diff --git a/flask_setup/routes.py b/flask_setup/routes.py
index 8d179fab..5295923c 100644
--- a/flask_setup/routes.py
+++ b/flask_setup/routes.py
@@ -100,6 +100,20 @@ def _register_auth_routes(app: Flask, adapters: dict) -> None:
         endpoint="auth.remove_profile_photo",
     )
 
+    app.add_url_rule(
+        "/profile/email",
+        view_func=acc.update_email,
+        methods=["POST"],
+        endpoint="auth.update_email",
+    )
+
+    app.add_url_rule(
+        "/profile/password",
+        view_func=acc.update_password,
+        methods=["POST"],
+        endpoint="auth.update_password",
+    )
+
     app.add_url_rule(
         "/admin/users",
         view_func=acc.list_all_users,
@@ -107,6 +121,20 @@ def _register_auth_routes(app: Flask, adapters: dict) -> None:
         endpoint="auth.list_all_users",
     )
 
+    app.add_url_rule(
+        "/account/delete",
+        view_func=acc.delete_account,
+        methods=["POST"],
+        endpoint="auth.delete_account",
+    )
+
+    app.add_url_rule(
+        "/admin/users/<int:account_id>/role",
+        view_func=acc.change_role,
+        methods=["POST"],
+        endpoint="auth.change_role",
+    )
+
 
 def _register_file_routes(app: Flask, adapters: dict) -> None:
     fad = adapters["file_adapter"]
diff --git a/frontend/static/css/article.css b/frontend/static/css/article.css
index 37f06767..e7473232 100644
--- a/frontend/static/css/article.css
+++ b/frontend/static/css/article.css
@@ -101,7 +101,7 @@
     margin-right: var(--spacing-xs);
 }
 
-.meta-author:hover {
+a.meta-author:hover {
     color: var(--primary);
     text-decoration: underline;
 }
@@ -295,47 +295,6 @@ input[type=number] {
     appearance: textfield;
 }
 
-/* Shared dialog (modal) styles */
-.dialog {
-    border: 1px solid var(--outline-variant);
-    border-radius: var(--radius-lg);
-    background: var(--surface-container-high);
-    color: var(--on-surface);
-    padding: var(--spacing-xl);
-    width: 90%;
-    max-width: 25rem;
-    box-shadow: 0 20px 40px color-mix(in srgb, var(--on-surface) 10%, transparent);
-    position: fixed;
-    top: 50%;
-    left: 50%;
-    transform: translate(-50%, -50%);
-    z-index: var(--z-modal);
-}
-
-.dialog-sm {
-    max-width: 20rem;
-}
-
-.dialog::backdrop {
-    background: color-mix(in srgb, var(--surface-container-lowest) 80%, transparent);
-    backdrop-filter: blur(8px);
-}
-
-.dialog .modal-footer {
-    margin-top: var(--spacing-xl);
-}
-
-.modal-header {
-    margin-bottom: var(--spacing-md);
-}
-
-.modal-title {
-    font-family: var(--font-primary);
-    font-size: var(--font-headline-md);
-    font-weight: 700;
-    margin: 0;
-}
-
 .modal-body {
     margin-bottom: var(--spacing-xl);
 }
@@ -561,10 +520,6 @@ input[type=number] {
     display: block;
 }
 
-.comment-depth-3 > .comment-content > .comment-replies {
-    display: block;
-}
-
 .comment-actions {
     display: flex;
     gap: var(--spacing-sm);
@@ -592,7 +547,7 @@ input[type=number] {
     text-decoration: none;
 }
 
-.comment-author:hover {
+a.comment-author:hover {
     color: var(--primary);
     text-decoration: underline;
 }
@@ -675,10 +630,6 @@ input[type=number] {
     margin-top: var(--spacing-sm);
 }
 
-.comment-depth-3 .comment-replies > .comment-depth-3 > .comment-avatar {
-    display: none;
-}
-
 @media (max-width: 30em) {
     .comment-avatar {
         width: 2rem;
diff --git a/frontend/static/css/base.css b/frontend/static/css/base.css
index 060474ec..bf147118 100644
--- a/frontend/static/css/base.css
+++ b/frontend/static/css/base.css
@@ -509,6 +509,53 @@ button:hover,
     filter: brightness(1.15);
 }
 
+#confirm-message {
+    text-align: justify;
+}
+
+.dialog {
+    border: 1px solid var(--outline-variant);
+    border-radius: var(--radius-lg);
+    background: var(--surface-container-high);
+    color: var(--on-surface);
+    padding: var(--spacing-xl);
+    width: 90%;
+    max-width: 25rem;
+    box-shadow: 0 20px 40px color-mix(in srgb, var(--on-surface) 10%, transparent);
+    position: fixed;
+    top: 50%;
+    left: 50%;
+    transform: translate(-50%, -50%);
+    z-index: var(--z-modal);
+}
+
+.dialog-sm {
+    max-width: 20rem;
+}
+
+.dialog::backdrop {
+    background: color-mix(in srgb, var(--surface-container-lowest) 80%, transparent);
+    backdrop-filter: blur(8px);
+}
+
+.dialog .modal-footer {
+    display: flex;
+    justify-content: flex-end;
+    gap: var(--spacing-md);
+    margin-top: var(--spacing-xl);
+}
+
+.modal-header {
+    margin-bottom: var(--spacing-md);
+}
+
+.modal-title {
+    font-family: var(--font-primary);
+    font-size: var(--font-headline-md);
+    font-weight: 700;
+    margin: 0;
+}
+
 button:focus-visible,
 .btn:focus-visible,
 a:focus-visible {
diff --git a/frontend/static/css/profile.css b/frontend/static/css/profile.css
index 626e1d54..de4d23c5 100644
--- a/frontend/static/css/profile.css
+++ b/frontend/static/css/profile.css
@@ -94,15 +94,89 @@
     margin-top: var(--spacing-lg);
 }
 
+.profile-actions .btn-secondary,
+.profile-actions .btn-danger {
+    padding: var(--spacing-xs) var(--spacing-md);
+    font-size: var(--font-body-base);
+}
+
+
+.info-right-group {
+    display: flex;
+    align-items: center;
+    gap: var(--spacing-sm);
+    flex-wrap: wrap;
+    justify-content: flex-end;
+}
+
+.email-edit-btn {
+    background: none;
+    border: none;
+    color: var(--primary);
+    cursor: pointer;
+    font-size: var(--font-body-xs);
+    font-family: var(--font-mono);
+    text-transform: uppercase;
+    padding: 0;
+}
+
+.email-edit-btn:hover {
+    background: color-mix(in srgb, var(--primary) 10%, transparent);
+    border-radius: var(--radius-xs);
+    filter: brightness(1.1);
+}
+
 @media (max-width: 22.5em) {
+    .profile-card {
+        padding: var(--spacing-md);
+    }
+
+    .info-row {
+        gap: var(--spacing-xs);
+    }
+
+    .info-right-group {
+        flex-wrap: nowrap;
+        min-width: 0;
+    }
+
+    .info-value {
+        overflow: hidden;
+        text-overflow: ellipsis;
+        white-space: nowrap;
+        min-width: 0;
+        max-width: 50%;
+    }
+
+    .email-edit-btn {
+        flex-shrink: 0;
+    }
+
     .profile-actions {
         flex-direction: column;
     }
-    .profile-actions .btn-secondary {
+    .profile-actions .btn-secondary,
+    .profile-actions .btn-danger {
         width: 100%;
     }
 }
 
+.modal-body {
+    margin-bottom: var(--spacing-xl);
+}
+
+.modal-input-group {
+    display: flex;
+    flex-direction: column;
+    gap: var(--spacing-sm);
+}
+
+.modal-input-group label {
+    font-size: var(--font-body-base);
+    color: var(--on-surface-variant);
+    font-family: var(--font-mono);
+}
+
 .back-link {
     display: flex;
     align-items: center;
@@ -130,3 +204,72 @@
 .back-link span:last-child {
     transform: translateY(1.5px);
 }
+
+.password-wrapper {
+    position: relative;
+}
+
+.password-toggle {
+    position: absolute;
+    right: 0.5rem;
+    top: 50%;
+    transform: translateY(-50%);
+    background: none;
+    border: none;
+    cursor: pointer;
+    color: var(--on-surface-variant);
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    padding: var(--spacing-xs);
+    line-height: 1;
+}
+
+.password-toggle .icon {
+    font-size: 1.5rem;
+}
+
+.password-toggle:hover {
+    color: var(--on-surface);
+}
+
+.password-toggle:focus-visible {
+    outline: 2px solid var(--primary);
+    outline-offset: 2px;
+}
+
+.role-row {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: var(--spacing-sm);
+}
+
+.role-inline-form {
+    display: inline-flex;
+    align-items: center;
+    gap: var(--spacing-sm);
+}
+
+.role-inline-form select {
+    font-family: var(--font-mono);
+    font-size: var(--font-body-sm);
+    font-weight: 600;
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+    padding: var(--spacing-xs) var(--spacing-sm);
+    border: 1px solid var(--outline-variant);
+    border-radius: var(--radius-default);
+    background: var(--surface);
+    color: var(--on-surface);
+    cursor: pointer;
+}
+
+.role-inline-form select:hover {
+    border-color: var(--outline);
+}
+
+.role-inline-form .btn-sm {
+    font-size: var(--font-body-sm);
+    padding: var(--spacing-xs) var(--spacing-sm);
+}
diff --git a/frontend/static/css/user-list.css b/frontend/static/css/user-list.css
index 38ad49a3..79208dba 100644
--- a/frontend/static/css/user-list.css
+++ b/frontend/static/css/user-list.css
@@ -97,3 +97,54 @@
 .user-card .back-link span:last-child {
     transform: translateY(1.5px);
 }
+
+.user-table .btn-danger {
+    font-size: var(--font-body-sm);
+    padding: var(--spacing-xs) var(--spacing-sm);
+    white-space: nowrap;
+}
+
+.user-table-form {
+    display: inline-flex;
+    align-items: center;
+    gap: var(--spacing-xs);
+    margin: 0;
+}
+
+.user-table td:last-child {
+    white-space: nowrap;
+}
+
+.user-table-actions {
+    display: flex;
+    align-items: center;
+    gap: var(--spacing-xs);
+}
+
+.user-table-na {
+    color: var(--on-surface-variant);
+    font-size: var(--font-body-sm);
+}
+
+.user-table-form select {
+    font-family: var(--font-mono);
+    font-size: var(--font-body-sm);
+    font-weight: 600;
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+    padding: var(--spacing-xs) var(--spacing-sm);
+    border: 1px solid var(--outline-variant);
+    border-radius: var(--radius-default);
+    background: var(--surface);
+    color: var(--on-surface);
+    cursor: pointer;
+}
+
+.user-table-form select:hover {
+    border-color: var(--outline);
+}
+
+.user-table-form .btn-sm {
+    font-size: var(--font-body-sm);
+    padding: var(--spacing-xs) var(--spacing-sm);
+}
diff --git a/frontend/static/scripts/profile-email.js b/frontend/static/scripts/profile-email.js
new file mode 100644
index 00000000..379ad3e6
--- /dev/null
+++ b/frontend/static/scripts/profile-email.js
@@ -0,0 +1,20 @@
+'use strict';
+(() => {
+    const MODAL_ID = 'email-modal';
+    const OPEN_BTN_ID = 'open-email-modal';
+    const CANCEL_BTN_ID = 'email-modal-cancel';
+
+    document.addEventListener('DOMContentLoaded', () => {
+        const dialog = document.getElementById(MODAL_ID);
+        const openBtn = document.getElementById(OPEN_BTN_ID);
+        const cancelBtn = document.getElementById(CANCEL_BTN_ID);
+        if (!dialog || !openBtn || !cancelBtn) return;
+
+        openBtn.addEventListener('click', () => dialog.showModal());
+        cancelBtn.addEventListener('click', () => dialog.close());
+
+        dialog.addEventListener('click', (e) => {
+            if (e.target === dialog) dialog.close();
+        });
+    });
+})();
diff --git a/frontend/static/scripts/profile-password.js b/frontend/static/scripts/profile-password.js
new file mode 100644
index 00000000..8544c3a4
--- /dev/null
+++ b/frontend/static/scripts/profile-password.js
@@ -0,0 +1,20 @@
+'use strict';
+(() => {
+    const MODAL_ID = 'password-modal';
+    const OPEN_BTN_ID = 'open-password-modal';
+    const CANCEL_BTN_ID = 'password-modal-cancel';
+
+    document.addEventListener('DOMContentLoaded', () => {
+        const dialog = document.getElementById(MODAL_ID);
+        const openBtn = document.getElementById(OPEN_BTN_ID);
+        const cancelBtn = document.getElementById(CANCEL_BTN_ID);
+        if (!dialog || !openBtn || !cancelBtn) return;
+
+        openBtn.addEventListener('click', () => dialog.showModal());
+        cancelBtn.addEventListener('click', () => dialog.close());
+
+        dialog.addEventListener('click', (e) => {
+            if (e.target === dialog) dialog.close();
+        });
+    });
+})();
diff --git a/frontend/templates/article_detail.html b/frontend/templates/article_detail.html
index dcee9ed6..68865223 100644
--- a/frontend/templates/article_detail.html
+++ b/frontend/templates/article_detail.html
@@ -48,18 +48,22 @@
         </a>
         <h1 class="item-title detail-title">{{ article.article_title }}</h1>
         <div class="item-meta">
+            {% if article.author_username == 'Anonymous' %}
+            <span class="meta-author">{{ article.author_username }}</span>
+            {% else %}
             <a href="{{ url_for('auth.user_profile', username=article.author_username) }}" class="meta-author">
                 {% if article.author_avatar_file_id %}
                     <img src="{{ url_for('file.serve_file', file_id=article.author_avatar_file_id, filename='avatar') }}" alt="{{ article.author_username }}" class="meta-author-avatar">
                 {% endif %}
                 {{ article.author_username }}
             </a>
+            {% endif %}
             <span class="meta-divider">•</span>
             <time datetime="{{ article.article_published_at|date_iso }}">{{ article.article_published_at|date_format }}</time>
         </div>
         
         <div class="detail-actions">
-            {% if current_user and current_user.account_id == article.article_author_id %}
+            {% if current_user and (current_user.account_id == article.article_author_id or current_user.account_role == 'admin') %}
                 <a href="{{ url_for('article.render_edit_page', article_id=article.article_id) }}" class="btn btn-sm btn-secondary">Edit</a>
                 <a href="#" class="btn btn-sm btn-secondary btn-danger confirm-trigger" data-confirm-message="Delete this article permanently ?" data-form-id="delete-article-{{ article.article_id }}">Delete</a>
                 <form id="delete-article-{{ article.article_id }}" action="{{ url_for('article.delete_article_html', article_id=article.article_id) }}" method="POST" hidden>
@@ -79,11 +83,14 @@ <h1 class="item-title detail-title">{{ article.article_title }}</h1>
 
     {% macro render_comment(node, depth=0) %}
         {% set display_depth = depth if depth < 3 else 3 %}
-        {% set should_cascade = display_depth < 3 and node.replies %}
         {% set is_deleted = node.comment.comment_content in ('Comment removed', '[deleted]', '<em>Comment removed</em>') %}
         <div class="comment comment-depth-{{ display_depth }}{% if is_deleted %} comment-deleted{% endif %}">
             <div class="comment-avatar">
-                {% if not is_deleted %}
+                {% if is_deleted %}
+                    <span class="comment-avatar-initial comment-avatar-deleted">?</span>
+                {% elif node.comment.author_username == 'Anonymous' %}
+                    <span class="comment-avatar-initial">A</span>
+                {% else %}
                     <a href="{{ url_for('auth.user_profile', username=node.comment.author_username) }}">
                         {% if node.comment.author_avatar_file_id %}
                             <img src="{{ url_for('file.serve_file', file_id=node.comment.author_avatar_file_id, filename='avatar') }}" alt="{{ node.comment.author_username }}" class="comment-avatar-img">
@@ -91,23 +98,20 @@ <h1 class="item-title detail-title">{{ article.article_title }}</h1>
                             <span class="comment-avatar-initial">{{ node.comment.author_username[0]|upper }}</span>
                         {% endif %}
                     </a>
-                {% else %}
-                    <span class="comment-avatar-initial comment-avatar-deleted">?</span>
                 {% endif %}
             </div>
             <div class="comment-content">
                 <div class="comment-header-section">
                     <div class="comment-header">
-                        {% if not is_deleted %}
-                            <a href="{{ url_for('auth.user_profile', username=node.comment.author_username) }}" class="comment-author">{{ node.comment.author_username }}</a>
-                        {% else %}
+                        {% if is_deleted or node.comment.author_username == 'Anonymous' %}
                             <span class="comment-author">{{ node.comment.author_username }}</span>
+                        {% else %}
+                            <a href="{{ url_for('auth.user_profile', username=node.comment.author_username) }}" class="comment-author">{{ node.comment.author_username }}</a>
                         {% endif %}
                         <span class="comment-timestamp">{{ node.comment.comment_posted_at_formatted }}</span>
                         {% if current_user and current_user.account_role == 'admin' %}
                             <form id="delete-comment-{{ node.comment.comment_id }}" action="{{ url_for('comment.delete_comment', article_id=article.article_id, comment_id=node.comment.comment_id) }}" method="POST" class="comment-delete-form">
                                 <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
-                                <input type="hidden" name="cascade" value="{{ 'true' if should_cascade else 'false' }}">
                                 <button type="submit" class="comment-delete-btn confirm-trigger" data-confirm-message="Delete this comment permanently ?" data-form-id="delete-comment-{{ node.comment.comment_id }}">[Delete]</button>
                             </form>
                         {% endif %}
@@ -115,10 +119,10 @@ <h1 class="item-title detail-title">{{ article.article_title }}</h1>
                     <div class="comment-body-text">
                         {{ node.comment.comment_content | safe }}
                     </div>
-                    {% if current_user and not is_deleted %}
+                    {% if current_user and not is_deleted and depth < 3 %}
                     <div class="comment-actions">
                         <button type="button" class="reply-toggle" data-comment-id="{{ node.comment.comment_id }}">Reply</button>
-                        {% if node.replies and display_depth < 3 %}
+                        {% if node.replies %}
                         <button type="button" class="view-replies-btn">View replies</button>
                         {% endif %}
                     </div>
@@ -135,7 +139,7 @@ <h1 class="item-title detail-title">{{ article.article_title }}</h1>
                                 </div>
                             </form>
                         </div>
-                    {% elif node.replies and display_depth < 3 %}
+                    {% elif node.replies %}
                     <div class="comment-actions">
                         <button type="button" class="view-replies-btn">View replies</button>
                     </div>
@@ -180,19 +184,7 @@ <h4 class="comment-join-title">Join the discussion</h4>
     </section>
 </article>
 
-<dialog id="confirm-dialog" class="dialog">
-    <div class="modal-header">
-        <h2 class="modal-title">Confirm</h2>
-    </div>
-    <p id="confirm-message"></p>
-    <div class="modal-footer">
-        <button class="btn btn-dialog btn-secondary" id="confirm-cancel-btn" autofocus>Cancel</button>
-        <button class="btn btn-dialog btn-primary" id="confirm-yes-btn">Delete</button>
-    </div>
-</dialog>
-
 {% block extra_js %}
-<script defer src="{{ url_for('static', filename='scripts/confirm-dialog.js') }}"></script>
 <script defer src="{{ url_for('static', filename='scripts/code-copy.js') }}"></script>
 {% endblock %}
 {% endblock %}
diff --git a/frontend/templates/article_list.html b/frontend/templates/article_list.html
index 92178092..7bfa9a77 100644
--- a/frontend/templates/article_list.html
+++ b/frontend/templates/article_list.html
@@ -93,12 +93,16 @@ <h2 class="item-title">
                     <p class="item-excerpt">{{ article.meta_description }}</p>
                 </div>
                 <div class="item-meta">
+                    {% if article.author_username == 'Anonymous' %}
+                    <span class="meta-author">{{ article.author_username }}</span>
+                    {% else %}
                     <a href="{{ url_for('auth.user_profile', username=article.author_username) }}" class="meta-author">
                     {% if article.author_avatar_file_id %}
                         <img src="{{ url_for('file.serve_file', file_id=article.author_avatar_file_id, filename='avatar') }}" alt="{{ article.author_username }}" class="meta-author-avatar">
                     {% endif %}
                     {{ article.author_username }}
                 </a>
+                    {% endif %}
                     {% if article.article_published_at %}
                     <span class="meta-divider">•</span>
                     <time datetime="{{ article.article_published_at|date_iso }}">{{ article.article_published_at|date_format }}</time>
diff --git a/frontend/templates/base.html b/frontend/templates/base.html
index e59c7473..0454c043 100644
--- a/frontend/templates/base.html
+++ b/frontend/templates/base.html
@@ -99,6 +99,17 @@
         {% block content %}{% endblock %}
     </main>
 
+    <dialog id="confirm-dialog" class="dialog">
+        <div class="modal-header">
+            <h2 class="modal-title">Confirm</h2>
+        </div>
+        <p id="confirm-message"></p>
+        <div class="modal-footer">
+            <button class="btn btn-dialog btn-secondary" id="confirm-cancel-btn" autofocus>Cancel</button>
+            <button class="btn btn-dialog btn-primary" id="confirm-yes-btn">Delete</button>
+        </div>
+    </dialog>
+
     <!-- Simple Footer -->
     <footer class="footer">
         <div class="main-layout">
@@ -109,6 +120,7 @@
     </footer>
     <script defer src="{{ url_for('static', filename='scripts/flash-messages.js') }}"></script>
     <script defer src="{{ url_for('static', filename='scripts/theme-toggle.js') }}"></script>
+    <script defer src="{{ url_for('static', filename='scripts/confirm-dialog.js') }}"></script>
     {% if page_with_editor and vite_js_url %}
     <script type="module" src="{{ url_for('static', filename=vite_js_url) }}"></script>
     {% endif %}
diff --git a/frontend/templates/login.html b/frontend/templates/login.html
index 2da89232..540bf3be 100644
--- a/frontend/templates/login.html
+++ b/frontend/templates/login.html
@@ -18,12 +18,12 @@ <h1 class="account-title">Welcome Back</h1>
         <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
         <div class="form-group">
             <label for="login-username">Username</label>
-            <input type="text" id="login-username" name="username" placeholder="dev_username" autocomplete="username" value="{{ username or '' }}" required>
+            <input type="text" id="login-username" name="username" placeholder="e.g., dev_journey" autocomplete="username" value="{{ username or '' }}" required>
         </div>
         <div class="form-group account-form-group">
             <label for="login-password">Password</label>
             <div class="password-wrapper">
-                <input type="password" id="login-password" name="password" placeholder="••••••••" autocomplete="current-password" required>
+                <input type="password" id="login-password" name="password" placeholder="e.g., MyP@ssw0rd!" autocomplete="current-password" required>
                 <button type="button" class="password-toggle" aria-label="Toggle password visibility" aria-pressed="false">{{ icon('visibility') }}</button>
             </div>
         </div>
diff --git a/frontend/templates/profile.html b/frontend/templates/profile.html
index 1903f0cf..ae33a5e5 100644
--- a/frontend/templates/profile.html
+++ b/frontend/templates/profile.html
@@ -28,14 +28,33 @@
         {% endif %}
         {% endif %}
         <h1>{{ user.account_username }}</h1>
-        <span class="role-badge">{{ user.account_role }}</span>
+        <div class="role-row">
+            <span class="role-badge">{{ user.account_role }}</span>
+            {% if current_user and current_user.account_role == 'admin' and not is_own_profile and user.account_role != 'admin' %}
+            <form action="{{ url_for('auth.change_role', account_id=user.account_id) }}" method="POST" class="role-inline-form">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+                <select name="role">
+                    <option value="user" {% if user.account_role == 'user' %}selected{% endif %}>User</option>
+                    <option value="author" {% if user.account_role == 'author' %}selected{% endif %}>Author</option>
+                </select>
+                <button type="submit" class="btn btn-sm">Update</button>
+            </form>
+            {% endif %}
+        </div>
     </div>
 
     <div class="info-section">
         {% if is_own_profile or (current_user and current_user.account_role == 'admin') %}
         <div class="info-row">
             <span class="info-label">Email</span>
+            {% if is_own_profile %}
+            <div class="info-right-group">
+                <span class="info-value">{{ user.account_email }}</span>
+                <button type="button" id="open-email-modal" class="email-edit-btn">[Edit]</button>
+            </div>
+            {% else %}
             <span class="info-value">{{ user.account_email }}</span>
+            {% endif %}
         </div>
         {% endif %}
         {% if is_own_profile or (current_user and current_user.account_role == 'admin') %}
@@ -56,15 +75,79 @@ <h1>{{ user.account_username }}</h1>
         </div>
     </div>
 
+    {% if is_own_profile %}
+    <dialog id="email-modal" class="dialog dialog-sm">
+        <div class="modal-header">
+            <h2 class="modal-title">Update Email</h2>
+        </div>
+        <form action="{{ url_for('auth.update_email') }}" method="POST">
+            <div class="modal-body">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+                <div class="modal-input-group">
+                    <label for="email-input">Email</label>
+<input type="email" id="email-input" name="email"
+       value="{{ user.account_email }}" placeholder="e.g., user@example.com" required>
+                </div>
+            </div>
+            <div class="modal-footer">
+                <button type="button" class="btn btn-dialog btn-secondary" id="email-modal-cancel" autofocus>Cancel</button>
+                <button type="submit" class="btn btn-dialog btn-primary">Save</button>
+            </div>
+        </form>
+    </dialog>
+
+    <dialog id="password-modal" class="dialog dialog-sm">
+        <div class="modal-header">
+            <h2 class="modal-title">Update Password</h2>
+        </div>
+        <form action="{{ url_for('auth.update_password') }}" method="POST">
+            <div class="modal-body">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+                <div class="modal-input-group">
+                    <label for="new-password-input">New Password</label>
+                    <div class="password-wrapper">
+                        <input type="password" id="new-password-input" name="new_password" placeholder="e.g., MyP@ssw0rd!" required>
+                        <button type="button" class="password-toggle" aria-label="Toggle password visibility" aria-pressed="false">{{ icon('visibility') }}</button>
+                    </div>
+                </div>
+            </div>
+            <div class="modal-footer">
+                <button type="button" class="btn btn-dialog btn-secondary" id="password-modal-cancel" autofocus>Cancel</button>
+                <button type="submit" class="btn btn-dialog btn-primary">Save</button>
+            </div>
+        </form>
+    </dialog>
+    {% endif %}
     {% if is_own_profile %}
     <div class="profile-actions">
         {% if current_user.account_role == 'admin' %}
         <a href="{{ url_for('auth.list_all_users') }}" class="btn btn-secondary">Manage Users</a>
         {% endif %}
+        <button type="button" id="open-password-modal" class="btn btn-secondary">Change Password</button>
         <form action="{{ url_for('auth.logout') }}" method="POST" class="logout-form">
             <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
             <button type="submit" class="btn btn-secondary">Sign Out</button>
         </form>
+        {% if current_user.account_role != 'admin' %}
+        <form id="delete-account-form" action="{{ url_for('auth.delete_account') }}" method="POST" class="logout-form">
+            <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+            <button type="button" class="btn btn-danger confirm-trigger"
+                data-form-id="delete-account-form"
+                data-confirm-message="Are you sure you want to delete your account ? This action is irreversible.">Delete Account</button>
+        </form>
+        {% endif %}
+    </div>
+    {% endif %}
+
+    {% if current_user and current_user.account_role == 'admin' and not is_own_profile and user.account_role != 'admin' %}
+    <div class="profile-actions">
+        <form id="admin-delete-account-form" action="{{ url_for('auth.delete_account') }}" method="POST" class="logout-form">
+            <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+            <input type="hidden" name="account_id" value="{{ user.account_id }}">
+            <button type="button" class="btn btn-danger confirm-trigger"
+                data-form-id="admin-delete-account-form"
+                data-confirm-message="Delete user &quot;{{ user.account_username }}&quot; ? This action is irreversible.">Delete Account</button>
+        </form>
     </div>
     {% endif %}
 
@@ -77,4 +160,7 @@ <h1>{{ user.account_username }}</h1>
 
 {% block extra_js %}
 <script defer src="{{ url_for('static', filename='scripts/profile-avatar.js') }}"></script>
+<script defer src="{{ url_for('static', filename='scripts/profile-email.js') }}"></script>
+<script defer src="{{ url_for('static', filename='scripts/profile-password.js') }}"></script>
+<script defer src="{{ url_for('static', filename='scripts/password-toggle.js') }}"></script>
 {% endblock %}
diff --git a/frontend/templates/registration.html b/frontend/templates/registration.html
index e30a3c47..e2ddaace 100644
--- a/frontend/templates/registration.html
+++ b/frontend/templates/registration.html
@@ -18,23 +18,23 @@ <h1 class="account-title">Join DevJournal</h1>
         <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
         <div class="form-group">
             <label for="registration-username">Choose Username</label>
-            <input type="text" id="registration-username" name="username" placeholder="dev_username" autocomplete="username" value="{{ username or '' }}" required>
+            <input type="text" id="registration-username" name="username" placeholder="e.g., dev_journey" autocomplete="username" value="{{ username or '' }}" required>
         </div>
         <div class="form-group">
             <label for="registration-email">Email Address</label>
-            <input type="email" id="registration-email" name="email" placeholder="dev@example.com" autocomplete="email" value="{{ email or '' }}" required>
+            <input type="email" id="registration-email" name="email" placeholder="e.g., user@example.com" autocomplete="email" value="{{ email or '' }}" required>
         </div>
         <div class="form-group">
             <label for="registration-password">Password</label>
             <div class="password-wrapper">
-                <input type="password" id="registration-password" name="password" placeholder="••••••••" autocomplete="new-password" required>
+                <input type="password" id="registration-password" name="password" placeholder="e.g., MyP@ssw0rd!" autocomplete="new-password" required>
                 <button type="button" class="password-toggle" aria-label="Toggle password visibility" aria-pressed="false">{{ icon('visibility') }}</button>
             </div>
         </div>
         <div class="form-group account-form-group">
             <label for="registration-confirm-password">Confirm Password</label>
             <div class="password-wrapper">
-                <input type="password" id="registration-confirm-password" name="confirm_password" placeholder="••••••••" autocomplete="new-password" required>
+                <input type="password" id="registration-confirm-password" name="confirm_password" placeholder="e.g., MyP@ssw0rd!" autocomplete="new-password" required>
                 <button type="button" class="password-toggle" aria-label="Toggle password visibility" aria-pressed="false">{{ icon('visibility') }}</button>
             </div>
         </div>
@@ -44,7 +44,7 @@ <h1 class="account-title">Join DevJournal</h1>
     <hr>
 
     <div class="account-footer">
-        <p class="account-subtitle">Already have an account?</p>
+        <p class="account-subtitle">Already have an account ?</p>
         <a href="{{ url_for('auth.login') }}" class="btn btn-secondary full-width">Sign In instead</a>
         
         <div class="account-footer-link">
diff --git a/frontend/templates/user_list.html b/frontend/templates/user_list.html
index fa817dbf..fc00ac5c 100644
--- a/frontend/templates/user_list.html
+++ b/frontend/templates/user_list.html
@@ -20,6 +20,7 @@ <h1>Manage Users</h1>
                     <th>Email</th>
                     <th>Role</th>
                     <th>Member Since</th>
+                    <th>Actions</th>
                 </tr>
             </thead>
             <tbody>
@@ -29,6 +30,29 @@ <h1>Manage Users</h1>
                     <td>{{ user.account_email }}</td>
                     <td>{{ user.account_role }}</td>
                     <td>{{ user.account_created_at|date_format if user.account_created_at else 'N/A' }}</td>
+                    <td>
+                        {% if user.account_role == 'admin' %}
+                        <span class="user-table-na">—</span>
+                        {% else %}
+                        <div class="user-table-actions">
+                        <form action="{{ url_for('auth.change_role', account_id=user.account_id) }}" method="POST" class="user-table-form">
+                            <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+                            <select name="role">
+                                <option value="user" {% if user.account_role == 'user' %}selected{% endif %}>User</option>
+                                <option value="author" {% if user.account_role == 'author' %}selected{% endif %}>Author</option>
+                            </select>
+                            <button type="submit" class="btn btn-sm">Update</button>
+                        </form>
+                        <form id="delete-user-{{ user.account_id }}" action="{{ url_for('auth.delete_account') }}" method="POST" class="user-table-form">
+                            <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+                            <input type="hidden" name="account_id" value="{{ user.account_id }}">
+                            <button type="button" class="btn btn-sm btn-danger confirm-trigger"
+                                data-form-id="delete-user-{{ user.account_id }}"
+                                data-confirm-message="Delete user &quot;{{ user.account_username }}&quot; ? This action is irreversible.">Delete</button>
+                        </form>
+                        </div>
+                        {% endif %}
+                    </td>
                 </tr>
             {% endfor %}
             </tbody>
diff --git a/migrations/V11__add_account_deletion_support.sql b/migrations/V11__add_account_deletion_support.sql
new file mode 100644
index 00000000..dcc88b39
--- /dev/null
+++ b/migrations/V11__add_account_deletion_support.sql
@@ -0,0 +1,16 @@
+ALTER TABLE articles DROP CONSTRAINT articles_author_fk;
+ALTER TABLE articles ALTER COLUMN article_author_id DROP NOT NULL;
+ALTER TABLE articles ADD CONSTRAINT articles_author_fk
+    FOREIGN KEY (article_author_id) REFERENCES accounts(account_id)
+    ON DELETE SET NULL;
+
+ALTER TABLE comments DROP CONSTRAINT comments_reply_fk;
+ALTER TABLE comments ADD CONSTRAINT comments_reply_fk
+    FOREIGN KEY (comment_reply_to) REFERENCES comments(comment_id)
+    ON DELETE SET NULL;
+
+ALTER TABLE comments DROP CONSTRAINT comments_author_fk;
+ALTER TABLE comments ALTER COLUMN comment_written_account_id DROP NOT NULL;
+ALTER TABLE comments ADD CONSTRAINT comments_author_fk
+    FOREIGN KEY (comment_written_account_id) REFERENCES accounts(account_id)
+    ON DELETE SET NULL;
diff --git a/src/application/domain/article.py b/src/application/domain/article.py
index 931d2d7a..5dde2e4d 100644
--- a/src/application/domain/article.py
+++ b/src/application/domain/article.py
@@ -10,7 +10,8 @@ class Article:
 
     Attributes:
         article_id (int): Unique identifier for the article.
-        article_author_id (int): Reference to the author's Account.
+        article_author_id (int | None): Reference to the author's Account.
+            None when the author's account has been deleted.
         article_title (str): Title of the article.
         article_content (str): Full text content of the article.
         article_published_at (datetime): Timestamp of publication.
@@ -19,7 +20,7 @@ class Article:
     def __init__(
         self,
         article_id: int,
-        article_author_id: int,
+        article_author_id: int | None,
         article_title: str,
         article_content: str,
         article_published_at: datetime | None,
@@ -29,7 +30,8 @@ def __init__(
 
         Args:
             article_id (int): Unique identifier for the article.
-            article_author_id (int): Reference to the author's Account.
+            article_author_id (int | None): Reference to the author's Account.
+                None when the author's account has been deleted.
             article_title (str): Title of the article.
             article_content (str): Full text content of the article.
             article_published_at (datetime): Timestamp of publication.
diff --git a/src/application/domain/comment.py b/src/application/domain/comment.py
index 9ca56f39..7f4de883 100644
--- a/src/application/domain/comment.py
+++ b/src/application/domain/comment.py
@@ -21,7 +21,7 @@ def __init__(
         self,
         comment_id: int,
         comment_article_id: int,
-        comment_written_account_id: int,
+        comment_written_account_id: int | None,
         comment_reply_to: int | None,
         comment_content: str,
         comment_posted_at: datetime,
diff --git a/src/application/input_ports/account_session_management.py b/src/application/input_ports/account_session_management.py
index 1350a4d8..557df054 100644
--- a/src/application/input_ports/account_session_management.py
+++ b/src/application/input_ports/account_session_management.py
@@ -40,6 +40,19 @@ def get_account_by_username(self, username: str) -> Account | None:
         """
         pass
 
+    @abstractmethod
+    def get_account_by_id(self, account_id: int) -> Account | None:
+        """
+        Retrieves a domain Account by its unique identifier.
+
+        Args:
+            account_id: The unique identifier of the account.
+
+        Returns:
+            Account | None: The domain Account if found, None otherwise.
+        """
+        pass
+
     @abstractmethod
     def update_avatar(self, avatar_file_id: str | None) -> None:
         """
@@ -52,6 +65,39 @@ def update_avatar(self, avatar_file_id: str | None) -> None:
         """
         pass
 
+    @abstractmethod
+    def update_email(self, new_email: str) -> str | None:
+        """
+        Updates the email address for the currently authenticated account.
+
+        Validates that the new email is not already in use by another account
+        before persisting the change.
+
+        Args:
+            new_email: The new email address to set.
+
+        Returns:
+            str | None: None on success, or an error message string if
+                the email is already taken or the user is not authenticated.
+        """
+        pass
+
+    @abstractmethod
+    def update_password(self, new_password: str) -> str | None:
+        """
+        Updates the password for the currently authenticated account.
+
+        Hashes the new password and persists it via the account repository.
+
+        Args:
+            new_password: The new plaintext password to set.
+
+        Returns:
+            str | None: None on success, or an error message string if
+                the user is not authenticated.
+        """
+        pass
+
     @abstractmethod
     def get_all_accounts(self) -> list[Account]:
         """
@@ -64,3 +110,32 @@ def get_all_accounts(self) -> list[Account]:
             list[Account]: A list of all Account domain entities.
         """
         pass
+
+    @abstractmethod
+    def delete_account(self, account_id: int) -> None:
+        """
+        Deletes a user account by its unique identifier.
+
+        The associated avatar file should be cleaned up by the caller
+        before invoking this method. The database handles orphaned
+        articles via ON DELETE SET NULL and comments via ON DELETE CASCADE.
+
+        Args:
+            account_id: The unique identifier of the account to delete.
+        """
+        pass
+
+    @abstractmethod
+    def update_account_role(self, admin_id: int, target_id: int, new_role: str) -> str | None:
+        """
+        Allows an admin user to update the role of another user account.
+
+        Args:
+            admin_id: The unique identifier of the admin performing the action.
+            target_id: The unique identifier of the account whose role is to be updated.
+            new_role: The new role string ("user" or "author").
+
+        Returns:
+            str | None: None on success, or an error message string if the operation fails.
+        """
+        pass
diff --git a/src/application/input_ports/article_management.py b/src/application/input_ports/article_management.py
index 3630f715..e9a859d8 100644
--- a/src/application/input_ports/article_management.py
+++ b/src/application/input_ports/article_management.py
@@ -105,15 +105,17 @@ def get_total_count(self) -> int:
         pass
 
     @abstractmethod
-    def get_author_name(self, author_id: int) -> str:
+    def get_author_name(self, author_id: int | None) -> str:
         """
         Retrieves the username of an author by their unique identifier.
 
         Args:
-            author_id (int): The unique identifier of the author.
+            author_id (int | None): The unique identifier of the author.
+                None when the author's account has been deleted.
 
         Returns:
-            str: The username of the author, or 'Unknown' if not found.
+            str: The username of the author, 'Anonymous' if the account was
+            deleted, or 'Unknown' if not found.
         """
         pass
 
diff --git a/src/application/input_ports/comment_management.py b/src/application/input_ports/comment_management.py
index 188aa070..09e8ca6d 100644
--- a/src/application/input_ports/comment_management.py
+++ b/src/application/input_ports/comment_management.py
@@ -56,15 +56,14 @@ def get_comments_for_article(self, article_id: int) -> list[CommentNode] | str:
         pass
 
     @abstractmethod
-    def delete_comment(self, comment_id: int, user_id: int, cascade: bool = True) -> bool | str:
+    def delete_comment(self, comment_id: int, user_id: int) -> bool | str:
         """
         Deletes a comment. First click soft-deletes (content → "Comment removed", author → Anonymous).
-        Second click hard-deletes: if cascade=True, removes all descendants recursively.
+        Second click hard-deletes: removes the comment and all its descendants recursively.
 
         Args:
             comment_id (int): ID of the comment to delete.
             user_id (int): ID of the user requesting the deletion.
-            cascade (bool): If True, also delete all child nodes recursively.
 
         Returns:
             bool | str: True if deletion was successful, or an error message string.
diff --git a/src/application/output_ports/account_repository.py b/src/application/output_ports/account_repository.py
index 1621a9bd..ccd673d7 100644
--- a/src/application/output_ports/account_repository.py
+++ b/src/application/output_ports/account_repository.py
@@ -85,6 +85,43 @@ def update_avatar(self, account_id: int, avatar_file_id: str | None) -> None:
         """
         pass
 
+    @abstractmethod
+    def update_email(self, account_id: int, new_email: str) -> None:
+        """
+        Updates the email address for a given account.
+
+        Args:
+            account_id: The ID of the account to update.
+            new_email: The new email address to set.
+
+        Raises:
+            AccountAlreadyExistsError: If the new email is already taken
+                by another account (detected at the database level).
+        """
+        pass
+
+    @abstractmethod
+    def update_password(self, account_id: int, new_hashed_password: str) -> None:
+        """
+        Updates the password hash for a given account.
+
+        Args:
+            account_id: The ID of the account to update.
+            new_hashed_password: The new Argon2 hash to store.
+        """
+        pass
+
+    @abstractmethod
+    def update_role(self, account_id: int, new_role: str) -> None:
+        """
+        Updates the account_role for a given account.
+
+        Args:
+            account_id: The ID of the account to update.
+            new_role: The new role string ("user" or "author").
+        """
+        pass
+
     @abstractmethod
     def get_all(self) -> list[Account]:
         """
@@ -94,3 +131,16 @@ def get_all(self) -> list[Account]:
             list[Account]: A list of all Account domain entities.
         """
         pass
+
+    @abstractmethod
+    def delete(self, account_id: int) -> None:
+        """
+        Deletes an account by its unique identifier.
+
+        The database will apply ON DELETE SET NULL for articles authored
+        by this account and ON DELETE CASCADE for their comments.
+
+        Args:
+            account_id (int): The unique identifier of the account to delete.
+        """
+        pass
diff --git a/src/application/output_ports/comment_repository.py b/src/application/output_ports/comment_repository.py
index 0897d66e..e14b9f57 100644
--- a/src/application/output_ports/comment_repository.py
+++ b/src/application/output_ports/comment_repository.py
@@ -67,13 +67,3 @@ def delete(self, comment_id: int) -> None:
             comment_id (int): ID of the comment to remove.
         """
         pass
-
-    @abstractmethod
-    def orphan_children(self, comment_id: int) -> None:
-        """
-        Sets comment_reply_to to NULL for all direct children of the given comment.
-
-        Args:
-            comment_id (int): ID of the parent comment whose children should be orphaned.
-        """
-        pass
diff --git a/src/application/services/article_service.py b/src/application/services/article_service.py
index 5b674ee8..2eeb6e26 100644
--- a/src/application/services/article_service.py
+++ b/src/application/services/article_service.py
@@ -169,7 +169,8 @@ def get_by_id(self, article_id: int) -> Article | None:
 
     def update_article(self, article_id: int, user_id: int, title: str, content: str) -> Article | str:
         """
-        Updates an existing article ensuring the requester is the original author.
+        Updates an existing article. Only the original author or an admin can edit
+        (admins can also edit anonymous articles whose author account was deleted).
 
         Args:
             article_id (int): ID of the article to update.
@@ -190,7 +191,7 @@ def update_article(self, article_id: int, user_id: int, title: str, content: str
             # TODO: Raise ArticleNotFoundException
             return "Article not found."
 
-        if article.article_author_id != user_id:
+        if account_or_error.account_role != AccountRole.ADMIN and article.article_author_id != user_id:
             # TODO: Raise OwnershipException
             return "Unauthorized : You are not the author of this article."
 
@@ -256,14 +257,14 @@ def get_paginated_articles(self, page: int = 1, per_page: int = 10) -> list[Arti
             page = min_page
 
         domain_articles = self.article_repository.get_paginated(page, per_page)
-        author_ids = {a.article_author_id for a in domain_articles}
-        authors = self.account_repository.get_by_ids(list(author_ids))
+        known_ids = {a.article_author_id for a in domain_articles if a.article_author_id is not None}
+        authors = self.account_repository.get_by_ids(list(known_ids))
         author_map = {acc.account_id: acc.account_username for acc in authors}
         avatar_map = {acc.account_id: acc.avatar_file_id for acc in authors}
         return [ArticleWithAuthor(
             article=a,
-            author_name=author_map.get(a.article_author_id, "Unknown"),
-            author_avatar_file_id=avatar_map.get(a.article_author_id),
+            author_name=author_map.get(a.article_author_id, "Unknown") if a.article_author_id is not None else "Anonymous",
+            author_avatar_file_id=avatar_map.get(a.article_author_id) if a.article_author_id in avatar_map else None,
         ) for a in domain_articles]
 
     def get_total_count(self) -> int:
@@ -275,16 +276,20 @@ def get_total_count(self) -> int:
         """
         return self.article_repository.count_all()
 
-    def get_author_name(self, author_id: int) -> str:
+    def get_author_name(self, author_id: int | None) -> str:
         """
         Retrieves the username of an author by their unique identifier.
 
         Args:
-            author_id (int): The unique identifier of the author.
+            author_id (int | None): The unique identifier of the author.
+                None when the author's account has been deleted.
 
         Returns:
-            str: The username of the author, or 'Unknown' if not found.
+            str: The username of the author, 'Anonymous' if the account was
+            deleted, or 'Unknown' if not found.
         """
+        if author_id is None:
+            return "Anonymous"
         account = self.account_repository.get_by_id(author_id)
         return account.account_username if account else "Unknown"
 
@@ -305,16 +310,20 @@ def get_article_with_comments(self, article_id: int) -> ArticleDetailView | str:
             return "Article not found."
 
         all_comments = self.comment_repository.get_all_by_article_id(article_id)
-        author_ids = {article.article_author_id}
-        author_ids.update(c.comment_written_account_id for c in all_comments)
-        authors = self.account_repository.get_by_ids(list(author_ids))
+        known_ids = {article.article_author_id} if article.article_author_id is not None else set()
+        known_ids.update(c.comment_written_account_id for c in all_comments if c.comment_written_account_id is not None)
+        authors = self.account_repository.get_by_ids(list(known_ids))
         author_map = {acc.account_id: acc.account_username for acc in authors}
         avatar_map = {acc.account_id: acc.avatar_file_id for acc in authors}
         nested = build_comment_nested_tree(all_comments, author_map, avatar_map)
-        author_name = author_map.get(article.article_author_id, "Unknown")
+        author_name = (
+            author_map.get(article.article_author_id, "Unknown")
+            if article.article_author_id is not None
+            else "Anonymous"
+        )
         article_with_author = ArticleWithAuthor(
             article=article,
             author_name=author_name,
-            author_avatar_file_id=avatar_map.get(article.article_author_id),
+            author_avatar_file_id=avatar_map.get(article.article_author_id) if article.article_author_id in avatar_map else None,
         )
         return ArticleDetailView(article_with_author=article_with_author, nested_comments=nested)
diff --git a/src/application/services/comment_service.py b/src/application/services/comment_service.py
index 5f31b57f..9ce48856 100644
--- a/src/application/services/comment_service.py
+++ b/src/application/services/comment_service.py
@@ -10,6 +10,8 @@
 from src.application.output_ports.comment_repository import CommentRepository
 from src.application.services.service_utils import build_comment_nested_tree
 
+MAX_REPLY_DEPTH = 3
+
 
 class CommentService(CommentManagementPort):
     """
@@ -58,6 +60,28 @@ def _get_account_if_exists(self, user_id: int) -> Account | str:
             return "Account not found."
         return account
 
+    @staticmethod
+    def _get_comment_depth(comment_id: int, comment_repo: CommentRepository) -> int:
+        """
+        Walks comment_reply_to chain up to root to compute nesting depth.
+
+        Args:
+            comment_id (int): ID of the comment to measure depth for.
+            comment_repo (CommentRepository): Repository for loading comments.
+
+        Returns:
+            int: Nesting depth (0 for root comment).
+        """
+        depth = 0
+        current_id = comment_id
+        for _ in range(10):
+            parent = comment_repo.get_by_id(current_id)
+            if not parent or parent.comment_reply_to is None:
+                break
+            current_id = parent.comment_reply_to
+            depth += 1
+        return depth
+
     def _delete_with_descendants(self, comment_id: int) -> None:
         """
         Recursively deletes a comment and all its descendants from the repository.
@@ -144,6 +168,14 @@ def create_reply(self, parent_comment_id: int, user_id: int, content: str) -> Co
             # TODO: Raise CommentNotFoundException later
             return "Parent comment not found."
 
+        if "<!--cmt-removed-->" in parent_comment.comment_content:
+            # TODO: Raise CannotReplyException later
+            return "Cannot reply to a removed comment."
+
+        parent_depth = self._get_comment_depth(parent_comment.comment_id, self.comment_repository)
+        if parent_depth >= MAX_REPLY_DEPTH:
+            return "Cannot reply to a comment at maximum nesting depth."
+
         sanitized = nh3.clean(
             content,
             tags=self.ALLOWED_TAGS,
@@ -183,21 +215,20 @@ def get_comments_for_article(self, article_id: int) -> list[CommentNode] | str:
             return "Article not found."
 
         all_comments = self.comment_repository.get_all_by_article_id(article_id)
-        author_ids = {c.comment_written_account_id for c in all_comments}
+        author_ids = {c.comment_written_account_id for c in all_comments if c.comment_written_account_id is not None}
         authors = self.account_repository.get_by_ids(list(author_ids))
         author_map = {acc.account_id: acc.account_username for acc in authors}
         avatar_map = {acc.account_id: acc.avatar_file_id for acc in authors}
         return build_comment_nested_tree(all_comments, author_map, avatar_map)
 
-    def delete_comment(self, comment_id: int, user_id: int, cascade: bool = True) -> bool | str:
+    def delete_comment(self, comment_id: int, user_id: int) -> bool | str:
         """
         Deletes a comment. First click soft-deletes (content → "Comment removed", author → Anonymous).
-        Second click hard-deletes: if cascade=True, removes all descendants recursively.
+        Second click hard-deletes: removes the comment and all its descendants recursively.
 
         Args:
             comment_id (int): ID of the comment to delete.
             user_id (int): ID of the user requesting the deletion.
-            cascade (bool): If True, also delete all child nodes recursively.
 
         Returns:
             bool | str: True if deletion was successful, or an error message string.
@@ -219,11 +250,7 @@ def delete_comment(self, comment_id: int, user_id: int, cascade: bool = True) ->
             return "Comment not found."
 
         if "<!--cmt-removed-->" in comment.comment_content:
-            if cascade:
-                self._delete_with_descendants(comment_id)
-            else:
-                self.comment_repository.orphan_children(comment_id)
-                self.comment_repository.delete(comment_id)
+            self._delete_with_descendants(comment_id)
             return True
 
         comment.comment_content = "<!--cmt-removed--><em>Comment removed</em>"
diff --git a/src/application/services/login_service.py b/src/application/services/login_service.py
index 2885d7d9..c7ed7941 100644
--- a/src/application/services/login_service.py
+++ b/src/application/services/login_service.py
@@ -1,4 +1,4 @@
-from src.application.domain.account import Account
+from src.application.domain.account import Account, AccountRole
 from src.application.input_ports.account_session_management import AccountSessionManagementPort
 from src.application.input_ports.login_management import LoginManagementPort
 from src.application.output_ports.account_repository import AccountRepository
@@ -92,6 +92,18 @@ def get_account_by_username(self, username: str) -> Account | None:
         """
         return self.account_repository.find_by_username(username)
 
+    def get_account_by_id(self, account_id: int) -> Account | None:
+        """
+        Retrieves a domain Account by its unique identifier via the repository.
+
+        Args:
+            account_id: The unique identifier of the account.
+
+        Returns:
+            Account | None: The domain Account if found, None otherwise.
+        """
+        return self.account_repository.get_by_id(account_id)
+
     def update_avatar(self, avatar_file_id: str | None) -> None:
         """
         Sets or clears the avatar_file_id for the currently authenticated account.
@@ -109,6 +121,61 @@ def update_avatar(self, avatar_file_id: str | None) -> None:
             return
         self.account_repository.update_avatar(account.account_id, avatar_file_id)
 
+    def update_email(self, new_email: str) -> str | None:
+        """
+        Updates the email address for the currently logged-in account.
+
+        Retrieves the current account from the session, checks that the new
+        email is not already used by a different account, and persists the
+        change via the account repository.
+
+        Args:
+            new_email: The new email address to set.
+
+        Returns:
+            str | None: None on success, or an error message string if
+                the email is already taken or the user is unauthenticated.
+        """
+        account = self.get_current_account()
+        if not account:
+            return "You must be signed in to update your email."
+
+        if new_email == account.account_email:
+            return None
+
+        existing = self.account_repository.find_by_email(new_email)
+        if existing and existing.account_id != account.account_id:
+            return "This email is already taken."
+
+        self.account_repository.update_email(account.account_id, new_email)
+        return None
+
+    def update_password(self, new_password: str) -> str | None:
+        """
+        Updates the password for the currently logged-in account.
+
+        Retrieves the current account from the session, hashes the new
+        password using the password hasher, and persists the change
+        via the account repository.
+
+        Args:
+            new_password: The new plaintext password to set.
+
+        Returns:
+            str | None: None on success, or an error message string if
+                the user is not authenticated or the password is empty.
+        """
+        account = self.get_current_account()
+        if not account:
+            return "You must be signed in to update your password."
+
+        if not new_password:
+            return "Password is required."
+
+        new_hash = self.password_hasher_repository.hash(new_password)
+        self.account_repository.update_password(account.account_id, new_hash)
+        return None
+
     def get_all_accounts(self) -> list[Account]:
         """
         Retrieves all accounts via the account repository.
@@ -117,3 +184,55 @@ def get_all_accounts(self) -> list[Account]:
             list[Account]: A list of all Account domain entities.
         """
         return self.account_repository.get_all()
+
+    def delete_account(self, account_id: int) -> None:
+        """
+        Deletes a user account by its unique identifier.
+
+        The caller is responsible for cleaning up the avatar file and
+        ensuring proper authorization before calling this method.
+        The database handles orphaned articles (ON DELETE SET NULL)
+        and comments (ON DELETE CASCADE).
+
+        Args:
+            account_id: The unique identifier of the account to delete.
+
+        Raises:
+            ValueError: If no account with the given ID exists.
+        """
+        existing = self.account_repository.get_by_id(account_id)
+        if not existing:
+            raise ValueError(f"Account with id {account_id} not found.")
+        self.account_repository.delete(account_id)
+
+    def update_account_role(self, admin_id: int, target_id: int, new_role: str) -> str | None:
+        """
+        Allows an admin user to update the role of another user account.
+
+        Validates that the requester is an admin, the target exists,
+        the target is not an admin, and the new role is valid.
+
+        Args:
+            admin_id: The unique identifier of the admin performing the action.
+            target_id: The unique identifier of the account whose role is to be updated.
+            new_role: The new role string ("user" or "author").
+
+        Returns:
+            str | None: None on success, or an error message string if the operation fails.
+        """
+        admin = self.account_repository.get_by_id(admin_id)
+        if not admin or admin.account_role != AccountRole.ADMIN:
+            return "Unauthorized."
+
+        target = self.account_repository.get_by_id(target_id)
+        if not target:
+            return "Account not found."
+
+        if target.account_role == AccountRole.ADMIN:
+            return "Cannot change role of another admin."
+
+        if new_role not in ("user", "author"):
+            return "Invalid role."
+
+        self.account_repository.update_role(target_id, new_role)
+        return None
diff --git a/src/application/services/service_utils.py b/src/application/services/service_utils.py
index 5772f23e..271767b6 100644
--- a/src/application/services/service_utils.py
+++ b/src/application/services/service_utils.py
@@ -31,16 +31,20 @@ def build_comment_nested_tree(
     roots.sort(key=lambda c: c.comment_posted_at, reverse=True)
 
     def _build_node(comment: Comment, depth: int) -> CommentNode:
+        author_id = comment.comment_written_account_id
+        author_name = author_map.get(author_id, "Anonymous") if author_id is not None else "Anonymous"  # type: ignore  # safe: None handled
+        author_avatar_file_id = (
+            avatar_map.get(author_id)
+            if avatar_map and author_id is not None
+            else None
+        )
         cwa = CommentWithAuthor(
             comment=comment,
-            author_name=author_map.get(comment.comment_written_account_id, "Unknown"),
-            author_avatar_file_id=(
-                avatar_map.get(comment.comment_written_account_id)
-                if avatar_map else None
-            ),
+            author_name=author_name,
+            author_avatar_file_id=author_avatar_file_id,
         )
         children = parent_map.pop(comment.comment_id, [])
-        children.sort(key=lambda c: c.comment_posted_at)
+        children.sort(key=lambda c: c.comment_posted_at, reverse=True)
         replies = [_build_node(child, depth + 1) for child in children]
         return CommentNode(comment=cwa, replies=replies, depth=depth)
 
diff --git a/src/infrastructure/input_adapters/dto/article_response.py b/src/infrastructure/input_adapters/dto/article_response.py
index f044cf9e..dc23332a 100644
--- a/src/infrastructure/input_adapters/dto/article_response.py
+++ b/src/infrastructure/input_adapters/dto/article_response.py
@@ -31,12 +31,14 @@ class ArticleResponse(BaseModel):
     Protects the Domain entity from being exposed directly to the templates.
 
     Attributes:
+        article_author_id (int | None): Reference to the author's Account.
+            None when the author's account has been deleted.
         author_avatar_file_id (str | None): UUID of the author's avatar file, or None.
     """
     model_config = ConfigDict(from_attributes=True)
 
     article_id: int
-    article_author_id: int
+    article_author_id: int | None = None
     author_username: str = "Unknown"
     author_avatar_file_id: str | None = None
     article_title: str
diff --git a/src/infrastructure/input_adapters/dto/comment_response.py b/src/infrastructure/input_adapters/dto/comment_response.py
index 55db860c..cd6c9334 100644
--- a/src/infrastructure/input_adapters/dto/comment_response.py
+++ b/src/infrastructure/input_adapters/dto/comment_response.py
@@ -18,7 +18,7 @@ class CommentResponse(BaseModel):
 
     comment_id: int
     comment_article_id: int
-    comment_written_account_id: int
+    comment_written_account_id: int | None
     author_username: str = "Unknown"
     author_avatar_file_id: str | None = None
     comment_reply_to: int | None
@@ -41,6 +41,11 @@ def from_domain(cls, comment, author_username: str = "Unknown", author_avatar_fi
             CommentResponse: The initialized DTO.
         """
         content = comment.comment_content
+
+        if comment.comment_written_account_id is None:
+            author_username = "Anonymous"
+            content = "<!--cmt-removed--><em>Comment removed</em>"
+
         if "<!--cmt-removed-->" in content or content in ("Comment removed", "[deleted]"):
             author_username = "Anonymous"
 
@@ -65,19 +70,23 @@ def from_domain(cls, comment, author_username: str = "Unknown", author_avatar_fi
     @classmethod
     def map_nested_tree(cls, nodes: list, depth_limit: int = 4) -> list[CommentNodeResponse]:
         """
-        Recursively maps a list of CommentNode domain tree nodes into DTO tree nodes.
+        Maps domain CommentNode tree into DTO tree.
+        Stops nesting at depth_limit - 1; deeper nodes have empty replies.
 
         Args:
-            nodes (list[CommentNode]): The root tree nodes from the domain layer.
-            depth_limit (int): Maximum rendering depth; deeper nodes are flattened.
+            nodes (list[CommentNode]): Root tree nodes from domain layer.
+            depth_limit (int): Max nesting depth; deeper nodes truncated.
 
         Returns:
-            list[CommentNodeResponse]: The mapped DTO tree.
+            list[CommentNodeResponse]: Mapped DTO tree.
         """
         def _map(node) -> CommentNodeResponse:
             display_depth = node.depth if node.depth < depth_limit else depth_limit
             cr = cls.from_domain(node.comment.comment, node.comment.author_name, node.comment.author_avatar_file_id)
-            replies = [_map(child) for child in node.replies]
+            if node.depth < depth_limit - 1:
+                replies = [_map(child) for child in node.replies]
+            else:
+                replies = []
             return CommentNodeResponse(comment=cr, replies=replies, depth=display_depth)
         return [_map(n) for n in nodes]
 
diff --git a/src/infrastructure/input_adapters/flask/flask_account_session_adapter.py b/src/infrastructure/input_adapters/flask/flask_account_session_adapter.py
index a3d81650..908729c4 100644
--- a/src/infrastructure/input_adapters/flask/flask_account_session_adapter.py
+++ b/src/infrastructure/input_adapters/flask/flask_account_session_adapter.py
@@ -204,6 +204,62 @@ def remove_profile_photo(self):
         flash("Profile photo removed.", "success")
         return redirect(url_for("auth.profile"))
 
+    def update_email(self):
+        """
+        Handles email address change form submission.
+
+        Validates authentication, extracts the new email from the form data,
+        and delegates the update to the session service. Redirects back to
+        the profile page with a flash message on success or error.
+
+        Returns:
+            Response: A Flask redirect response to the profile page.
+        """
+        account = self.session_service.get_current_account()
+        if not account:
+            flash("Please sign in.", "error")
+            return redirect(url_for("auth.login"))
+
+        new_email = request.form.get("email", "").strip()
+        if not new_email:
+            flash("Email is required.", "error")
+            return redirect(url_for("auth.profile"))
+
+        result = self.session_service.update_email(new_email)
+        if result is not None:
+            flash(result, "error")
+        else:
+            flash("Email updated.", "success")
+        return redirect(url_for("auth.profile"))
+
+    def update_password(self):
+        """
+        Handles password change form submission.
+
+        Validates authentication, extracts the new password from the form data,
+        and delegates the update to the session service. Redirects back to
+        the profile page with a flash message on success or error.
+
+        Returns:
+            Response: A Flask redirect response to the profile page.
+        """
+        account = self.session_service.get_current_account()
+        if not account:
+            flash("Please sign in.", "error")
+            return redirect(url_for("auth.login"))
+
+        new_password = request.form.get("new_password", "")
+        if not new_password:
+            flash("Password is required.", "error")
+            return redirect(url_for("auth.profile"))
+
+        result = self.session_service.update_password(new_password)
+        if result is not None:
+            flash(result, "error")
+        else:
+            flash("Password updated.", "success")
+        return redirect(url_for("auth.profile"))
+
     def list_all_users(self):
         """
         Renders the admin-only user list page.
@@ -229,3 +285,105 @@ def list_all_users(self):
             users=users_dto,
             current_user=current_account,
         )
+
+    def delete_account(self):
+        """
+        Handles account deletion form submission.
+
+        Supports two modes:
+        - Self-delete: account_id not provided or matches current user
+          (admin self-delete is forbidden and returns 403).
+          Session is terminated and user is redirected to the home page.
+        - Admin delete: account_id is provided and current user is admin.
+          Session is preserved and admin is redirected to the user list.
+
+        Avatar file is cleaned up before deleting the account record.
+        The database automatically sets article_author_id to NULL
+        (ON DELETE SET NULL) and cascades comment deletion.
+
+        Returns:
+            Response: A Flask redirect response.
+
+        Raises:
+            403: If a non-admin tries to delete another account,
+                 or if an admin tries to delete another admin,
+                 or if an admin tries to delete their own account.
+        """
+        current_account = self.session_service.get_current_account()
+        if not current_account:
+            flash("Please sign in.", "error")
+            return redirect(url_for("auth.login"))
+
+        target_id = request.form.get("account_id", type=int) or current_account.account_id
+        is_self = target_id == current_account.account_id
+
+        if is_self and current_account.account_role == AccountRole.ADMIN:
+            abort(403)
+
+        if not is_self:
+            if current_account.account_role != AccountRole.ADMIN:
+                abort(403)
+            target = self.session_service.get_account_by_id(target_id)
+            if not target:
+                flash("Account not found.", "error")
+                return redirect(url_for("auth.list_all_users"))
+            if target.account_role == AccountRole.ADMIN:
+                abort(403)
+
+        account = self.session_service.get_account_by_id(target_id)
+        if account and account.avatar_file_id:
+            try:
+                self.file_service.delete_file(account.avatar_file_id)
+            except Exception:
+                logger.warning("Failed to delete avatar %s for account %s", account.avatar_file_id, target_id)
+
+        self.session_service.delete_account(target_id)
+
+        if is_self:
+            self.session_service.terminate_session()
+            flash("Account deleted.", "success")
+            return redirect(url_for("article.list_articles"))
+
+        flash("Account deleted.", "success")
+        return redirect(url_for("auth.list_all_users"))
+
+    def change_role(self, account_id: int):
+        """
+        Handles role change form submission (Admin only).
+
+        Validates authentication, extracts the new role from the form data,
+        and delegates the update to the session service. Redirects back to
+        the target user's profile page with a flash message.
+
+        Args:
+            account_id: The ID of the account whose role to update.
+
+        Returns:
+            Response: A Flask redirect response.
+
+        Raises:
+            403: If the current user is not authenticated or not an admin.
+        """
+        current_account = self.session_service.get_current_account()
+        if not current_account or current_account.account_role != AccountRole.ADMIN:
+            abort(403)
+
+        new_role = request.form.get("role", "")
+        result = self.session_service.update_account_role(
+            admin_id=current_account.account_id,
+            target_id=account_id,
+            new_role=new_role,
+        )
+
+        target = self.session_service.get_account_by_id(account_id)
+
+        if result is not None:
+            flash(result, "error")
+            if target:
+                return redirect(url_for("auth.user_profile", username=target.account_username))
+            return redirect(url_for("auth.list_all_users"))
+
+        flash("Role updated.", "success")
+        if target:
+            return redirect(url_for("auth.user_profile", username=target.account_username))
+        return redirect(url_for("auth.list_all_users"))
diff --git a/src/infrastructure/input_adapters/flask/flask_comment_adapter.py b/src/infrastructure/input_adapters/flask/flask_comment_adapter.py
index 61e0a554..9f54f9df 100644
--- a/src/infrastructure/input_adapters/flask/flask_comment_adapter.py
+++ b/src/infrastructure/input_adapters/flask/flask_comment_adapter.py
@@ -153,11 +153,9 @@ def delete_comment(self, article_id: int, comment_id: int) -> Response:
             flash("You must be signed in to delete comments.", "error")
             return redirect(url_for("auth.login"))
 
-        cascade = request.form.get("cascade", "true").lower() == "true"
         result = self.comment_service.delete_comment(
             comment_id=comment_id,
             user_id=user.account_id,
-            cascade=cascade
         )
 
         if isinstance(result, str):
diff --git a/src/infrastructure/output_adapters/dto/article_record.py b/src/infrastructure/output_adapters/dto/article_record.py
index 6c385c82..898bf7ab 100644
--- a/src/infrastructure/output_adapters/dto/article_record.py
+++ b/src/infrastructure/output_adapters/dto/article_record.py
@@ -10,12 +10,15 @@ class ArticleRecord(BaseModel):
     Pydantic DTO (Data Transfer Object) for article database records.
 
     Provides validation when loading data from the persistence layer.
+
+    article_author_id is nullable — None when the author account
+    has been deleted (articles are preserved via ON DELETE SET NULL).
     """
 
     model_config = ConfigDict(from_attributes=True)
 
     article_id: int
-    article_author_id: int
+    article_author_id: int | None = None
     article_title: str
     article_content: str
     article_published_at: datetime | None = None
diff --git a/src/infrastructure/output_adapters/dto/comment_record.py b/src/infrastructure/output_adapters/dto/comment_record.py
index 2d76ced1..943d819e 100644
--- a/src/infrastructure/output_adapters/dto/comment_record.py
+++ b/src/infrastructure/output_adapters/dto/comment_record.py
@@ -16,7 +16,7 @@ class CommentRecord(BaseModel):
 
     comment_id: int
     comment_article_id: int
-    comment_written_account_id: int
+    comment_written_account_id: int | None
     comment_reply_to: int | None
     comment_content: str
     comment_posted_at: datetime
diff --git a/src/infrastructure/output_adapters/in_memory/account_repository.py b/src/infrastructure/output_adapters/in_memory/account_repository.py
index ae34df1a..99d6d55f 100644
--- a/src/infrastructure/output_adapters/in_memory/account_repository.py
+++ b/src/infrastructure/output_adapters/in_memory/account_repository.py
@@ -1,4 +1,4 @@
-from src.application.domain.account import Account
+from src.application.domain.account import Account, AccountRole
 from src.application.output_ports.account_repository import AccountRepository
 
 
@@ -94,6 +94,45 @@ def update_avatar(self, account_id: int, avatar_file_id: str | None) -> None:
             return
         account.avatar_file_id = avatar_file_id
 
+    def update_email(self, account_id: int, new_email: str) -> None:
+        """
+        Updates the email address for the given account in memory.
+
+        Args:
+            account_id: The ID of the account to update.
+            new_email: The new email address to set.
+        """
+        account = self._accounts.get(account_id)
+        if account is None:
+            return
+        account.account_email = new_email
+
+    def update_password(self, account_id: int, new_hashed_password: str) -> None:
+        """
+        Updates the password hash for the given account in memory.
+
+        Args:
+            account_id: The ID of the account to update.
+            new_hashed_password: The new password hash to store.
+        """
+        account = self._accounts.get(account_id)
+        if account is None:
+            return
+        account.account_password = new_hashed_password
+
+    def update_role(self, account_id: int, new_role: str) -> None:
+        """
+        Updates the account_role for the given account in memory.
+
+        Args:
+            account_id: The ID of the account to update.
+            new_role: The new role string ("user" or "author").
+        """
+        account = self._accounts.get(account_id)
+        if account is None:
+            return
+        account.account_role = AccountRole(new_role)
+
     def get_all(self) -> list[Account]:
         """
         Retrieves all accounts from the in-memory store.
@@ -102,3 +141,12 @@ def get_all(self) -> list[Account]:
             list[Account]: A list of all Account domain entities.
         """
         return list(self._accounts.values())
+
+    def delete(self, account_id: int) -> None:
+        """
+        Deletes an account by its unique identifier from the in-memory store.
+
+        Args:
+            account_id (int): The unique identifier of the account to delete.
+        """
+        self._accounts.pop(account_id, None)
diff --git a/src/infrastructure/output_adapters/in_memory/comment_repository.py b/src/infrastructure/output_adapters/in_memory/comment_repository.py
index b200194c..9b5aec7e 100644
--- a/src/infrastructure/output_adapters/in_memory/comment_repository.py
+++ b/src/infrastructure/output_adapters/in_memory/comment_repository.py
@@ -73,14 +73,3 @@ def delete(self, comment_id: int) -> None:
         """
         if comment_id in self._comments:
             del self._comments[comment_id]
-
-    def orphan_children(self, comment_id: int) -> None:
-        """
-        Sets comment_reply_to to NULL for all direct children of the given comment.
-
-        Args:
-            comment_id (int): ID of the parent comment whose children should be orphaned.
-        """
-        for c in self._comments.values():
-            if c.comment_reply_to == comment_id:
-                c.comment_reply_to = None
diff --git a/src/infrastructure/output_adapters/sqlalchemy/models/sqlalchemy_article_model.py b/src/infrastructure/output_adapters/sqlalchemy/models/sqlalchemy_article_model.py
index 521df791..31ba50ff 100644
--- a/src/infrastructure/output_adapters/sqlalchemy/models/sqlalchemy_article_model.py
+++ b/src/infrastructure/output_adapters/sqlalchemy/models/sqlalchemy_article_model.py
@@ -9,14 +9,17 @@
 class ArticleModel(SqlAlchemyModel):
     """
     SQLAlchemy ORM model for the 'articles' table.
+
+    article_author_id uses ON DELETE SET NULL to preserve articles
+    when the author account is deleted (author becomes "Anonymous").
     """
 
     __tablename__ = "articles"
 
     article_id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
-    article_author_id: Mapped[int] = mapped_column(
-        ForeignKey("accounts.account_id", ondelete="CASCADE"),
-        nullable=False,
+    article_author_id: Mapped[int | None] = mapped_column(
+        ForeignKey("accounts.account_id", ondelete="SET NULL"),
+        nullable=True,
     )
     article_title: Mapped[str] = mapped_column(Text, nullable=False)
     article_content: Mapped[str] = mapped_column(Text, nullable=False)
diff --git a/src/infrastructure/output_adapters/sqlalchemy/models/sqlalchemy_comment_model.py b/src/infrastructure/output_adapters/sqlalchemy/models/sqlalchemy_comment_model.py
index 7dd0a19a..e95f4928 100644
--- a/src/infrastructure/output_adapters/sqlalchemy/models/sqlalchemy_comment_model.py
+++ b/src/infrastructure/output_adapters/sqlalchemy/models/sqlalchemy_comment_model.py
@@ -15,6 +15,9 @@
 class CommentModel(SqlAlchemyModel):
     """
     SQLAlchemy ORM model for comments used in the new architecture.
+
+    comment_reply_to uses ON DELETE SET NULL so that replies to a deleted
+    comment become top-level comments instead of being cascaded away.
     """
 
     __tablename__ = "comments"
@@ -29,14 +32,14 @@ class CommentModel(SqlAlchemyModel):
         type_=Integer,
         nullable=False,
     )
-    comment_written_account_id: Mapped[int] = mapped_column(
-        ForeignKey("accounts.account_id", ondelete="CASCADE"),
+    comment_written_account_id: Mapped[int | None] = mapped_column(
+        ForeignKey("accounts.account_id", ondelete="SET NULL"),
         name="comment_written_account_id",
         type_=Integer,
-        nullable=False,
+        nullable=True,
     )
     comment_reply_to: Mapped[int | None] = mapped_column(
-        ForeignKey("comments.comment_id"),
+        ForeignKey("comments.comment_id", ondelete="SET NULL"),
         name="comment_reply_to",
         type_=Integer,
         nullable=True,
diff --git a/src/infrastructure/output_adapters/sqlalchemy/sqlalchemy_account_adapter.py b/src/infrastructure/output_adapters/sqlalchemy/sqlalchemy_account_adapter.py
index 89d7d9e1..8b71af2e 100644
--- a/src/infrastructure/output_adapters/sqlalchemy/sqlalchemy_account_adapter.py
+++ b/src/infrastructure/output_adapters/sqlalchemy/sqlalchemy_account_adapter.py
@@ -172,6 +172,64 @@ def update_avatar(self, account_id: int, avatar_file_id: str | None) -> None:
         model.avatar_file_id = avatar_file_id
         self._session.commit()
 
+    def update_email(self, account_id: int, new_email: str) -> None:
+        """
+        Updates the email address for the given account directly in the database.
+
+        Performs a targeted column update and commits the transaction.
+        Catches unique constraint violations and re-raises as a domain exception.
+
+        Args:
+            account_id: The ID of the account to update.
+            new_email: The new email address to set.
+
+        Raises:
+            AccountAlreadyExistsError: If the new email is already taken
+                by another account.
+        """
+        model = self._session.get(AccountModel, account_id)
+        if model is None:
+            return
+        model.account_email = new_email
+        try:
+            self._session.commit()
+        except IntegrityError as e:
+            self._session.rollback()
+            constraint_name = cast(UniqueViolation, e.orig).diag.constraint_name if e.orig else None
+            if constraint_name == "accounts_account_email_key":
+                raise AccountAlreadyExistsError("This email is already taken.") from None
+            raise
+
+    def update_password(self, account_id: int, new_hashed_password: str) -> None:
+        """
+        Updates the password hash for the given account directly in the database.
+
+        Performs a targeted column update and commits the transaction.
+
+        Args:
+            account_id: The ID of the account to update.
+            new_hashed_password: The new Argon2 hash to store.
+        """
+        model = self._session.get(AccountModel, account_id)
+        if model is None:
+            return
+        model.account_password = new_hashed_password
+        self._session.commit()
+
+    def update_role(self, account_id: int, new_role: str) -> None:
+        """
+        Updates the role for the given account directly in the database.
+
+        Args:
+            account_id: The ID of the account to update.
+            new_role: The new role string ("user" or "author").
+        """
+        model = self._session.get(AccountModel, account_id)
+        if model is None:
+            return
+        model.account_role = new_role
+        self._session.commit()
+
     def get_all(self) -> list[Account]:
         """
         Retrieves all accounts from the database.
@@ -181,3 +239,22 @@ def get_all(self) -> list[Account]:
         """
         models = self._session.query(AccountModel).all()
         return [self._to_domain(model) for model in models]
+
+    def delete(self, account_id: int) -> None:
+        """
+        Deletes an account by its unique identifier.
+
+        The database will apply ON DELETE SET NULL for articles authored
+        by this account and ON DELETE CASCADE for their comments.
+
+        Args:
+            account_id (int): The unique identifier of the account to delete.
+
+        Raises:
+            ValueError: If no account with the given ID exists.
+        """
+        model = self._session.get(AccountModel, account_id)
+        if model is None:
+            raise ValueError(f"Account with id {account_id} not found.")
+        self._session.delete(model)
+        self._session.commit()
diff --git a/src/infrastructure/output_adapters/sqlalchemy/sqlalchemy_comment_adapter.py b/src/infrastructure/output_adapters/sqlalchemy/sqlalchemy_comment_adapter.py
index a90a9d67..bee0c259 100644
--- a/src/infrastructure/output_adapters/sqlalchemy/sqlalchemy_comment_adapter.py
+++ b/src/infrastructure/output_adapters/sqlalchemy/sqlalchemy_comment_adapter.py
@@ -117,15 +117,3 @@ def delete(self, comment_id: int) -> None:
             comment_id=comment_id,
         ).delete()
         self._session.commit()
-
-    def orphan_children(self, comment_id: int) -> None:
-        """
-        Sets comment_reply_to to NULL for all direct children of the given comment.
-
-        Args:
-            comment_id (int): ID of the parent comment whose children should be orphaned.
-        """
-        self._session.query(CommentModel).filter_by(
-            comment_reply_to=comment_id,
-        ).update({"comment_reply_to": None})
-        self._session.commit()
diff --git a/tests/test_prosemirror_to_html.py b/tests/test_prosemirror_to_html.py
index 7ad3f227..b12a4b1f 100644
--- a/tests/test_prosemirror_to_html.py
+++ b/tests/test_prosemirror_to_html.py
@@ -144,6 +144,13 @@ def test_code_block_escapes_html(self):
         assert "&lt;script&gt;" in str(result)
         assert "<script>" not in str(result)
 
+    def test_paragraph_escapes_script_tags(self):
+        result = prosemirror_to_html(
+            '[{"type":"paragraph","content":[{"type":"text","text":"<script>alert(1)</script>"}]}]'
+        )
+        assert "&lt;script&gt;" in str(result)
+        assert "<script>" not in str(result)
+
     def test_inline_code_mark(self):
         result = prosemirror_to_html(
             '[{"type":"paragraph","content":[{"type":"text","marks":[{"type":"code"}],"text":"var x = 1;"}]}]'
diff --git a/tests/tests_infrastructure/tests_input_adapters/dto/test_article_response.py b/tests/tests_infrastructure/tests_input_adapters/dto/test_article_response.py
index 4d1c1c5d..df84438d 100644
--- a/tests/tests_infrastructure/tests_input_adapters/dto/test_article_response.py
+++ b/tests/tests_infrastructure/tests_input_adapters/dto/test_article_response.py
@@ -50,3 +50,12 @@ def test_from_domain_without_avatar_file_id(self):
         )
         result = ArticleResponse.from_domain(domain_article, "yoda")
         assert result.author_avatar_file_id is None
+
+    def test_from_domain_with_none_author_id(self):
+        domain_article = Article(
+            article_id=1, article_author_id=None, article_title="Title",
+            article_content="Content", article_published_at=datetime.now()
+        )
+        result = ArticleResponse.from_domain(domain_article, "Anonymous")
+        assert result.article_author_id is None
+        assert result.author_username == "Anonymous"
diff --git a/tests/tests_infrastructure/tests_input_adapters/dto/test_comment_response.py b/tests/tests_infrastructure/tests_input_adapters/dto/test_comment_response.py
index 65fc3e1b..6080f8e9 100644
--- a/tests/tests_infrastructure/tests_input_adapters/dto/test_comment_response.py
+++ b/tests/tests_infrastructure/tests_input_adapters/dto/test_comment_response.py
@@ -91,6 +91,20 @@ def test_from_domain_without_avatar_file_id():
     result = CommentResponse.from_domain(comment, "yoda")
     assert result.author_avatar_file_id is None
 
+def test_from_domain_with_none_author_id_maps_to_removed():
+    comment = Comment(
+        comment_id=4,
+        comment_article_id=10,
+        comment_written_account_id=None,
+        comment_reply_to=None,
+        comment_content="Original content",
+        comment_posted_at=datetime.now()
+    )
+    result = CommentResponse.from_domain(comment, "some_user")
+    assert result.author_username == "Anonymous"
+    assert result.comment_written_account_id is None
+    assert result.comment_content == "<em>Comment removed</em>"
+
 def test_map_nested_tree_threads_avatar():
     posted_at = datetime(2023, 10, 27, 14, 30)
     comment_1 = Comment(1, 10, 1, None, "Root", posted_at)
@@ -110,3 +124,124 @@ def test_map_nested_tree_threads_avatar():
     result = CommentResponse.map_nested_tree(nodes)
     assert result[0].comment.author_avatar_file_id == "avatar-1"
     assert result[0].replies[0].comment.author_avatar_file_id == "avatar-2"
+
+def test_map_nested_tree_shallow_no_flatten():
+    posted_at = datetime(2023, 10, 27, 14, 30)
+    c1 = Comment(1, 10, 1, None, "Root", posted_at)
+    c2 = Comment(2, 10, 2, 1, "Lvl1", posted_at)
+    c3 = Comment(3, 10, 3, 2, "Lvl2", posted_at)
+    nodes = [
+        CommentNode(
+            comment=CommentWithAuthor(c1, "U1"),
+            replies=[
+                CommentNode(
+                    comment=CommentWithAuthor(c2, "U2"),
+                    replies=[
+                        CommentNode(
+                            comment=CommentWithAuthor(c3, "U3"),
+                            depth=2,
+                        )
+                    ],
+                    depth=1,
+                )
+            ],
+            depth=0,
+        )
+    ]
+    result = CommentResponse.map_nested_tree(nodes)
+    assert len(result) == 1
+    assert result[0].depth == 0
+    assert len(result[0].replies) == 1
+    assert result[0].replies[0].depth == 1
+    assert len(result[0].replies[0].replies) == 1
+    assert result[0].replies[0].replies[0].depth == 2
+
+def test_map_nested_tree_truncate_deep():
+    posted_at = datetime(2023, 10, 27, 14, 30)
+    c1 = Comment(1, 10, 1, None, "Root", posted_at)
+    c2 = Comment(2, 10, 2, 1, "Lvl1", posted_at)
+    c3 = Comment(3, 10, 3, 2, "Lvl2", posted_at)
+    c4 = Comment(4, 10, 4, 3, "Lvl3", posted_at)
+    c5 = Comment(5, 10, 5, 4, "Lvl4", posted_at)
+    nodes = [
+        CommentNode(
+            comment=CommentWithAuthor(c1, "U1"),
+            replies=[
+                CommentNode(
+                    comment=CommentWithAuthor(c2, "U2"),
+                    replies=[
+                        CommentNode(
+                            comment=CommentWithAuthor(c3, "U3"),
+                            replies=[
+                                CommentNode(
+                                    comment=CommentWithAuthor(c4, "U4"),
+                                    replies=[
+                                        CommentNode(
+                                            comment=CommentWithAuthor(c5, "U5"),
+                                            depth=4,
+                                        )
+                                    ],
+                                    depth=3,
+                                )
+                            ],
+                            depth=2,
+                        )
+                    ],
+                    depth=1,
+                )
+            ],
+            depth=0,
+        )
+    ]
+    result = CommentResponse.map_nested_tree(nodes)
+    assert len(result) == 1
+    root = result[0]
+    assert root.depth == 0
+    assert len(root.replies) == 1
+    lvl1 = root.replies[0]
+    assert lvl1.depth == 1
+    assert len(lvl1.replies) == 1
+    lvl2 = lvl1.replies[0]
+    assert lvl2.depth == 2
+    assert len(lvl2.replies) == 1
+    lvl3 = lvl2.replies[0]
+    assert lvl3.comment.comment_id == 4
+    assert lvl3.depth == 3
+    assert len(lvl3.replies) == 0
+    assert lvl3.comment.comment_content == "Lvl3"
+
+def test_map_nested_tree_flatten_multiple_children():
+    posted_at = datetime(2023, 10, 27, 14, 30)
+    c1 = Comment(1, 10, 1, None, "Root", posted_at)
+    c2 = Comment(2, 10, 2, 1, "Lvl1_A", posted_at)
+    c3 = Comment(3, 10, 3, 1, "Lvl1_B", posted_at)
+    c4 = Comment(4, 10, 4, 2, "Lvl2", posted_at)
+    nodes = [
+        CommentNode(
+            comment=CommentWithAuthor(c1, "U1"),
+            replies=[
+                CommentNode(
+                    comment=CommentWithAuthor(c2, "U2"),
+                    replies=[
+                        CommentNode(
+                            comment=CommentWithAuthor(c4, "U4"),
+                            depth=2,
+                        )
+                    ],
+                    depth=1,
+                ),
+                CommentNode(
+                    comment=CommentWithAuthor(c3, "U3"),
+                    depth=1,
+                ),
+            ],
+            depth=0,
+        )
+    ]
+    result = CommentResponse.map_nested_tree(nodes)
+    assert len(result) == 1
+    assert len(result[0].replies) == 2
+    assert result[0].replies[0].comment.comment_id == 2
+    assert result[0].replies[0].depth == 1
+    assert result[0].replies[1].comment.comment_id == 3
+    assert result[0].replies[1].depth == 1
diff --git a/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_account_session_adapter.py b/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_account_session_adapter.py
index 2fe6b717..63612438 100644
--- a/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_account_session_adapter.py
+++ b/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_account_session_adapter.py
@@ -40,6 +40,13 @@ def setup_method(self):
         self._register_dummy_route("/register", "registration.register", "registration")
         self._register_dummy_route("/articles/new", "article.render_create_page", "new_article")
 
+        self.app.add_url_rule(
+            "/account/delete",
+            view_func=self.adapter.delete_account,
+            methods=["POST"],
+            endpoint="auth.delete_account",
+        )
+
         self.app.add_url_rule(
             "/users/<username>",
             view_func=self.adapter.display_user_profile,
@@ -66,6 +73,20 @@ def setup_method(self):
             endpoint="auth.remove_profile_photo",
         )
 
+        self.app.add_url_rule(
+            "/profile/email",
+            view_func=self.adapter.update_email,
+            methods=["POST"],
+            endpoint="auth.update_email",
+        )
+
+        self.app.add_url_rule(
+            "/profile/password",
+            view_func=self.adapter.update_password,
+            methods=["POST"],
+            endpoint="auth.update_password",
+        )
+
         self.app.add_url_rule(
             "/admin/users",
             view_func=self.adapter.list_all_users,
@@ -73,6 +94,13 @@ def setup_method(self):
             endpoint="auth.list_all_users",
         )
 
+        self.app.add_url_rule(
+            "/admin/users/<int:account_id>/role",
+            view_func=self.adapter.change_role,
+            methods=["POST"],
+            endpoint="auth.change_role",
+        )
+
     def test_logout_clears_session(self):
         response = self.client.post("/logout", follow_redirects=True)
         assert b"You have been logged out." in response.data
@@ -253,6 +281,187 @@ def test_list_all_users_as_non_admin_returns_403(self):
         response = self.client.get("/admin/users")
         assert response.status_code == 403
 
+    def test_non_admin_post_delete_another_returns_403(self):
+        user = create_test_account(account_id=1, account_role=AccountRole.USER)
+        self.set_current_user(user)
+        self.mock_session_service.get_current_account.return_value = user
+        response = self.client.post("/account/delete", data={"account_id": 2})
+        assert response.status_code == 403
+
+    def test_admin_self_delete_returns_403(self):
+        admin = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
+        self.set_current_user(admin)
+        self.mock_session_service.get_current_account.return_value = admin
+        self.mock_session_service.get_account_by_id.return_value = admin
+        response = self.client.post("/account/delete")
+        assert response.status_code == 403
+
+    def test_self_delete_redirects(self):
+        user = create_test_account(account_id=1, account_role=AccountRole.USER)
+        self.set_current_user(user)
+        self.mock_session_service.get_current_account.return_value = user
+        self.mock_session_service.get_account_by_id.return_value = user
+        self.mock_session_service.delete_account.return_value = None
+        response = self.client.post("/account/delete", follow_redirects=True)
+        assert response.status_code == 200
+        assert b"articles" in response.data or b"Account deleted" in response.data
+
+    def test_admin_delete_another_user_redirects(self):
+        admin = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
+        target = create_test_account(account_id=2, account_role=AccountRole.USER)
+        self.set_current_user(admin)
+        self.mock_session_service.get_current_account.return_value = admin
+        self.mock_session_service.get_account_by_id.return_value = target
+        self.mock_session_service.get_all_accounts.return_value = []
+        self.mock_session_service.delete_account.return_value = None
+        response = self.client.post("/account/delete", data={"account_id": 2}, follow_redirects=True)
+        assert response.status_code == 200
+        assert b"Manage Users" in response.data or b"Account deleted" in response.data
+
+    def test_admin_delete_nonexistent_target_redirects_with_flash(self):
+        admin = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
+        self.set_current_user(admin)
+        self.mock_session_service.get_current_account.return_value = admin
+        self.mock_session_service.get_account_by_id.return_value = None
+        self.mock_session_service.get_all_accounts.return_value = []
+        response = self.client.post("/account/delete", data={"account_id": 999}, follow_redirects=True)
+        assert response.status_code == 200
+        assert b"not found" in response.data or b"Account not found" in response.data
+
+    def test_update_email_success(self):
+        fake_user = create_test_account(account_id=1, account_email="old@test.com")
+        self.mock_session_service.get_current_account.return_value = fake_user
+        self.mock_session_service.update_email.return_value = None
+        response = self.client.post(
+            "/profile/email",
+            data={"email": "new@test.com"},
+            follow_redirects=True,
+        )
+        assert response.status_code == 200
+        assert b"Email updated." in response.data
+        assert b"alert-success" in response.data
+        self.mock_session_service.update_email.assert_called_once_with("new@test.com")
+
+    def test_update_email_unauthenticated(self):
+        self.mock_session_service.get_current_account.return_value = None
+        response = self.client.post(
+            "/profile/email",
+            data={"email": "new@test.com"},
+            follow_redirects=True,
+        )
+        assert response.status_code == 200
+        assert b"Please sign in." in response.data
+        self.mock_session_service.update_email.assert_not_called()
+
+    def test_update_email_error(self):
+        fake_user = create_test_account(account_id=1, account_email="old@test.com")
+        self.mock_session_service.get_current_account.return_value = fake_user
+        self.mock_session_service.update_email.return_value = "This email is already taken."
+        response = self.client.post(
+            "/profile/email",
+            data={"email": "taken@test.com"},
+            follow_redirects=True,
+        )
+        assert response.status_code == 200
+        assert b"This email is already taken." in response.data
+        assert b"alert-error" in response.data
+        self.mock_session_service.update_email.assert_called_once_with("taken@test.com")
+
+    def test_update_password_success(self):
+        fake_user = create_test_account(account_id=1)
+        self.mock_session_service.get_current_account.return_value = fake_user
+        self.mock_session_service.update_password.return_value = None
+        response = self.client.post(
+            "/profile/password",
+            data={"new_password": "new_secret"},
+            follow_redirects=True,
+        )
+        assert response.status_code == 200
+        assert b"Password updated." in response.data
+        assert b"alert-success" in response.data
+        self.mock_session_service.update_password.assert_called_once_with("new_secret")
+
+    def test_update_password_unauthenticated(self):
+        self.mock_session_service.get_current_account.return_value = None
+        response = self.client.post(
+            "/profile/password",
+            data={"new_password": "new_secret"},
+            follow_redirects=True,
+        )
+        assert response.status_code == 200
+        assert b"Please sign in." in response.data
+        self.mock_session_service.update_password.assert_not_called()
+
+
+class TestAccountSessionChangeRole(FlaskInputAdapterTestBase):
+    """
+    Tests for the change_role POST endpoint.
+    """
+
+    def setup_method(self):
+        super().setup_method()
+        self.mock_session_service = Mock(spec=AccountSessionManagementPort, autospec=True)
+        self.mock_file_service = Mock(spec=FileManagementPort, autospec=True)
+        self.adapter = AccountSessionAdapter(
+            session_service=self.mock_session_service,
+            file_service=self.mock_file_service,
+        )
+        self.app.add_url_rule(
+            "/admin/users/<int:account_id>/role",
+            view_func=self.adapter.change_role,
+            methods=["POST"],
+            endpoint="auth.change_role",
+        )
+        self.app.add_url_rule(
+            "/users/<username>",
+            view_func=lambda username: "profile",
+            endpoint="auth.user_profile",
+        )
+        self.app.add_url_rule(
+            "/admin/users",
+            view_func=lambda: "users",
+            endpoint="auth.list_all_users",
+        )
+
+    def test_admin_change_role_redirects(self):
+        admin = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
+        target = create_test_account(account_id=2, account_username="targetuser")
+        self.set_current_user(admin)
+        self.mock_session_service.get_current_account.return_value = admin
+        self.mock_session_service.update_account_role.return_value = None
+        self.mock_session_service.get_account_by_id.return_value = target
+        response = self.client.post(
+            "/admin/users/2/role",
+            data={"role": "author"},
+        )
+        assert response.status_code == 302
+        assert response.location.endswith("/users/targetuser")
+        self.mock_session_service.update_account_role.assert_called_once_with(
+            admin_id=1, target_id=2, new_role="author",
+        )
+
+    def test_admin_change_role_nonexistent_target(self):
+        admin = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
+        self.set_current_user(admin)
+        self.mock_session_service.get_current_account.return_value = admin
+        self.mock_session_service.update_account_role.return_value = "Account not found."
+        self.mock_session_service.get_account_by_id.return_value = None
+        response = self.client.post(
+            "/admin/users/999/role",
+            data={"role": "author"},
+        )
+        assert response.status_code == 302
+
+    def test_non_admin_change_role_returns_403(self):
+        user = create_test_account(account_id=1, account_role=AccountRole.USER)
+        self.set_current_user(user)
+        self.mock_session_service.get_current_account.return_value = user
+        response = self.client.post(
+            "/admin/users/2/role",
+            data={"role": "author"},
+        )
+        assert response.status_code == 403
+
 
 class TestAccountSessionBeforeRequestHook(FlaskInputAdapterTestBase):
     """
diff --git a/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_comment_adapter.py b/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_comment_adapter.py
index f4a85ea0..5ee3e63b 100644
--- a/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_comment_adapter.py
+++ b/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_comment_adapter.py
@@ -152,7 +152,6 @@ def test_delete_comment_success(self):
         self.mock_comment_service.delete_comment.assert_called_once_with(
             comment_id=99,
             user_id=1,
-            cascade=True
         )
 
     def test_delete_comment_requires_login(self):
diff --git a/tests/tests_infrastructure/tests_output_adapters/dto/test_article_record.py b/tests/tests_infrastructure/tests_output_adapters/dto/test_article_record.py
index ca654557..88242538 100644
--- a/tests/tests_infrastructure/tests_output_adapters/dto/test_article_record.py
+++ b/tests/tests_infrastructure/tests_output_adapters/dto/test_article_record.py
@@ -60,3 +60,11 @@ def test_to_domain_maps_all_fields_correctly(self):
         assert domain.article_title == "Mapped"
         assert domain.article_content == "Properly"
         assert domain.article_published_at == dt
+
+    def test_to_domain_with_none_author_id(self):
+        record = ArticleRecord(
+            article_id=1, article_author_id=None, article_title="Title",
+            article_content="Content", article_published_at=datetime(2023, 1, 1, 12, 0, 0),
+        )
+        domain = record.to_domain()
+        assert domain.article_author_id is None
diff --git a/tests/tests_infrastructure/tests_output_adapters/test_in_memory_adapters.py b/tests/tests_infrastructure/tests_output_adapters/test_in_memory_adapters.py
index 0ff2beef..33513cec 100644
--- a/tests/tests_infrastructure/tests_output_adapters/test_in_memory_adapters.py
+++ b/tests/tests_infrastructure/tests_output_adapters/test_in_memory_adapters.py
@@ -128,6 +128,36 @@ def test_get_all_accounts(self):
         assert a1 in results
         assert a2 in results
 
+    def test_update_email_changes_email(self):
+        repo = InMemoryAccountRepository()
+        account = Account(0, "user", "pass", "old@test.com", AccountRole.USER, datetime.now())
+        repo.save(account)
+        repo.update_email(account.account_id, "new@test.com")
+        updated = repo.get_by_id(account.account_id)
+        assert updated is not None
+        assert updated.account_email == "new@test.com"
+
+    def test_update_password_changes_password(self):
+        repo = InMemoryAccountRepository()
+        account = Account(0, "user", "old_hash", "e@t.com", AccountRole.USER, datetime.now())
+        repo.save(account)
+        repo.update_password(account.account_id, "new_hash")
+        updated = repo.get_by_id(account.account_id)
+        assert updated is not None
+        assert updated.account_password == "new_hash"
+
+    def test_delete_account(self):
+        repo = InMemoryAccountRepository()
+        account = Account(0, "user", "pass", "em", AccountRole.USER, datetime.now())
+        repo.save(account)
+        assert repo.get_by_id(account.account_id) is not None
+        repo.delete(account.account_id)
+        assert repo.get_by_id(account.account_id) is None
+
+    def test_delete_nonexistent_account_does_not_raise(self):
+        repo = InMemoryAccountRepository()
+        repo.delete(999)
+
 
 class TestInMemoryCommentRepository:
     def test_save_and_get(self):
diff --git a/tests/tests_infrastructure/tests_output_adapters/tests_sqlalchemy/test_sqlalchemy_account_adapter.py b/tests/tests_infrastructure/tests_output_adapters/tests_sqlalchemy/test_sqlalchemy_account_adapter.py
index f4dc826c..39020ab0 100644
--- a/tests/tests_infrastructure/tests_output_adapters/tests_sqlalchemy/test_sqlalchemy_account_adapter.py
+++ b/tests/tests_infrastructure/tests_output_adapters/tests_sqlalchemy/test_sqlalchemy_account_adapter.py
@@ -1,5 +1,6 @@
 import pytest
 
+from src.application.application_exceptions import AccountAlreadyExistsError
 from src.application.domain.account import AccountRole
 from src.infrastructure.output_adapters.sqlalchemy.models.sqlalchemy_account_model import AccountModel
 from src.infrastructure.output_adapters.sqlalchemy.sqlalchemy_account_adapter import SqlAlchemyAccountAdapter
@@ -141,6 +142,30 @@ def test_update_avatar_nonexistent_account_does_not_raise(self):
         self.repository.update_avatar(99999, "abc-123")
 
 
+class TestAccountUpdateEmail(SqlAlchemyAccountAdapterTestBase):
+    def test_update_email_success(self):
+        account = self.account_builder.create(username="email_user", email="old@test.com")
+        self.repository.update_email(account.account_id, "new@test.com")
+        result = self.repository.get_by_id(account.account_id)
+        assert result is not None
+        assert result.account_email == "new@test.com"
+
+    def test_update_email_duplicate_raises_error(self):
+        self.account_builder.create(username="first", email="first@test.com")
+        second = self.account_builder.create(username="second", email="second@test.com")
+        with pytest.raises(AccountAlreadyExistsError, match="This email is already taken."):
+            self.repository.update_email(second.account_id, "first@test.com")
+
+
+class TestAccountUpdatePassword(SqlAlchemyAccountAdapterTestBase):
+    def test_update_password_success(self):
+        account = self.account_builder.create(username="pass_user", password="old_hash")
+        self.repository.update_password(account.account_id, "new_hash")
+        result = self.repository.get_by_id(account.account_id)
+        assert result is not None
+        assert result.account_password == "new_hash"
+
+
 class TestAccountGetAll(SqlAlchemyAccountAdapterTestBase):
     def test_get_all_returns_all_accounts(self):
         self.account_builder.create(username="user_one", email="one@test.com")
diff --git a/tests/tests_integration/test_account_integration.py b/tests/tests_integration/test_account_integration.py
index cb8285a8..55e3f1b6 100644
--- a/tests/tests_integration/test_account_integration.py
+++ b/tests/tests_integration/test_account_integration.py
@@ -127,6 +127,54 @@ def test_upload_replaces_old_avatar_and_remove_clears_integ(self, client, db_ses
         assert deleted_new_file is None
 
 
+class TestEmailUpdate:
+    """Tests for account email change flow via the full Flask stack."""
+
+    def test_update_email_flow(self, client, db_session):
+        auth = AccountModel(
+            account_username="email_user",
+            account_email="before@test.com",
+            account_password="p",
+            account_role="user",
+        )
+        db_session.add(auth)
+        db_session.commit()
+
+        client.post("/login", data={"username": "email_user", "password": "p"}, follow_redirects=True)
+
+        response = client.post("/profile/email", data={"email": "after@test.com"}, follow_redirects=True)
+        assert response.status_code == 200
+        assert b"Email updated." in response.data
+
+        profile = client.get("/profile")
+        assert b"after@test.com" in profile.data
+        assert b"before@test.com" not in profile.data
+
+
+class TestPasswordUpdate:
+    """Tests for account password change flow via the full Flask stack."""
+
+    def test_update_password_flow(self, client, db_session):
+        auth = AccountModel(
+            account_username="pass_user",
+            account_email="pass@test.com",
+            account_password="old_pass",
+            account_role="user",
+        )
+        db_session.add(auth)
+        db_session.commit()
+
+        client.post("/login", data={"username": "pass_user", "password": "old_pass"}, follow_redirects=True)
+
+        response = client.post("/profile/password", data={"new_password": "new_pass"}, follow_redirects=True)
+        assert response.status_code == 200
+        assert b"Password updated." in response.data
+
+        client.post("/logout", follow_redirects=True)
+        login = client.post("/login", data={"username": "pass_user", "password": "new_pass"}, follow_redirects=True)
+        assert b"Profile" in login.data
+
+
 class TestConcurrency:
     """Grouped tests for high-concurrency race condition scenarios."""
 
diff --git a/tests/tests_integration/test_article_integration.py b/tests/tests_integration/test_article_integration.py
index fdca1053..af24c06c 100644
--- a/tests/tests_integration/test_article_integration.py
+++ b/tests/tests_integration/test_article_integration.py
@@ -93,7 +93,9 @@ class TestPersistence:
 
     def test_cascading_deletes_account_integ(self, client, db_session):
         """
-        Verifies that deleting an account removes all its articles and comments.
+        Verifies that deleting an account removes its comments but keeps
+        its articles (article_author_id becomes NULL, author shown as
+        "Anonymous").
         """
         auth = AccountModel(account_username="victim", account_email="v@t.com", account_password="p", account_role="author")
         db_session.add(auth)
@@ -101,19 +103,25 @@ def test_cascading_deletes_account_integ(self, client, db_session):
         art = ArticleModel(article_title="Ghost Article", article_content="...", article_author_id=auth.account_id)
         db_session.add(art)
         db_session.commit()
+
         cmt = CommentModel(
             comment_content="My last words",
             comment_article_id=art.article_id,
             comment_written_account_id=auth.account_id
         )
+
         db_session.add(cmt)
         db_session.commit()
         article_id = art.article_id
         comment_id = cmt.comment_id
         db_session.delete(auth)
         db_session.commit()
-        assert db_session.query(ArticleModel).filter_by(article_id=article_id).count() == 0
-        assert db_session.query(CommentModel).filter_by(comment_id=comment_id).count() == 0
+        assert db_session.query(ArticleModel).filter_by(article_id=article_id).count() == 1
+        orphan = db_session.query(ArticleModel).filter_by(article_id=article_id).first()
+        assert orphan.article_author_id is None
+        orphan_cmt = db_session.query(CommentModel).filter_by(comment_id=comment_id).first()
+        assert orphan_cmt is not None
+        assert orphan_cmt.comment_written_account_id is None
 
     def test_article_delete_end_to_end_integ(self, client, db_session):
         """
diff --git a/tests/tests_integration/test_security_integration.py b/tests/tests_integration/test_security_integration.py
index fba10d2c..48c616fc 100644
--- a/tests/tests_integration/test_security_integration.py
+++ b/tests/tests_integration/test_security_integration.py
@@ -1,3 +1,5 @@
+import json
+
 from src.infrastructure.output_adapters.sqlalchemy.models.sqlalchemy_account_model import AccountModel
 from src.infrastructure.output_adapters.sqlalchemy.models.sqlalchemy_article_model import ArticleModel
 
@@ -46,6 +48,41 @@ def test_article_detail_loads_content_via_api(self, client, db_session):
         assert b"xss" in response.data
         assert f'data-article-id="{article_id}"'.encode() in response.data
 
+    def test_blocknote_article_xss_sanitized(self, client, db_session):
+        auth = AccountModel(
+            account_username="xss_bn", account_email="xss_bn@t.com",
+            account_password="p", account_role="author"
+        )
+
+        db_session.add(auth)
+        db_session.commit()
+        client.post("/login", data={"username": "xss_bn", "password": "p"},
+                    follow_redirects=True)
+
+        xss_content = json.dumps({
+            "type": "doc",
+            "content": [{
+                "type": "paragraph",
+                "content": [{
+                    "type": "text",
+                    "text": "<script>alert('xss')</script>"
+                }]
+            }]
+        })
+
+        resp = client.post("/api/articles", json={
+            "title": "XSS BlockNote Test",
+            "content": xss_content
+        })
+
+        assert resp.status_code == 201
+        article_id = resp.get_json()["id"]
+        response = client.get(f"/articles/{article_id}")
+        assert response.status_code == 200
+        assert f'data-article-id="{article_id}"'.encode() in response.data
+        assert b"&lt;script&gt;alert" in response.data
+        assert b'<script id="article-data"' in response.data
+
     def test_comment_xss_with_newlines_escaped(self, client, db_session):
         """
         Verifies that a comment containing both XSS payload and newlines
diff --git a/tests/tests_integration/test_workflow_integration.py b/tests/tests_integration/test_workflow_integration.py
index 4e2a6c07..56360580 100644
--- a/tests/tests_integration/test_workflow_integration.py
+++ b/tests/tests_integration/test_workflow_integration.py
@@ -108,7 +108,7 @@ def test_two_click_delete_cascade(self, client, db_session):
         rid = root.comment_id
         client.post(f"/articles/{aid}/comments/{rid}/reply", data={"content": "Child"})
 
-        first_click = client.post(f"/articles/{aid}/comments/{rid}/delete", data={"cascade": "true"}, follow_redirects=False)
+        first_click = client.post(f"/articles/{aid}/comments/{rid}/delete", follow_redirects=False)
         assert first_click.status_code == 302
         db_session.expire_all()
         soft = db_session.get(CommentModel, rid)
@@ -120,7 +120,7 @@ def test_two_click_delete_cascade(self, client, db_session):
         assert b">?<" in detail.data
         assert b"comment-deleted" in detail.data
 
-        second_click = client.post(f"/articles/{aid}/comments/{rid}/delete", data={"cascade": "true"}, follow_redirects=False)
+        second_click = client.post(f"/articles/{aid}/comments/{rid}/delete", follow_redirects=False)
         assert second_click.status_code == 302
         db_session.expire_all()
         assert db_session.get(CommentModel, rid) is None
@@ -167,11 +167,41 @@ def test_deep_comment_threading_integ(self, client, db_session):
         db_session.add(comment_3)
         db_session.commit()
 
+        comment_4 = CommentModel(
+            comment_content="Level 4",
+            comment_article_id=article.article_id,
+            comment_written_account_id=author.account_id,
+            comment_reply_to=comment_3.comment_id
+        )
+        db_session.add(comment_4)
+        db_session.commit()
+
+        comment_5 = CommentModel(
+            comment_content="Level 5",
+            comment_article_id=article.article_id,
+            comment_written_account_id=author.account_id,
+            comment_reply_to=comment_4.comment_id
+        )
+        db_session.add(comment_5)
+        db_session.commit()
+
+        comment_6 = CommentModel(
+            comment_content="Level 6",
+            comment_article_id=article.article_id,
+            comment_written_account_id=author.account_id,
+            comment_reply_to=comment_5.comment_id
+        )
+        db_session.add(comment_6)
+        db_session.commit()
+
         response = client.get(f"/articles/{article.article_id}")
         assert response.status_code == 200
         assert b"Level 1" in response.data
         assert b"Level 2" in response.data
         assert b"Level 3" in response.data
+        assert b"Level 4" in response.data
+        assert b"Level 5" not in response.data
+        assert b"Level 6" not in response.data
 
     def test_registration_login_profile_flow_integ(self, client, db_session):
         client.post("/register", data={
@@ -440,3 +470,71 @@ def test_article_list_author_link_points_to_profile(self, client, db_session):
         response = client.get("/")
         assert response.status_code == 200
         assert b'href="/users/link_test_author"' in response.data
+
+
+class TestAdminChangeRole:
+    """
+    Integration tests for admin promoting/demoting user roles.
+    """
+
+    def test_admin_promote_user_to_author_integ(self, client, db_session):
+        """
+        Verifies admin can change a user's role via POST /admin/users/<id>/role.
+        Role persists in DB after the change.
+        """
+        admin = AccountModel(
+            account_username="role_admin", account_email="role@t.com",
+            account_password="p", account_role="admin",
+        )
+        db_session.add(admin)
+        db_session.commit()
+
+        target = AccountModel(
+            account_username="target_user", account_email="target@t.com",
+            account_password="p", account_role="user",
+        )
+        db_session.add(target)
+        db_session.commit()
+
+        client.post("/login", data={"username": "role_admin", "password": "p"}, follow_redirects=True)
+
+        response = client.post(
+            f"/admin/users/{target.account_id}/role",
+            data={"role": "author"},
+            follow_redirects=True,
+        )
+
+        assert response.status_code == 200
+        assert b"Role updated." in response.data
+
+        db_session.expire_all()
+        updated = db_session.get(AccountModel, target.account_id)
+        assert updated.account_role == "author"
+
+    def test_non_admin_change_role_returns_error_integ(self, client, db_session):
+        """
+        Verifies non-admin user cannot change another user's role.
+        """
+        user = AccountModel(
+            account_username="plain_user", account_email="plain@t.com",
+            account_password="p", account_role="user",
+        )
+        db_session.add(user)
+        db_session.commit()
+
+        target = AccountModel(
+            account_username="victim", account_email="victim@t.com",
+            account_password="p", account_role="user",
+        )
+        db_session.add(target)
+        db_session.commit()
+
+        client.post("/login", data={"username": "plain_user", "password": "p"}, follow_redirects=True)
+
+        response = client.post(
+            f"/admin/users/{target.account_id}/role",
+            data={"role": "author"},
+            follow_redirects=True,
+        )
+
+        assert response.status_code == 403
diff --git a/tests/tests_services/test_article_service.py b/tests/tests_services/test_article_service.py
index 835b35ca..cf885f95 100644
--- a/tests/tests_services/test_article_service.py
+++ b/tests/tests_services/test_article_service.py
@@ -215,7 +215,7 @@ def test_update_article_success(self):
     def test_update_article_unauthorized(self):
         fake_article = create_test_article(article_author_id=1)
         self.mock_article_repo.get_by_id.return_value = fake_article
-        fake_account = create_test_account(account_id=99, account_role=AccountRole.ADMIN)
+        fake_account = create_test_account(account_id=99, account_role=AccountRole.AUTHOR)
         self.mock_account_repo.get_by_id.return_value = fake_account
 
         result = self.service.update_article(
diff --git a/tests/tests_services/test_comment_service.py b/tests/tests_services/test_comment_service.py
index ccfedcb3..8e494649 100644
--- a/tests/tests_services/test_comment_service.py
+++ b/tests/tests_services/test_comment_service.py
@@ -113,7 +113,7 @@ def test_create_reply_success_root_comment(self):
             comment_content="Root comment",
         )
 
-        self.mock_comment_repo.get_by_id.return_value = parent_comment
+        self.mock_comment_repo.get_by_id.side_effect = lambda cid: parent_comment if cid == 10 else None
 
         result = self.service.create_reply(
             parent_comment_id=parent_comment.comment_id,
@@ -121,7 +121,7 @@ def test_create_reply_success_root_comment(self):
         )
 
         self.mock_account_repo.get_by_id.assert_called_once_with(fake_account.account_id)
-        self.mock_comment_repo.get_by_id.assert_called_once_with(parent_comment.comment_id)
+        self.mock_comment_repo.get_by_id.assert_any_call(parent_comment.comment_id)
         self.mock_comment_repo.save.assert_called_once()
         index_first_arg = 0
         saved_reply = self.mock_comment_repo.save.call_args.args[index_first_arg]
@@ -135,6 +135,10 @@ def test_create_reply_success_nested_comment(self):
         fake_account = create_test_account(account_id=1, account_role=AccountRole.USER)
         self.mock_account_repo.get_by_id.return_value = fake_account
 
+        root_comment = create_test_comment(
+            comment_id=10,
+            comment_reply_to=None,
+        )
         parent_comment = create_test_comment(
             comment_id=15,
             comment_article_id=5,
@@ -142,7 +146,12 @@ def test_create_reply_success_nested_comment(self):
             comment_reply_to=10,
             comment_content="I am a reply",
         )
-        self.mock_comment_repo.get_by_id.return_value = parent_comment
+
+        def mock_get_by_id(cid):
+            mapping = {10: root_comment, 15: parent_comment}
+            return mapping.get(cid)
+
+        self.mock_comment_repo.get_by_id.side_effect = mock_get_by_id
 
         result = self.service.create_reply(
             parent_comment_id=parent_comment.comment_id,
@@ -170,6 +179,42 @@ def test_create_reply_parent_not_found(self):
         self.mock_comment_repo.save.assert_not_called()
         assert result == "Parent comment not found."
 
+    def test_create_reply_to_removed_comment_returns_error(self):
+        self.mock_account_repo.get_by_id.return_value = create_test_account(
+            account_id=99, account_role=AccountRole.ADMIN
+        )
+
+        removed = create_test_comment(
+            comment_id=5,
+            comment_content="<!--cmt-removed--><em>Comment removed</em>"
+        )
+
+        self.mock_comment_repo.get_by_id.return_value = removed
+        result = self.service.create_reply(5, 99, "Reply to removed")
+        self.mock_comment_repo.save.assert_not_called()
+        assert isinstance(result, str)
+        assert "removed" in result.lower()
+
+    def test_create_reply_too_deep_returns_error(self):
+        self.mock_account_repo.get_by_id.return_value = create_test_account(
+            account_id=1, account_role=AccountRole.USER
+        )
+        deep_comment_1 = create_test_comment(comment_id=1, comment_reply_to=None)
+        deep_comment_2 = create_test_comment(comment_id=2, comment_reply_to=1)
+        deep_comment_3 = create_test_comment(comment_id=3, comment_reply_to=2)
+        deep_parent = create_test_comment(comment_id=4, comment_reply_to=3)
+
+        def mock_get_by_id(cid):
+            mapping = {1: deep_comment_1, 2: deep_comment_2, 3: deep_comment_3, 4: deep_parent}
+            return mapping.get(cid)
+
+        self.mock_comment_repo.get_by_id.side_effect = mock_get_by_id
+
+        result = self.service.create_reply(4, 1, "Too deep reply")
+        self.mock_comment_repo.save.assert_not_called()
+        assert isinstance(result, str)
+        assert "maximum nesting depth" in result.lower()
+
 
 class TestGetComments(CommentServiceTestBase):
     def test_get_comments_for_article_not_found(self):
@@ -244,8 +289,8 @@ def test_get_comments_for_article_ordering(self):
         latest_reply, oldest_reply = result[0].replies
         assert latest_root.comment.comment.comment_id == comment_2.comment_id
         assert oldest_root.comment.comment.comment_id == comment_1.comment_id
-        assert latest_reply.comment.comment.comment_id == reply_2.comment_id
-        assert oldest_reply.comment.comment.comment_id == reply_1.comment_id
+        assert latest_reply.comment.comment.comment_id == reply_1.comment_id
+        assert oldest_reply.comment.comment.comment_id == reply_2.comment_id
 
     def test_get_comments_for_article_unknown_author(self):
         fake_article = create_test_article(article_id=1, article_author_id=2)
@@ -256,7 +301,7 @@ def test_get_comments_for_article_unknown_author(self):
         result = self.service.get_comments_for_article(article_id=1)
         assert not isinstance(result, str)
         comment_node, = result
-        assert comment_node.comment.author_name == "Unknown"
+        assert comment_node.comment.author_name == "Anonymous"
 
 
 class TestDeleteComment(CommentServiceTestBase):
@@ -297,7 +342,6 @@ def test_delete_comment_second_click_cascade(self):
         result = self.service.delete_comment(
             comment_id=comment_to_delete.comment_id,
             user_id=admin_account.account_id,
-            cascade=True
         )
 
         assert result is True
@@ -305,25 +349,6 @@ def test_delete_comment_second_click_cascade(self):
         assert self.mock_comment_repo.delete.call_args_list[1].args[0] == 11
         assert self.mock_comment_repo.delete.call_args_list[2].args[0] == 10
 
-    def test_delete_comment_second_click_no_cascade(self):
-        admin_account = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
-        self.mock_account_repo.get_by_id.return_value = admin_account
-        comment_to_delete = create_test_comment(
-            comment_id=10,
-            comment_content="<!--cmt-removed--><em>Comment removed</em>"
-        )
-        self.mock_comment_repo.get_by_id.return_value = comment_to_delete
-
-        result = self.service.delete_comment(
-            comment_id=comment_to_delete.comment_id,
-            user_id=admin_account.account_id,
-            cascade=False
-        )
-
-        assert result is True
-        self.mock_comment_repo.orphan_children.assert_called_once_with(10)
-        self.mock_comment_repo.delete.assert_called_once_with(10)
-
     def test_delete_comment_unauthorized_not_admin(self):
         fake_account = create_test_account(account_id=2, account_role=AccountRole.USER)
         self.mock_account_repo.get_by_id.return_value = fake_account
diff --git a/tests/tests_services/test_login_service.py b/tests/tests_services/test_login_service.py
index 1a881e05..bb4ae8cf 100644
--- a/tests/tests_services/test_login_service.py
+++ b/tests/tests_services/test_login_service.py
@@ -1,6 +1,6 @@
 from unittest.mock import MagicMock
 
-from src.application.domain.account import Account
+from src.application.domain.account import Account, AccountRole
 from src.application.output_ports.account_repository import AccountRepository
 from src.application.output_ports.account_session_repository import AccountSessionRepository
 from src.application.output_ports.password_hasher_repository import PasswordHasherRepository
@@ -95,3 +95,121 @@ def test_authenticate_user_session_repo_failure(self):
         self.mock_session_repo.save_account.side_effect = ExceptionTest("Storage failure")
         with pytest.raises(ExceptionTest, match="Storage failure"):
             self.service.authenticate_user("leia", "password123")
+
+    def test_update_email_success(self):
+        fake_account = create_test_account(account_id=1, account_email="old@test.com")
+        self.mock_session_repo.get_account.return_value = fake_account
+        self.mock_repo.find_by_email.return_value = None
+        result = self.service.update_email("new@test.com")
+        assert result is None
+        self.mock_repo.update_email.assert_called_once_with(1, "new@test.com")
+
+    def test_update_email_taken_returns_error(self):
+        fake_account = create_test_account(account_id=1, account_email="old@test.com")
+        other = create_test_account(account_id=2, account_email="taken@test.com")
+        self.mock_session_repo.get_account.return_value = fake_account
+        self.mock_repo.find_by_email.return_value = other
+        result = self.service.update_email("taken@test.com")
+        assert result == "This email is already taken."
+        self.mock_repo.update_email.assert_not_called()
+
+    def test_update_email_unauthenticated_returns_error(self):
+        self.mock_session_repo.get_account.return_value = None
+        result = self.service.update_email("new@test.com")
+        assert result == "You must be signed in to update your email."
+        self.mock_repo.update_email.assert_not_called()
+
+    def test_update_password_success(self):
+        fake_account = create_test_account(account_id=1)
+        self.mock_session_repo.get_account.return_value = fake_account
+        self.mock_hasher.hash.return_value = "$argon2id$new_hash"
+        result = self.service.update_password("new_secret")
+        assert result is None
+        self.mock_hasher.hash.assert_called_once_with("new_secret")
+        self.mock_repo.update_password.assert_called_once_with(1, "$argon2id$new_hash")
+
+    def test_update_password_unauthenticated_returns_error(self):
+        self.mock_session_repo.get_account.return_value = None
+        result = self.service.update_password("new_secret")
+        assert result == "You must be signed in to update your password."
+        self.mock_hasher.hash.assert_not_called()
+        self.mock_repo.update_password.assert_not_called()
+
+    def test_update_password_empty_returns_error(self):
+        fake_account = create_test_account(account_id=1)
+        self.mock_session_repo.get_account.return_value = fake_account
+        result = self.service.update_password("")
+        assert result == "Password is required."
+        self.mock_hasher.hash.assert_not_called()
+        self.mock_repo.update_password.assert_not_called()
+
+    def test_delete_account_success(self):
+        fake_account = create_test_account(account_id=1)
+        self.mock_repo.get_by_id.return_value = fake_account
+        self.service.delete_account(fake_account.account_id)
+        self.mock_repo.delete.assert_called_once_with(fake_account.account_id)
+
+    def test_delete_account_not_found_raises_value_error(self):
+        self.mock_repo.get_by_id.return_value = None
+        import pytest
+        with pytest.raises(ValueError, match="not found"):
+            self.service.delete_account(999)
+        self.mock_repo.delete.assert_not_called()
+
+    def test_update_role_success(self):
+        admin = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
+        target = create_test_account(account_id=2, account_role=AccountRole.USER)
+        self.mock_repo.get_by_id.side_effect = lambda cid: {1: admin, 2: target}.get(cid)
+
+        result = self.service.update_account_role(
+            admin_id=1, target_id=2, new_role="author"
+        )
+
+        assert result is None
+        self.mock_repo.update_role.assert_called_once_with(2, "author")
+
+    def test_update_role_account_not_found(self):
+        admin = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
+        self.mock_repo.get_by_id.side_effect = lambda cid: {1: admin}.get(cid)
+
+        result = self.service.update_account_role(
+            admin_id=1, target_id=999, new_role="author"
+        )
+
+        assert result == "Account not found."
+        self.mock_repo.update_role.assert_not_called()
+
+    def test_update_role_not_admin(self):
+        user = create_test_account(account_id=1, account_role=AccountRole.USER)
+        self.mock_repo.get_by_id.return_value = user
+
+        result = self.service.update_account_role(
+            admin_id=1, target_id=2, new_role="author"
+        )
+
+        assert result == "Unauthorized."
+        self.mock_repo.update_role.assert_not_called()
+
+    def test_update_role_target_is_admin(self):
+        admin = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
+        target_admin = create_test_account(account_id=2, account_role=AccountRole.ADMIN)
+        self.mock_repo.get_by_id.side_effect = lambda cid: {1: admin, 2: target_admin}.get(cid)
+
+        result = self.service.update_account_role(
+            admin_id=1, target_id=2, new_role="user"
+        )
+
+        assert result == "Cannot change role of another admin."
+        self.mock_repo.update_role.assert_not_called()
+
+    def test_update_role_invalid_role(self):
+        admin = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
+        target = create_test_account(account_id=2, account_role=AccountRole.USER)
+        self.mock_repo.get_by_id.side_effect = lambda cid: {1: admin, 2: target}.get(cid)
+
+        result = self.service.update_account_role(
+            admin_id=1, target_id=2, new_role="superadmin"
+        )
+
+        assert result == "Invalid role."
+        self.mock_repo.update_role.assert_not_called()