diff --git a/AGENTS.md b/AGENTS.md
index 139ed808b..3c9860be1 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2793,7 +2793,7 @@ contacting every contributor individually.
 | Add or edit a palette "Navigate" entry (the icon-label-href rows the palette renders alongside player results) | `web/includes/View/PaletteActions.php` (`Sbpp\View\PaletteActions::for($userbank)` — catalog + filter). The catalog's `entries()` method declares each entry as `{icon, label, href, permission, config?}`; `for()` drops entries the user can't reach (admin entries gated via `HasAccess` with `ADMIN_OWNER` OR'd in; public entries optionally gated on a `config.enable*` toggle) and emits the public `{icon, label, href}` triple. The filtered list is JSON-encoded by `web/pages/core/footer.php` (with `JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT` so the content can never escape its `<script>` wrapper) and emitted by `core/footer.tpl` inside `<script type="application/json" id="palette-actions" data-testid="palette-actions">`. `theme.js`'s `loadNavItems()` reads + `JSON.parse`s the blob at boot. Pre-#1304 the entry list was a hardcoded `NAV_ITEMS` array in `theme.js` with no permission check, leaking admin entries to logged-out + partial-permission users; the regression guard is `web/tests/integration/PaletteActionsTest.php` (server-side filter) plus `web/tests/e2e/specs/flows/ui/command-palette-permissions.spec.ts` (end-to-end blob → DOM contract). |
 | Add a "copy this value" affordance to a panel surface (single-source clipboard wiring) | Mark the trigger with `data-copy="<value>"` (`<button type="button">` is the canonical shape; the drawer uses `<button>` inside a `<dd>`, the banlist row uses `<button>` inside `.row-actions`). The document-level COPY BUTTONS delegate in `web/themes/default/js/theme.js` handles every `[data-copy]` site: secure-context callers go through `navigator.clipboard.writeText` with a `.then(success, fallback)` chain, non-secure callers (plain HTTP behind a TLS-terminating proxy) drop to `copyFallback()` — a hidden-textarea + `document.execCommand('copy')` that's the only portable option outside HTTPS (#1308). NEVER add an inline `onclick="event.stopPropagation()"` to a `[data-copy]` button — the bubble-phase stop kills the document delegate (Defect A, #1308). NEVER assume `navigator.clipboard` exists or that `writeText()` resolves — both fall through to the same execCommand fallback (Defect B, #1308). |
 | Add admin-only per-player notes | `web/api/handlers/notes.php` (CRUD) — Notes tab is gated by `bans.detail`'s `notes_visible` flag |
-| Add or extend the server-player right-click context menu on `?p=servers` (View Profile / Copy SteamID / Kick / Ban / Block Comms) | `web/scripts/server-context-menu.js` (event-delegate menu, single `document.addEventListener('contextmenu')` filtered by `closest('[data-context-menu="server-player"]')`) + `web/scripts/server-tile-hydrate.js` (`renderPlayers()` emits the `data-context-menu` / `data-steamid` / `data-name` / `data-server-sid` / `data-can-ban-player` hooks on each `<li>`) + `web/api/handlers/servers.php` (`api_servers_host_players` attaches SteamIDs via `RconStatusCache::fetch($sid)` only when the caller has `WebPermission::Owner \| WebPermission::AddBan` AND per-server RCON access; `can_ban_player` boolean signals whether to render the kick/ban/block items) + `web/includes/Servers/RconStatusCache.php` (`Sbpp\Servers\RconStatusCache::fetch($sid, $ttl=30)` — per-sid on-disk cache under `SB_CACHE/srvstatus/`, mirrors `SourceQueryCache` shape; calls `rcon('status', $sid, true)` with the silent flag so passive probes don't spam the audit log). The admin hint copy in `page_servers.tpl` + the `<script src="./scripts/server-context-menu.js">` include are both gated on `$can_use_context_menu` (= `Perms::for($userbank)['can_add_ban']`) so anonymous viewers don't pay for either. SteamID3 / SteamID2 → SteamID64 conversion happens client-side (`STEAM_X:Y:Z` → `76561197960265728 + Z*2 + Y`; `[U:1:N]` → `76561197960265728 + N`). Ban / Block both route through panel-chromed smart-default URLs (`?p=admin&c=bans&section=add-ban&steam=…&type=0` consumed by `Sbpp\View\AdminBansAddView::prefill_steam` / `?p=admin&c=comms&steam=…&type=0` consumed by `Sbpp\View\AdminCommsAddView::prefill_steam` — #1395 brought Block onto the panel route; pre-fix it pointed at `pages/admin.blockit.php` which is the post-`Actions.CommsAdd` rcon-fan-out iframe target, NOT a stand-alone operator page); Kick stays on the iframe path (`pages/admin.kickit.php`) because it's a one-shot RCON command with no persistent panel surface to anchor on after firing. Both `admin.bans.php` and `admin.comms.php` allowlist the inbound shape via the same regex (`STEAM_X:Y:Z` / `[U:1:N]` / 17-digit SteamID64 / dotted IPv4) so a hostile/malformed referrer can't smuggle arbitrary text into the form's `<input value="…">`; the comms `?type=…` allowlist is `{1,2,3}` (Mute/Gag/Silence) with anything else (including the menu's `?type=0` bridging value, sourced from the bans-menu URL shape where 0=Steam ID) treated as "no pre-selection". The integration test (`web/tests/integration/ServerListHintRegressionTest.php`) is the post-restoration contract — it asserts the hint and the JS include both ship for admins and both stay absent for anonymous viewers (the pre-#1306 contract is superseded). Regression guards: `web/tests/api/ServersTest.php` (handler-shape coverage for the SteamID side-channel + the `can_ban_player` flag), `web/tests/integration/RconStatusCacheTest.php` (cache shape + silent-flag contract), `web/tests/integration/AdminBansAddSmartDefaultTest.php` + `web/tests/integration/AdminCommsAddSmartDefaultTest.php` (server-side prefill allowlist, valid / hostile / bare-section round-trips, type-coercion), `web/tests/e2e/specs/flows/server-player-context-menu.spec.ts` (end-to-end menu open / Ban + Block hrefs both ride the panel route / Kick stays on the iframe route / Escape close / no-steamid no-menu). |
+| Add or extend the server-player right-click context menu on `?p=servers` (View Profile / Copy SteamID / Kick / Ban / Block Comms) | `web/scripts/server-context-menu.js` (event-delegate menu, single `document.addEventListener('contextmenu')` filtered by `closest('[data-context-menu="server-player"]')`) + `web/scripts/server-tile-hydrate.js` (`renderPlayers()` emits the `data-context-menu` / `data-steamid` / `data-name` / `data-server-sid` / `data-can-ban-player` hooks on each `<li>`) + `web/api/handlers/servers.php` (`api_servers_host_players` attaches SteamIDs via `RconStatusCache::fetch($sid)` only when the caller has `WebPermission::Owner \| WebPermission::AddBan` AND per-server RCON access; `can_ban_player` boolean signals whether to render the kick/ban/block items) + `web/includes/Servers/RconStatusCache.php` (`Sbpp\Servers\RconStatusCache::fetch($sid, $ttl=30)` — per-sid on-disk cache under `SB_CACHE/srvstatus/`, mirrors `SourceQueryCache` shape; calls `rcon('status', $sid, true)` with the silent flag so passive probes don't spam the audit log). The admin hint copy in `page_servers.tpl` + the `<script src="./scripts/server-context-menu.js">` include are both gated on `$can_use_context_menu` (= `Perms::for($userbank)['can_add_ban']`) so anonymous viewers don't pay for either. SteamID3 / SteamID2 → SteamID64 conversion happens client-side (`STEAM_X:Y:Z` → `76561197960265728 + Z*2 + Y`; `[U:1:N]` → `76561197960265728 + N`). **The `player_list` field excludes A2S entries with an empty `Name` (#1396)** — some Source-engine variants and SourceMod plugins emit a "host slot" / "console" stub at the start of `GetPlayers` (`Name = ''`, `Frags = 0`, `Time = 0`) that pre-fix rendered as a phantom `<li data-testid="server-player">` above the first visible player with no `data-context-menu` hooks (the empty name fails the SteamID match gate above). The phantom row was a thin border-bottom strip with a misleading "0 · " meta on the right; users perceived the next real player as "the first player of the list" and right-clicks landing in the phantom row's area silently no-op'd. The filter lives at the same `$name === ''` skip the SteamID-by-name lookup uses, so the JS contract stays simple: every row in `player_list` has a displayable name. Bots, real players whose A2S name didn't match the RCON status output, and anonymous callers still render — the filter is strictly "name is empty string". Ban / Block both route through panel-chromed smart-default URLs (`?p=admin&c=bans&section=add-ban&steam=…&type=0` consumed by `Sbpp\View\AdminBansAddView::prefill_steam` / `?p=admin&c=comms&steam=…&type=0` consumed by `Sbpp\View\AdminCommsAddView::prefill_steam` — #1395 brought Block onto the panel route; pre-fix it pointed at `pages/admin.blockit.php` which is the post-`Actions.CommsAdd` rcon-fan-out iframe target, NOT a stand-alone operator page); Kick stays on the iframe path (`pages/admin.kickit.php`) because it's a one-shot RCON command with no persistent panel surface to anchor on after firing. Both `admin.bans.php` and `admin.comms.php` allowlist the inbound shape via the same regex (`STEAM_X:Y:Z` / `[U:1:N]` / 17-digit SteamID64 / dotted IPv4) so a hostile/malformed referrer can't smuggle arbitrary text into the form's `<input value="…">`; the comms `?type=…` allowlist is `{1,2,3}` (Mute/Gag/Silence) with anything else (including the menu's `?type=0` bridging value, sourced from the bans-menu URL shape where 0=Steam ID) treated as "no pre-selection". The integration test (`web/tests/integration/ServerListHintRegressionTest.php`) is the post-restoration contract — it asserts the hint and the JS include both ship for admins and both stay absent for anonymous viewers (the pre-#1306 contract is superseded). Regression guards: `web/tests/api/ServersTest.php` (handler-shape coverage for the SteamID side-channel + the `can_ban_player` flag + the #1396 empty-name filter via `testHostPlayersFiltersEmptyNameEntries` / `testHostPlayersFiltersAllEmptyNameEntries`), `web/tests/integration/RconStatusCacheTest.php` (cache shape + silent-flag contract), `web/tests/integration/AdminBansAddSmartDefaultTest.php` + `web/tests/integration/AdminCommsAddSmartDefaultTest.php` (server-side prefill allowlist, valid / hostile / bare-section round-trips, type-coercion), `web/tests/e2e/specs/flows/server-player-context-menu.spec.ts` (end-to-end menu open / Ban + Block hrefs both ride the panel route / Kick stays on the iframe route / Escape close / no-steamid no-menu / #1396 first-named-player accepts real `mouse.click({button:'right'})`). |
 | Cache an A2S `GetInfo + GetPlayers` round-trip / add another public server-query handler | `web/includes/Servers/SourceQueryCache.php` (`Sbpp\Servers\SourceQueryCache::fetch($ip, $port, $ttl=30)` — per-`(ip, port)` on-disk cache under `SB_CACHE/srvquery/`, atomic tempfile + `rename()` writes mirroring `system.check_version`'s release cache; both success and failure cache so an unreachable server costs ONE A2S probe per ~30s window). The sibling `Sbpp\Servers\RconStatusCache` (`SB_CACHE/srvstatus/`) follows the same shape for RCON `status` round-trips — used by `api_servers_host_players` to surface per-player SteamIDs to admins (see the context-menu row above). Every public handler under `web/api/handlers/servers.php` (`api_servers_host_players` / `host_property` / `host_players_list` / `players`) goes through this — never call `new SourceQuery()` directly from a handler. The cache stamps user-agnostic data only; the handler stamps per-caller fields (`is_owner`, `can_ban`, the per-call `trunchostname`) on top. Per-tile JS debounce on the public servers page lives in `web/themes/default/page_servers.tpl` (`loadTile()` flips `tile.__sbppLoading` + the Re-query button's `disabled` attr while a probe is in flight, releases both in the success / error tails). The matching JS gate on the toggle button has been the precedent since v2.0.0; #1311 brought the refresh button onto the same shape. Tests: `web/tests/integration/SourceQueryCacheTest.php` (cache shape + coalescing + TTL + invalidation, drives `setProbeOverrideForTesting()` so the assertion is deterministic without UDP) + `testHostPlayersCoalescesRapidRepeatCallsViaCache` / `testHostPlayersNegativeCachesUnreachableServers` in `web/tests/api/ServersTest.php` (handler-shape coverage). E2E: `web/tests/e2e/specs/flows/server-refresh-debounce.spec.ts`. |
 | Render admin-authored Markdown to safe HTML | `web/includes/Markup/IntroRenderer.php` (`Sbpp\Markup`) |
 | Build / extend the anonymous opt-out daily telemetry payload (#1126) | `web/includes/Telemetry/Telemetry.php` (`Sbpp\Telemetry\Telemetry` — `tickIfDue`, `collect`, `send`) + `web/includes/Telemetry/Schema1.php` (`Sbpp\Telemetry\Schema1::payloadFieldNames()`, drives the extractor parity test) + `web/includes/Telemetry/schema-1.lock.json` (vendored from [sbpp/cf-analytics](https://github.com/sbpp/cf-analytics) — manual sync via `make sync-telemetry-schema`). Tick is registered at the tail of `init.php` via `register_shutdown_function`; on FPM, `fastcgi_finish_request()` flushes the response BEFORE the cURL POST so telemetry never delays a panel page. Slot reservation is atomic (`UPDATE :prefix_settings WHERE CAST(value AS UNSIGNED) <= :threshold`) at the START of the attempt, so a flapping endpoint costs one ping/day, not one ping/request. Audit-log only enable/disable transitions, never individual pings. The in-panel disclosure surface is the help-icon copy in `page_admin_settings_features.tpl`; the upgrade-time disclosure lives in `docs/src/content/docs/updating/1.8-to-2.0.mdx` (no first-login modal). |
diff --git a/web/api/handlers/servers.php b/web/api/handlers/servers.php
index 257f13ce0..95a2d4eba 100644
--- a/web/api/handlers/servers.php
+++ b/web/api/handlers/servers.php
@@ -298,9 +298,28 @@ function api_servers_host_players(array $params): array
         }
     }
 
+    // Build the public player list. Empty-name A2S entries are
+    // filtered out (#1396): some Source-engine variants and
+    // SourceMod plugins emit a "host slot" / "console" entry at
+    // the start of `GetPlayers` with an empty Name, zero Frags,
+    // and zero Time. Pre-fix the entry flowed through verbatim
+    // and the JS rendered it as a phantom `<li>` (an invisible
+    // thin row with a misleading "0 · " meta on the right and no
+    // `data-context-menu` hooks, because the empty name fails
+    // the SteamID match gate above). Users perceiving the next
+    // real player as "the first player of the list" and
+    // right-clicking near the top would land on the phantom
+    // row instead and the menu silently no-op'd. Filtering the
+    // entry out here matches the same `name === ''` skip the
+    // SteamID-by-name lookup above already applies, so the JS
+    // contract stays simple: every row in `player_list` has a
+    // displayable name.
     $playerList = [];
     foreach ($players as $p) {
         $name = (string) ($p['Name'] ?? '');
+        if ($name === '') {
+            continue;
+        }
         $row  = [
             'id'     => $p['Id']    ?? null,
             'name'   => $name,
@@ -310,7 +329,6 @@ function api_servers_host_players(array $params): array
         ];
         if (
             $canBanPlayer
-            && $name !== ''
             && isset($steamidByName[$name])
             && ($rconNameCount[$name] ?? 0) === 1
             && ($sqNameCount[$name] ?? 0) === 1
diff --git a/web/tests/api/ServersTest.php b/web/tests/api/ServersTest.php
index f9c0c1fb4..23641e12e 100644
--- a/web/tests/api/ServersTest.php
+++ b/web/tests/api/ServersTest.php
@@ -738,4 +738,133 @@ public function testHostPlayersPreservesMaliciousPlayerNameVerbatim(): void
             'sanity check: the hostile name is in the response body',
         );
     }
+
+    /**
+     * #1396 — Some Source-engine variants and SourceMod plugins return
+     * an A2S `GetPlayers` entry with an empty `Name` field (the
+     * "host slot" / "console" stub). Pre-fix the handler passed
+     * these through verbatim to `player_list`, so the client
+     * rendered a phantom `<li data-testid="server-player">` with
+     * an empty name span + a meta span like "0 · ". Two failure
+     * modes:
+     *
+     *   1. The phantom row has no `steamid` (the matcher gate
+     *      filters empty names out of `$steamidByName` and
+     *      `$rconNameCount`), so `web/scripts/server-tile-hydrate.js`
+     *      renderPlayers() also skips the `data-context-menu`
+     *      hooks on it. Right-clicking the row does nothing.
+     *   2. Visually the empty row is a thin border-bottom strip
+     *      directly above the first named player; users perceive
+     *      the next real player ("Fletcher" in the user's report)
+     *      as "the first player of the list" — and when their
+     *      right-click lands on the phantom row above instead of
+     *      the named row, the menu silently fails to open.
+     *
+     * The fix: empty-name A2S entries are filtered out of
+     * `$playerList` at the same gate that already skips them from
+     * the steamid-by-name lookup (web/api/handlers/servers.php).
+     * The contract: `player_list` only contains rows with a
+     * non-empty `name`. Bots, real players whose A2S name didn't
+     * match the RCON status output, and admin-without-rcon callers
+     * all still render — the gate is strictly "name === ''".
+     */
+    public function testHostPlayersFiltersEmptyNameEntries(): void
+    {
+        Fixture::rawPdo()->prepare(sprintf(
+            "UPDATE `%s_admins` SET srv_flags = 'mz' WHERE aid = ?",
+            DB_PREFIX
+        ))->execute([Fixture::adminAid()]);
+        $sid = $this->seedServer(220, 'r1');
+        Fixture::rawPdo()->prepare(sprintf(
+            'INSERT INTO `%s_admins_servers_groups` (admin_id, group_id, srv_group_id, server_id)
+             VALUES (?, 0, -1, ?)',
+            DB_PREFIX
+        ))->execute([Fixture::adminAid(), $sid]);
+
+        $this->loginAsAdmin();
+
+        // A2S response with an empty-name entry first (the "host
+        // slot" quirk) — index 1 onwards are real players the
+        // user perceives as "the first / second / third player".
+        SourceQueryCache::setProbeOverrideForTesting(static fn(): array => [
+            'info'    => [
+                'HostName'   => 'Phantom-Row Server',
+                'Players'    => 3,
+                'MaxPlayers' => 24,
+                'Map'        => 'cp_dustbowl',
+                'Os'         => 'l',
+                'Secure'     => true,
+            ],
+            'players' => [
+                ['Id' => 0, 'Name' => '',         'Frags' => 0,  'Time' => 0,    'TimeF' => '00:00'],
+                ['Id' => 1, 'Name' => 'Fletcher', 'Frags' => 12, 'Time' => 1200, 'TimeF' => '20:00'],
+                ['Id' => 2, 'Name' => 'kovka',    'Frags' => 7,  'Time' => 400,  'TimeF' => '06:40'],
+            ],
+        ]);
+        RconStatusCache::setProbeOverrideForTesting(static fn(): array => [
+            ['id' => 1, 'name' => 'Fletcher', 'steamid' => 'STEAM_0:0:1234', 'ip' => '203.0.113.10'],
+            ['id' => 2, 'name' => 'kovka',    'steamid' => 'STEAM_0:0:5678', 'ip' => '203.0.113.11'],
+        ]);
+
+        $env = $this->api('servers.host_players', ['sid' => $sid]);
+        $this->assertTrue($env['ok'], json_encode($env));
+        $list = $env['data']['player_list'];
+
+        // The empty-name entry must NOT be in the response. The
+        // pre-#1396 shape would carry 3 rows; the fix drops it to 2.
+        $this->assertCount(2, $list,
+            'empty-name A2S entries must be filtered out of player_list (#1396)',
+        );
+        // The visually-first player (Fletcher) is now at index 0
+        // with the steamid the menu needs.
+        $this->assertSame('Fletcher', $list[0]['name']);
+        $this->assertSame('STEAM_0:0:1234', $list[0]['steamid']);
+        $this->assertSame('kovka', $list[1]['name']);
+        $this->assertSame('STEAM_0:0:5678', $list[1]['steamid']);
+        // Defensive: no entry should have an empty name.
+        foreach ($list as $row) {
+            $this->assertNotSame('', $row['name'],
+                'no player_list row should have an empty name post-#1396',
+            );
+        }
+    }
+
+    /**
+     * #1396 — Defensive sibling of the test above. If the entire
+     * A2S response is empty-name garbage, `player_list` should be
+     * empty (the JS then renders its `[data-empty-message]`
+     * placeholder instead of a wall of phantom rows). The
+     * `players` count from the A2S info block stays as-is — that
+     * field is the server-reported player count, not the rendered
+     * list length, and the two can legitimately diverge (e.g. a
+     * SourceMod plugin inflating the public count).
+     */
+    public function testHostPlayersFiltersAllEmptyNameEntries(): void
+    {
+        $sid = $this->seedServer(221, 'r1');
+        SourceQueryCache::setProbeOverrideForTesting(static fn(): array => [
+            'info'    => [
+                'HostName'   => 'All-Empty Server',
+                'Players'    => 3,
+                'MaxPlayers' => 24,
+                'Map'        => 'cp_dustbowl',
+                'Os'         => 'l',
+                'Secure'     => true,
+            ],
+            'players' => [
+                ['Id' => 0, 'Name' => '', 'Frags' => 0, 'Time' => 0, 'TimeF' => '00:00'],
+                ['Id' => 1, 'Name' => '', 'Frags' => 0, 'Time' => 0, 'TimeF' => '00:00'],
+                ['Id' => 2, 'Name' => '', 'Frags' => 0, 'Time' => 0, 'TimeF' => '00:00'],
+            ],
+        ]);
+
+        $env = $this->api('servers.host_players', ['sid' => $sid]);
+        $this->assertTrue($env['ok']);
+        $this->assertCount(0, $env['data']['player_list'],
+            'all-empty-name A2S response must yield an empty player_list (#1396)',
+        );
+        $this->assertSame(3, $env['data']['players'],
+            'A2S-reported player count is independent of the rendered list — the inflated count stays as-is',
+        );
+    }
 }
diff --git a/web/tests/e2e/specs/flows/server-player-context-menu.spec.ts b/web/tests/e2e/specs/flows/server-player-context-menu.spec.ts
index f7b368205..b3750b66a 100644
--- a/web/tests/e2e/specs/flows/server-player-context-menu.spec.ts
+++ b/web/tests/e2e/specs/flows/server-player-context-menu.spec.ts
@@ -315,6 +315,83 @@ test.describe('flow: server-player right-click context menu (#PLAYER_CTX_MENU)',
         await expect(menu.locator('[data-testid="context-menu-block"]')).toHaveCount(0);
     });
 
+    /**
+     * #1396 — When the API stops carrying empty-name entries (the
+     * server-side filter the fix lands), the JS must render the
+     * remaining named players without a phantom row at the top.
+     * The visually-first player gets a `data-context-menu` `<li>`
+     * at index 0 and right-click on it opens the menu.
+     *
+     * Stubbing the API at the contract boundary (post-fix shape):
+     * caller never receives the empty-name entry. Pre-fix this
+     * spec would still pass because the JS happily renders the
+     * filtered list; the load-bearing regression coverage for the
+     * filter itself is in `web/tests/api/ServersTest.php`
+     * (`testHostPlayersFiltersEmptyNameEntries`). This spec pins
+     * the END-USER outcome — right-click on the first named player
+     * opens the menu — so future regressions either in the
+     * filter OR in the JS rendering surface here.
+     */
+    test('first named player accepts right-click (#1396 end-to-end)', async ({ page }) => {
+        await truncateE2eDb();
+        const seeded = await seedServerViaApi(page);
+        await stubHostPlayers(
+            page,
+            seeded,
+            [
+                // Three real players — no empty-name phantom (the
+                // post-fix shape the handler emits). The first row
+                // is the one the user reported as "impossible to
+                // open the menu on" — the regression guard is that
+                // right-clicking it opens the menu just like every
+                // other row.
+                { name: 'Fletcher', steamid: 'STEAM_0:0:1234', frags: 12, time_f: '20:00' },
+                { name: 'kovka',    steamid: 'STEAM_0:0:5678', frags: 7,  time_f: '06:40' },
+                { name: 'Charlie',  steamid: '[U:1:99999]',    frags: 3,  time_f: '02:13' },
+            ],
+            /* canBanPlayer */ true,
+        );
+
+        await page.goto('/index.php?p=servers&s=0');
+
+        const tile = page.locator('[data-testid="server-tile"]').first();
+        await expect(tile).toHaveAttribute('data-status', 'online');
+        await expect(tile).toHaveAttribute('data-expanded', 'true');
+
+        // The list must render exactly three rows — no phantom
+        // entry above the first named player (the bug shape was
+        // the visually-first named row sitting at index 1 with a
+        // ~27px empty-name `<li>` above it that lacked
+        // `data-context-menu` and silently swallowed right-clicks
+        // landed in its area).
+        const rows = tile.locator('[data-testid="server-player"]');
+        await expect(rows).toHaveCount(3);
+
+        const firstRow = rows.first();
+        await expect(firstRow).toHaveAttribute('data-context-menu', 'server-player');
+        await expect(firstRow).toHaveAttribute('data-name', 'Fletcher');
+
+        // Use real `mouse.click({ button: 'right' })` against the
+        // visual centre of the first row, not just `dispatchEvent` —
+        // the goal is to mirror what the user does in their
+        // browser and prove the hit-test resolves to the named
+        // row (not to a phantom row above it).
+        const box = await firstRow.boundingBox();
+        if (!box) throw new Error('first row has no bounding box');
+        await page.mouse.click(box.x + box.width / 2, box.y + box.height / 2, { button: 'right' });
+
+        const menu = page.locator('[data-testid="server-context-menu"]');
+        await expect(menu).toBeVisible();
+        await expect(menu.locator('.context-menu__header')).toHaveText('Fletcher');
+        // The menu should target THIS player — kick / ban URLs
+        // carry Fletcher's SteamID, not the second player's.
+        await expect(menu.locator('[data-testid="context-menu-kick"]'))
+            .toHaveAttribute('href', /check=STEAM_0%3A0%3A1234/);
+
+        await page.keyboard.press('Escape');
+        await expect(menu).toHaveCount(0);
+    });
+
     test('does NOT open on player rows without a steamid attribute', async ({ page }) => {
         await truncateE2eDb();
         const seeded = await seedServerViaApi(page);