diff --git a/.gitattributes b/.gitattributes
index 1fa9d63..c5a925a 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -12,3 +12,4 @@ composer.lock     export-ignore
 phpunit.xml.*     export-ignore
 tests             export-ignore
 docs              export-ignore
+.editorconfig     export-ignore
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 0000000..8f2bd8b
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,38 @@
+name: Lint
+
+# PHP syntax check on the lowest PHP version this extension supports and the
+# newest one. tests.yml runs phpBB's own checks (code sniffer, EPV) and
+# the PHPUnit suite.
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: PHP ${{ matrix.php }} lint
+    runs-on: ubuntu-24.04
+    strategy:
+      matrix:
+        php: ['8.1', '8.5']
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up PHP ${{ matrix.php }}
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+          tools: composer:v2
+
+      - name: PHP syntax check
+        run: find . -name '*.php' -not -path './.git/*' -not -path './vendor/*' -print0 | xargs -0 -n1 php -l
+
+      - name: Validate composer.json
+        run: composer validate --no-check-all --no-check-publish
diff --git a/README.md b/README.md
index 7f0538a..9ebfefc 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,21 @@
 # Knowledge Base
 
-A knowledge base for phpBB: articles organised in categories, with attachments, Markdown or BBCode text, revisions, an approval workflow, search, and its own permission system, all managed from the ACP.
+[![Tests](https://github.com/phpbbmodders/knowledgebase/actions/workflows/tests.yml/badge.svg)](https://github.com/phpbbmodders/knowledgebase/actions/workflows/tests.yml) [![Lint](https://github.com/phpbbmodders/knowledgebase/actions/workflows/lint.yml/badge.svg)](https://github.com/phpbbmodders/knowledgebase/actions/workflows/lint.yml)
+
+A knowledge base for phpBB: categorised articles in Markdown or BBCode, with revisions, an approval workflow, search, and RSS and Atom feeds.
+
+## Features
+
+- Articles in categories, shown as one flat index with a category dropdown (the default) or as a category tree, in each member's board style, with an optional colour stylesheet.
+- Articles written in BBCode or Markdown, with attachments, custom fields (a dropdown, radio buttons or a checkbox list, each optionally required) and a plain-text description.
+- Private drafts, revisions, and an approval queue where moderators assign, review, approve or reject articles and edits; authors get notifications and, by default, private messages.
+- Co-authors, and **Change author** to hand an article to another member or a Knowledge Base team. Every transfer is logged.
+- Article status (draft, pending, pending revision) on article pages, category lists and queues, without showing what a draft says.
+- Search with phpBB-style native, MySQL fulltext or PostgreSQL fulltext backends, and a Knowledge Base block in the board's own search results.
+- A recent changes page with RSS and Atom feeds, optional comment topics, and an optional changelog forum.
+- Its own per-category permissions, managed with the rest of the settings in the ACP.
+- An optional introduction above the article index, in BBCode or Markdown.
+- Takes over the data of the original `sheer/knowledgebase` extension, and imports `kinerity/knowledgebase`.
 
 ## Screenshots
 
@@ -17,15 +32,11 @@ A knowledge base for phpBB: articles organised in categories, with attachments,
 
 More screenshots, including the article form, the approval queue and the ACP settings: [docs/images/screenshots](docs/images/screenshots/README.md).
 
-Primary authorship of submitted articles can be transferred to another active
-member or a configured KB team using **Change author** on the article page.
-Grant moderators **Can change the primary author of submitted articles** in
-Knowledge Base category permissions. KB administrators already have access.
-Transfers are logged and retain co-authors and submitted revisions. Private
-drafts and articles with private draft edits must be submitted or discarded
-before authorship can change.
+## Requirements
 
-Article pages show status below the category. Category lists and review queues also show status, pending revisions, and “Has draft” for authors and authorized editors. Draft contents remain private. Markdown search excerpts retain their formatting.
+- phpBB 3.3.19 or later; phpBB 4.0 works too (tested with its development version)
+- PHP 8.1 or later
+- MySQL/MariaDB, PostgreSQL, SQLite or MSSQL
 
 ## Installation
 
@@ -83,17 +94,17 @@ sudo chmod -R 775 store
 
 Without shell access, set the `store` folder and everything in it to 775 with your FTP program (777 only if your host allows nothing else). Reload the Configuration page: the message goes away as soon as the folders can be made. Attachments that earlier versions kept in `ext/phpbbmodders/knowledgebase/files/` are moved across when the extension is updated; any that could not be moved stay in that folder and keep the old problem, so run the commands above and disable and enable the extension again.
 
-## Automated testing
+## TODO
 
-See [Testing](docs/testing.md) for local regression tests and disposable
-MySQL/PostgreSQL fixtures. The current GitHub workflow runs coding and
-extension validation checks, not these regression tests.
+Ideas not yet built, practical and speculative alike: [`docs/TODO.md`](docs/TODO.md).
 
-[![Tests](https://github.com/phpbbmodders/knowledgebase/actions/workflows/tests.yml/badge.svg)](https://github.com/phpbbmodders/knowledgebase/actions/workflows/tests.yml)
+## Contributing
 
-## TODO
+Contributions are welcome!
 
-Ideas not yet built, practical and speculative alike: [`docs/TODO.md`](docs/TODO.md).
+- **Bug reports**: [Open an issue](https://github.com/phpbbmodders/knowledgebase/issues).
+- **Everything else** (questions, feature requests, ideas, general discussion): [Use Discussions](https://github.com/orgs/phpbbmodders/discussions), or the [community forum](https://www.phpbbmodders.com/community/).
+- Pull requests are welcome for bug fixes or discussed features. See [Testing](docs/testing.md) for the PHPUnit suite and the browser checks.
 
 ## Acknowledgments
 
@@ -102,7 +113,6 @@ Based on the original [knowledgebase](https://github.com/sutrus/knowledgebase) e
 - Code review, bug fixes, and documentation assisted by [Claude](https://www.anthropic.com/claude).
 - Code review, bug fixes, and documentation assisted by [Codex](https://openai.com/codex/).
 
-
 ## License
 
 Licensed under the [GNU General Public License v2](license.txt)
diff --git a/acp/attachments_info.php b/acp/attachments_info.php
index 7f94a1b..4f08a81 100644
--- a/acp/attachments_info.php
+++ b/acp/attachments_info.php
@@ -33,17 +33,17 @@ public function module(): array
 				],
 				'orphan'      => [
 					'title' => 'ACP_LIBRARY_ATTACHMENTS_ORPHAN',
-					'auth'  => 'ext_phpbbmodders/knowledgebase && acl_a_board',
+					'auth'  => 'ext_phpbbmodders/knowledgebase && acl_a_board && acl_a_manage_kb',
 					'cat'   => ['ACP_KNOWLEDGE_BASE'],
 				],
 				'extra_files' => [
 					'title' => 'ACP_LIBRARY_ATTACHMENTS_EXTRA_FILES',
-					'auth'  => 'ext_phpbbmodders/knowledgebase && acl_a_board',
+					'auth'  => 'ext_phpbbmodders/knowledgebase && acl_a_board && acl_a_manage_kb',
 					'cat'   => ['ACP_KNOWLEDGE_BASE'],
 				],
 				'lost_files'  => [
 					'title' => 'ACP_LIBRARY_ATTACHMENTS_LOST_FILES',
-					'auth'  => 'ext_phpbbmodders/knowledgebase && acl_a_board',
+					'auth'  => 'ext_phpbbmodders/knowledgebase && acl_a_board && acl_a_manage_kb',
 					'cat'   => ['ACP_KNOWLEDGE_BASE'],
 				],
 			],
diff --git a/acp/manage_module.php b/acp/manage_module.php
index b96e9a3..eae3f09 100644
--- a/acp/manage_module.php
+++ b/acp/manage_module.php
@@ -75,10 +75,22 @@ public function main(string $id, string $mode): void
 
 		$action = $request->variable('action', '');
 		$update = ($request->is_set_post('update'));
-		$category_id = $request->variable('f', '');
+		$category_id = $request->variable('f', 0);
 		$parent_id = $request->variable('parent_id', 0);
 		$copy_perm_from_id = $request->variable('cat_perm_from', 0);
 
+		// Every change below needs this page's form token (add, edit,
+		// delete) or its link hash (move up/down, sync)
+		add_form_key('kb_acp_manage');
+		if ($update && !check_form_key('kb_acp_manage'))
+		{
+			trigger_error($language->lang('FORM_INVALID') . adm_back_link($this->u_action . '&parent_id=' . $parent_id), E_USER_WARNING);
+		}
+		if (in_array($action, ['move_up', 'move_down', 'sync'], true) && !check_link_hash($request->variable('hash', ''), 'kb_acp_manage'))
+		{
+			trigger_error($language->lang('FORM_INVALID') . adm_back_link($this->u_action . '&parent_id=' . $parent_id), E_USER_WARNING);
+		}
+
 		if ($update)
 		{
 			switch ($action)
@@ -331,11 +343,11 @@ public function main(string $id, string $mode): void
 						'CATEGORY_DESCR' => $row['category_details'],
 						'ARTICLES'       => $row['number_articles'],
 						'U_CATEGORY'     => $this->u_action . '&parent_id=' . $row['category_id'],
-						'U_MOVE_UP'      => $url . '&action=move_up',
-						'U_MOVE_DOWN'    => $url . '&action=move_down',
+						'U_MOVE_UP'      => $url . '&action=move_up&hash=' . generate_link_hash('kb_acp_manage'),
+						'U_MOVE_DOWN'    => $url . '&action=move_down&hash=' . generate_link_hash('kb_acp_manage'),
 						'U_EDIT'         => $url . '&action=edit',
 						'U_DELETE'       => $url . '&action=delete',
-						'U_SYNC'         => $url . '&action=sync',
+						'U_SYNC'         => $url . '&action=sync&hash=' . generate_link_hash('kb_acp_manage'),
 					]
 				);
 			} while ($row = $db->sql_fetchrow($result));
diff --git a/acp/permissions_module.php b/acp/permissions_module.php
index 4c4cdd2..62983d3 100644
--- a/acp/permissions_module.php
+++ b/acp/permissions_module.php
@@ -94,6 +94,10 @@ public function main(string $id, string $mode): void
 		$delete = $request->variable('delete', false);
 		$category_id = $all_cats ? $admin_controller->make_array_categoryid() : $request->variable('category_id', [0]);
 
+		// The token for every form on these pages; get_mask() checks it
+		// before saving permissions
+		add_form_key('kb_acp_permissions');
+
 		// Map usernames to ids and vice versa
 		if ($usernames)
 		{
diff --git a/adm/style/acp_knowledgebase_category.html b/adm/style/acp_knowledgebase_category.html
index df0714b..a033efc 100644
--- a/adm/style/acp_knowledgebase_category.html
+++ b/adm/style/acp_knowledgebase_category.html
@@ -203,7 +203,7 @@ <h3>{{ lang('WARNING') }}</h3>
 			<fieldset class="quick">
 				{{ lang('SELECT_CATEGORY') }}{{ lang('COLON') }}
 				<label>
-					<select name="parent_id"
+					<select name="parent_id" aria-label="{{ lang('SELECT_CATEGORY') }}"
 						onchange="if(this.options[this.selectedIndex].value !== -1){ this.form.submit(); }">{{ CATS_BOX }}
 					</select>
 				</label>
@@ -214,7 +214,7 @@ <h3>{{ lang('WARNING') }}</h3>
 		{% endif %}
 		<fieldset class="quick">
 			<input type="hidden" name="action" value="add"/>
-			<label><input type="text" name="category_name" value="" maxlength="255"/></label>
+			<label><input type="text" name="category_name" value="" maxlength="255" aria-label="{{ lang('ADD_CATEGORY') }}"/></label>
 			<input class="button2" name="addcat" type="submit" value="{{ lang('ADD_CATEGORY') }}"/>
 			{{ S_FORM_TOKEN }}
 		</fieldset>
diff --git a/adm/style/acp_knowledgebase_config.html b/adm/style/acp_knowledgebase_config.html
index 13320c2..366d3eb 100644
--- a/adm/style/acp_knowledgebase_config.html
+++ b/adm/style/acp_knowledgebase_config.html
@@ -231,14 +231,15 @@ <h1>{{ lang('ACP_KNOWLEDGE_BASE_CONFIGURE') }}</h1>
 			<dd>
 				<input type="number" id="extgroup_filesize" min="0" max="999999999999999" step="any" name="max_filesize"
 					value="{{ EXTGROUP_FILESIZE }}"/>
-				<label><select name="size_select"> {{ S_EXT_GROUP_SIZE_OPTIONS }}</select></label>
+				<label><select name="size_select" aria-label="{{ lang('ATTACH_MAX_FILESIZE') }}"> {{ S_EXT_GROUP_SIZE_OPTIONS }}</select></label>
 			</dd>
 		</dl>
 	</fieldset>
 	<fieldset>
 		<legend>{{ lang('KB_TEAMS') }}</legend>
-		<dl>{{ lang('KB_TEAMS_EXPLAIN') }}</dl>
+		<p>{{ lang('KB_TEAMS_EXPLAIN') }}</p>
 		<dl>
+			<dt>{{ lang('KB_TEAMS') }}{{ lang('COLON') }}</dt>
 			{% for row in loops.team_group %}
 				<dd>
 					<label>
diff --git a/composer.json b/composer.json
index 75a9534..e353106 100644
--- a/composer.json
+++ b/composer.json
@@ -1,7 +1,7 @@
 {
 	"name": "phpbbmodders/knowledgebase",
 	"type": "phpbb-extension",
-	"description": "Knowledge Base",
+	"description": "A knowledge base for phpBB: categorised articles in Markdown or BBCode, with revisions, an approval workflow, search, and RSS and Atom feeds.",
 	"homepage": "https://www.phpbbmodders.com/",
 	"version": "2.1.0-a1-dev",
 	"keywords": [
diff --git a/controller/acp_controller.php b/controller/acp_controller.php
index 6e2751b..05b63bb 100644
--- a/controller/acp_controller.php
+++ b/controller/acp_controller.php
@@ -1421,8 +1421,10 @@ public function move_article(): void
 		// move from
 		$info = $this->kb->get_kb_article_info($article_id);
 
+		add_form_key('kb_acp_articles');
 		if ($submit)
 		{
+			$this->require_form_key('kb_acp_articles');
 			$this->kb->kb_move_article($article_id, $info['article_title'], $info['article_category_id'], $to_id, $info['display_order']);
 			meta_refresh(2, $this->u_action);
 			trigger_error($this->language->lang('ARTICLE_MOVED'));
@@ -2547,6 +2549,12 @@ public function get_mask($mode, $user_mode, $group_id, $category_id, $user_id):
 		];
 
 		$apply_all_permissions = $this->request->variable('apply_all_permissions', false);
+		// Saving permissions changes them, so it needs the form token
+		// permissions_module adds to every form on its pages
+		if ($apply_all_permissions || $this->request->is_set_post('submit'))
+		{
+			$this->require_form_key('kb_acp_permissions');
+		}
 
 		if (!empty($user_id) && $user_mode != 'group')
 		{
diff --git a/controller/approve.php b/controller/approve.php
index 858e4f9..af1ac3a 100644
--- a/controller/approve.php
+++ b/controller/approve.php
@@ -324,7 +324,6 @@ public function approve_article(): \Symfony\Component\HttpFoundation\Response
 
 		$kb_article_info = $this->kb->get_kb_article_info($art_id);
 		$kb_category_info = $this->kb->get_cat_info($kb_article_info['article_category_id']);
-		$category_name = $kb_category_info['category_name'];
 		$status = (int) $kb_article_info['status'];
 
 		// A draft was never submitted - not even reachable by a moderator
@@ -339,6 +338,13 @@ public function approve_article(): \Symfony\Component\HttpFoundation\Response
 			$this->auth->acl_get('a_manage_kb') ||
 			$this->kb->acl_kb_get_any($this->kb->get_article_categories($art_id), 'kb_m_approve');
 
+		// The page shows unapproved articles and pending revisions in full,
+		// so only moderators and the team reviewing the article may open it
+		if (!$is_moderator && !($effective_team_id && $this->kb->is_team_member([$effective_team_id])))
+		{
+			trigger_error('NOT_AUTHORISED');
+		}
+
 		// Actions submitted from the Administration queue's own row form
 		// (deactivate/reactivate/review) should return there, not to the
 		// category page - the moderator is working through a list, not
diff --git a/docs/images/screenshots/07-acp-configuration.png b/docs/images/screenshots/07-acp-configuration.png
index 8aa02c6..2c1e238 100644
Binary files a/docs/images/screenshots/07-acp-configuration.png and b/docs/images/screenshots/07-acp-configuration.png differ
diff --git a/docs/images/screenshots/17-index-introduction.png b/docs/images/screenshots/17-index-introduction.png
new file mode 100644
index 0000000..b673aa9
Binary files /dev/null and b/docs/images/screenshots/17-index-introduction.png differ
diff --git a/docs/images/screenshots/18-acp-introduction.png b/docs/images/screenshots/18-acp-introduction.png
new file mode 100644
index 0000000..0d13b5d
Binary files /dev/null and b/docs/images/screenshots/18-acp-introduction.png differ
diff --git a/docs/images/screenshots/README.md b/docs/images/screenshots/README.md
index 4455ba2..34545cd 100644
--- a/docs/images/screenshots/README.md
+++ b/docs/images/screenshots/README.md
@@ -14,6 +14,9 @@ browsing on for the category-tree capture and restores its previous setting.
 The current fixture is the seed-forum board at `http://localhost:8102`.
 
 The two ACP pages are taken in full, so a setting further down the page is not cut off.
+The ACP configuration page and the two introduction shots (11/12/2026) come from
+`phpbb-release-tools/phpbb-test-board/screenshots.py` instead, on a board built by its
+`setup-board.sh` with seed-forum's standard fixtures, which is why they are narrower than the rest.
 
 ## The flat article index
 
@@ -65,9 +68,9 @@ Results of a search on the Knowledge Base's own search page.
 
 ## ACP configuration
 
-**Extensions > Knowledge Base > Configuration**, the whole page: the announcement and changelog forums, hierarchical browsing, the alternative stylesheet, the **Recent changes feed** (RSS, Atom or both), the number of articles per page, the description length and the sorting order, then the attachment settings, the review teams and the contact group.
+**Extensions > Knowledge Base > Configuration**, the whole page: the announcement and changelog forums, hierarchical browsing, the introduction above the index, the alternative stylesheet, the **Recent changes feed** (RSS, Atom or both), the number of articles per page, the description length and the sorting order, then the attachment settings, the review teams and the contact group.
 
-<a href="07-acp-configuration.png"><img src="07-acp-configuration.png" width="960" height="1094" alt="The configuration page in the ACP"></a>
+<a href="07-acp-configuration.png"><img src="07-acp-configuration.png" width="960" height="1277" alt="The configuration page in the ACP"></a>
 
 ## Knowledge Base articles in the board's search
 
@@ -111,3 +114,15 @@ A blocked transfer appears in the extension's Notice tab, with the board styling
 Markdown headings, lists and emphasis render in a shortened search excerpt rather than appearing as source syntax.
 
 <a href="16-markdown-search.png"><img src="16-markdown-search.png" width="960" height="673" alt="Rendered Markdown search"></a>
+
+## Index introduction
+
+With **Show an introduction** ticked in the ACP configuration, a short text sits under the Knowledge Base title on the index. It can be BBCode or Markdown; a new board gets a default text, and it is off until switched on.
+
+<a href="17-index-introduction.png"><img src="17-index-introduction.png" width="960" height="675" alt="The Knowledge Base index with an introduction under its title"></a>
+
+## ACP introduction settings
+
+The **Configuration** block of the ACP configuration page with **Show an introduction** ticked: the introduction text, which starts as the default text, and whether it is written in Markdown.
+
+<a href="18-acp-introduction.png"><img src="18-acp-introduction.png" width="960" height="807" alt="The introduction settings in the ACP configuration"></a>
diff --git a/docs/testing.md b/docs/testing.md
index 4af1613..7105d8b 100644
--- a/docs/testing.md
+++ b/docs/testing.md
@@ -1566,3 +1566,48 @@ workers for `serve-board.py` (a browser's unused early connection held the singl
 
 The PHPUnit suite passes on phpBB 3.3.x and master with the MySQL and PostgreSQL fixtures above:
 511 tests, none skipped.
+
+## Maintenance pass: form tokens, the approve page and labels - 11/12/2026
+
+A validation of the whole extension found four problems:
+
+- ACP category management read the category id as a string and put it into SQL, ran move up,
+  move down and sync from plain links, and added, edited and deleted categories without checking
+  a form token. A forged link or page could make an administrator run SQL or delete a category.
+  The id is now an integer, the links carry a link hash and the forms are checked.
+- Moving an article in the ACP and saving Knowledge Base permissions did not check the form token.
+- The approve page showed the title, description and pending revision text of unapproved articles
+  to any registered member, whatever their Knowledge Base access. Only moderators and the members
+  of the team the article is assigned to may open it now.
+- Smaller: three attachment modes in `attachments_info.php` asked for less permission than the
+  installed modules, and the minimum-version message used `%1s` instead of `%1$s`.
+
+`kb_acp_csrf_test.php` now covers the article move and both ways of saving permissions; those
+three cases fail on the code before the fix. `tests/browser/kb_page_sweep.js` also checks that a
+category move link without its hash and the approve page for `kb_reader` are refused.
+
+An axe-core run (WCAG 2.2 A and AA, desktop and phone widths, with keyboard focus checks) through
+`phpbb-test-board/page_a11y.py`, on the index, a category, an article, the posting form, the queue,
+the approve page and two ACP pages, found controls without an accessible name: the category
+dropdown, the copy-link boxes, the article text box, custom-field dropdowns, the queue's team and
+action menus, and in the ACP the category picker, the new-category box and the file-size unit menu.
+Each is now labelled, and the Teams block of the ACP configuration page uses valid definition-list
+markup. What remains is prosilver's own markup (header menus, footer links, the pagination list,
+plupload's hidden file input), the inactive tabs' contrast, which comes from prosilver's tab colours
+and differs per style, and small touch targets in the article lists and queue rows.
+
+phpbb-release-tools gained a Knowledge Base feature check (`check_knowledgebase` in
+`feature_checks.py`): the ACP adds a category and refuses its form without a token and a move link
+without a hash; a member submits an article that other members cannot read, nor open its approve
+page, until a moderator assigns it to a team, marks it reviewed and approves it; then members read
+it and the Knowledge Base search finds it. On the code before this pass, exactly the three refusal
+checks fail.
+
+Claude ran, on fresh seed-forum boards with the full fixtures for phpBB 3.3.19 and 4.0.0-a3-dev on
+SQLite, MySQL 8.4, MariaDB, PostgreSQL 16 and MSSQL (ten boards): the page sweep (26 of 26 on each),
+the feature check with its disable, purge and enable round trip (14 of 14 on each), and a second
+disable, purge and enable that left nothing behind and finished all 43 migrations. An upgrade from
+the current development build's code (`313eac3`, 40 migrations) on SQLite and MySQL boards migrated
+to 43 and passed the sweep and the feature check. The PHPUnit suite passes on phpBB 3.3.x and
+master with the MySQL and PostgreSQL fixtures: 578 tests, none skipped. EPV and phpcs are clean on
+both branches.
diff --git a/docs/update/2026-11-12/01-index-introduction.png b/docs/update/2026-11-12/01-index-introduction.png
new file mode 100644
index 0000000..b673aa9
Binary files /dev/null and b/docs/update/2026-11-12/01-index-introduction.png differ
diff --git a/docs/update/2026-11-12/02-acp-introduction.png b/docs/update/2026-11-12/02-acp-introduction.png
new file mode 100644
index 0000000..0d13b5d
Binary files /dev/null and b/docs/update/2026-11-12/02-acp-introduction.png differ
diff --git a/docs/update/2026-11-12/README.md b/docs/update/2026-11-12/README.md
new file mode 100644
index 0000000..1e7f97c
--- /dev/null
+++ b/docs/update/2026-11-12/README.md
@@ -0,0 +1,9 @@
+# Knowledge Base update screenshots — 11/12/2026
+
+An optional introduction under the Knowledge Base title on the index, in BBCode or Markdown.
+
+[<img src="01-index-introduction.png" width="640" height="450" alt="The Knowledge Base index with an introduction under its title." />](01-index-introduction.png)
+
+The introduction settings in the ACP configuration: switch it on, write the text, and choose Markdown if you like.
+
+[<img src="02-acp-introduction.png" width="640" height="538" alt="The introduction settings in the Knowledge Base ACP configuration." />](02-acp-introduction.png)
diff --git a/ext.php b/ext.php
index e04cd8d..d51dda9 100644
--- a/ext.php
+++ b/ext.php
@@ -43,7 +43,7 @@ public function is_enableable()
 		if (!$this->check_phpbb_version() || !$this->check_php_version())
 		{
 			$language->add_lang('install_failed', 'phpbbmodders/knowledgebase');
-			$messages[] = $language->lang('INSTALL_FAILED_VERSION', self::MIN_PHPBB_VERSION, PHPBB_VERSION, self::MIN_PHP_VERSION, PHP_VERSION);
+			$messages[] = $language->lang('KB_NOT_ENABLEABLE', self::MIN_PHPBB_VERSION, PHPBB_VERSION, self::MIN_PHP_VERSION, PHP_VERSION);
 		}
 
 		// The original sheer/knowledgebase package shares this extension's
diff --git a/inc/field/kb_single_select_field_type.php b/inc/field/kb_single_select_field_type.php
index af89841..4a2b69a 100644
--- a/inc/field/kb_single_select_field_type.php
+++ b/inc/field/kb_single_select_field_type.php
@@ -64,7 +64,7 @@ public function render_posting_field(array $field, array $values, array $selecte
 			$options .= '<option value="' . (int) $value['value_id'] . '"' . $is_selected . '>' . htmlspecialchars($value['value_label']) . '</option>';
 		}
 
-		return $this->wrap_posting_field($field, '<select name="field_values[' . (int) $field['field_id'] . '][]">' . $options . '</select>');
+		return $this->wrap_posting_field($field, '<select name="field_values[' . (int) $field['field_id'] . '][]" id="kb_field_' . (int) $field['field_id'] . '">' . $options . '</select>', 'kb_field_' . (int) $field['field_id']);
 	}
 
 	/**
@@ -73,14 +73,18 @@ public function render_posting_field(array $field, array $values, array $selecte
 	 *
 	 * @param array  $field
 	 * @param string $widget
+	 * @param string $label_for Id of the widget's control, when it is a single one
 	 * @return string
 	 */
-	protected function wrap_posting_field(array $field, string $widget): string
+	protected function wrap_posting_field(array $field, string $widget, string $label_for = ''): string
 	{
+		// Only a single control can be the label's target; a group of radio
+		// buttons keeps its own labels
+		$for = $label_for !== '' ? ' for="' . $label_for . '"' : '';
 		$hint = !empty($field['field_required']) ? '<br><span>' . $this->language->lang('KB_FIELD_REQUIRED_HINT') . '</span>' : '';
 
 		return '<dl style="clear: left;">
-			<dt><label>' . htmlspecialchars($field['field_name']) . $this->language->lang('COLON') . '</label>' . $hint . '</dt>
+			<dt><label' . $for . '>' . htmlspecialchars($field['field_name']) . $this->language->lang('COLON') . '</label>' . $hint . '</dt>
 			<dd>' . $widget . '</dd>
 		</dl>';
 	}
diff --git a/language/en/install_failed.php b/language/en/install_failed.php
index a1134df..e3455ec 100644
--- a/language/en/install_failed.php
+++ b/language/en/install_failed.php
@@ -21,7 +21,7 @@
 }
 
 $lang = array_merge($lang, [
-	'INSTALL_FAILED_VERSION' => '<b>The Knowledge Base extension does not meet the minimum requirements</b><br><br>phpBB minimum version %1s - you are using %2s <br>PHP minimum version %3s - you are using %4s',
+	'KB_NOT_ENABLEABLE' => '<b>The Knowledge Base extension does not meet the minimum requirements</b><br><br>phpBB minimum version %1$s - you are using %2$s <br>PHP minimum version %3$s - you are using %4$s',
 	'INSTALL_FAILED_ORIGINAL_ENABLED' => '<b>The original %1$s extension is still enabled</b><br><br>It uses the same database tables and pages as this Knowledge Base, so both cannot be enabled together. Disable %1$s first (Customise &raquo; Manage extensions), then enable this extension: it takes over the articles, categories, permissions and settings the original created.',
 	'INSTALL_FAILED_KINERITY_ENABLED' => '<b>The %1$s extension is still enabled</b><br><br>It uses the same database table names and pages as this Knowledge Base, so both cannot be enabled together. Disable %1$s first (Customise &raquo; Manage extensions), without deleting its data, then enable this extension: it imports the categories, articles and permissions %1$s created.',
 ]);
diff --git a/language/en/knowledgebase_lng.php b/language/en/knowledgebase_lng.php
index b35ac84..c972844 100644
--- a/language/en/knowledgebase_lng.php
+++ b/language/en/knowledgebase_lng.php
@@ -75,6 +75,7 @@
 	'KB_APPROVE_REVISION'                  => 'Approve revision',
 	'KB_ASSIGN'                            => 'Assign',
 	'KB_ASSIGN_TO'                         => 'Assign to team',
+	'KB_QUEUE_ACTION'                      => 'Action',
 	'KB_CHANGELOG_REPLY_SUBJECT'           => 'Re: %s',
 	'KB_CHANGELOG_SUBMITTED'               => 'Article submitted by %s.',
 	'KB_CHANGELOG_REVISION_SUBMITTED'      => 'New revision submitted by %s.',
diff --git a/styles/all/template/kb_article_body.html b/styles/all/template/kb_article_body.html
index b99f386..d3b2089 100644
--- a/styles/all/template/kb_article_body.html
+++ b/styles/all/template/kb_article_body.html
@@ -47,12 +47,12 @@ <h3 class="first">{{ ARTICLE_TITLE }}</h3>
 				<p>{{ lang('LINK_TO_ARTICLE') }}{{ lang('COLON') }} <a class="buttoncopy"
 						data-copytarget="#bbcode">{{ lang('COPY_TO_BUFFER') }}</a></p>
 				<code>{{ U_ARTICLE }}</code>
-				<input value="{{ U_ARTICLE }}" id="bbcode" type="text">
+				<input value="{{ U_ARTICLE }}" id="bbcode" type="text" aria-label="{{ lang('LINK_TO_ARTICLE') }}">
 				<hr>
 				<p>{{ lang('DIRECT_LINK') }}{{ lang('COLON') }} <a class="buttoncopy"
 						data-copytarget="#link">{{ lang('COPY_TO_BUFFER') }}</a></p>
 				<code>{{ U_DIRECT_LINK }}</code>
-				<input value="{{ U_DIRECT_LINK }}" id="link" type="text">
+				<input value="{{ U_DIRECT_LINK }}" id="link" type="text" aria-label="{{ lang('DIRECT_LINK') }}">
 			</div>
 			<ul class="post-buttons">
 				{% if (not S_APPROVED or S_HAS_REVISION) and S_CAN_APPROVE %}
diff --git a/styles/all/template/kb_cat_body.html b/styles/all/template/kb_cat_body.html
index 7c324dd..d84c6dc 100644
--- a/styles/all/template/kb_cat_body.html
+++ b/styles/all/template/kb_cat_body.html
@@ -5,9 +5,9 @@ <h2><a href="{{ U_LIBRARY }}" class="nav">{{ lang('LIBRARY') }}</a></h2>
 {% if S_FLAT_LAYOUT %}
 	<div class="panel">
 		<div class="inner">
-			<strong>{{ lang('KB_NARROW_CATEGORY') }}</strong><br>
+			<label for="kb_category_select"><strong>{{ lang('KB_NARROW_CATEGORY') }}</strong></label><br>
 			<form method="get" action="{{ S_ACTION }}">
-				<select name="id" onchange="this.form.submit();">
+				<select name="id" id="kb_category_select" onchange="this.form.submit();">
 					<option value="0">{{ lang('KB_ALL_CATEGORIES') }}</option>
 					{{ CATS_OPTIONS }}
 				</select>
diff --git a/styles/all/template/kb_post_body.html b/styles/all/template/kb_post_body.html
index b05e95c..7289d60 100644
--- a/styles/all/template/kb_post_body.html
+++ b/styles/all/template/kb_post_body.html
@@ -125,7 +125,7 @@ <h3>{{ lang('POST_A') }}</h3>
 						{% endif %}
 					</div>
 					<div id="message-box" class="message-box">
-						<textarea name="message" id="message" rows="15" cols="76" tabindex="4" onselect="storeCaret(this);"
+						<textarea name="message" id="message" rows="15" cols="76" tabindex="4" aria-label="{{ lang('MESSAGE_BODY') }}" onselect="storeCaret(this);"
 							onclick="storeCaret(this);" onkeyup="storeCaret(this);" onfocus="initInsertions();"
 							class="inputbox">{{ MESSAGE }}</textarea>
 					</div>
diff --git a/styles/all/template/kb_queue_body.html b/styles/all/template/kb_queue_body.html
index d72655c..d6715ea 100644
--- a/styles/all/template/kb_queue_body.html
+++ b/styles/all/template/kb_queue_body.html
@@ -46,7 +46,7 @@ <h2><a href="{{ U_LIBRARY }}" class="nav">{{ lang('LIBRARY') }}</a> &raquo; {{ l
 						{{ S_FORM_TOKEN }}
 						<input type="hidden" name="redirect_queue" value="1">
 						<input type="hidden" name="action" value="assign">
-						<select name="team_id">{{ art_row.TEAM_OPTIONS }}</select>
+						<select name="team_id" aria-label="{{ lang('KB_ASSIGN_TO') }}">{{ art_row.TEAM_OPTIONS }}</select>
 						<button class="button2" type="submit">{{ lang('KB_ASSIGN') }}</button>
 					</form>&nbsp;
 				{% endif %}
@@ -64,7 +64,7 @@ <h2><a href="{{ U_LIBRARY }}" class="nav">{{ lang('LIBRARY') }}</a> &raquo; {{ l
 					<form method="post" action="{{ art_row.S_ACTION }}">
 						{{ S_FORM_TOKEN }}
 						<input type="hidden" name="redirect_queue" value="1">
-						<select name="action">
+						<select name="action" aria-label="{{ lang('KB_QUEUE_ACTION') }}">
 							{% if art_row.S_STATUS_NEW and art_row.S_CAN_REVIEW %}
 								<option value="review">{{ lang('KB_MARK_REVIEWED') }}</option>
 							{% endif %}
diff --git a/tests/browser/kb_page_sweep.js b/tests/browser/kb_page_sweep.js
index 6a9a3f3..59bd52b 100644
--- a/tests/browser/kb_page_sweep.js
+++ b/tests/browser/kb_page_sweep.js
@@ -1,7 +1,9 @@
 // Load every main Knowledge Base page and every Knowledge Base ACP module as
 // the seeded administrator, and fail on a server error, a PHP error or
-// phpBB's SQL error page. Read-only: it opens pages and submits nothing but
-// the login forms, so it suits any seed-forum board on any database.
+// phpBB's SQL error page. Then check two refusals: an ACP category move link
+// without its hash, and the approve page for the seeded kb_reader. Read-only:
+// it opens pages and submits nothing but the login forms, so it suits any
+// seeded seed-forum board on any database.
 //
 // KB_TEST_URL is the board's base URL, without a trailing slash. Routes go
 // through app.php, so the board needs no clean-URL rewriting.
@@ -17,6 +19,10 @@ const password = 'KbTest1234!';
 // Text that only shows up when a page broke
 const ERROR_MARKERS = ['SQL ERROR', 'Fatal error', 'Parse error', 'Uncaught', 'General Error', '[phpBB Debug]', 'Warning</b>:', 'Notice</b>:', 'Deprecated</b>:'];
 
+// phpBB's English messages for a refused form or page (seed-forum boards are English)
+const FORM_INVALID = 'The submitted form was invalid';
+const NOT_AUTHORISED = 'You are not authorised to access this area';
+
 // phpBB refuses a form submitted within two seconds of it being made
 async function waitForFormAge(page) {
 	await page.waitForFunction(() => {
@@ -58,6 +64,13 @@ async function waitForFormAge(page) {
 		return body;
 	}
 
+	// A page that must be refused, showing phpBB's message for that
+	async function expectText(label, url, text, tab = page) {
+		const response = await tab.goto(url, ready);
+		const shown = await tab.locator('body').innerText();
+		results.push({label, status: response ? response.status() : 0, problems: shown.includes(text) ? [] : [`expected "${text}"`]});
+	}
+
 	try {
 		// Board login
 		await page.goto(`${base}/ucp.php?mode=login`, ready);
@@ -95,6 +108,21 @@ async function waitForFormAge(page) {
 		const modules = await page.locator('#menu a[href*="i=-phpbbmodders-knowledgebase-acp-"]').evaluateAll(links => links.map(link => [link.textContent.trim(), link.href]));
 		if (!modules.length) throw new Error('No Knowledge Base modules in the ACP menu');
 		for (const [label, href] of modules) await check(`acp ${label}`, href);
+
+		// Refusals: a category move link without its hash, and the approve
+		// page for a member who is neither a moderator nor on the article's team
+		const manage = '/adm/index.php?i=-phpbbmodders-knowledgebase-acp-manage_module&mode=manage';
+		await expectText('acp move without hash refused', `${base}${manage}&action=move_up&f=1&sid=${await sessionCookie(page)}`, FORM_INVALID);
+		const reader = await browser.newPage();
+		reader.setDefaultTimeout(120000);
+		await reader.route(/\.(css|js|png|gif|jpe?g|svg|ico|woff2?|ttf)(\?|$)/, route => route.abort());
+		await reader.goto(`${base}/ucp.php?mode=login`, ready);
+		await reader.locator('#username').fill('kb_reader');
+		await reader.locator('#password').fill(password);
+		await waitForFormAge(reader);
+		await reader.locator('[name="login"][type="submit"]').click();
+		await reader.waitForURL(url => !url.search.includes('mode=login'), ready);
+		await expectText('approve page refused for kb_reader', `${base}/app.php/knowledgebase/approve?id=${new URL(article).searchParams.get('k')}`, NOT_AUTHORISED, reader);
 	} finally {
 		await browser.close();
 	}
diff --git a/tests/kb_acp_csrf_test.php b/tests/kb_acp_csrf_test.php
index 6810505..f7a233a 100644
--- a/tests/kb_acp_csrf_test.php
+++ b/tests/kb_acp_csrf_test.php
@@ -96,9 +96,30 @@ public function forged_requests()
 			['search_index', ['id', 'index'], [], ['action' => 'create', 'hash' => 'kb_acp_search_create_valid'], ''],
 			['search_index', ['id', 'index'], ['continue'], ['action' => 'create'], 'probe,create,1'],
 			['search_index', ['id', 'index'], ['cancel'], [], 'probe,create,1'],
+			['get_mask', ['setting', 'group', [2], [1], false], ['submit'], [], ''],
+			['get_mask', ['setting', 'group', [2], [1], false], [], ['apply_all_permissions' => true], ''],
 		];
 	}
 
+	public function test_forged_article_move_is_rejected_before_moving()
+	{
+		$this->request_values(['submit'], ['aid' => 5, 'to_id' => 2]);
+		$kb = $this->createMock(\phpbbmodders\knowledgebase\inc\functions_kb::class);
+		$kb->method('get_kb_article_info')->willReturn(['article_title' => 'A', 'article_category_id' => 1, 'display_order' => 1]);
+		$kb->expects($this->never())->method('kb_move_article');
+		$this->inject('kb', $kb);
+		try
+		{
+			$this->controller->move_article();
+		}
+		catch (\RuntimeException $error)
+		{
+			$this->assertSame('FORM_INVALID', $error->getMessage());
+			return;
+		}
+		$this->fail('A forged article move must be rejected');
+	}
+
 	/** @dataProvider batch_keys */
 	public function test_valid_batch_submissions_and_continuations($key, $post)
 	{
diff --git a/tests/kb_single_select_field_test.php b/tests/kb_single_select_field_test.php
index 2d2d22c..3ca8941 100644
--- a/tests/kb_single_select_field_test.php
+++ b/tests/kb_single_select_field_test.php
@@ -61,7 +61,9 @@ public function test_the_dropdown_marks_the_chosen_value_and_escapes_labels()
 	{
 		$html = $this->type(kb_single_select_field_type::class)->render_posting_field(self::FIELD, self::VALUES, [5]);
 
-		$this->assertStringContainsString('<select name="field_values[7][]">', $html);
+		// The field name labels the dropdown itself
+		$this->assertStringContainsString('<select name="field_values[7][]" id="kb_field_7">', $html);
+		$this->assertStringContainsString('<label for="kb_field_7">', $html);
 		$this->assertStringContainsString('<option value="0">KB_FIELD_SELECT_PLACEHOLDER</option>', $html);
 		$this->assertStringContainsString('<option value="4">Users</option>', $html);
 		$this->assertStringContainsString('<option value="5" selected="selected">Admins &amp; &lt;i&gt;devs&lt;/i&gt;</option>', $html);
@@ -86,6 +88,15 @@ public function test_a_required_field_shows_the_hint()
 		}
 	}
 
+	public function test_radio_buttons_keep_a_label_without_a_target()
+	{
+		// A group of radio buttons has no single control for the field's label to point at
+		$html = $this->type(kb_radio_select_field_type::class)->render_posting_field(self::FIELD, self::VALUES, [5]);
+
+		$this->assertStringContainsString('<dt><label>Audience &lt;b&gt;', $html);
+		$this->assertStringNotContainsString('for="kb_field_', $html);
+	}
+
 	public function test_radio_buttons_offer_none_only_for_an_optional_field()
 	{
 		$type = $this->type(kb_radio_select_field_type::class);