diff --git a/AGENTS.md b/AGENTS.md
index e3b26784d..1fc2152ab 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -4938,7 +4938,7 @@ contributions without contacting every contributor individually.
 | Re-apply (Reban) affordance on the public banlist for expired / unbanned rows | `web/themes/default/page_bans.tpl`. The desktop row-actions cell emits `<a class="btn btn--secondary btn--sm" data-testid="row-action-reapply" href="index.php?p=admin&c=bans&section=add-ban&rebanid={$ban.bid}&key={$admin_postkey}">…<i data-lucide="rotate-ccw">…Re-apply</a>` when `$can_add_ban && ($ban.state == 'expired' \|\| $ban.state == 'unbanned')`. The smart-default block on `admin.bans.php`'s `add-ban` section detects `?rebanid=…` and pre-populates the form via `BansPrepareReban`. Mobile parity (this PR) — the mobile card was restructured from a single wrapping `<a>` to the `page_comms.tpl` shape (`<div data-testid="ban-card">` wrapping `<a class="ban-card__summary" data-testid="drawer-trigger">` + a sibling `<div class="row-actions ban-card__actions">`), so the same Re-apply button surfaces under `data-testid="row-action-reapply-mobile"`. The drawer trigger stays the inner anchor's `data-drawer-href` + `data-testid="drawer-trigger"` so the existing responsive spec selector keeps working. |
 | Fan rcon kick / block commands out to every enabled server after a successful `Actions.BansAdd` / `Actions.CommsAdd` (the hidden `<iframe id="srvkicker">` pattern) | `web/themes/default/page_admin_bans_add.tpl` (#1441 — `Actions.BansAdd .then(r => ...)` handler reads `r.data.kickit` and spawns the iframe pointing at `pages/admin.kickit.php?check=<check>&type=<type>`) + `web/themes/default/page_admin_comms_add.tpl` (the older sibling — `Actions.CommsAdd .then(r => ...)` reads `r.data.block` and spawns the iframe pointing at `pages/admin.blockit.php?check=<steam>&type=<type>&length=<length>`). The URL parameter `check=` is symmetric across both surfaces; the JS envelope field names are NOT — bans.add returns `r.data.kickit.check` while comms.add returns `r.data.block.steam`, because `api_bans_add` and `api_comms_add` chose different envelope shapes when the kickit/blockit envelopes were originally added. Always read the server-side envelope shape (`web/api/handlers/bans.php::api_bans_add` / `web/api/handlers/comms.php::api_comms_add`) FIRST when porting between the two branches. The iframe template (`web/themes/default/page_kickit.tpl` / `page_blockit.tpl`) auto-fires `Actions.KickitLoadServers` (or `Actions.BlockitLoadServers`) on `window.addEventListener('load', ...)` which enumerates enabled servers and fans out per-server `Actions.KickitKickPlayer` / `Actions.BlockitBlockPlayer` rcon calls. The iframe is `display: none` — the operator never sees it, but the panel can spawn it from any surface that needs server-side rcon side-effects (the right-click context menu's "Kick player" item navigates to the same `pages/admin.kickit.php` URL as a top-level document instead — see "Add or extend the server-player right-click context menu" row). Don't reach for `setBusy(submitBtn, false)` after spawning the iframe — the success branch keeps the button busy through the 2s `setTimeout` that reloads the parent page (matching `page_admin_comms_add.tpl`'s shape), preventing operators from queuing a second submit while rcon fans out. Regression guards: `web/tests/e2e/specs/flows/ban-kickit-iframe.spec.ts` (#1441 — stubs both `Actions.BansAdd` and `pages/admin.kickit.php` at the network layer; asserts the iframe is spawned exactly once with `toBe(1)` on the request count so a future double-mount regression — e.g. a `.then()` chain that resolves twice, a `dispatchEvent` re-firing the submit handler, a `setBusy` gap — surfaces immediately) + `web/tests/e2e/specs/flows/kickit-iframe.spec.ts` (#1433 — exercises the deeper rcon round-trip via the context-menu path) + `web/tests/api/KickitTest.php` (PHPUnit — handler permission gate + malformed-input envelopes). Pre-#1441 the bans-add side carried a `typeof window.ShowKickBox === 'function'` guard pointing at a v1.x helper that was deleted at #1123 D1; the `if` body silently never ran and operators reported "banning doesn't kick" (the canonical "chrome reads as success while the load-bearing action never fired" UI regression — see the matching anti-pattern entry under Anti-patterns). |
 | Wrap a public-list legacy advanced-search form (banlist / commslist) in a default-collapsed `<details class="filters-details">` disclosure | `web/themes/default/page_bans.tpl` + `web/themes/default/page_comms.tpl` (#1315). The same `.filters-details` rules in `web/themes/default/css/theme.css` cover the chrome (summary chevron, `[open]` state, hover bg, focus ring, count badge); the public-list usage adds a `.filters-details__body > form.card` rule that suppresses the inner card framing because the disclosure body wraps a `{load_template file="admin.bans.search"}` (or `…comms.search`) — i.e. a sibling page-render that emits its own `<form class="card">`. The View DTO (`Sbpp\View\BanListView` / `Sbpp\View\CommsListView`) carries a `bool $is_advanced_search_open` set by the page handler from `isset($_GET['advSearch']) && (string) $_GET['advSearch'] !== ''` so the legacy `?advSearch=…&advType=…` URL shim auto-opens the disclosure. Bare `?p=banlist` / `?p=commslist` and simple-bar filters (`?searchText=` / `?server=` / `?time=`) leave it closed so the unfiltered list reaches above the fold. Selectors anchor on `[data-testid="banlist-advsearch-disclosure"]` / `[data-testid="commslist-advsearch-disclosure"]` (the `<details>`) + the `…-toggle` (the `<summary>`) + the `…-active` count badge. The same `.filters-details` chrome was introduced for admin-admins by #1303 — both surfaces share the CSS so a future tweak is single-source. |
-| Surface admin-authored per-ban / per-comm comments inline on the public banlist + commslist (`<details data-testid="ban-comments-inline">` / `comm-comments-inline`) | `web/themes/default/page_bans.tpl` + `web/themes/default/page_comms.tpl` (#BANLIST-COMMENTS, this PR). Both desktop tables render a native `<details class="ban-comments-inline">` next to the player-name cell whose `<summary>` doubles as the count chip (icon + tabular-nums count + "comment(s)" label) and whose body lists each comment with `<strong>{$com.comname}</strong>` + timestamp + `<div data-testid="ban-comment-text">{$com.commenttxt nofilter}</div>`. The `nofilter` is load-bearing because `$com.commenttxt` is server-built HTML produced by `encodePreservingBr` (per-segment `htmlspecialchars`, only `<br/>` survives) plus the URL-wrap regex that wraps already-escaped `https?://...` strings in `<a>` tags — same trust contract as the existing comment-edit-mode "Other comments" foreach at the top of `page_bans.tpl`. The mobile cards emit a non-interactive `<div data-testid="ban-comments-count-mobile">` count indicator instead — the card wraps every cell in a single `<a data-drawer-href>`, so a nested `<details>` would be invalid HTML (interactive content inside interactive content); mobile users tap through to the drawer (`renderOverviewPane` paints the same comments under `[data-testid="drawer-comments"]`). Both surfaces gate on `$view_comments` (mirrors the page handler's `Config::getBool('config.enablepubliccomments') \|\| $userbank->is_admin()` check at `page.banlist.php` line 766 / `page.commslist.php` line 734). The drawer surface (`api_bans_detail.comments_visible` + `api_bans_detail.comments`) is unchanged — both surfaces share the same data path and same gate so there's no leak risk. The commslist regression was worse than the banlist's because there's no drawer fallback on `<tr data-testid="comm-row">`; the inline disclosure is the ONLY on-page way for admins to see comm-block comment text. Regression guards: `web/tests/integration/BanlistCommentsVisibilityTest.php` (admin sees disclosure regardless of flag, anonymous gated correctly, drawer mirrors disclosure via `bans.detail`) + `web/tests/e2e/specs/flows/banlist-comments-visibility.spec.ts` (desktop disclosure renders + opens, drawer paints same data, mobile count indicator is a `<div>` not a `<details>`). The fix restores the v1.x `mooaccordion` discoverability that was lost when the v2.0 rewrite of `page_bans.tpl` collapsed the inline panel down to a silent `<span>[N]</span>` count badge with no affordance. |
+| Surface admin-authored per-ban / per-comm comments inline on the public banlist + commslist (`<details data-testid="ban-comments-inline">` / `comm-comments-inline`) | `web/themes/default/page_bans.tpl` + `web/themes/default/page_comms.tpl` (#BANLIST-COMMENTS, this PR). Both desktop tables render a native `<details class="ban-comments-inline">` next to the player-name cell whose `<summary>` doubles as the count chip (icon + tabular-nums count + "comment(s)" label) and whose body lists each comment with `<strong>{$com.comname}</strong>` + timestamp + `<div data-testid="ban-comment-text">{$com.commenttxt nofilter}</div>`. The `nofilter` is load-bearing because `$com.commenttxt` is server-built HTML produced by `encodePreservingBr` (per-segment `htmlspecialchars`, only `<br/>` survives) plus the URL-wrap regex that wraps already-escaped `https?://...` strings in `<a>` tags — same trust contract as the existing comment-edit-mode "Other comments" foreach at the top of `page_bans.tpl`. The mobile cards emit a non-interactive `<div data-testid="ban-comments-count-mobile">` count indicator instead — the card wraps every cell in a single `<a data-drawer-href>`, so a nested `<details>` would be invalid HTML (interactive content inside interactive content); mobile users tap through to the drawer (`renderOverviewPane` paints the same comments under `[data-testid="drawer-comments"]`). Both surfaces gate on `$view_comments` (mirrors the page handler's `Config::getBool('config.enablepubliccomments') \|\| $userbank->is_admin()` check at `page.banlist.php` line 766 / `page.commslist.php` line 734). The drawer surface (`api_bans_detail.comments_visible` + `api_bans_detail.comments`) is unchanged — both surfaces share the same data path and same gate so there's no leak risk. The commslist regression was worse than the banlist's because there's no drawer fallback on `<tr data-testid="comm-row">`; the inline disclosure is the ONLY on-page way for admins to see comm-block comment text. Regression guards: `web/tests/integration/BanlistCommentsVisibilityTest.php` (admin sees disclosure regardless of flag, anonymous gated correctly, drawer mirrors disclosure via `bans.detail`) + `web/tests/e2e/specs/flows/banlist-comments-visibility.spec.ts` (desktop disclosure renders + opens, drawer paints same data, mobile count indicator is a `<div>` not a `<details>`). The fix restores the v1.x `mooaccordion` discoverability that was lost when the v2.0 rewrite of `page_bans.tpl` collapsed the inline panel down to a silent `<span>[N]</span>` count badge with no affordance. **#1500: `banlist.hideadminname` now also suppresses the comment AUTHOR + EDITOR (both are admin usernames), matching the focal `admin.name` / `removed_by` gate.** The suppression lands at the DATA layer for the three server-rendered surfaces — `page.banlist.php` / `page.commslist.php` null `comname` / `editname` (preserving `edittime`, so the "last edit" indicator survives) before they reach the template, so a third-party theme that renders the name directly can't re-leak it; the templates then render a three-way `{if $hideadminname}Hidden{elseif !empty($com.comname)}name{else}deleted admin{/if}` for both the inline `<details>` disclosure AND the `?comment=N` "Other comments" comment-edit view (reachable by ANY caller — no admin gate, only `$canedit` differs). The JSON drawer path (`api_bans_detail` / `api_comms_detail`) nulls the comment `author` / `edited_by` AND ships an `author_hidden` boolean sentinel so `theme.js` + `partials/player-drawer.tpl` render "Hidden" (policy) distinctly from "unknown" (deleted admin → `author` already null, `author_hidden` false). Regression guards extended: `BanlistCommentsVisibilityTest` (inline + `?comment=N` author/editor-hidden branches + admin control), `BansTest`/`CommsTest::testDetailHidesCommentAuthorForPublicWhenHideAdminName` (API `author` / `edited_by` / `author_hidden` contract). Known follow-up (out of scope #1500): the `?comment=N` view renders comment BODIES regardless of `config.enablepubliccomments` — that's a separate body-exposure surface, not a name leak. |
 | Filter the public banlist by ban state (`?p=banlist&state=permanent\|active\|expired\|unbanned`) — server-side rowset narrowing for a chip strip | `web/pages/page.banlist.php` (#1352). The `?state=` value is allowlisted (`['permanent','active','expired','unbanned']`, anything else falls through to "All"), composed into the existing `$publicFilterAnd` / `$publicFilterWheren` SQL fragments via the per-state predicates documented inline. **Symmetric defensive shape across the four arms**: `permanent` / `active` BOTH require `RemovedOn IS NULL` (otherwise a pre-2.0 admin-lifted row with `ends > now` would match BOTH `?state=active` AND `?state=unbanned`); `expired` carries THREE arms (`RemoveType = 'E'` post-migration shape + `RemoveType IS NULL AND length > 0 AND ends < now AND RemovedOn IS NULL` for pre-475 installs the prune writer never touched + `RemoveType IS NULL AND RemovedOn IS NOT NULL AND length > 0 AND (RemovedBy IS NULL OR RemovedBy = 0)` for the fork-divergence shape `810.php` pass 2 backfills); `unbanned` carries TWO arms (`RemoveType IN ('D', 'U')` post-migration shape + `RemovedOn IS NOT NULL AND RemoveType IS NULL AND RemovedBy IS NOT NULL AND RemovedBy > 0` for pre-2.0 admin-lifts that `810.php` pass 1 backfills). The `RemovedBy > 0` vs `RemovedBy IS NULL OR = 0` split between unbanned / expired is the **load-bearing distinction** — natural expiry sets `RemovedBy = 0` (PruneBans) or NULL (pre-475); admin lifts set `RemovedBy = <aid>`. The View DTO (`Sbpp\View\BanListView`) carries `string $active_state` + `string $chip_base_link`; the chip strip in `web/themes/default/page_bans.tpl` renders as real `<a href="index.php?p=banlist{$chip_base_link}&state=…">` anchors with `aria-current="true"` (NOT `aria-pressed` — only valid on role=button; axe rejects it on `<a>` as `aria-allowed-attr`) and `data-active="true"` server-rendered on the matching chip — never `<button onclick=…>` (the legacy `web/scripts/banlist.js applyStateFilter` row-hide layer was a client-side filter on top of server-side pagination, so on installs with thousands of bans the unbanned chip silently rendered an empty page 1). The "Hide inactive" toggle is suppressed in the template when `$active_state !== ''` so the two predicates (`hideinactive` is `RemoveType IS NULL`; `?state=expired` / `unbanned` ask for the OPPOSITE) don't visually fight. Pagination URLs preserve `&state=` via `$stateFilterLink`; the per-row state classifier in the same file mirrors the SQL filter (a row pulled in by `?state=unbanned` renders the Unbanned pill, never the legacy mis-classified "Active" pill). The JSON API parity surface is `api_bans_detail` + `api_bans_player_history` in `web/api/handlers/bans.php` — same `isPre2AdminLift` defensive branch so the drawer's detail view + the history pane don't visibly contradict the SQL filter. Regression guards: `web/tests/integration/BanListStateFilterTest.php` (per-state row inclusion / exclusion + chip render contract + suppressed Hide-inactive toggle + symmetric `expired` arm 3 contract), `web/tests/integration/UpdaterBackfillRemoveTypeTest.php` (the migration's idempotency + two-pass cross-contamination contract), `web/tests/api/BansTest.php::testDetailReportsUnbannedForPre2AdminLiftWithRemoveTypeNull` (API parity), `web/tests/e2e/specs/responsive/banlist.spec.ts` + `web/tests/e2e/specs/responsive/filters.spec.ts` (mobile chip click navigates + asserts `aria-current` rather than `history.replaceState` + `aria-pressed`'ing). |
 | Edit the player-detail drawer (open trigger, tabs, panes, lazy loaders) | `web/themes/default/js/theme.js` (`renderDrawerBody` / `loadPaneIfNeeded`). The drawer handles two focal kinds via `drawerKind` (`'ban'` / `'comm'`): the bans list ships `data-drawer-bid` / `data-drawer-href` on row anchors, the comms list ships `data-drawer-cid`. `loadDrawer({kind, id})` dispatches to `Actions.BansDetail` (bid → `bans.detail`) or `Actions.CommsDetail` (cid → `comms.detail`) and stamps the response into `drawerDetail`. `loadPaneIfNeeded` then keys lazy panes off the focal kind: bans-focal History sends `{bid}` (handler excludes the focal via `BA.bid <> ?`); comm-focal History sends `{authid: drawerDetail.player.steam_id}` (no focal to exclude — different table); bans-focal Comms sends `{bid}` (resolves to authid; no comm to exclude); comm-focal Comms sends `{cid}` (handler excludes the focal cid via `C.bid <> ?` — sister contract to the bans-focal History exclusion so the Overview pane and the Comms tab don't render the same record twice). The Notes tab is admin-only and shared across both focal kinds (keys off `player.steam_id`). |
 | Add a comms-list player drawer parity surface (mirror the banlist's `data-drawer-href` row anchor with a comm-focal equivalent) | The desktop `<tr data-testid="comm-row">` and mobile `<div data-testid="comm-card">` rows in `web/themes/default/page_comms.tpl` carry a player-name anchor with `data-drawer-cid="{$comm.cid}"` + `data-testid="drawer-trigger"`. The `href` falls back to a useful no-JS surface (`?p=commslist&id=…` desktop / `?p=commslist&searchText=…` mobile) so the affordance still leads somewhere when JS is off / `theme.js` is stripped by a third-party theme. The drawer JS (`theme.js`'s document `click` delegate at `[data-drawer-bid], [data-drawer-cid], [data-drawer-href]`) routes the click through `keyFromTrigger(trigger)` which returns `{kind: 'comm', id}` for cid triggers; downstream `loadDrawer` dispatches `Actions.CommsDetail` and the renderer branches on `drawerKind === 'comm'` for the header chip ("Comm #N") and the Overview pane's focal-block grid (`[data-testid="drawer-block"]` with `Type` / `Reason` / `Started` / `Ends` rows — vs `[data-testid="drawer-ban"]` on the bans-focal path). The handler is `api_comms_detail` in `web/api/handlers/comms.php` (sister to `api_bans_detail`, same envelope shape modulo `cid` instead of `bid` / `block` instead of `ban` / `'unmuted'` instead of `'unbanned'` in the state vocab — both `api_comms_detail` AND `api_comms_player_history` use `'unmuted'` for `RemoveType IN ('U', 'D')` rows so the drawer's Overview pane and Comms tab don't render contradictory state labels for the same player). Public action; field-level hide-* gating mirrors `bans.detail`. Pill CSS lives next to `.pill--unbanned` in `theme.css` (`.pill--unmuted` carries the same success-bg + emerald colour treatment because admin-lifted is admin-lifted regardless of the focal kind). The drawer JS's `stateLabel()` switch in `theme.js` carries the matching `'unmuted' → 'Unmuted'` arm. Regression guards: `web/tests/api/CommsTest.php` (snapshot + state vocab + lifted-block branch + permanent-block branch + `comms.player_history` cid path with focal exclusion + 404 on unknown cid + lone-focal empty-feed shape) and `web/tests/e2e/specs/flows/ui/comms-drawer.spec.ts` (desktop) + `web/tests/e2e/specs/responsive/drawer.spec.ts` (mobile — clicking a `.ban-cards [data-testid="drawer-trigger"]` opens the comm-focal drawer, header reads "Comm #N", Type row in Overview pane). The desktop spec mirrors `player-drawer.spec.ts`'s isolation strategy — NO `truncateE2eDb` between tests, unique authids per (subtest × project × worker), and `seedCommOrAccept` / `seedBanOrAccept` helpers that tolerate `already_blocked` / `already_banned` so a Playwright retry on the same worker reuses the existing row. Adding a per-test truncate would only widen the cross-file race window where a concurrent worker's API call lands during another worker's truncate→reseed gap and gets a `forbidden` cascade; the comms-drawer tests are read-shaped (open the drawer, assert the chrome) so authid-namespacing is enough. |
diff --git a/web/api/handlers/bans.php b/web/api/handlers/bans.php
index 50e59c729..6eb3b69db 100644
--- a/web/api/handlers/bans.php
+++ b/web/api/handlers/bans.php
@@ -944,14 +944,22 @@ function api_bans_detail(array $params): array
         )->resultset([$bid]);
         foreach ($commentRows as $crow) {
             $editTime = $crow['edittime'] !== null ? (int)$crow['edittime'] : null;
+            // #1500: comment author/editor are admin usernames; suppress them
+            // for public callers when `banlist.hideadminname` is on, same as
+            // the focal admin.name and removed_by fields above. `author_hidden`
+            // lets the drawer render "Hidden" (policy) distinctly from "unknown"
+            // (deleted admin -> author already null), matching the server-side
+            // inline disclosure's three-way label.
+            $authorHidden = $hideAdmin && $crow['author'] !== null;
             $comments[] = [
                 'cid'        => (int)$crow['cid'],
                 'added'      => (int)$crow['added'],
                 'added_human'=> Config::time((int)$crow['added']),
-                'author'     => $crow['author'] !== null ? (string)$crow['author'] : null,
+                'author'     => ($authorHidden || $crow['author'] === null) ? null : (string)$crow['author'],
+                'author_hidden' => $authorHidden,
                 'text'       => (string)$crow['commenttxt'],
                 'edited_at'  => $editTime,
-                'edited_by'  => $crow['editor'] !== null ? (string)$crow['editor'] : null,
+                'edited_by'  => (!$hideAdmin && $crow['editor'] !== null) ? (string)$crow['editor'] : null,
             ];
         }
     }
diff --git a/web/api/handlers/comms.php b/web/api/handlers/comms.php
index b37ea270b..c82450f28 100644
--- a/web/api/handlers/comms.php
+++ b/web/api/handlers/comms.php
@@ -542,14 +542,22 @@ function api_comms_detail(array $params): array
         )->resultset([$cid]);
         foreach ($commentRows as $crow) {
             $editTime = $crow['edittime'] !== null ? (int)$crow['edittime'] : null;
+            // #1500: comment author/editor are admin usernames; suppress them
+            // for public callers when `banlist.hideadminname` is on, same as
+            // the focal admin.name and removed_by fields above. `author_hidden`
+            // lets the drawer render "Hidden" (policy) distinctly from "unknown"
+            // (deleted admin -> author already null), matching the server-side
+            // inline disclosure's three-way label.
+            $authorHidden = $hideAdmin && $crow['author'] !== null;
             $comments[] = [
                 'cid'        => (int)$crow['cid'],
                 'added'      => (int)$crow['added'],
                 'added_human'=> Config::time((int)$crow['added']),
-                'author'     => $crow['author'] !== null ? (string)$crow['author'] : null,
+                'author'     => ($authorHidden || $crow['author'] === null) ? null : (string)$crow['author'],
+                'author_hidden' => $authorHidden,
                 'text'       => (string)$crow['commenttxt'],
                 'edited_at'  => $editTime,
-                'edited_by'  => $crow['editor'] !== null ? (string)$crow['editor'] : null,
+                'edited_by'  => (!$hideAdmin && $crow['editor'] !== null) ? (string)$crow['editor'] : null,
             ];
         }
     }
diff --git a/web/pages/page.banlist.php b/web/pages/page.banlist.php
index 67eb2afaf..ba07a2f74 100644
--- a/web/pages/page.banlist.php
+++ b/web/pages/page.banlist.php
@@ -1005,6 +1005,11 @@ function setPostKey()
     //-----------------------------------
     if (Config::getBool('config.enablepubliccomments') || $userbank->is_admin()) {
         $view_comments = true;
+        // #1500: comment author/editor are admin usernames. Null them at the
+        // data layer for public viewers when banlist.hideadminname is on, so a
+        // third-party theme that renders the name directly can't re-leak it
+        // (parity with the focal $data['admin'] = false gate above).
+        $commentsHideAdmin = Config::getBool('banlist.hideadminname') && !$userbank->is_admin();
         $GLOBALS['PDO']->query("SELECT cid, aid, commenttxt, added, edittime,
 											(SELECT user FROM `:prefix_admins` WHERE aid = C.aid) AS comname,
 											(SELECT user FROM `:prefix_admins` WHERE aid = C.editaid) AS editname
@@ -1043,7 +1048,7 @@ function setPostKey()
                     $cdata['delcomlink']  = "";
                 }
 
-                $cdata['comname']    = $crow['comname'];
+                $cdata['comname']    = $commentsHideAdmin ? '' : $crow['comname'];
                 $cdata['added']      = Config::time($crow['added']);
                 $commentText         = html_entity_decode($crow['commenttxt'], ENT_QUOTES | ENT_HTML5, 'UTF-8');
                 $commentText         = encodePreservingBr($commentText);
@@ -1053,7 +1058,7 @@ function setPostKey()
 
                 if (!empty($crow['edittime'])) {
                     $cdata['edittime'] = Config::time($crow['edittime']);
-                    $cdata['editname'] = $crow['editname'];
+                    $cdata['editname'] = $commentsHideAdmin ? '' : $crow['editname'];
                 } else {
                     $cdata['edittime'] = "";
                     $cdata['editname'] = "";
@@ -1281,10 +1286,15 @@ function setPostKey()
         $_GET["comment"],
     ]);
 
+    // #1500: same gate as the per-ban comment thread above — null admin
+    // usernames for public viewers so this comment-edit surface (reachable
+    // by anyone via ?comment=N) doesn't leak them regardless of theme.
+    $commentsHideAdmin = Config::getBool('banlist.hideadminname') && !$userbank->is_admin();
+
     $ocomments = [];
     foreach ($cotherdata as $cdrow) {
         $coment               = [];
-        $coment['comname']    = $cdrow['comname'];
+        $coment['comname']    = $commentsHideAdmin ? '' : $cdrow['comname'];
         $coment['added']      = Config::time($cdrow['added']);
         $commentTextRow       = html_entity_decode($cdrow['commenttxt'], ENT_QUOTES | ENT_HTML5, 'UTF-8');
         $commentTextRow       = encodePreservingBr($commentTextRow);
@@ -1294,7 +1304,7 @@ function setPostKey()
 
         if ($cdrow['editname'] != "") {
             $coment['edittime'] = Config::time($cdrow['edittime']);
-            $coment['editname'] = $cdrow['editname'];
+            $coment['editname'] = $commentsHideAdmin ? '' : $cdrow['editname'];
         } else {
             $coment['editname'] = "";
             $coment['edittime'] = "";
diff --git a/web/pages/page.commslist.php b/web/pages/page.commslist.php
index 1c849fb74..586c69feb 100644
--- a/web/pages/page.commslist.php
+++ b/web/pages/page.commslist.php
@@ -816,6 +816,11 @@ function setPostKey()
     //-----------------------------------
     if (Config::getBool('config.enablepubliccomments') || $userbank->is_admin()) {
         $view_comments = true;
+        // #1500: comment author/editor are admin usernames. Null them at the
+        // data layer for public viewers when banlist.hideadminname is on, so a
+        // third-party theme that renders the name directly can't re-leak it
+        // (parity with the focal admin-name gate above).
+        $commentsHideAdmin = Config::getBool('banlist.hideadminname') && !$userbank->is_admin();
         $GLOBALS['PDO']->query("SELECT cid, aid, commenttxt, added, edittime,
 											(SELECT user FROM `:prefix_admins` WHERE aid = C.aid) AS comname,
 											(SELECT user FROM `:prefix_admins` WHERE aid = C.editaid) AS editname
@@ -849,7 +854,7 @@ function setPostKey()
                     $cdata['delcomlink']  = "";
                 }
 
-                $cdata['comname']    = $crow['comname'];
+                $cdata['comname']    = $commentsHideAdmin ? '' : $crow['comname'];
                 $cdata['added']      = Config::time($crow['added']);
                 $commentText         = html_entity_decode($crow['commenttxt'], ENT_QUOTES | ENT_HTML5, 'UTF-8');
                 $commentText         = encodePreservingBr($commentText);
@@ -859,7 +864,7 @@ function setPostKey()
 
                 if (!empty($crow['edittime'])) {
                     $cdata['edittime'] = Config::time($crow['edittime']);
-                    $cdata['editname'] = $crow['editname'];
+                    $cdata['editname'] = $commentsHideAdmin ? '' : $crow['editname'];
                 } else {
                     $cdata['edittime'] = "";
                     $cdata['editname'] = "";
@@ -1067,9 +1072,14 @@ function setPostKey()
         $_GET["comment"],
     ]);
 
+    // #1500: same gate as the per-comm comment thread above — null admin
+    // usernames for public viewers so this comment-edit surface (reachable
+    // by anyone via ?comment=N) doesn't leak them regardless of theme.
+    $commentsHideAdmin = Config::getBool('banlist.hideadminname') && !$userbank->is_admin();
+
     foreach ($cotherdata as $cdrow) {
         $coment               = [];
-        $coment['comname']    = $cdrow['comname'];
+        $coment['comname']    = $commentsHideAdmin ? '' : $cdrow['comname'];
         $coment['added']      = Config::time($cdrow['added']);
         $commentText          = html_entity_decode($cdrow['commenttxt'], ENT_QUOTES | ENT_HTML5, 'UTF-8');
         $commentText          = encodePreservingBr($commentText);
@@ -1077,7 +1087,7 @@ function setPostKey()
         $coment['commenttxt'] = $commentText;
         if ($cdrow['editname'] != "") {
             $coment['edittime'] = Config::time($cdrow['edittime']);
-            $coment['editname'] = $cdrow['editname'];
+            $coment['editname'] = $commentsHideAdmin ? '' : $cdrow['editname'];
         } else {
             $coment['editname'] = "";
             $coment['edittime'] = "";
diff --git a/web/tests/api/BansTest.php b/web/tests/api/BansTest.php
index 02c05bb43..f8714e7be 100644
--- a/web/tests/api/BansTest.php
+++ b/web/tests/api/BansTest.php
@@ -510,6 +510,57 @@ public function testDetailAdminViewExposesEverything(): void
         ]);
     }
 
+    public function testDetailHidesCommentAuthorForPublicWhenHideAdminName(): void
+    {
+        // #1500: with public comments ENABLED, the comment author/editor
+        // (admin usernames) must still be suppressed for public callers
+        // under banlist.hideadminname — same as the focal admin.name and
+        // removed_by fields. Pre-fix the handler leaked them: the
+        // testDetailPublicViewHidesAdminFields case above turns public
+        // comments OFF, so it never exercised this combination.
+        Fixture::rawPdo()->prepare(sprintf(
+            "REPLACE INTO `%s_settings` (`setting`, `value`) VALUES
+                ('banlist.hideadminname', '1'),
+                ('config.enablepubliccomments', '1')",
+            DB_PREFIX
+        ))->execute();
+        \Config::init($GLOBALS['PDO']);
+
+        $bid = $this->seedBan('STEAM_0:1:1500', 'comment-author-leak');
+        // Author AND editor set to the seeded admin so both subqueries
+        // resolve to a real username (the value that must NOT leak).
+        Fixture::rawPdo()->prepare(sprintf(
+            "INSERT INTO `%s_comments` (`bid`, `type`, `aid`, `editaid`, `commenttxt`, `added`, `edittime`)
+             VALUES (?, 'B', ?, ?, ?, UNIX_TIMESTAMP(), UNIX_TIMESTAMP())",
+            DB_PREFIX
+        ))->execute([$bid, Fixture::adminAid(), Fixture::adminAid(), 'leaky comment']);
+
+        // Public caller (not logged in).
+        $env = $this->api('bans.detail', ['bid' => $bid]);
+        $this->assertTrue($env['ok'], json_encode($env));
+        $this->assertTrue($env['data']['comments_visible'], 'public comments are enabled');
+        $this->assertCount(1, $env['data']['comments']);
+        $this->assertSame('leaky comment', $env['data']['comments'][0]['text']);
+        $this->assertNull($env['data']['comments'][0]['author'],
+            'comment author must be hidden for public + hideadminname (#1500)');
+        $this->assertNull($env['data']['comments'][0]['edited_by'],
+            'comment editor must be hidden for public + hideadminname (#1500)');
+        $this->assertTrue($env['data']['comments'][0]['author_hidden'],
+            'author_hidden sentinel must be true when a real name was suppressed (#1500 m1: lets the drawer render "Hidden" vs "unknown")');
+        $this->assertNull($env['data']['admin']['name'], 'focal admin name is hidden too');
+
+        // Admins still see the author + editor; author_hidden is false.
+        $this->loginAsAdmin();
+        $adminEnv = $this->api('bans.detail', ['bid' => $bid]);
+        $this->assertTrue($adminEnv['ok'], json_encode($adminEnv));
+        $this->assertNotNull($adminEnv['data']['comments'][0]['author'],
+            'admins still see the comment author');
+        $this->assertNotNull($adminEnv['data']['comments'][0]['edited_by'],
+            'admins still see the comment editor');
+        $this->assertFalse($adminEnv['data']['comments'][0]['author_hidden'],
+            'author_hidden must be false for admin viewers (#1500 m1)');
+    }
+
     public function testDetailReportsUnbannedForPre2AdminLiftWithRemoveTypeNull(): void
     {
         // #1352: pre-2.0 admin-lifted bans whose `RemoveType IS NULL`
diff --git a/web/tests/api/CommsTest.php b/web/tests/api/CommsTest.php
index f9f9f49b0..3bec6fb75 100644
--- a/web/tests/api/CommsTest.php
+++ b/web/tests/api/CommsTest.php
@@ -587,6 +587,57 @@ public function testDetailAdminViewExposesEverything(): void
         $this->assertSame('Gag', $env['data']['block']['type_label']);
     }
 
+    public function testDetailHidesCommentAuthorForPublicWhenHideAdminName(): void
+    {
+        // #1500: with public comments ENABLED, the comment author/editor
+        // (admin usernames) must still be suppressed for public callers
+        // under banlist.hideadminname — same as the focal admin.name and
+        // removed_by fields. Pre-fix the handler leaked them: the
+        // testDetailPublicViewHidesAdminFields case above turns public
+        // comments OFF, so it never exercised this combination.
+        Fixture::rawPdo()->prepare(sprintf(
+            "REPLACE INTO `%s_settings` (`setting`, `value`) VALUES
+                ('banlist.hideadminname', '1'),
+                ('config.enablepubliccomments', '1')",
+            DB_PREFIX
+        ))->execute();
+        \Config::init($GLOBALS['PDO']);
+
+        $cid = $this->seedComm('STEAM_0:0:1500', 'comment-author-leak');
+        // Author AND editor set to the seeded admin so both subqueries
+        // resolve to a real username (the value that must NOT leak).
+        Fixture::rawPdo()->prepare(sprintf(
+            "INSERT INTO `%s_comments` (`bid`, `type`, `aid`, `editaid`, `commenttxt`, `added`, `edittime`)
+             VALUES (?, 'C', ?, ?, ?, UNIX_TIMESTAMP(), UNIX_TIMESTAMP())",
+            DB_PREFIX
+        ))->execute([$cid, Fixture::adminAid(), Fixture::adminAid(), 'leaky comment']);
+
+        // Public caller (not logged in).
+        $env = $this->api('comms.detail', ['cid' => $cid]);
+        $this->assertTrue($env['ok'], json_encode($env));
+        $this->assertTrue($env['data']['comments_visible'], 'public comments are enabled');
+        $this->assertCount(1, $env['data']['comments']);
+        $this->assertSame('leaky comment', $env['data']['comments'][0]['text']);
+        $this->assertNull($env['data']['comments'][0]['author'],
+            'comment author must be hidden for public + hideadminname (#1500)');
+        $this->assertNull($env['data']['comments'][0]['edited_by'],
+            'comment editor must be hidden for public + hideadminname (#1500)');
+        $this->assertTrue($env['data']['comments'][0]['author_hidden'],
+            'author_hidden sentinel must be true when a real name was suppressed (#1500 m1: lets the drawer render "Hidden" vs "unknown")');
+        $this->assertNull($env['data']['admin']['name'], 'focal admin name is hidden too');
+
+        // Admins still see the author + editor; author_hidden is false.
+        $this->loginAsAdmin();
+        $adminEnv = $this->api('comms.detail', ['cid' => $cid]);
+        $this->assertTrue($adminEnv['ok'], json_encode($adminEnv));
+        $this->assertNotNull($adminEnv['data']['comments'][0]['author'],
+            'admins still see the comment author');
+        $this->assertNotNull($adminEnv['data']['comments'][0]['edited_by'],
+            'admins still see the comment editor');
+        $this->assertFalse($adminEnv['data']['comments'][0]['author_hidden'],
+            'author_hidden must be false for admin viewers (#1500 m1)');
+    }
+
     public function testDetailReportsUnmutedForLiftedBlock(): void
     {
         // After comms.unblock the block's state must be 'unmuted' (the
diff --git a/web/tests/api/__snapshots__/bans/detail_admin_view.json b/web/tests/api/__snapshots__/bans/detail_admin_view.json
index 0b598c346..683aa69c7 100644
--- a/web/tests/api/__snapshots__/bans/detail_admin_view.json
+++ b/web/tests/api/__snapshots__/bans/detail_admin_view.json
@@ -43,6 +43,7 @@
                 "added": "<*>",
                 "added_human": "<*>",
                 "author": "admin",
+                "author_hidden": false,
                 "text": "note for the drawer",
                 "edited_at": null,
                 "edited_by": null
diff --git a/web/tests/integration/BanlistCommentsVisibilityTest.php b/web/tests/integration/BanlistCommentsVisibilityTest.php
index e97ea60ef..1eb0bf267 100644
--- a/web/tests/integration/BanlistCommentsVisibilityTest.php
+++ b/web/tests/integration/BanlistCommentsVisibilityTest.php
@@ -124,6 +124,15 @@ public function testBanlistAdminSeesInlineDisclosureOnCommentedRow(): void
         // survives, the rest is htmlspecialchars-escaped per text
         // segment. The seeded body is one line so no `<br/>` is
         // emitted; the literal text reaches the assertion surface.
+        // Control for #1500: an admin viewer resolves hideadminname to
+        // false (`getBool && !is_admin()`), so the comment author renders
+        // un-hidden as `<strong>admin</strong>`. The anonymous + #1500
+        // tests assert this exact wrapper is suppressed.
+        $this->assertStringContainsString(
+            '<strong>admin</strong>',
+            $html,
+            'admin viewer sees the un-hidden comment author username (control for #1500)',
+        );
         $this->assertStringContainsString(
             'first comment from worker C',
             $html,
@@ -235,6 +244,165 @@ public function testBanlistAnonymousWithFlagOnSeesDisclosure(): void
             $html,
             'comment text must reach anonymous callers when the flag is on (this is the public-comments use case)',
         );
+        // banlist.hideadminname defaults to '1' (data.sql), so this
+        // anonymous render already hides the author — the comment text
+        // reaches the page but the admin username does NOT. (The
+        // dedicated #1500 test below pins that suppression explicitly;
+        // the admin-viewer test pins the un-hidden control.)
+        $this->assertStringNotContainsString(
+            '<strong>admin</strong>',
+            $html,
+            'comment author username must not leak to anonymous callers (hideadminname defaults on) (#1500)',
+        );
+    }
+
+    // ---------------------------------------------------------------
+    // Banlist — #1500: hideadminname suppresses the comment author too
+    // ---------------------------------------------------------------
+
+    #[RunInSeparateProcess]
+    #[PreserveGlobalState(false)]
+    public function testBanlistHidesCommentAuthorWhenHideAdminName(): void
+    {
+        // #1500: with public comments ON, the inline disclosure must
+        // still suppress the comment author (an admin username) for
+        // anonymous callers when banlist.hideadminname is on — same gate
+        // the unban-meta inline already honours. Pre-fix the author
+        // leaked even though the focal ban's admin name was suppressed.
+        Fixture::rawPdo()->prepare(sprintf(
+            "REPLACE INTO `%s_settings` (`setting`, `value`) VALUES
+                ('config.enablepubliccomments', '1'),
+                ('banlist.hideadminname', '1')",
+            DB_PREFIX,
+        ))->execute();
+        \Config::init($GLOBALS['PDO']);
+
+        $_GET = ['p' => 'banlist'];
+        $html = $this->renderBanlistPage();
+
+        // The disclosure + comment body still render — hideadminname
+        // gates the NAME, not the comment.
+        $this->assertStringContainsString('data-testid="ban-comments-inline"', $html);
+        $this->assertStringContainsString('first comment from worker C', $html);
+        // The author username must NOT leak inline...
+        $this->assertStringNotContainsString(
+            '<strong>admin</strong>',
+            $html,
+            'comment author (admin username) must not leak inline when hideadminname is on (#1500)',
+        );
+        // ...and the gated placeholder renders in its place.
+        $this->assertStringContainsString(
+            '<i class="text-faint">Hidden</i>',
+            $html,
+            'the gated comment author must render the Hidden placeholder (#1500)',
+        );
+    }
+
+    // ---------------------------------------------------------------
+    // Banlist — #1500 (M2): the ?comment=N "Other comments" surface.
+    // The comment-edit view (page.banlist.php $cotherdata block) is
+    // reachable by ANY caller — there is no admin gate; $commentCanedit
+    // only controls whether the textarea + submit render. Pre-fix it
+    // listed every comment on the ban with the author / editor admin
+    // username inline regardless of banlist.hideadminname, so it was a
+    // second leak surface distinct from the inline disclosure above.
+    // ---------------------------------------------------------------
+
+    #[RunInSeparateProcess]
+    #[PreserveGlobalState(false)]
+    public function testBanlistCommentViewHidesAuthorAndEditorForPublicWhenHideAdminName(): void
+    {
+        // Give both seeded comments an editor so the "last edit by"
+        // branch is exercised (the editor name is a second admin
+        // username that must be suppressed too).
+        Fixture::rawPdo()->prepare(sprintf(
+            'UPDATE `%s_comments` SET editaid = ?, edittime = ? WHERE bid = ? AND type = ?',
+            DB_PREFIX,
+        ))->execute([Fixture::adminAid(), time() - 300, $this->banWithCommentsBid, 'B']);
+
+        Fixture::rawPdo()->prepare(sprintf(
+            "REPLACE INTO `%s_settings` (`setting`, `value`) VALUES
+                ('config.enablepubliccomments', '1'),
+                ('banlist.hideadminname', '1')",
+            DB_PREFIX,
+        ))->execute();
+        \Config::init($GLOBALS['PDO']);
+
+        // Anonymous caller hits the comment-edit view in "Add" mode (no
+        // cid), which lists every comment on the ban as "Other comments".
+        $_GET = [
+            'p'       => 'banlist',
+            'comment' => (string) $this->banWithCommentsBid,
+            'ctype'   => 'B',
+        ];
+        $html = $this->renderBanlistPage();
+
+        // The "Other comments" surface + bodies render...
+        $this->assertStringContainsString(
+            'Other comments',
+            $html,
+            'the comment-edit view must list existing comments under "Other comments"',
+        );
+        $this->assertStringContainsString('first comment from worker C', $html);
+        // ...the "last edit by" line renders (edittime present, gated on
+        // edittime not editname so the indicator survives the #1500 null)...
+        $this->assertStringContainsString(
+            'last edit',
+            $html,
+            'the edit indicator must survive — it gates on edittime, which #1500 does NOT null',
+        );
+        // ...but neither the author nor the editor admin username leaks...
+        $this->assertStringNotContainsString(
+            '<strong>admin</strong>',
+            $html,
+            'comment author (admin username) must not leak in the ?comment=N view (#1500 M2)',
+        );
+        $this->assertStringNotContainsString(
+            'by admin',
+            $html,
+            'comment editor (admin username) must not leak in the "last edit by" line (#1500 M2)',
+        );
+        // ...and the Hidden placeholder stands in for author AND editor
+        // (two comments × {author + editor} = at least 2 occurrences).
+        $this->assertGreaterThanOrEqual(
+            2,
+            substr_count($html, '<i class="text-faint">Hidden</i>'),
+            'both the suppressed author and editor must render the Hidden placeholder (#1500 M2)',
+        );
+    }
+
+    #[RunInSeparateProcess]
+    #[PreserveGlobalState(false)]
+    public function testBanlistCommentViewShowsAuthorAndEditorForAdmin(): void
+    {
+        // Control for the M2 test above: an admin viewer resolves
+        // hideadminname=false, so the ?comment=N view shows both the
+        // author and editor admin usernames un-hidden.
+        Fixture::rawPdo()->prepare(sprintf(
+            'UPDATE `%s_comments` SET editaid = ?, edittime = ? WHERE bid = ? AND type = ?',
+            DB_PREFIX,
+        ))->execute([Fixture::adminAid(), time() - 300, $this->banWithCommentsBid, 'B']);
+        $this->setPublicCommentsFlag(true);
+        $this->loginAsAdmin();
+
+        $_GET = [
+            'p'       => 'banlist',
+            'comment' => (string) $this->banWithCommentsBid,
+            'ctype'   => 'B',
+        ];
+        $html = $this->renderBanlistPage();
+
+        $this->assertStringContainsString('Other comments', $html);
+        $this->assertStringContainsString(
+            '<strong>admin</strong>',
+            $html,
+            'admin viewer sees the un-hidden comment author in the ?comment=N view (control for #1500 M2)',
+        );
+        $this->assertStringNotContainsString(
+            '<i class="text-faint">Hidden</i>',
+            $html,
+            'no Hidden placeholder for admin viewers',
+        );
     }
 
     // ---------------------------------------------------------------
@@ -271,6 +439,12 @@ public function testCommslistAdminSeesInlineDisclosureOnCommentedRow(): void
             $html,
             'seeded mute-comment text must reach the rendered HTML inside the disclosure body',
         );
+        // Control for #1500: admin viewer sees the un-hidden author.
+        $this->assertStringContainsString(
+            '<strong>admin</strong>',
+            $html,
+            'admin viewer sees the un-hidden comm-block comment author username (control for #1500)',
+        );
     }
 
     #[RunInSeparateProcess]
@@ -294,6 +468,42 @@ public function testCommslistAnonymousWithFlagOffSeesNoDisclosure(): void
         );
     }
 
+    #[RunInSeparateProcess]
+    #[PreserveGlobalState(false)]
+    public function testCommslistHidesCommentAuthorWhenHideAdminName(): void
+    {
+        // #1500 sister-fix: the commslist inline disclosure has no
+        // drawer fallback, so a leaked comm-block comment author is the
+        // ONLY on-page surface — must honour banlist.hideadminname too.
+        Fixture::rawPdo()->prepare(sprintf(
+            "REPLACE INTO `%s_settings` (`setting`, `value`) VALUES
+                ('config.enablepubliccomments', '1'),
+                ('banlist.hideadminname', '1')",
+            DB_PREFIX,
+        ))->execute();
+        \Config::init($GLOBALS['PDO']);
+
+        $_GET = ['p' => 'commslist'];
+        $html = $this->renderCommslistPage();
+
+        // Disclosure + comment body still render — the gate suppresses
+        // the NAME, not the comment.
+        $this->assertStringContainsString('data-testid="comm-comments-inline"', $html);
+        $this->assertStringContainsString('mute comment for worker C', $html);
+        // The author username must NOT leak inline...
+        $this->assertStringNotContainsString(
+            '<strong>admin</strong>',
+            $html,
+            'comm-block comment author (admin username) must not leak inline when hideadminname is on (#1500)',
+        );
+        // ...and the gated placeholder renders in its place.
+        $this->assertStringContainsString(
+            '<i class="text-faint">Hidden</i>',
+            $html,
+            'the gated comm-block comment author must render the Hidden placeholder (#1500)',
+        );
+    }
+
     // ---------------------------------------------------------------
     // Drawer / API — verify the drawer surface stays in sync with the
     // disclosure (the fix preserves both surfaces, doesn't replace one
diff --git a/web/themes/default/js/theme.js b/web/themes/default/js/theme.js
index 5ddfa681c..da2093d54 100644
--- a/web/themes/default/js/theme.js
+++ b/web/themes/default/js/theme.js
@@ -788,7 +788,7 @@
             + comments.map((c) =>
                 '<li style="border:1px solid var(--border);border-radius:var(--radius-md);padding:0.625rem 0.75rem;background:var(--bg-surface)">'
                 + '<div style="display:flex;justify-content:space-between;font-size:0.75rem;color:var(--text-muted);margin-bottom:0.25rem">'
-                +   '<span class="font-medium">' + escapeHtml(c.author || 'unknown') + '</span>'
+                +   '<span class="font-medium">' + escapeHtml(c.author_hidden ? 'Hidden' : (c.author || 'unknown')) + '</span>'
                 +   '<span>' + escapeHtml(c.added_human || '') + '</span>'
                 + '</div>'
                 + '<div class="text-sm" style="white-space:pre-wrap">' + escapeHtml(c.text || '') + '</div>'
diff --git a/web/themes/default/page_bans.tpl b/web/themes/default/page_bans.tpl
index 9e7aaf594..d9392a151 100644
--- a/web/themes/default/page_bans.tpl
+++ b/web/themes/default/page_bans.tpl
@@ -45,13 +45,15 @@
         {if $smarty.foreach.othercomments.first}<h3 style="font-size:var(--fs-base);font-weight:600;margin:0 0 0.5rem">Other comments</h3>{/if}
         <div class="mt-4" style="border-top:1px solid var(--border);padding-top:0.75rem">
           <div class="flex items-center justify-between">
-            <strong>{$com.comname|escape}</strong>
+            {* #1500: comment author is an admin username; hide it for public viewers when banlist.hideadminname is on (parity with the inline disclosure block below). *}
+            {if $hideadminname}<i class="text-faint">Hidden</i>{elseif !empty($com.comname)}<strong>{$com.comname|escape}</strong>{else}<i class="text-faint">deleted admin</i>{/if}
             <span class="text-xs text-muted">{$com.added}</span>
           </div>
           {* nofilter: $com.commenttxt is server-built HTML produced by encodePreservingBr (htmlspecialchars per text segment, only `<br/>` survives) plus a URL-wrap regex that wraps already-escaped URLs in `<a>` tags — see page.banlist.php $cotherdata loop *}
           <div class="text-sm mt-2">{$com.commenttxt nofilter}</div>
-          {if $com.editname != ''}
-          <div class="text-xs text-faint mt-2">last edit {$com.edittime} by {$com.editname|escape}</div>
+          {* gate on edittime not editname: #1500 nulls editname for hidden viewers, edittime survives so the "last edit" indicator still shows. *}
+          {if !empty($com.edittime)}
+          <div class="text-xs text-faint mt-2">last edit {$com.edittime} by {if $hideadminname}<i class="text-faint">Hidden</i>{elseif !empty($com.editname)}{$com.editname|escape}{else}<i>deleted admin</i>{/if}</div>
           {/if}
         </div>
       {/foreach}
@@ -360,7 +362,10 @@
                 {foreach from=$ban.commentdata item=com}
                 <li class="ban-comments-inline__item" data-testid="ban-comment-item">
                   <div class="ban-comments-inline__meta">
-                    {if !empty($com.comname)}
+                    {* #1500: comment author is an admin username; hide it for public viewers when banlist.hideadminname is on (parity with the unban-meta gate below). *}
+                    {if $hideadminname}
+                      <i class="text-faint">Hidden</i>
+                    {elseif !empty($com.comname)}
                       <strong>{$com.comname|escape}</strong>
                     {else}
                       <i class="text-faint">deleted admin</i>
@@ -371,7 +376,7 @@
                   {* nofilter: $com.commenttxt is server-built HTML produced by encodePreservingBr (htmlspecialchars per text segment, only `<br/>` survives) plus a URL-wrap regex that wraps already-escaped URLs in `<a>` tags — see page.banlist.php $commentres loop. Same provenance + safety as the existing comment-edit-mode block at the top of this template. *}
                   <div class="ban-comments-inline__text" data-testid="ban-comment-text">{$com.commenttxt nofilter}</div>
                   {if !empty($com.edittime)}
-                  <div class="ban-comments-inline__edit text-xs text-faint">last edit {$com.edittime} by {if !empty($com.editname)}{$com.editname|escape}{else}<i>deleted admin</i>{/if}</div>
+                  <div class="ban-comments-inline__edit text-xs text-faint">last edit {$com.edittime} by {if $hideadminname}<i class="text-faint">Hidden</i>{elseif !empty($com.editname)}{$com.editname|escape}{else}<i>deleted admin</i>{/if}</div>
                   {/if}
                 </li>
                 {/foreach}
diff --git a/web/themes/default/page_comms.tpl b/web/themes/default/page_comms.tpl
index e7b9be8e9..74dc97b23 100644
--- a/web/themes/default/page_comms.tpl
+++ b/web/themes/default/page_comms.tpl
@@ -290,14 +290,15 @@
                                         {foreach from=$comm.commentdata item=com}
                                         <li class="ban-comments-inline__item" data-testid="comm-comment-item">
                                           <div class="ban-comments-inline__meta">
-                                            {if !empty($com.comname)}<strong>{$com.comname|escape}</strong>{else}<i class="text-faint">deleted admin</i>{/if}
+                                            {* #1500: comment author is an admin username; hide it for public viewers when banlist.hideadminname is on (parity with the unban-meta gate above). *}
+                                            {if $hideadminname}<i class="text-faint">Hidden</i>{elseif !empty($com.comname)}<strong>{$com.comname|escape}</strong>{else}<i class="text-faint">deleted admin</i>{/if}
                                             <span class="text-faint">&middot;</span>
                                             <span class="text-xs text-faint tabular-nums">{$com.added}</span>
                                           </div>
                                           {* nofilter: $com.commenttxt is server-built HTML produced by encodePreservingBr (htmlspecialchars per text segment, only `<br/>` survives) plus a URL-wrap regex that wraps already-escaped URLs in `<a>` tags — see page.commslist.php $commentres loop. Same provenance + safety as the banlist disclosure (template comment up-thread). *}
                                           <div class="ban-comments-inline__text" data-testid="comm-comment-text">{$com.commenttxt nofilter}</div>
                                           {if !empty($com.edittime)}
-                                          <div class="ban-comments-inline__edit text-xs text-faint">last edit {$com.edittime} by {if !empty($com.editname)}{$com.editname|escape}{else}<i>deleted admin</i>{/if}</div>
+                                          <div class="ban-comments-inline__edit text-xs text-faint">last edit {$com.edittime} by {if $hideadminname}<i class="text-faint">Hidden</i>{elseif !empty($com.editname)}{$com.editname|escape}{else}<i>deleted admin</i>{/if}</div>
                                           {/if}
                                         </li>
                                         {/foreach}
diff --git a/web/themes/default/partials/player-drawer.tpl b/web/themes/default/partials/player-drawer.tpl
index e04b6b55d..5427b06a1 100644
--- a/web/themes/default/partials/player-drawer.tpl
+++ b/web/themes/default/partials/player-drawer.tpl
@@ -34,6 +34,7 @@
       - $detail.server.name                  string|null
       - $detail.comments_visible             bool
       - $detail.comments[].author            string|null
+      - $detail.comments[].author_hidden     bool   (#1500: name suppressed by banlist.hideadminname)
       - $detail.comments[].added_human       string
       - $detail.comments[].text              string
 
@@ -123,7 +124,7 @@
                 {foreach $detail.comments as $c}
                     <li style="border:1px solid var(--border);border-radius:var(--radius-md);padding:0.625rem 0.75rem;background:var(--bg-surface)">
                         <div style="display:flex;justify-content:space-between;font-size:0.75rem;color:var(--text-muted);margin-bottom:0.25rem">
-                            <span class="font-medium">{$c.author|default:'unknown'}</span>
+                            <span class="font-medium">{if $c.author_hidden}Hidden{else}{$c.author|default:'unknown'}{/if}</span>
                             <span>{$c.added_human}</span>
                         </div>
                         <div class="text-sm" style="white-space:pre-wrap">{$c.text}</div>