- Public modlog no longer discloses access-restricted subjects: a subject that is not publicly admitted (pending, rejected, community-removed, unadmitted, or a comment on such a root) is projected without subject or community, kept in the admin log's privateSubject, and dropped from subject/collection/community-filtered public pages; decided at read time with the anonymous admission predicate. - Edits the consumers reject (postv2 community retarget, comment threading change, same-rkey comment re-create with a changed parent) now add owner-scoped blocks for their new images on a removed subject (Q-I6). One MediaReconciler interface serves both consumers. - Blocked-media purge job runs through runTicker: per-cycle recover and deadline. - CDN purge queue: interrupted targets are rescheduled without counting an attempt; each sweep batch has its own timeout; failures log one aggregated error per code, naming refused credentials for 401/403. - moderation_media_purges rejects an empty owner_did; removal refuses an indexed subject with images but no owner. - Tests pin the kind='removal' filter in the three raw removal readers and the content-row FOR SHARE lock against a concurrent author edit. - Docs: release gate 5 no longer promises a #notFoundPost fallback; the PRD records what is implemented and the Q-LABEL-LOG public-log scope. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>