:${name.toLowerCase()}`
+}
+
 /**
- * Resolves CSV author emails to member IDs.
+ * Resolves CSV authors to principal IDs.
  *
  * - Caches lookups per instance (create once per import job)
- * - Batches user+member creation via flushPendingCreates()
- * - Case-insensitive email matching
+ * - Batches user+principal creation via flushPendingCreates()
+ * - Case-insensitive email matching; case-insensitive name matching for
+ *   name-only contacts (never matches an identified user by display name)
  */
 export class ImportUserResolver {
   private cache = new Map<string, PrincipalId>()
   private pendingCreates: PendingUser[] = []
 
   /**
-   * Resolve an email to a member ID.
+   * Resolve a CSV author to a principal ID.
    *
-   * If the email has an existing user+member, returns the principalId.
-   * If not, queues a new user+member for creation and returns a pre-generated principalId.
-   * If email is null/empty, returns the fallbackPrincipalId.
+   * Email present: existing user+principal by email, else queue a new
+   * claimable shell (`emailVerified` applies only to that create).
+   * Email empty, name present: existing name-only contact by display
+   * name, else queue a name-only portal person.
+   * Both empty: throws — CSV rows without an author are rejected at
+   * schema validation; callers that might see an empty identity (voters)
+   * must skip before calling this.
    *
-   * `emailVerified` applies only when THIS call queues the creation (default
-   * true: import shells must be claimable via SSO). Existing users (and
-   * already-queued creates) are never flipped — an import row can opt out for
-   * a user it introduces, not one that predates it.
+   * `emailVerified` applies only when THIS call queues an email create
+   * (default true: import shells must be claimable via SSO). Existing
+   * users (and already-queued creates) are never flipped. Name-only
+   * creates are always unverified — there is no address to vouch for.
    */
   async resolve(
     email: string | null | undefined,
     name: string | null | undefined,
-    fallbackPrincipalId: PrincipalId,
     emailVerified = true
   ): Promise<PrincipalId> {
-    if (!email) return fallbackPrincipalId
+    const normalizedEmail = email?.toLowerCase().trim() ?? ''
+    if (normalizedEmail) {
+      return this.resolveByEmail(normalizedEmail, name, emailVerified)
+    }
 
-    const normalizedEmail = email.toLowerCase().trim()
-    if (!normalizedEmail) return fallbackPrincipalId
+    const trimmedName = name?.trim() ?? ''
+    if (trimmedName) {
+      return this.resolveByName(trimmedName)
+    }
 
+    throw new Error('Import author requires a name or email')
+  }
+
+  private async resolveByEmail(
+    normalizedEmail: string,
+    name: string | null | undefined,
+    emailVerified: boolean
+  ): Promise<PrincipalId> {
     if (this.cache.has(normalizedEmail)) {
       return this.cache.get(normalizedEmail)!
     }
 
-    // Look up existing principal by email
     const existing = await db
       .select({ principalId: principal.id })
       .from(user)
@@ -72,7 +95,6 @@ export class ImportUserResolver {
       return principalId
     }
 
-    // Queue for creation
     const userId = createId('user')
     const principalId = createId('principal')
     const displayName = name?.trim() || normalizedEmail.split('@')[0]
@@ -88,6 +110,41 @@ export class ImportUserResolver {
     return principalId
   }
 
+  private async resolveByName(trimmedName: string): Promise<PrincipalId> {
+    const cacheKey = nameCacheKey(trimmedName)
+    if (this.cache.has(cacheKey)) {
+      return this.cache.get(cacheKey)!
+    }
+
+    const existing = await db
+      .select({ principalId: principal.id })
+      .from(user)
+      .innerJoin(principal, eq(principal.userId, user.id))
+      .where(
+        and(isNull(user.email), sql`lower(${principal.displayName}) = ${trimmedName.toLowerCase()}`)
+      )
+      .orderBy(asc(principal.createdAt))
+      .limit(1)
+
+    if (existing.length > 0) {
+      const principalId = existing[0].principalId as PrincipalId
+      this.cache.set(cacheKey, principalId)
+      return principalId
+    }
+
+    const userId = createId('user')
+    const principalId = createId('principal')
+    this.pendingCreates.push({
+      principalId,
+      userId,
+      email: null,
+      name: trimmedName,
+      emailVerified: false,
+    })
+    this.cache.set(cacheKey, principalId)
+    return principalId
+  }
+
   /**
    * Flush all pending user+member creations to the database.
    * Call this once per batch after all resolves are done.
@@ -116,7 +173,12 @@ export class ImportUserResolver {
 
       // Create principal records (single multi-row insert, no N+1)
       await createPrincipals(
-        chunk.map((u) => ({ id: u.principalId, userId: u.userId, role: 'user' as const }))
+        chunk.map((u) => ({
+          id: u.principalId,
+          userId: u.userId,
+          role: 'user' as const,
+          displayName: u.name,
+        }))
       )
     }
 
diff --git a/apps/web/src/lib/server/domains/merge-suggestions/__tests__/merge-assessment.service.test.ts b/apps/web/src/lib/server/domains/merge-suggestions/__tests__/merge-assessment.service.test.ts
index 553f21acd4..e1c07a1ca9 100644
--- a/apps/web/src/lib/server/domains/merge-suggestions/__tests__/merge-assessment.service.test.ts
+++ b/apps/web/src/lib/server/domains/merge-suggestions/__tests__/merge-assessment.service.test.ts
@@ -3,6 +3,7 @@
  */
 
 import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { z } from 'zod'
 import type { PostId } from '@quackback/ids'
 import type { MergeCandidate } from '../merge-search.service'
 
@@ -115,6 +116,17 @@ describe('merge-assessment.service', () => {
       expect(results[0].reasoning).toBe('Both request dark mode')
     })
 
+    it('sends an output schema OpenAI Structured Outputs accept — no propertyNames (#505)', async () => {
+      mockChat.mockResolvedValueOnce({ results: [] })
+
+      const { assessMergeCandidates } = await import('../merge-assessment.service')
+      await assessMergeCandidates(sourcePost, candidates, 'test-model')
+
+      const call = mockChat.mock.calls.at(-1)?.[0] as { outputSchema: z.ZodType }
+      const jsonSchema = JSON.stringify(z.toJSONSchema(call.outputSchema))
+      expect(jsonSchema).not.toContain('propertyNames')
+    })
+
     it('should handle the { results: [...] } JSON shape', async () => {
       mockChat.mockResolvedValueOnce({
         results: [
diff --git a/apps/web/src/lib/server/domains/merge-suggestions/merge-assessment.service.ts b/apps/web/src/lib/server/domains/merge-suggestions/merge-assessment.service.ts
index 1a2f9e5f06..b73d742340 100644
--- a/apps/web/src/lib/server/domains/merge-suggestions/merge-assessment.service.ts
+++ b/apps/web/src/lib/server/domains/merge-suggestions/merge-assessment.service.ts
@@ -91,18 +91,16 @@ export interface MergeAssessment {
 
 const CONFIDENCE_THRESHOLD = 0.75
 
-// Item fields are intentionally loose (not typed/required) rather than a
-// strict `z.object`: the old code tolerated individual malformed items by
-// skipping just that item (the typeof guards in the filter loop below), and
-// a strict per-item schema would instead fail the WHOLE batched response —
-// and thus the whole `chat()` call — over one bad item. `results` itself
-// gets `.catch([])` so a present-but-wrong-shaped `results` field degrades
-// to "no assessments" rather than failing the request; a genuinely missing
-// or non-object top level (e.g. a bare array, which older prompts/providers
-// could still emit) is treated as a parse failure by the catch in
-// `assessMergeCandidates`, matching the old code's parse-fail → `[]` branch.
+// Avoid z.record() — Zod emits `propertyNames`, which OpenAI Structured Outputs reject.
+const MergeAssessmentItemSchema = z.strictObject({
+  candidatePostId: z.string(),
+  isDuplicate: z.boolean(),
+  confidence: z.number(),
+  reasoning: z.string(),
+})
+
 const MergeAssessmentResponseSchema = z.object({
-  results: z.array(z.record(z.string(), z.unknown())).catch([]),
+  results: z.array(MergeAssessmentItemSchema).catch([]),
 })
 
 /**
diff --git a/apps/web/src/lib/server/domains/post-tags/__tests__/post-tag.service.test.ts b/apps/web/src/lib/server/domains/post-tags/__tests__/post-tag.service.test.ts
new file mode 100644
index 0000000000..d708589446
--- /dev/null
+++ b/apps/web/src/lib/server/domains/post-tags/__tests__/post-tag.service.test.ts
@@ -0,0 +1,149 @@
+/**
+ * Tag portal visibility at the service layer.
+ *
+ * `listPublicPostTags` is the portal's tag catalog. Non-team viewers must only
+ * receive tags marked public; team actors get everything (they assign internal
+ * tags from the portal too). Create/update persist the flag, defaulting new
+ * tags to public so behaviour is unchanged for admins who never touch it.
+ *
+ * Pure unit test — the db module is stubbed with tagging operators so the
+ * `where` shape can be asserted without a database.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import type { PostTagId, PrincipalId } from '@quackback/ids'
+import type { Actor } from '@/lib/server/policy'
+
+const mockEq = vi.fn((col, val) => ({ _tag: 'eq', col, val }))
+const mockAnd = vi.fn((...args) => ({ _tag: 'and', args }))
+const mockIsNull = vi.fn((col) => ({ _tag: 'isNull', col }))
+const mockAsc = vi.fn((col) => ({ _tag: 'asc', col }))
+
+const mockPostTags = {
+  id: Symbol('postTags.id'),
+  name: Symbol('postTags.name'),
+  isPublic: Symbol('postTags.isPublic'),
+  deletedAt: Symbol('postTags.deletedAt'),
+}
+
+const mockFindMany = vi.fn()
+const mockFindFirst = vi.fn()
+const mockInsertReturning = vi.fn()
+const mockInsertValues = vi.fn(() => ({ returning: mockInsertReturning }))
+const mockUpdateReturning = vi.fn()
+const mockUpdateWhere = vi.fn(() => ({ returning: mockUpdateReturning }))
+const mockUpdateSet = vi.fn(() => ({ where: mockUpdateWhere }))
+
+vi.mock('@/lib/server/db', () => ({
+  db: {
+    query: { postTags: { findMany: mockFindMany, findFirst: mockFindFirst } },
+    insert: vi.fn(() => ({ values: mockInsertValues })),
+    update: vi.fn(() => ({ set: mockUpdateSet })),
+  },
+  eq: mockEq,
+  and: mockAnd,
+  isNull: mockIsNull,
+  asc: mockAsc,
+  postTags: mockPostTags,
+  boards: {},
+  postTagAssignments: {},
+  posts: {},
+}))
+
+const TEAM_ACTOR: Actor = {
+  principalId: 'principal_team' as PrincipalId,
+  role: 'admin',
+  principalType: 'user',
+  segmentIds: new Set(),
+  permissions: new Set(),
+}
+
+const CUSTOMER_ACTOR: Actor = {
+  principalId: 'principal_customer' as PrincipalId,
+  role: 'user',
+  principalType: 'user',
+  segmentIds: new Set(),
+  permissions: new Set(),
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mockFindMany.mockResolvedValue([])
+})
+
+describe('listPublicPostTags — portal visibility', () => {
+  it('restricts to public, non-deleted tags for an anonymous viewer (default actor)', async () => {
+    const { listPublicPostTags } = await import('../post-tag.service')
+
+    await listPublicPostTags()
+
+    const { where } = mockFindMany.mock.calls[0][0]
+    expect(where).toEqual({
+      _tag: 'and',
+      args: [
+        { _tag: 'isNull', col: mockPostTags.deletedAt },
+        { _tag: 'eq', col: mockPostTags.isPublic, val: true },
+      ],
+    })
+  })
+
+  it('restricts to public tags for a signed-in customer', async () => {
+    const { listPublicPostTags } = await import('../post-tag.service')
+
+    await listPublicPostTags(CUSTOMER_ACTOR)
+
+    expect(mockEq).toHaveBeenCalledWith(mockPostTags.isPublic, true)
+  })
+
+  it('returns every non-deleted tag for a team actor', async () => {
+    const { listPublicPostTags } = await import('../post-tag.service')
+
+    await listPublicPostTags(TEAM_ACTOR)
+
+    const { where } = mockFindMany.mock.calls[0][0]
+    expect(where).toEqual({ _tag: 'isNull', col: mockPostTags.deletedAt })
+    expect(mockEq).not.toHaveBeenCalledWith(mockPostTags.isPublic, true)
+  })
+})
+
+describe('createPostTag — isPublic', () => {
+  it('defaults new tags to public when the flag is omitted', async () => {
+    mockInsertReturning.mockResolvedValue([{ id: 'post_tag_1', isPublic: true }])
+    const { createPostTag } = await import('../post-tag.service')
+
+    await createPostTag({ name: 'Bug' })
+
+    expect(mockInsertValues).toHaveBeenCalledWith(expect.objectContaining({ isPublic: true }))
+  })
+
+  it('persists an explicit internal flag', async () => {
+    mockInsertReturning.mockResolvedValue([{ id: 'post_tag_1', isPublic: false }])
+    const { createPostTag } = await import('../post-tag.service')
+
+    await createPostTag({ name: 'Churn risk', isPublic: false })
+
+    expect(mockInsertValues).toHaveBeenCalledWith(expect.objectContaining({ isPublic: false }))
+  })
+})
+
+describe('updatePostTag — isPublic', () => {
+  beforeEach(() => {
+    mockFindFirst.mockResolvedValue({ id: 'post_tag_1', name: 'Bug', isPublic: true })
+    mockUpdateReturning.mockResolvedValue([{ id: 'post_tag_1', isPublic: false }])
+  })
+
+  it('writes isPublic when provided', async () => {
+    const { updatePostTag } = await import('../post-tag.service')
+
+    await updatePostTag('post_tag_1' as PostTagId, { isPublic: false })
+
+    expect(mockUpdateSet).toHaveBeenCalledWith({ isPublic: false })
+  })
+
+  it('leaves isPublic untouched when omitted', async () => {
+    const { updatePostTag } = await import('../post-tag.service')
+
+    await updatePostTag('post_tag_1' as PostTagId, { color: '#ef4444' })
+
+    expect(mockUpdateSet).toHaveBeenCalledWith({ color: '#ef4444' })
+  })
+})
diff --git a/apps/web/src/lib/server/domains/post-tags/post-tag.service.ts b/apps/web/src/lib/server/domains/post-tags/post-tag.service.ts
index 0d6640b3a7..57ea19788e 100644
--- a/apps/web/src/lib/server/domains/post-tags/post-tag.service.ts
+++ b/apps/web/src/lib/server/domains/post-tags/post-tag.service.ts
@@ -25,6 +25,7 @@ import {
 import type { PostTagId, BoardId } from '@quackback/ids'
 import { NotFoundError, ValidationError, ConflictError, InternalError } from '@/lib/shared/errors'
 import type { CreateTagInput, UpdateTagInput } from './post-tag.types'
+import { isTeamActor, ANONYMOUS_ACTOR, type Actor } from '@/lib/server/policy'
 import { logger } from '@/lib/server/logger'
 
 const log = logger.child({ component: 'tags' })
@@ -76,6 +77,7 @@ export async function createPostTag(input: CreateTagInput): Promise<PostTag> {
       color,
       description: input.description?.trim() || null,
       aiPrompt: input.aiPrompt?.trim() || null,
+      isPublic: input.isPublic ?? true,
     })
     .returning()
 
@@ -141,6 +143,7 @@ export async function updatePostTag(id: PostTagId, input: UpdateTagInput): Promi
   if (input.color !== undefined) updateData.color = input.color
   if (input.description !== undefined) updateData.description = input.description?.trim() || null
   if (input.aiPrompt !== undefined) updateData.aiPrompt = input.aiPrompt?.trim() || null
+  if (input.isPublic !== undefined) updateData.isPublic = input.isPublic
 
   // Update the tag
   const [updatedTag] = await db
@@ -245,16 +248,19 @@ export async function getPostTagsByBoard(boardId: BoardId): Promise<PostTag[]> {
 }
 
 /**
- * List all tags (public, no authentication required)
+ * List tags visible to a portal viewer.
  *
- * Returns tags ordered by name.
- * This method is used for public endpoints like feedback portal filtering.
+ * Team actors see every non-deleted tag (they assign internal tags from the
+ * portal too); everyone else only sees tags marked `isPublic`. Ordered by name.
+ * Used for public endpoints like feedback portal filtering.
  */
-export async function listPublicPostTags(): Promise<PostTag[]> {
+export async function listPublicPostTags(actor: Actor = ANONYMOUS_ACTOR): Promise<PostTag[]> {
   log.debug('list public tags')
   try {
     return await db.query.postTags.findMany({
-      where: isNull(postTags.deletedAt),
+      where: isTeamActor(actor)
+        ? isNull(postTags.deletedAt)
+        : and(isNull(postTags.deletedAt), eq(postTags.isPublic, true)),
       orderBy: [asc(postTags.name)],
     })
   } catch (error) {
diff --git a/apps/web/src/lib/server/domains/post-tags/post-tag.types.ts b/apps/web/src/lib/server/domains/post-tags/post-tag.types.ts
index b025229807..0d80049931 100644
--- a/apps/web/src/lib/server/domains/post-tags/post-tag.types.ts
+++ b/apps/web/src/lib/server/domains/post-tags/post-tag.types.ts
@@ -11,6 +11,8 @@ export interface CreateTagInput {
   description?: string
   /** Matching rule for AI auto-tagging of new posts; unset disables it. */
   aiPrompt?: string
+  /** Show on the public portal (default true). False = internal, team-only. */
+  isPublic?: boolean
 }
 
 /**
@@ -21,4 +23,5 @@ export interface UpdateTagInput {
   color?: string
   description?: string | null
   aiPrompt?: string | null
+  isPublic?: boolean
 }
diff --git a/apps/web/src/lib/server/domains/posts/__tests__/post-public.test.ts b/apps/web/src/lib/server/domains/posts/__tests__/post-public.test.ts
index e2a7878b2e..ad1a284a26 100644
--- a/apps/web/src/lib/server/domains/posts/__tests__/post-public.test.ts
+++ b/apps/web/src/lib/server/domains/posts/__tests__/post-public.test.ts
@@ -1,5 +1,6 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { PostStatusId } from '@quackback/ids'
+import type { PostStatusId, PostTagId, PrincipalId } from '@quackback/ids'
+import type { Actor } from '@/lib/server/policy'
 
 const mockEq = vi.fn((col, val) => ({ _tag: 'eq', col, val }))
 const mockOr = vi.fn((...args) => ({ _tag: 'or', args }))
@@ -48,6 +49,23 @@ const mockMainOrderBy = vi.fn().mockReturnValue({ limit: mockMainLimit })
 const mockMainWhere = vi.fn().mockReturnValue({ orderBy: mockMainOrderBy })
 const mockMainInnerJoin = vi.fn().mockReturnValue({ where: mockMainWhere })
 
+const mockPostTagAssignments = {
+  postId: Symbol('postTagAssignments.postId'),
+  tagId: Symbol('postTagAssignments.tagId'),
+}
+
+const mockPostTags = {
+  id: Symbol('postTags.id'),
+  name: Symbol('postTags.name'),
+  color: Symbol('postTags.color'),
+  isPublic: Symbol('postTags.isPublic'),
+}
+
+// tagIds filter subquery: selectDistinct(...).from(postTagAssignments).innerJoin(postTags).where(...)
+const TAG_SUBQUERY_MARKER = Symbol('tag_subquery')
+const mockTagSubWhere = vi.fn().mockReturnValue(TAG_SUBQUERY_MARKER)
+const mockTagSubInnerJoin = vi.fn().mockReturnValue({ where: mockTagSubWhere })
+
 // Route based on which table is passed to .from(): postStatuses = subquery chain, posts = main chain
 const mockDbSelect = vi.fn().mockImplementation(() => ({
   from: vi.fn().mockImplementation((table) => {
@@ -58,8 +76,17 @@ const mockDbSelect = vi.fn().mockImplementation(() => ({
   }),
 }))
 
+const mockDbSelectDistinct = vi.fn().mockImplementation(() => ({
+  from: vi.fn().mockImplementation((table) => {
+    if (table === mockPostTagAssignments) {
+      return { innerJoin: mockTagSubInnerJoin }
+    }
+    throw new Error('unexpected selectDistinct table')
+  }),
+}))
+
 vi.mock('@/lib/server/db', () => ({
-  db: { select: mockDbSelect },
+  db: { select: mockDbSelect, selectDistinct: mockDbSelectDistinct },
   eq: mockEq,
   and: mockAnd,
   or: mockOr,
@@ -71,15 +98,8 @@ vi.mock('@/lib/server/db', () => ({
   posts: mockPosts,
   boards: mockBoards,
   postStatuses: mockPostStatuses,
-  postTagAssignments: {
-    postId: Symbol('postTagAssignments.postId'),
-    tagId: Symbol('postTagAssignments.tagId'),
-  },
-  postTags: {
-    id: Symbol('postTags.id'),
-    name: Symbol('postTags.name'),
-    color: Symbol('postTags.color'),
-  },
+  postTagAssignments: mockPostTagAssignments,
+  postTags: mockPostTags,
   postVotes: { postId: Symbol('postVotes.postId'), principalId: Symbol('postVotes.principalId') },
   principal: { id: Symbol('principal.id') },
 }))
@@ -262,3 +282,105 @@ describe('listPublicPostsWithVotesAndAvatars — pinned posts lead every sort',
     expect(args[1]).toEqual({ _tag: 'desc', col: mockPosts.createdAt })
   })
 })
+
+// ---------------------------------------------------------------------------
+// Tag portal visibility — internal (is_public=false) tags never reach a
+// non-team viewer, neither as a filter nor attached to a post.
+// ---------------------------------------------------------------------------
+
+const TEAM_ACTOR: Actor = {
+  principalId: 'principal_team' as PrincipalId,
+  role: 'member',
+  principalType: 'user',
+  segmentIds: new Set(),
+  permissions: new Set(),
+}
+
+function isPublicFilterApplied() {
+  return mockEq.mock.calls.some(([col, val]) => col === mockPostTags.isPublic && val === true)
+}
+
+/** Whether any raw-SQL template contains the `t.is_public` guard. */
+function isPublicSqlFragmentEmitted() {
+  return mockSql.mock.calls.some((call) => {
+    const [fragments] = call as unknown as [TemplateStringsArray | undefined]
+    return fragments ? fragments.join('?').includes('t.is_public = true') : false
+  })
+}
+
+describe('tag portal visibility — tagIds filter subquery', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockSubWhere.mockReturnValue(SUBQUERY_MARKER)
+    mockTagSubWhere.mockReturnValue(TAG_SUBQUERY_MARKER)
+    mockTagSubInnerJoin.mockReturnValue({ where: mockTagSubWhere })
+    mockMainOffset.mockResolvedValue([])
+    mockMainLimit.mockReturnValue({ offset: mockMainOffset })
+    mockMainOrderBy.mockReturnValue({ limit: mockMainLimit })
+    mockMainWhere.mockReturnValue({ orderBy: mockMainOrderBy })
+    mockMainInnerJoin.mockReturnValue({ where: mockMainWhere })
+  })
+
+  it('joins the tag catalog and requires is_public for an anonymous viewer', async () => {
+    const { listPublicPostsWithVotesAndAvatars } = await import('../post.public')
+
+    await listPublicPostsWithVotesAndAvatars({ tagIds: ['post_tag_1' as PostTagId] })
+
+    expect(mockTagSubInnerJoin).toHaveBeenCalledWith(mockPostTags, expect.anything())
+    expect(mockInArray).toHaveBeenCalledWith(mockPostTagAssignments.tagId, ['post_tag_1'])
+    expect(isPublicFilterApplied()).toBe(true)
+    expect(mockInArray).toHaveBeenCalledWith(mockPosts.id, TAG_SUBQUERY_MARKER)
+  })
+
+  it('does not restrict the tag filter for a team viewer', async () => {
+    const { listPublicPostsWithVotesAndAvatars } = await import('../post.public')
+
+    await listPublicPostsWithVotesAndAvatars({
+      tagIds: ['post_tag_1' as PostTagId],
+      actor: TEAM_ACTOR,
+    })
+
+    expect(mockInArray).toHaveBeenCalledWith(mockPostTagAssignments.tagId, ['post_tag_1'])
+    expect(isPublicFilterApplied()).toBe(false)
+  })
+})
+
+describe('tag portal visibility — tags embedded on listed posts', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockSubWhere.mockReturnValue(SUBQUERY_MARKER)
+    mockMainOffset.mockResolvedValue([])
+    mockMainLimit.mockReturnValue({ offset: mockMainOffset })
+    mockMainOrderBy.mockReturnValue({ limit: mockMainLimit })
+    mockMainWhere.mockReturnValue({ orderBy: mockMainOrderBy })
+    mockMainInnerJoin.mockReturnValue({ where: mockMainWhere })
+  })
+
+  it('listPublicPosts guards the json_agg tag subquery with is_public for an anonymous viewer', async () => {
+    const { listPublicPosts } = await import('../post.public')
+
+    await listPublicPosts({})
+
+    expect(isPublicSqlFragmentEmitted()).toBe(true)
+  })
+
+  it('listPublicPosts leaves the json_agg tag subquery unguarded for a team viewer', async () => {
+    const { listPublicPosts } = await import('../post.public')
+
+    await listPublicPosts({ actor: TEAM_ACTOR })
+
+    expect(isPublicSqlFragmentEmitted()).toBe(false)
+  })
+
+  it('publicTagCondition is undefined for team actors and an is_public predicate otherwise', async () => {
+    const { publicTagCondition } = await import('../post.public')
+    const { ANONYMOUS_ACTOR } = await import('@/lib/server/policy')
+
+    expect(publicTagCondition(TEAM_ACTOR)).toBeUndefined()
+    expect(publicTagCondition(ANONYMOUS_ACTOR)).toEqual({
+      _tag: 'eq',
+      col: mockPostTags.isPublic,
+      val: true,
+    })
+  })
+})
diff --git a/apps/web/src/lib/server/domains/posts/post.public.detail.ts b/apps/web/src/lib/server/domains/posts/post.public.detail.ts
index 6a9578899f..996777bd35 100644
--- a/apps/web/src/lib/server/domains/posts/post.public.detail.ts
+++ b/apps/web/src/lib/server/domains/posts/post.public.detail.ts
@@ -18,7 +18,7 @@ import { toUuid, fromUuid, type PostId, type PostCommentId, type PrincipalId } f
 import { buildCommentTree, toStatusChange } from '@/lib/shared'
 import type { PublicPostDetail, PublicComment, PinnedComment } from './post.types'
 import { DEFAULT_COMMENT_PAGE_SIZE, encodeCommentCursor, decodeCommentCursor } from './comment-page'
-import { resolveAvatarUrl, parseJson } from './post.public'
+import { resolveAvatarUrl, parseJson, publicTagSqlFilter } from './post.public'
 import { getExecuteRows } from '@/lib/server/utils'
 import {
   canViewPost,
@@ -149,7 +149,7 @@ export async function getPublicPostDetail(
           (SELECT json_agg(json_build_object('id', t.id, 'name', t.name, 'color', t.color))
            FROM ${postTagAssignments} pt
            INNER JOIN ${postTags} t ON t.id = pt.tag_id
-           WHERE pt.post_id = ${posts.id}),
+           WHERE pt.post_id = ${posts.id} ${publicTagSqlFilter(actor)}),
           '[]'
         )`.as('tags_json'),
         authorName: sql<string | null>`(
diff --git a/apps/web/src/lib/server/domains/posts/post.public.ts b/apps/web/src/lib/server/domains/posts/post.public.ts
index 6b11e6182b..9969f5c0bd 100644
--- a/apps/web/src/lib/server/domains/posts/post.public.ts
+++ b/apps/web/src/lib/server/domains/posts/post.public.ts
@@ -28,10 +28,29 @@ import {
 } from '@quackback/ids'
 import type { PublicPostListResult } from './post.types'
 import type { RespondedFilter } from '@/lib/shared/types/filters'
-import { postViewFilter, ANONYMOUS_ACTOR, type Actor } from '@/lib/server/policy'
+import { postViewFilter, isTeamActor, ANONYMOUS_ACTOR, type Actor } from '@/lib/server/policy'
 
 import { resolveUserAvatarUrl } from '@/lib/server/domains/principals/principal-display'
 
+/**
+ * Portal tag visibility. Non-team viewers only see tags marked public —
+ * both in filter lists and attached to posts — so an internal tag never
+ * reaches a customer. Team actors see every tag (they assign internal tags
+ * from the portal too). Returns undefined for team actors so it can be
+ * dropped into `and(...)` without a branch.
+ */
+export function publicTagCondition(actor: Actor) {
+  return isTeamActor(actor) ? undefined : eq(postTags.isPublic, true)
+}
+
+/**
+ * Raw-SQL twin of {@link publicTagCondition} for the `json_agg` tag
+ * subqueries, which alias `post_tags` as `t`. Empty for team actors.
+ */
+export function publicTagSqlFilter(actor: Actor) {
+  return isTeamActor(actor) ? sql`` : sql`AND t.is_public = true`
+}
+
 /** Resolve avatar URL — uploaded key first, then OAuth/external URL. */
 export function resolveAvatarUrl(source: {
   avatarKey?: string | null
@@ -156,10 +175,14 @@ function buildPostFilterConditions(params: PostListParams, actor: Actor) {
   }
 
   if (tagIds && tagIds.length > 0) {
+    // Join the tag catalog so an internal tag id in a crafted URL is inert
+    // for non-team callers — otherwise the filter would reveal which posts
+    // carry a tag the viewer is never shown.
     const postIdsWithTagsSubquery = db
       .selectDistinct({ postId: postTagAssignments.postId })
       .from(postTagAssignments)
-      .where(inArray(postTagAssignments.tagId, tagIds))
+      .innerJoin(postTags, eq(postTags.id, postTagAssignments.tagId))
+      .where(and(inArray(postTagAssignments.tagId, tagIds), publicTagCondition(actor)))
     conditions.push(inArray(posts.id, postIdsWithTagsSubquery))
   }
 
@@ -277,7 +300,7 @@ export async function listPublicPostsWithVotesAndAvatars(
           })
           .from(postTagAssignments)
           .innerJoin(postTags, eq(postTags.id, postTagAssignments.tagId))
-          .where(inArray(postTagAssignments.postId, pagePostIds))
+          .where(and(inArray(postTagAssignments.postId, pagePostIds), publicTagCondition(actor)))
       : Promise.resolve([]),
     pageAuthorIds.length > 0
       ? db
@@ -359,7 +382,7 @@ export async function listPublicPosts(
         (SELECT json_agg(json_build_object('id', t.id, 'name', t.name, 'color', t.color))
          FROM ${postTagAssignments} pt
          INNER JOIN ${postTags} t ON t.id = pt.tag_id
-         WHERE pt.post_id = ${posts.id}),
+         WHERE pt.post_id = ${posts.id} ${publicTagSqlFilter(actor)}),
         '[]'
       )`.as('tags_json'),
       authorName: sql<string | null>`(
diff --git a/apps/web/src/lib/server/domains/roadmaps/__tests__/roadmap-derived-query.test.ts b/apps/web/src/lib/server/domains/roadmaps/__tests__/roadmap-derived-query.test.ts
index 58630b17ef..6bc902a962 100644
--- a/apps/web/src/lib/server/domains/roadmaps/__tests__/roadmap-derived-query.test.ts
+++ b/apps/web/src/lib/server/domains/roadmaps/__tests__/roadmap-derived-query.test.ts
@@ -33,6 +33,7 @@ import {
 import { DEFAULT_BOARD_ACCESS, type BoardAccess } from '@/lib/shared/db-types'
 import { ANONYMOUS_ACTOR, type Actor } from '@/lib/server/policy'
 import { getPublicRoadmapPosts, getRoadmapPosts } from '../roadmap.query'
+import { listPublicRoadmaps } from '../roadmap.service'
 
 const fixture = await createDbTestFixture({
   probe: async (db) => {
@@ -303,6 +304,92 @@ describe.skipIf(!fixture.available)('roadmap derived membership (real DB)', () =
     expect(admin.items.some((post) => post.id === merged)).toBe(false)
   })
 
+  it('makes an internal tag inert in caller-supplied public roadmap filters, but not for team', async () => {
+    const seeded = await seedBase()
+    const roadmapId = await seedRoadmap(seeded, {})
+    const [internalTag] = await testDb
+      .insert(postTags)
+      .values({ name: `Internal roadmap tag ${suffix()}`, isPublic: false })
+      .returning()
+    const tagged = await seedPost(seeded)
+    await seedPost(seeded)
+    await testDb.insert(postTagAssignments).values({ postId: tagged, tagId: internalTag.id })
+
+    // A non-team viewer filtering by the internal tag's id must not learn
+    // which posts carry it: the filter matches nothing rather than leaking.
+    const anonymous = await getPublicRoadmapPosts(
+      roadmapId,
+      { statusId: seeded.statusA, tagIds: [internalTag.id] },
+      ANONYMOUS_ACTOR
+    )
+    expect(anonymous.items).toEqual([])
+    expect(anonymous.total).toBe(0)
+
+    // Public tags still filter normally for the same viewer.
+    await testDb.insert(postTagAssignments).values({ postId: tagged, tagId: seeded.tagA })
+    const byPublicTag = await getPublicRoadmapPosts(
+      roadmapId,
+      { statusId: seeded.statusA, tagIds: [seeded.tagA] },
+      ANONYMOUS_ACTOR
+    )
+    expect(byPublicTag.items.map((post) => post.id)).toEqual([tagged])
+
+    // Team viewers see and filter by internal tags.
+    const team = await getPublicRoadmapPosts(
+      roadmapId,
+      { statusId: seeded.statusA, tagIds: [internalTag.id] },
+      actor({ role: 'member', principalId: seeded.authorA })
+    )
+    expect(team.items.map((post) => post.id)).toEqual([tagged])
+
+    // The admin-configured base filter is not caller-controlled and keeps
+    // defining membership even when it names an internal tag.
+    const internalBaseRoadmap = await seedRoadmap(seeded, {
+      baseFilter: { tagIds: [internalTag.id] },
+    })
+    const viaBase = await getPublicRoadmapPosts(
+      internalBaseRoadmap,
+      { statusId: seeded.statusA },
+      ANONYMOUS_ACTOR
+    )
+    expect(viaBase.items.map((post) => post.id)).toEqual([tagged])
+  })
+
+  it('redacts internal tag ids from public roadmap base filters for non-team viewers', async () => {
+    const seeded = await seedBase()
+    const [internalTag] = await testDb
+      .insert(postTags)
+      .values({ name: `Internal curation tag ${suffix()}`, isPublic: false })
+      .returning()
+    const mixed = await seedRoadmap(seeded, {
+      baseFilter: { boardIds: [seeded.boardA], tagIds: [seeded.tagA, internalTag.id] },
+    })
+    const onlyInternal = await seedRoadmap(seeded, { baseFilter: { tagIds: [internalTag.id] } })
+    const tagged = await seedPost(seeded)
+    await testDb.insert(postTagAssignments).values({ postId: tagged, tagId: internalTag.id })
+
+    const anonymous = await listPublicRoadmaps(ANONYMOUS_ACTOR)
+    const anonMixed = anonymous.find((r) => r.id === mixed)!
+    const anonOnlyInternal = anonymous.find((r) => r.id === onlyInternal)!
+    expect(anonMixed.baseFilter).toEqual({ boardIds: [seeded.boardA], tagIds: [seeded.tagA] })
+    expect(anonOnlyInternal.baseFilter).toEqual({})
+    expect(JSON.stringify(anonymous)).not.toContain(internalTag.id)
+
+    // Redaction is payload-only: the curation still defines membership.
+    const posts = await getPublicRoadmapPosts(
+      onlyInternal,
+      { statusId: seeded.statusA },
+      ANONYMOUS_ACTOR
+    )
+    expect(posts.items.map((post) => post.id)).toEqual([tagged])
+
+    const team = await listPublicRoadmaps(actor({ role: 'member', principalId: seeded.authorA }))
+    expect(team.find((r) => r.id === mixed)!.baseFilter.tagIds).toEqual([
+      seeded.tagA,
+      internalTag.id,
+    ])
+  })
+
   it('enforces public, team, and matching-segment roadmap visibility', async () => {
     const seeded = await seedBase()
     const publicRoadmap = await seedRoadmap(seeded, { visibility: 'public' })
diff --git a/apps/web/src/lib/server/domains/roadmaps/roadmap.query.ts b/apps/web/src/lib/server/domains/roadmaps/roadmap.query.ts
index 05814c2f61..1105752590 100644
--- a/apps/web/src/lib/server/domains/roadmaps/roadmap.query.ts
+++ b/apps/web/src/lib/server/domains/roadmaps/roadmap.query.ts
@@ -13,6 +13,7 @@ import {
   roadmapColumns,
   posts,
   postTagAssignments,
+  postTags,
   boards,
   userSegments,
   type Roadmap,
@@ -20,6 +21,7 @@ import {
 import { type RoadmapId } from '@quackback/ids'
 import { NotFoundError, ValidationError } from '@/lib/shared/errors'
 import { ANONYMOUS_ACTOR, boardViewFilter, canViewRoadmap, type Actor } from '@/lib/server/policy'
+import { publicTagCondition } from '@/lib/server/domains/posts/post.public'
 import {
   parseRoadmapDateBucket,
   roadmapBaseFilterSchema,
@@ -42,19 +44,32 @@ function parseBaseFilter(roadmap: Roadmap): RoadmapBaseFilter {
   return parsed.data as RoadmapBaseFilter
 }
 
-function addDimensionConditions(conditions: SQL[], filter: RoadmapBaseFilter): void {
+/**
+ * `viewer` is set only for caller-supplied (runtime) filters on the public
+ * roadmap: an internal tag id in a crafted URL must then be inert for
+ * non-team viewers, or the filter would reveal which posts carry a tag they
+ * are never shown. Admin-configured base filters define the roadmap's
+ * membership and are not caller-controlled, so they pass no viewer.
+ */
+function addDimensionConditions(
+  conditions: SQL[],
+  filter: RoadmapBaseFilter,
+  viewer?: Actor
+): void {
   if (filter.statusIds?.length) conditions.push(inArray(posts.statusId, filter.statusIds))
   if (filter.boardIds?.length) conditions.push(inArray(posts.boardId, filter.boardIds))
   if (filter.tagIds?.length) {
-    conditions.push(
-      inArray(
-        posts.id,
-        db
+    const tagSubquery = viewer
+      ? db
+          .selectDistinct({ postId: postTagAssignments.postId })
+          .from(postTagAssignments)
+          .innerJoin(postTags, eq(postTags.id, postTagAssignments.tagId))
+          .where(and(inArray(postTagAssignments.tagId, filter.tagIds), publicTagCondition(viewer)))
+      : db
           .selectDistinct({ postId: postTagAssignments.postId })
           .from(postTagAssignments)
           .where(inArray(postTagAssignments.tagId, filter.tagIds))
-      )
-    )
+    conditions.push(inArray(posts.id, tagSubquery))
   }
   if (filter.segmentIds?.length) {
     conditions.push(
@@ -105,18 +120,22 @@ function membershipConditions(
   return conditions
 }
 
-function runtimeFilterConditions(options: RoadmapPostsQueryOptions): SQL[] {
+function runtimeFilterConditions(options: RoadmapPostsQueryOptions, viewer?: Actor): SQL[] {
   const conditions: SQL[] = []
   if (options.search) {
     conditions.push(
       sql`${posts.searchVector} @@ websearch_to_tsquery('english', ${options.search})`
     )
   }
-  addDimensionConditions(conditions, {
-    boardIds: options.boardIds,
-    tagIds: options.tagIds,
-    segmentIds: options.segmentIds,
-  })
+  addDimensionConditions(
+    conditions,
+    {
+      boardIds: options.boardIds,
+      tagIds: options.tagIds,
+      segmentIds: options.segmentIds,
+    },
+    viewer
+  )
   return conditions
 }
 
@@ -149,7 +168,10 @@ async function queryRoadmapPosts(
   } else {
     conditions.push(isNull(boards.deletedAt))
   }
-  conditions.push(...membershipConditions(roadmap, options), ...runtimeFilterConditions(options))
+  conditions.push(
+    ...membershipConditions(roadmap, options),
+    ...runtimeFilterConditions(options, publicActor)
+  )
   const orderBy = sortFor(options)
 
   const [results, countResult] = await Promise.all([
diff --git a/apps/web/src/lib/server/domains/roadmaps/roadmap.service.ts b/apps/web/src/lib/server/domains/roadmaps/roadmap.service.ts
index 95673e14db..ee39048e8c 100644
--- a/apps/web/src/lib/server/domains/roadmaps/roadmap.service.ts
+++ b/apps/web/src/lib/server/domains/roadmaps/roadmap.service.ts
@@ -9,15 +9,16 @@ import {
   roadmaps,
   roadmapColumns,
   postStatuses,
+  postTags,
   type Roadmap,
   type RoadmapColumn,
   type Transaction,
 } from '@/lib/server/db'
-import type { RoadmapId, RoadmapColumnId } from '@quackback/ids'
+import type { PostTagId, RoadmapId, RoadmapColumnId } from '@quackback/ids'
 import { positionCaseSql } from '@/lib/server/utils'
 import { NotFoundError, ValidationError, ConflictError } from '@/lib/shared/errors'
 import { roadmapBaseFilterSchema } from '@/lib/shared/roadmap-config'
-import { roadmapViewFilter, type Actor, ANONYMOUS_ACTOR } from '@/lib/server/policy'
+import { roadmapViewFilter, isTeamActor, type Actor, ANONYMOUS_ACTOR } from '@/lib/server/policy'
 import type {
   CreateRoadmapColumnInput,
   CreateRoadmapInput,
@@ -281,14 +282,54 @@ export async function listRoadmaps(): Promise<RoadmapWithColumns[]> {
   })
 }
 
+/**
+ * Roadmaps visible to `actor`, with internal tag ids redacted from each
+ * `baseFilter` for non-team viewers.
+ *
+ * An admin may curate a public roadmap by an internal tag; the curation still
+ * applies (membership is admin-defined, see roadmap.query), but the tag id
+ * itself must not reach the portal payload, or a viewer could correlate it
+ * with the returned posts and learn which of them carry a tag they are never
+ * shown. Team actors receive the filter unredacted.
+ */
 export async function listPublicRoadmaps(
   actor: Actor = ANONYMOUS_ACTOR
 ): Promise<RoadmapWithColumns[]> {
-  return db.query.roadmaps.findMany({
+  const result = await db.query.roadmaps.findMany({
     where: roadmapViewFilter(actor),
     orderBy: [asc(roadmaps.position)],
     with: { columns: { orderBy: [asc(roadmapColumns.position)] } },
   })
+  if (isTeamActor(actor)) return result
+
+  const referenced = new Set<PostTagId>()
+  for (const roadmap of result) {
+    for (const tagId of roadmap.baseFilter.tagIds ?? []) referenced.add(tagId)
+  }
+  if (referenced.size === 0) return result
+
+  const publicRows = await db
+    .select({ id: postTags.id })
+    .from(postTags)
+    .where(
+      and(
+        inArray(postTags.id, [...referenced]),
+        eq(postTags.isPublic, true),
+        isNull(postTags.deletedAt)
+      )
+    )
+  const publicIds = new Set<PostTagId>(publicRows.map((row) => row.id))
+
+  return result.map((roadmap) => {
+    const tagIds = roadmap.baseFilter.tagIds
+    if (!tagIds?.length) return roadmap
+    const visible = tagIds.filter((id) => publicIds.has(id))
+    if (visible.length === tagIds.length) return roadmap
+    const baseFilter = { ...roadmap.baseFilter }
+    if (visible.length) baseFilter.tagIds = visible
+    else delete baseFilter.tagIds
+    return { ...roadmap, baseFilter }
+  })
 }
 
 export async function reorderRoadmaps(roadmapIds: RoadmapId[]): Promise<void> {
diff --git a/apps/web/src/lib/server/fleet/__tests__/migrator-gate.test.ts b/apps/web/src/lib/server/fleet/__tests__/migrator-gate.test.ts
index b31368cf04..ab656a5a0f 100644
--- a/apps/web/src/lib/server/fleet/__tests__/migrator-gate.test.ts
+++ b/apps/web/src/lib/server/fleet/__tests__/migrator-gate.test.ts
@@ -351,6 +351,7 @@ describe('replayGateVerdict', () => {
       '0274_external_link_scope',
       '0275_changelog_entry_boards',
       '0276_identity_provider_logo_key',
+      '0277_post_tags_is_public',
     ])
     const verdict = replayGateVerdict(before, verdictsFor(replaySetFor(before)), false)
     expect(verdict.ok).toBe(false)
diff --git a/apps/web/src/lib/server/functions/__tests__/portal-gate-extended.test.ts b/apps/web/src/lib/server/functions/__tests__/portal-gate-extended.test.ts
index 50c50cf674..3f55368ea6 100644
--- a/apps/web/src/lib/server/functions/__tests__/portal-gate-extended.test.ts
+++ b/apps/web/src/lib/server/functions/__tests__/portal-gate-extended.test.ts
@@ -40,6 +40,7 @@
  *   8  topViewedChangelogsFn
  */
 import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { policyActorFromAuth } from '@/lib/server/functions/auth-helpers'
 
 // ---------------------------------------------------------------------------
 // Shared handler registry
@@ -335,6 +336,22 @@ describe('portal.ts fetchPortalData — portal-visibility gate', () => {
     await h[FETCH_PORTAL_DATA]({ data: { sort: 'top' } })
     expect(mockListPublicBoardsWithStats).toHaveBeenCalledTimes(1)
   })
+
+  it('scopes the tag list to the resolved actor so internal tags stay team-only', async () => {
+    mockResolvePortalAccess.mockResolvedValue({ granted: true, reason: 'public' })
+    mockListPublicBoardsWithStats.mockResolvedValue([])
+    mockListPublicPostsWithVotesAndAvatars.mockResolvedValue({ items: [], hasMore: false })
+    mockListPublicStatuses.mockResolvedValue([])
+    mockListPublicTags.mockResolvedValue([])
+    mockGetVotedPostIdsByUserId.mockResolvedValue(new Set())
+    const actor = { principalId: null, role: null, principalType: 'anonymous' }
+    vi.mocked(policyActorFromAuth).mockResolvedValueOnce(actor as never)
+
+    const h = await loadModule(PORTAL)
+    await h[FETCH_PORTAL_DATA]({ data: { sort: 'top' } })
+    expect(mockListPublicTags).toHaveBeenCalledTimes(1)
+    expect(mockListPublicTags).toHaveBeenCalledWith(actor)
+  })
 })
 
 // ---------------------------------------------------------------------------
@@ -583,6 +600,17 @@ describe('portal.ts fetchPublicTags — portal-visibility gate', () => {
     expect(result).toHaveLength(1)
     expect(result[0].id).toBe('tag_1')
   })
+
+  it('passes the resolved actor so the service can hide internal tags from non-team viewers', async () => {
+    mockResolvePortalAccess.mockResolvedValue({ granted: true, reason: 'public' })
+    mockListPublicTags.mockResolvedValue([])
+    const actor = { principalId: 'principal_1', role: 'member', principalType: 'user' }
+    vi.mocked(policyActorFromAuth).mockResolvedValueOnce(actor as never)
+
+    const h = await loadModule(PORTAL)
+    await h[FETCH_PUBLIC_TAGS]({ data: {} })
+    expect(mockListPublicTags).toHaveBeenCalledWith(actor)
+  })
 })
 
 // ---------------------------------------------------------------------------
diff --git a/apps/web/src/lib/server/functions/portal.ts b/apps/web/src/lib/server/functions/portal.ts
index 1a22ccebac..ee7fb7d181 100644
--- a/apps/web/src/lib/server/functions/portal.ts
+++ b/apps/web/src/lib/server/functions/portal.ts
@@ -202,7 +202,8 @@ export const fetchPortalData = createServerFn({ method: 'GET' })
           segmentIds,
         }),
         listPublicStatuses(),
-        listPublicPostTags(),
+        // Actor-scoped: internal tags are only listed for team viewers.
+        listPublicPostTags(actor),
         // Get ALL voted post IDs for this user (runs in parallel, we'll filter to displayed posts)
         data.userId
           ? getVotedPostIdsByUserId(data.userId as UserId)
@@ -449,7 +450,12 @@ export const fetchPublicTags = createServerFn({ method: 'GET' }).handler(async (
     log.debug('portal access denied, returning empty')
     return []
   }
-  return await listPublicPostTags()
+
+  // Team viewers assign tags from the portal, so they need the full catalog;
+  // everyone else only gets tags marked public.
+  const auth = await getOptionalAuth()
+  const actor = await policyActorFromAuth(auth)
+  return await listPublicPostTags(actor)
 })
 
 export const fetchUserAvatar = createServerFn({ method: 'GET' })
diff --git a/apps/web/src/lib/server/functions/post-tags.ts b/apps/web/src/lib/server/functions/post-tags.ts
index ad51418bb9..3c420fd809 100644
--- a/apps/web/src/lib/server/functions/post-tags.ts
+++ b/apps/web/src/lib/server/functions/post-tags.ts
@@ -31,6 +31,7 @@ const createTagSchema = z.object({
     .default('#6b7280'),
   description: z.string().max(200).optional(),
   aiPrompt: z.string().max(500).optional(),
+  isPublic: z.boolean().optional(),
 })
 
 const getTagSchema = z.object({
@@ -46,6 +47,7 @@ const updateTagSchema = z.object({
     .optional(),
   description: z.string().max(200).optional().nullable(),
   aiPrompt: z.string().max(500).optional().nullable(),
+  isPublic: z.boolean().optional(),
 })
 
 const deleteTagSchema = z.object({
@@ -114,6 +116,7 @@ export const createPostTagFn = createServerFn({ method: 'POST' })
       color: data.color,
       description: data.description,
       aiPrompt: data.aiPrompt,
+      isPublic: data.isPublic,
     })
     log.info({ tag_id: tag.id }, 'tag created')
     return tag
@@ -134,6 +137,7 @@ export const updatePostTagFn = createServerFn({ method: 'POST' })
       color: data.color,
       description: data.description,
       aiPrompt: data.aiPrompt,
+      isPublic: data.isPublic,
     })
     log.info({ tag_id: tag.id }, 'tag updated')
 
diff --git a/apps/web/src/lib/server/jobs/JOBS.md b/apps/web/src/lib/server/jobs/JOBS.md
index 1d86a1fae8..13d3fd4215 100644
--- a/apps/web/src/lib/server/jobs/JOBS.md
+++ b/apps/web/src/lib/server/jobs/JOBS.md
@@ -255,12 +255,13 @@ Read from `process.env` directly rather than through the zod config, matching
 `process-role.ts`: these must work in any context, including a worker process that
 has not loaded the full application config.
 
-| Variable               | Default | Meaning                                                             |
-| ---------------------- | ------- | ------------------------------------------------------------------- |
-| `JOB_POLL_INTERVAL_MS` | 1000    | How often each workspace loop claims work                           |
-| `JOB_BATCH_SIZE`       | 5       | Jobs claimed per drain pass                                         |
-| `JOB_REAP_INTERVAL_MS` | 15000   | How often expired leases are adjudicated                            |
-| `JOB_RETENTION_MS`     | 7 days  | How long terminal rows are kept. Must exceed any live cron slot key |
+| Variable                | Default | Meaning                                                                                       |
+| ----------------------- | ------- | --------------------------------------------------------------------------------------------- |
+| `JOB_POLL_INTERVAL_MS`  | 1000    | How often each workspace loop claims work                                                     |
+| `JOB_BATCH_SIZE`        | 5       | Jobs claimed per drain pass                                                                   |
+| `JOB_REAP_INTERVAL_MS`  | 15000   | How often expired leases are adjudicated                                                      |
+| `JOB_PRUNE_INTERVAL_MS` | 1 hour  | How often terminal rows past retention are dropped (a per-workspace table scan; keep it slow) |
+| `JOB_RETENTION_MS`      | 7 days  | How long terminal rows are kept. Must exceed any live cron slot key                           |
 
 ### Worker job logs
 
diff --git a/apps/web/src/lib/server/jobs/__tests__/job-queue.test.ts b/apps/web/src/lib/server/jobs/__tests__/job-queue.test.ts
index a7d2bc513b..9ce1400046 100644
--- a/apps/web/src/lib/server/jobs/__tests__/job-queue.test.ts
+++ b/apps/web/src/lib/server/jobs/__tests__/job-queue.test.ts
@@ -689,6 +689,27 @@ describe('per-queue retention', () => {
     const rows = await rowsFor(q)
     expect(rows.map((r) => r.status)).toEqual(['failed'])
   })
+
+  it('keeps a row past the shortest window but inside its own longer one', async () => {
+    // The index-usable floor is the shortest retention anywhere; it must only
+    // ever narrow the scan, never decide the outcome for a queue kept longer.
+    const short = queue('retention-floor-short')
+    const long = queue('retention-floor-long')
+    for (const q of [short, long]) {
+      await enqueueJob({ queue: q, dedupeKey: 'done' })
+      const [job] = await claimJobs({ specs: [{ queue: q, limit: 1, leaseMs: LEASE }] })
+      await completeJob(job)
+    }
+    await testSql()`
+      UPDATE job_queue SET finished_at = now() - interval '3 days'
+      WHERE queue IN (${short}, ${long})
+    `
+    // Default one day is the floor; the long queue keeps successes thirty.
+    await pruneTerminalJobs(86_400_000, { [long]: { succeeded: 30 * 86_400_000 } })
+
+    expect(await rowsFor(short)).toHaveLength(0)
+    expect((await rowsFor(long)).map((r) => r.status)).toEqual(['succeeded'])
+  })
 })
 
 describe('transactional enqueue', () => {
diff --git a/apps/web/src/lib/server/jobs/__tests__/runner.test.ts b/apps/web/src/lib/server/jobs/__tests__/runner.test.ts
index c0342e5bf2..70bf0594c4 100644
--- a/apps/web/src/lib/server/jobs/__tests__/runner.test.ts
+++ b/apps/web/src/lib/server/jobs/__tests__/runner.test.ts
@@ -522,6 +522,25 @@ describe('maintenance', () => {
     expect(rows[0].status).toBe('failed')
     expect(rows[0].last_error).toMatch(/no attempts remaining/)
   })
+
+  it('leaves aged terminal rows alone when the prune is not due', async () => {
+    const q = queue('maintenance-no-prune')
+    __setJobDefinitionsForTests([{ name: q, maxAttempts: 1, handler: async () => async () => {} }])
+
+    await enqueueJob({ queue: q, dedupeKey: 'stranded', maxAttempts: 1 })
+    await claimJobs({ specs: [{ queue: q, limit: 1, leaseMs: 30_000 }] })
+    await expireLease(q)
+    await enqueueJob({ queue: q, dedupeKey: 'ancient', maxAttempts: 1 })
+    await testSql()`
+      UPDATE job_queue SET status = 'succeeded', finished_at = now() - interval '400 days'
+      WHERE queue = ${q} AND dedupe_key = 'ancient'
+    `
+
+    const result = await runMaintenanceTick(CONFIG, { prune: false })
+    expect(result.terminated).toBeGreaterThanOrEqual(1)
+    expect(result.pruned).toBe(0)
+    expect((await rowsFor(q)).map((r) => r.status).sort()).toEqual(['failed', 'succeeded'])
+  })
 })
 
 describe('the bounded pool', () => {
diff --git a/apps/web/src/lib/server/jobs/__tests__/worker.test.ts b/apps/web/src/lib/server/jobs/__tests__/worker.test.ts
index d71cd8b477..bf33fcabfc 100644
--- a/apps/web/src/lib/server/jobs/__tests__/worker.test.ts
+++ b/apps/web/src/lib/server/jobs/__tests__/worker.test.ts
@@ -5,6 +5,8 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
 
 const POLL_MS = 50
+const REAP_MS = POLL_MS * 4
+const PRUNE_MS = REAP_MS * 10
 const WORKSPACE_KEY = 'job_loop_ws'
 
 const workspace = {
@@ -18,6 +20,8 @@ const workspace = {
 
 interface ClaimPlan {
   claimed: number
+  /** `prune` flag of every `runMaintenanceTick` call, in order, when provided. */
+  maintenance?: boolean[]
 }
 
 async function bootJobWorker(plan: ClaimPlan) {
@@ -45,7 +49,8 @@ async function bootJobWorker(plan: ClaimPlan) {
     runnerConfig: () => ({
       pollIntervalMs: POLL_MS,
       batchSize: 5,
-      reapIntervalMs: 15_000,
+      reapIntervalMs: REAP_MS,
+      pruneIntervalMs: PRUNE_MS,
       retentionMs: 7 * 24 * 60 * 60 * 1000,
       maxConcurrency: 4,
     }),
@@ -53,7 +58,10 @@ async function bootJobWorker(plan: ClaimPlan) {
     poolSize: () => 0,
     createScheduleState: () => ({}),
     runScheduleTick: async () => ({ enqueued: 0, attempted: 0, nextSlotAt: null }),
-    runMaintenanceTick: async () => ({ requeued: 0, terminated: 0 }),
+    runMaintenanceTick: async (_config: unknown, opts: { prune?: boolean } = {}) => {
+      plan.maintenance?.push(opts.prune !== false)
+      return { requeued: 0, terminated: 0, pruned: 0 }
+    },
     dispatchPass: async () => ({ claimed: plan.claimed, saturated: true }),
     runJob: async () => 'succeeded',
     awaitPool: async () => {},
@@ -102,6 +110,24 @@ describe('pooled job worker', () => {
     expect(handle.status().claimed).toBeGreaterThanOrEqual(2)
   })
 
+  it('reaps leases on the reap clock and prunes only on the slower prune clock', async () => {
+    // Retention is measured in days; pruning on every reap tick scans every
+    // workspace's terminal rows for nothing. Only the first tick of each prune
+    // window carries the flag.
+    vi.useFakeTimers()
+    const plan: ClaimPlan = { claimed: 0, maintenance: [] }
+    handle = await bootJobWorker(plan)
+    expect(plan.maintenance).toEqual([true])
+
+    await vi.advanceTimersByTimeAsync(PRUNE_MS - REAP_MS)
+    const withinWindow = plan.maintenance!.slice(1)
+    expect(withinWindow.length).toBeGreaterThanOrEqual(2)
+    expect(withinWindow.every((prune) => prune === false)).toBe(true)
+
+    await vi.advanceTimersByTimeAsync(REAP_MS * 2)
+    expect(plan.maintenance!.filter(Boolean)).toHaveLength(2)
+  })
+
   it('does not start the job worker on a web replica', async () => {
     vi.resetModules()
     vi.doMock('@/lib/server/process-role', () => ({ shouldRunWorkers: () => false }))
diff --git a/apps/web/src/lib/server/jobs/job-queue.ts b/apps/web/src/lib/server/jobs/job-queue.ts
index 0a320702dd..225c9f8926 100644
--- a/apps/web/src/lib/server/jobs/job-queue.ts
+++ b/apps/web/src/lib/server/jobs/job-queue.ts
@@ -658,6 +658,11 @@ export async function pruneTerminalJobs(
   // stays answerable long after the successful traffic has been discarded. One
   // fleet-wide window either bloats the highest-volume queue's table or throws
   // away the diagnostic history the low-volume ones were keeping on purpose.
+  const overrideSecs = Object.values(perQueueMs).flatMap((byStatus) =>
+    Object.values(byStatus)
+      .filter((ms): ms is number => typeof ms === 'number')
+      .map((ms) => ms / 1000)
+  )
   const overrides = JSON.stringify(
     Object.fromEntries(
       Object.entries(perQueueMs).map(([queue, byStatus]) => [
@@ -670,9 +675,17 @@ export async function pruneTerminalJobs(
       ])
     )
   )
+  // The per-row retention below depends on the row's own `queue` and `status`,
+  // so the planner cannot use `job_queue_terminal_idx` for it and would scan
+  // every terminal row on every prune. The shortest retention anywhere is a
+  // plain constant bound that every qualifying row also satisfies, so it goes
+  // first as the index-usable filter; the precise test then runs only on rows
+  // already past that floor.
+  const floorSecs = Math.min(olderThanMs / 1000, ...overrideSecs)
   const result = await db.execute(sql`
     DELETE FROM job_queue
     WHERE status IN ('succeeded', 'failed')
+      AND finished_at < now() - make_interval(secs => ${floorSecs})
       AND finished_at < now() - make_interval(
         secs => COALESCE(
           (${overrides}::jsonb -> queue ->> status)::numeric,
diff --git a/apps/web/src/lib/server/jobs/runner.ts b/apps/web/src/lib/server/jobs/runner.ts
index f81e59628b..579327bde4 100644
--- a/apps/web/src/lib/server/jobs/runner.ts
+++ b/apps/web/src/lib/server/jobs/runner.ts
@@ -65,6 +65,13 @@ export interface RunnerConfig {
   batchSize: number
   /** How often expired leases are reclaimed. */
   reapIntervalMs: number
+  /**
+   * How often terminal rows past retention are pruned. Retention is measured
+   * in days, so this is deliberately much slower than `reapIntervalMs`: a lost
+   * lease has to be noticed quickly, an aged row does not, and the prune is a
+   * table scan on every workspace in a pooled fleet.
+   */
+  pruneIntervalMs: number
   /** How long terminal rows are kept. Must exceed any live cron slot key. */
   retentionMs: number
   /**
@@ -89,6 +96,7 @@ export function runnerConfig(): RunnerConfig {
     pollIntervalMs: envInt('JOB_POLL_INTERVAL_MS', 1_000, 50, 600_000),
     batchSize: envInt('JOB_BATCH_SIZE', 5, 1, 100),
     reapIntervalMs: envInt('JOB_REAP_INTERVAL_MS', 15_000, 500, 3_600_000),
+    pruneIntervalMs: envInt('JOB_PRUNE_INTERVAL_MS', 3_600_000, 1_000, 86_400_000),
     retentionMs: envInt('JOB_RETENTION_MS', 7 * 24 * 60 * 60 * 1000, 60_000, 365 * 86_400_000),
     maxConcurrency: envInt('JOB_MAX_CONCURRENCY', totalDeclaredConcurrency(), 1, 512),
   }
@@ -665,9 +673,20 @@ export interface MaintenanceResult extends ReapResult {
   pruned: number
 }
 
-/** Reclaim expired leases, then drop terminal rows past retention. */
-export async function runMaintenanceTick(config: RunnerConfig): Promise<MaintenanceResult> {
+/**
+ * Reclaim expired leases and, when the caller says the prune is due, drop
+ * terminal rows past retention.
+ *
+ * The two run on different clocks (`reapIntervalMs` vs `pruneIntervalMs`); the
+ * loop owns both and tells this function which fired. `prune` defaults to on so
+ * a caller with a single clock keeps the historical "both, every tick" shape.
+ */
+export async function runMaintenanceTick(
+  config: RunnerConfig,
+  opts: { prune?: boolean } = {}
+): Promise<MaintenanceResult> {
   const reaped = await reapExpiredLeases()
-  const pruned = await pruneTerminalJobs(config.retentionMs, retentionOverrides())
+  const pruned =
+    opts.prune === false ? 0 : await pruneTerminalJobs(config.retentionMs, retentionOverrides())
   return { ...reaped, pruned }
 }
diff --git a/apps/web/src/lib/server/jobs/worker.ts b/apps/web/src/lib/server/jobs/worker.ts
index ea14dd4aa0..64f5606a69 100644
--- a/apps/web/src/lib/server/jobs/worker.ts
+++ b/apps/web/src/lib/server/jobs/worker.ts
@@ -113,6 +113,7 @@ function startLoop(opts: {
   let waitResolve: (() => void) | null = null
   let nextScheduleAt = 0
   let nextMaintenanceAt = 0
+  let nextPruneAt = 0
   let descriptor: WorkspaceDescriptor | null = opts.workspace
   const schedule = createScheduleState()
   const pool = createJobPool()
@@ -186,10 +187,12 @@ function startLoop(opts: {
             nextScheduleAt = tick.nextSlotAt ? tick.nextSlotAt.getTime() : now + 60_000
           }
           if (now >= nextMaintenanceAt) {
-            const maintenance = await runMaintenanceTick(opts.config)
+            const prune = now >= nextPruneAt
+            const maintenance = await runMaintenanceTick(opts.config, { prune })
             s.requeued += maintenance.requeued
             s.terminated += maintenance.terminated
             nextMaintenanceAt = now + opts.config.reapIntervalMs
+            if (prune) nextPruneAt = now + opts.config.pruneIntervalMs
           }
           return dispatchPass({
             pool,
diff --git a/apps/web/src/lib/server/policy/dep-graph/GRAPH.md b/apps/web/src/lib/server/policy/dep-graph/GRAPH.md
index 930dd5445b..2078f347db 100644
--- a/apps/web/src/lib/server/policy/dep-graph/GRAPH.md
+++ b/apps/web/src/lib/server/policy/dep-graph/GRAPH.md
@@ -59,7 +59,7 @@ Edges (28):
 ## 3. Server domains (lib/server/domains)
 
 Nodes (49): activity, ai, analytics, api, api-keys, assistant, billing, boards, changelog, channel-accounts, channels, comments, companies, company-attributes, conversation, conversation-attributes, conversation-views, embeddings, export, help-center, import, inbox, macros, merge-suggestions, moderation, notifications, office-hours, platform-credentials, post-tags, post-views, posts, principals, push-devices, roadmaps, roles, segments, sentiment, settings, sla, status, statuses, subscriptions, summary, teams, tickets, user-attributes, users, webhooks, workflows
-Edges (115):
+Edges (116):
 
 - analytics -> api
 - analytics -> assistant
@@ -145,6 +145,7 @@ Edges (115):
 - principals -> roles
 - principals -> settings
 - principals -> teams
+- roadmaps -> posts
 - roles -> settings
 - sentiment -> ai
 - sentiment -> settings
diff --git a/apps/web/src/lib/server/policy/migration-contract/CONTRACT.md b/apps/web/src/lib/server/policy/migration-contract/CONTRACT.md
index faad5c8dac..bb7636faae 100644
--- a/apps/web/src/lib/server/policy/migration-contract/CONTRACT.md
+++ b/apps/web/src/lib/server/policy/migration-contract/CONTRACT.md
@@ -6,7 +6,7 @@ Regenerate with `bunx vitest run apps/web/src/lib/server/policy/migration-contra
 
 ## Summary
 
-Migrations scanned: 254. Migrations with destructive DDL: 33.
+Migrations scanned: 255. Migrations with destructive DDL: 33.
 
 | Kind | Occurrences |
 | --- | --- |
diff --git a/apps/web/src/lib/shared/schemas/import.ts b/apps/web/src/lib/shared/schemas/import.ts
index 4ca21058e7..5e6f38cc2b 100644
--- a/apps/web/src/lib/shared/schemas/import.ts
+++ b/apps/web/src/lib/shared/schemas/import.ts
@@ -15,5 +15,5 @@ export const REQUIRED_HEADERS = ['title', 'content'] as const
  */
 export const CSV_TEMPLATE = `title,content,status,tags,board,author_name,author_email,email_verified,vote_count,created_at,source_id
 "Add dark mode support","It would be great to have a dark mode option for the app. Many users prefer working in low-light environments.","open","feature,ui","","John Doe","john@example.com","false","5","2024-01-15T10:30:00Z",""
-"Fix login timeout","Users are being logged out too quickly. The session timeout seems too aggressive.","under_review","bug","","","","","2","",""
+"Fix login timeout","Users are being logged out too quickly. The session timeout seems too aggressive.","under_review","bug","","Jane Doe","","","2","",""
 `
diff --git a/apps/web/src/routes/api/v1/tags/$tagId.ts b/apps/web/src/routes/api/v1/tags/$tagId.ts
index 9fe33244a6..511e85a810 100644
--- a/apps/web/src/routes/api/v1/tags/$tagId.ts
+++ b/apps/web/src/routes/api/v1/tags/$tagId.ts
@@ -19,6 +19,7 @@ const updateTagSchema = z.object({
     .regex(/^#[0-9A-Fa-f]{6}$/, 'Color must be a valid hex color')
     .optional(),
   description: z.string().max(200).optional().nullable(),
+  isPublic: z.boolean().optional(),
 })
 
 export const Route = createFileRoute('/api/v1/tags/$tagId')({
@@ -43,6 +44,7 @@ export const Route = createFileRoute('/api/v1/tags/$tagId')({
             name: tag.name,
             color: tag.color,
             description: tag.description,
+            isPublic: tag.isPublic,
             createdAt: tag.createdAt.toISOString(),
           })
         } catch (error) {
@@ -75,6 +77,7 @@ export const Route = createFileRoute('/api/v1/tags/$tagId')({
             name: parsed.data.name,
             color: parsed.data.color,
             description: parsed.data.description,
+            isPublic: parsed.data.isPublic,
           })
 
           return successResponse({
@@ -82,6 +85,7 @@ export const Route = createFileRoute('/api/v1/tags/$tagId')({
             name: tag.name,
             color: tag.color,
             description: tag.description,
+            isPublic: tag.isPublic,
             createdAt: tag.createdAt.toISOString(),
           })
         } catch (error) {
diff --git a/apps/web/src/routes/api/v1/tags/index.ts b/apps/web/src/routes/api/v1/tags/index.ts
index 9e332326c8..da0bb464ef 100644
--- a/apps/web/src/routes/api/v1/tags/index.ts
+++ b/apps/web/src/routes/api/v1/tags/index.ts
@@ -18,6 +18,7 @@ const createTagSchema = z.object({
     .optional()
     .default('#6b7280'),
   description: z.string().max(200).optional(),
+  isPublic: z.boolean().optional(),
 })
 
 export const Route = createFileRoute('/api/v1/tags/')({
@@ -42,6 +43,7 @@ export const Route = createFileRoute('/api/v1/tags/')({
               name: tag.name,
               color: tag.color,
               description: tag.description,
+              isPublic: tag.isPublic,
               createdAt: tag.createdAt.toISOString(),
             }))
           )
@@ -75,6 +77,7 @@ export const Route = createFileRoute('/api/v1/tags/')({
             name: parsed.data.name,
             color: parsed.data.color,
             description: parsed.data.description,
+            isPublic: parsed.data.isPublic,
           })
 
           return createdResponse({
@@ -82,6 +85,7 @@ export const Route = createFileRoute('/api/v1/tags/')({
             name: tag.name,
             color: tag.color,
             description: tag.description,
+            isPublic: tag.isPublic,
             createdAt: tag.createdAt.toISOString(),
           })
         } catch (error) {
diff --git a/packages/db/drizzle/0277_post_tags_is_public.sql b/packages/db/drizzle/0277_post_tags_is_public.sql
new file mode 100644
index 0000000000..94ad20ef93
--- /dev/null
+++ b/packages/db/drizzle/0277_post_tags_is_public.sql
@@ -0,0 +1,4 @@
+-- Per-tag portal visibility. Existing tags were always shown on the public
+-- portal, so the default keeps that behaviour; admins opt individual tags out
+-- to make them internal (team-only). Additive / expand-only.
+ALTER TABLE "post_tags" ADD COLUMN IF NOT EXISTS "is_public" boolean DEFAULT true NOT NULL;
diff --git a/packages/db/drizzle/meta/_journal.json b/packages/db/drizzle/meta/_journal.json
index f00e5a813b..57ccd3d41d 100644
--- a/packages/db/drizzle/meta/_journal.json
+++ b/packages/db/drizzle/meta/_journal.json
@@ -1779,6 +1779,13 @@
       "when": 1785700000034,
       "tag": "0276_identity_provider_logo_key",
       "breakpoints": true
+    },
+    {
+      "idx": 254,
+      "version": "7",
+      "when": 1785700000035,
+      "tag": "0277_post_tags_is_public",
+      "breakpoints": true
     }
   ]
 }
diff --git a/packages/db/src/__tests__/schema.test.ts b/packages/db/src/__tests__/schema.test.ts
index 6eb4c810ca..ba6206e5d6 100644
--- a/packages/db/src/__tests__/schema.test.ts
+++ b/packages/db/src/__tests__/schema.test.ts
@@ -95,8 +95,16 @@ describe('Schema definitions', () => {
       expect(columns).toContain('id')
       expect(columns).toContain('name')
       expect(columns).toContain('color')
+      expect(columns).toContain('isPublic')
       expect(columns).toContain('createdAt')
     })
+
+    it('defaults isPublic to true so existing tags stay visible on the portal', () => {
+      const { isPublic } = getTableColumns(postTags)
+      expect(isPublic.notNull).toBe(true)
+      expect(isPublic.hasDefault).toBe(true)
+      expect(isPublic.default).toBe(true)
+    })
   })
 
   describe('posts schema', () => {
diff --git a/packages/db/src/generate-sample-csv.ts b/packages/db/src/generate-sample-csv.ts
index b4e740de3a..1304c96123 100644
--- a/packages/db/src/generate-sample-csv.ts
+++ b/packages/db/src/generate-sample-csv.ts
@@ -358,22 +358,17 @@ function escapeCSV(value: string): string {
 // ============================================================================
 
 function generateRow(): string[] {
-  // Author: 75% have author, 25% anonymous
-  const hasAuthor = Math.random() > 0.25
-  let authorName = ''
-  let authorEmail = ''
-
-  if (hasAuthor) {
-    if (Math.random() < 0.6) {
-      const persona = pick(userPersonas)
-      authorName = `${persona.firstName} ${persona.lastName}`
-      authorEmail = `${persona.firstName.toLowerCase()}.${persona.lastName.toLowerCase()}@example.com`
-    } else {
-      const firstName = faker.person.firstName()
-      const lastName = faker.person.lastName()
-      authorName = `${firstName} ${lastName}`
-      authorEmail = faker.internet.email({ firstName, lastName }).toLowerCase()
-    }
+  let authorName: string
+  let authorEmail: string
+  if (Math.random() < 0.6) {
+    const persona = pick(userPersonas)
+    authorName = `${persona.firstName} ${persona.lastName}`
+    authorEmail = `${persona.firstName.toLowerCase()}.${persona.lastName.toLowerCase()}@example.com`
+  } else {
+    const firstName = faker.person.firstName()
+    const lastName = faker.person.lastName()
+    authorName = `${firstName} ${lastName}`
+    authorEmail = faker.internet.email({ firstName, lastName }).toLowerCase()
   }
 
   // Tags: 0-3 with weighted selection
diff --git a/packages/db/src/schema/boards.ts b/packages/db/src/schema/boards.ts
index 5f449fb561..6dfef7897d 100644
--- a/packages/db/src/schema/boards.ts
+++ b/packages/db/src/schema/boards.ts
@@ -4,6 +4,7 @@ import {
   timestamp,
   jsonb,
   integer,
+  boolean,
   index,
   uniqueIndex,
   check,
@@ -129,6 +130,9 @@ export const postTags = pgTable(
     // Matching rule for AI auto-tagging: new posts are evaluated against every
     // tag whose prompt is set, and matching tags are assigned automatically.
     aiPrompt: text('ai_prompt'),
+    // Portal visibility: when false the tag is internal — non-team portal
+    // viewers never see it in filter lists or on posts. Team actors see all.
+    isPublic: boolean('is_public').default(true).notNull(),
     createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
     // Soft delete support
     deletedAt: timestamp('deleted_at', { withTimezone: true }),
diff --git a/packages/email/src/__tests__/email-brand-name.test.ts b/packages/email/src/__tests__/email-brand-name.test.ts
new file mode 100644
index 0000000000..15e98c052c
--- /dev/null
+++ b/packages/email/src/__tests__/email-brand-name.test.ts
@@ -0,0 +1,107 @@
+import { describe, it, expect } from 'vitest'
+import { render } from '@react-email/components'
+import { WelcomeEmail } from '../templates/welcome'
+import { InvitationEmail } from '../templates/invitation'
+import { MagicLinkEmail } from '../templates/magic-link'
+import { PasswordResetEmail } from '../templates/password-reset'
+
+const BRAND = 'Acme Feedback'
+
+// React Email emits an empty comment between static text and an interpolated
+// expression (`Sign in to {brandName}` → `Sign in to <!-- -->Acme Feedback`).
+// Drop it so a heading reads as the plain phrase a recipient sees. This does not
+// touch the "Powered by Quackback" footer, which is the separate attribution
+// link and is expected to stay regardless of the brand name.
+const phrases = (html: string) => html.replace(/<!-- -->/g, '')
+
+describe('templates speak in the configured brand name', () => {
+  it('WelcomeEmail uses the brand in the heading and sign-off', async () => {
+    const html = phrases(
+      await render(
+        WelcomeEmail({
+          name: 'Alice',
+          workspaceName: 'Acme',
+          dashboardUrl: 'https://example.com/dashboard',
+          brandName: BRAND,
+        })
+      )
+    )
+    expect(html).toContain(`Welcome to ${BRAND}!`)
+    expect(html).toContain(`The ${BRAND} Team`)
+    expect(html).not.toContain('Welcome to Quackback!')
+    expect(html).not.toContain('The Quackback Team')
+  })
+
+  it('InvitationEmail names the brand alongside the workspace', async () => {
+    const html = phrases(
+      await render(
+        InvitationEmail({
+          invitedByName: 'Bob',
+          organizationName: 'Acme',
+          inviteLink: 'https://example.com/invite',
+          brandName: BRAND,
+        })
+      )
+    )
+    // Both halves stay distinct: the workspace is Acme, the product is the brand.
+    expect(html).toContain('Acme')
+    expect(html).toContain(`on ${BRAND}.`)
+  })
+
+  it('MagicLinkEmail uses the brand in the heading', async () => {
+    const html = phrases(
+      await render(
+        MagicLinkEmail({
+          signInUrl: 'https://example.com/verify-magic-link?token=abc',
+          code: '123456',
+          brandName: BRAND,
+        })
+      )
+    )
+    expect(html).toContain(`Sign in to ${BRAND}`)
+    expect(html).not.toContain('Sign in to Quackback')
+  })
+
+  it('PasswordResetEmail uses the brand in the preview', async () => {
+    const html = phrases(
+      await render(PasswordResetEmail({ resetLink: 'https://example.com/reset', brandName: BRAND }))
+    )
+    expect(html).toContain(`Reset your ${BRAND} password`)
+    expect(html).not.toContain('Reset your Quackback password')
+  })
+})
+
+describe('templates default to Quackback when no brand is set', () => {
+  it('WelcomeEmail falls back to Quackback', async () => {
+    const html = phrases(
+      await render(
+        WelcomeEmail({
+          name: 'Alice',
+          workspaceName: 'Acme',
+          dashboardUrl: 'https://example.com/dashboard',
+        })
+      )
+    )
+    expect(html).toContain('Welcome to Quackback!')
+    expect(html).toContain('The Quackback Team')
+  })
+
+  it('MagicLinkEmail falls back to Quackback', async () => {
+    const html = phrases(
+      await render(
+        MagicLinkEmail({
+          signInUrl: 'https://example.com/verify-magic-link?token=abc',
+          code: '123456',
+        })
+      )
+    )
+    expect(html).toContain('Sign in to Quackback')
+  })
+
+  it('PasswordResetEmail falls back to Quackback', async () => {
+    const html = phrases(
+      await render(PasswordResetEmail({ resetLink: 'https://example.com/reset' }))
+    )
+    expect(html).toContain('Reset your Quackback password')
+  })
+})
diff --git a/packages/email/src/index.ts b/packages/email/src/index.ts
index b8136b3733..55201de5ab 100644
--- a/packages/email/src/index.ts
+++ b/packages/email/src/index.ts
@@ -71,6 +71,21 @@ function getEnv(key: string): string | undefined {
   return process.env[key]
 }
 
+/**
+ * The product name that transactional subjects and headings speak in.
+ *
+ * Defaults to Quackback, which is what the hosted service and every existing
+ * install already say. A self-hoster running under their own brand sets
+ * `EMAIL_BRAND_NAME` once, and the sign-in, invite, welcome, and reset mails
+ * then carry that name instead — the inbox being the one surface that in-app
+ * theming, a custom logo, and a custom domain never reach. This is the product
+ * name, not the per-workspace name: `workspaceName` still names the board the
+ * mail is about, so "join Acme on Quackback" keeps both halves distinct.
+ */
+function productName(): string {
+  return getEnv('EMAIL_BRAND_NAME') || 'Quackback'
+}
+
 /**
  * A send refused because the install is not configured for it.
  *
@@ -560,13 +575,14 @@ export async function sendInvitationEmail(params: SendInvitationParams): Promise
 
   return sendEmail({
     to,
-    subject: `You've been invited to join ${workspaceName} on Quackback`,
+    subject: `You've been invited to join ${workspaceName} on ${productName()}`,
     react: InvitationEmail({
       invitedByName,
       inviteeName,
       organizationName: workspaceName,
       inviteLink,
       logoUrl,
+      brandName: productName(),
     }),
     emailType: 'InvitationEmail',
     preview: { inviteLink },
@@ -614,8 +630,8 @@ export async function sendWelcomeEmail(params: SendWelcomeParams): Promise<Email
 
   return sendEmail({
     to,
-    subject: `Welcome to ${workspaceName} on Quackback!`,
-    react: WelcomeEmail({ name, workspaceName, dashboardUrl, logoUrl }),
+    subject: `Welcome to ${workspaceName} on ${productName()}!`,
+    react: WelcomeEmail({ name, workspaceName, dashboardUrl, logoUrl, brandName: productName() }),
     emailType: 'WelcomeEmail',
     preview: { dashboardUrl },
   })
@@ -638,8 +654,8 @@ export async function sendMagicLinkEmail(params: SendMagicLinkParams): Promise<E
   log.debug('sending sign-in email')
   return sendEmail({
     to,
-    subject: 'Your Quackback sign-in link',
-    react: MagicLinkEmail({ signInUrl, code, logoUrl }),
+    subject: `Your ${productName()} sign-in link`,
+    react: MagicLinkEmail({ signInUrl, code, logoUrl, brandName: productName() }),
     emailType: 'MagicLinkEmail',
     preview: { signInUrl, code },
   })
@@ -674,7 +690,7 @@ export async function sendSignupNotAllowedEmail(
   log.debug('sending sign-in refusal email')
   return sendEmail({
     to,
-    subject: 'About your Quackback sign-in request',
+    subject: `About your ${productName()} sign-in request`,
     react: SignupNotAllowedEmail({ workspaceName, logoUrl }),
     emailType: 'SignupNotAllowedEmail',
   })
@@ -698,8 +714,8 @@ export async function sendPasswordResetEmail(
   log.debug('sending password reset email')
   return sendEmail({
     to,
-    subject: 'Reset your Quackback password',
-    react: PasswordResetEmail({ resetLink, logoUrl }),
+    subject: `Reset your ${productName()} password`,
+    react: PasswordResetEmail({ resetLink, logoUrl, brandName: productName() }),
     emailType: 'PasswordResetEmail',
     preview: { resetLink },
   })
diff --git a/packages/email/src/templates/invitation.tsx b/packages/email/src/templates/invitation.tsx
index b5dcf9e715..bc33d96a98 100644
--- a/packages/email/src/templates/invitation.tsx
+++ b/packages/email/src/templates/invitation.tsx
@@ -8,6 +8,7 @@ interface InvitationEmailProps {
   organizationName: string
   inviteLink: string
   logoUrl?: string
+  brandName?: string
 }
 
 export function InvitationEmail({
@@ -16,10 +17,11 @@ export function InvitationEmail({
   organizationName,
   inviteLink,
   logoUrl,
+  brandName = 'Quackback',
 }: InvitationEmailProps) {
   return (
     <EmailLayout
-      preview={`Join ${organizationName} on Quackback`}
+      preview={`Join ${organizationName} on ${brandName}`}
       logoUrl={logoUrl}
       logoAlt={organizationName}
     >
@@ -29,7 +31,7 @@ export function InvitationEmail({
       </Heading>
       <Text style={typography.text}>
         <strong>{invitedByName}</strong> has invited you to join <strong>{organizationName}</strong>{' '}
-        on Quackback.
+        on {brandName}.
       </Text>
 
       {/* CTA Button */}
diff --git a/packages/email/src/templates/magic-link.tsx b/packages/email/src/templates/magic-link.tsx
index 9f696c3234..eefd593231 100644
--- a/packages/email/src/templates/magic-link.tsx
+++ b/packages/email/src/templates/magic-link.tsx
@@ -6,6 +6,7 @@ interface MagicLinkEmailProps {
   signInUrl: string
   code: string
   logoUrl?: string
+  brandName?: string
 }
 
 /**
@@ -17,10 +18,15 @@ interface MagicLinkEmailProps {
  * verification record on the server, so the user can pick whichever is
  * convenient.
  */
-export function MagicLinkEmail({ signInUrl, code, logoUrl }: MagicLinkEmailProps) {
+export function MagicLinkEmail({
+  signInUrl,
+  code,
+  logoUrl,
+  brandName = 'Quackback',
+}: MagicLinkEmailProps) {
   return (
-    <EmailLayout preview="Your sign-in link" logoUrl={logoUrl}>
-      <Heading style={{ ...typography.h1, textAlign: 'center' }}>Sign in to Quackback</Heading>
+    <EmailLayout preview="Your sign-in link" logoUrl={logoUrl} logoAlt={brandName}>
+      <Heading style={{ ...typography.h1, textAlign: 'center' }}>Sign in to {brandName}</Heading>
       <Text style={{ ...typography.text, textAlign: 'center' }}>
         Click the button below to finish signing in.
       </Text>
diff --git a/packages/email/src/templates/password-reset.tsx b/packages/email/src/templates/password-reset.tsx
index 70a4f7d467..acee211667 100644
--- a/packages/email/src/templates/password-reset.tsx
+++ b/packages/email/src/templates/password-reset.tsx
@@ -5,11 +5,16 @@ import { typography, button, utils } from './shared-styles'
 interface PasswordResetEmailProps {
   resetLink: string
   logoUrl?: string
+  brandName?: string
 }
 
-export function PasswordResetEmail({ resetLink, logoUrl }: PasswordResetEmailProps) {
+export function PasswordResetEmail({
+  resetLink,
+  logoUrl,
+  brandName = 'Quackback',
+}: PasswordResetEmailProps) {
   return (
-    <EmailLayout preview="Reset your Quackback password" logoUrl={logoUrl}>
+    <EmailLayout preview={`Reset your ${brandName} password`} logoUrl={logoUrl} logoAlt={brandName}>
       {/* Content */}
       <Heading style={{ ...typography.h1, textAlign: 'center' }}>Reset your password</Heading>
       <Text style={{ ...typography.text, textAlign: 'center' }}>
diff --git a/packages/email/src/templates/welcome.tsx b/packages/email/src/templates/welcome.tsx
index 459168dfad..945d9c4b58 100644
--- a/packages/email/src/templates/welcome.tsx
+++ b/packages/email/src/templates/welcome.tsx
@@ -7,17 +7,24 @@ interface WelcomeEmailProps {
   workspaceName: string
   dashboardUrl: string
   logoUrl?: string
+  brandName?: string
 }
 
-export function WelcomeEmail({ name, workspaceName, dashboardUrl, logoUrl }: WelcomeEmailProps) {
+export function WelcomeEmail({
+  name,
+  workspaceName,
+  dashboardUrl,
+  logoUrl,
+  brandName = 'Quackback',
+}: WelcomeEmailProps) {
   return (
     <EmailLayout
-      preview={`Welcome to ${workspaceName} on Quackback`}
+      preview={`Welcome to ${workspaceName} on ${brandName}`}
       logoUrl={logoUrl}
       logoAlt={workspaceName}
     >
       {/* Content */}
-      <Heading style={typography.h1}>Welcome to Quackback!</Heading>
+      <Heading style={typography.h1}>Welcome to {brandName}!</Heading>
       <Text style={typography.text}>
         Hi {name}, your workspace <strong>{workspaceName}</strong> is ready. Start collecting and
         managing customer feedback today.
@@ -53,7 +60,7 @@ export function WelcomeEmail({ name, workspaceName, dashboardUrl, logoUrl }: Wel
       <TransactionalFooter>
         Happy collecting!
         <br />
-        The Quackback Team
+        The {brandName} Team
       </TransactionalFooter>
     </EmailLayout>
   )
diff --git a/scripts/__tests__/coverage-scope.test.ts b/scripts/__tests__/coverage-scope.test.ts
index d4635612c9..a4ce71230c 100644
--- a/scripts/__tests__/coverage-scope.test.ts
+++ b/scripts/__tests__/coverage-scope.test.ts
@@ -50,6 +50,7 @@ describe('the coverage scope the gate grades against (B7)', () => {
     expect(coverageScope().exclude).toEqual([
       ...coverageConfigDefaults.exclude,
       'scripts/*-check.ts',
+      'packages/db/src/generate-sample-csv.ts',
     ])
   })
 
diff --git a/scripts/import/README.md b/scripts/import/README.md
index 85c99c0be4..05184749b3 100644
--- a/scripts/import/README.md
+++ b/scripts/import/README.md
@@ -27,6 +27,9 @@ Generic CSV files (posts, comments, votes, notes)
 To migrate from another tool (Canny, UserVoice, ...), export your data there and
 map it onto the intermediate CSV columns below. If you only need posts, the
 in-app CSV import under **Admin → Settings → Imports & exports** is simpler.
+There, every row needs `author_name` or `author_email` (`author_name` without
+an email creates a name-only contact). The CLI path below still identifies
+authors by email.
 
 ## Quick Start
 
diff --git a/vitest.config.ts b/vitest.config.ts
index 7c491c0df2..8c63bf4e59 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -58,6 +58,12 @@ export default defineConfig({
         // `scripts/__tests__/*-gate.test.ts`. The policy modules beside them
         // (`*-policy.ts`) hold the logic and are graded normally.
         'scripts/*-check.ts',
+        // Same shape: `bun run db:generate-csv` runs this file as a process,
+        // it reads argv and writes a file at module scope, so importing it
+        // in-process is not an option. Its contract — every generated row is
+        // one the importer accepts — is covered by spawning it:
+        // `domains/import/__tests__/sample-csv-imports.test.ts`.
+        'packages/db/src/generate-sample-csv.ts',
       ],
     },
     // Use ts-node or vite's transformation instead of stripping