diff --git a/docs/decisions/README.md b/docs/decisions/README.md
index 04c140333..d75159af8 100644
--- a/docs/decisions/README.md
+++ b/docs/decisions/README.md
@@ -164,7 +164,7 @@ the link for rationale. Superseded/retired history lives in `archive/`. Regenera
 | `spa.deco-templates-table` | The deco-templates editor also renders its day/deco assignment as a table, extending (not replacing) the templates-editor-table convention. | 2026-07-09 | [link](records/spa/deco-templates-table.md) |
 | `spa.download-sample-gate` | The SPA disables both Download Media Sample and Download Results while a troubleshooting session is starting/running (Blazor only gated Download Results). | 2026-07-09 | [link](records/spa/download-sample-gate.md) |
 | `spa.legacy-redirect-matcher` | `LegacyUiRedirects.TryGetRedirect` is a two-tier matcher — an exact `OrdinalIgnoreCase` `Map` (Tier 1) then an ordered segment-template pattern list (Tier 2, first-match-wins) — collision-free by construction, with a guard invariant that no rule may prefix-match `/api`, `/artwork`, `/docs`, `/openapi`, `/iptv`, `/app`, or `/media/sources`. | 2026-07-11 | [link](records/spa/legacy-redirect-matcher.md) |
-| `spa.library-pickers-resolve-by-search` | A picker over a media-library table (Episode/Song/Image/Movie/MusicVideo/TelevisionShow/TelevisionSeason/Artist/OtherVideo/RemoteStream) resolves its options by SEARCH — a debounced `SearchPicker` calling `searchLibraryPickerOptions`, which issues at most ONE `getLibraryBrowseItems` request per settled query, bounded to `LIBRARY_PICKER_RESULTS` (25) rows — CLAMPED inside the helper, not merely defaulted — and gated on `LIBRARY_PICKER_MIN_QUERY` (2) characters. It list-loads NOTHING on mount or on a type switch, so there is no truncation to surface and no truncation hint. The typed text is COMPILED (`titleContainsQuery` → `title:*<escaped>*`), never forwarded raw. The current selection renders from the OWNING RECORD, not from the result set (`selectedName` on a rerun collection / playlist item; a single by-id detail read — `getShow`/`getSeason`/`getArtist` — for a filler preset, which stores only the id), and an edit draft is INITIALIZED ONCE from the detail read — never seeded from the list row, never reconciled against a late response — with the form withheld until it lands, the editor failing CLOSED when the response carries no USABLE concurrency token — absent, empty and whitespace-only ETags are ONE case, normalized in one place, so a PUT without `If-Match` is unreachable, and a deadline plus a route back so a hung request cannot strand it. An id NEVER travels without its namespace: search results are cached against `(source, query)` and list-backed options carry the type they were loaded for, so no id from one type can be offered under another. Conflicts are detected at SAVE time via `If-Match` -> 412 -> Reload, and Reload simply drops the draft back to null and re-runs the same initialize-once load, so the form is unmounted while the replacement is in flight; an asynchronously-resolved name is keyed to the id it was resolved for and never overwrites a label naming a different id. The typeahead implements the full ARIA combobox keyboard contract, because it replaces a natively keyboard-operable `<select>`. The other half of the superseded record is UNCHANGED: bounded-by-construction admin lists (collections, multi-collections, smart collections, playlists) still page to completeness via `loadAllPages` and still report `complete`/`hint: incomplete`. Server-side caps are not raised — this is a web-only change. | 2026-07-26 | [link](records/spa/library-pickers-resolve-by-search.md) |
+| `spa.library-pickers-resolve-by-search` | A picker over a media-library table (Episode/Song/Image/Movie/MusicVideo/TelevisionShow/TelevisionSeason/Artist/OtherVideo/RemoteStream) resolves its options by SEARCH — a debounced `SearchPicker` calling `searchLibraryPickerOptions`, which issues at most ONE `getLibraryBrowseItems` request per settled query, bounded to `LIBRARY_PICKER_RESULTS` (25) rows — CLAMPED inside the helper, not merely defaulted — and gated on `LIBRARY_PICKER_MIN_QUERY` (2) characters. It list-loads NOTHING on mount or on a type switch, so there is no truncation to surface and no truncation hint. The typed text is COMPILED (`titleContainsQuery` → `title:*<escaped>*`), never forwarded raw. The current selection renders from the OWNING RECORD, not from the result set (`selectedName` on a rerun collection / playlist item; a single by-id detail read — `getShow`/`getSeason`/`getArtist` — for a filler preset, which stores only the id), and an edit draft is INITIALIZED ONCE from the detail read — never seeded from the list row, never reconciled against a late response — with the form withheld until it lands, the editor failing CLOSED when the response carries no USABLE concurrency token — absent, empty and whitespace-only ETags are ONE case, normalized in one place, so a PUT without `If-Match` is unreachable, and a deadline plus a route back so a hung request cannot strand it. An id NEVER travels without its namespace: search results are cached against `(source, query)` and list-backed options carry the type they were loaded for, so no id from one type can be offered under another; and every id entering editor state — search result, list-backed option, or a selection restored from a detail read — passes ONE shared `isSelectionId` (int32) predicate at that boundary, an unbindable id being treated as ABSENT rather than coerced. Conflicts are detected at SAVE time via `If-Match` -> 412 -> Reload, and Reload simply drops the draft back to null and re-runs the same initialize-once load, so the form is unmounted while the replacement is in flight; an asynchronously-resolved name is keyed to the id it was resolved for and never overwrites a label naming a different id. The typeahead implements the full ARIA combobox keyboard contract, because it replaces a natively keyboard-operable `<select>`. The other half of the superseded record is UNCHANGED: bounded-by-construction admin lists (collections, multi-collections, smart collections, playlists) still page to completeness via `loadAllPages` and still report `complete`/`hint: incomplete`. Server-side caps are not raised — this is a web-only change. | 2026-07-26 | [link](records/spa/library-pickers-resolve-by-search.md) |
 | `spa.logs-page-size-local` | The Logs page rows-per-page preference is stored in `window.localStorage` (`ctv-logs-page-size`), not a server `ConfigElement`. | 2026-07-11 | [link](records/spa/logs-page-size-local.md) |
 | `spa.playback-troubleshoot-poll` | The playback-troubleshooting screen reports FFmpeg completion by polling `GET /api/troubleshoot/playback/status` (~2s) rather than a server push channel. | 2026-07-09 | [link](records/spa/playback-troubleshoot-poll.md) |
 | `spa.playout-reset-button` | The SPA keeps a single Reset action (server picks the default build mode) and drops Blazor's separate "Schedule reset" button since its capability already exists via the playout's Edit-details flow. | 2026-07-09 | [link](records/spa/playout-reset-button.md) |
diff --git a/docs/decisions/records/spa/library-pickers-resolve-by-search.md b/docs/decisions/records/spa/library-pickers-resolve-by-search.md
index 711cef00c..c5a6bb3ff 100644
--- a/docs/decisions/records/spa/library-pickers-resolve-by-search.md
+++ b/docs/decisions/records/spa/library-pickers-resolve-by-search.md
@@ -5,8 +5,8 @@ status: active
 since: '2026-07-26'
 supersedes: spa.list-completeness-vs-bounded-pickers@2026-07-26
 superseded-by: none
-rule: 'A picker over a media-library table (Episode/Song/Image/Movie/MusicVideo/TelevisionShow/TelevisionSeason/Artist/OtherVideo/RemoteStream) resolves its options by SEARCH — a debounced `SearchPicker` calling `searchLibraryPickerOptions`, which issues at most ONE `getLibraryBrowseItems` request per settled query, bounded to `LIBRARY_PICKER_RESULTS` (25) rows — CLAMPED inside the helper, not merely defaulted — and gated on `LIBRARY_PICKER_MIN_QUERY` (2) characters. It list-loads NOTHING on mount or on a type switch, so there is no truncation to surface and no truncation hint. The typed text is COMPILED (`titleContainsQuery` → `title:*<escaped>*`), never forwarded raw. The current selection renders from the OWNING RECORD, not from the result set (`selectedName` on a rerun collection / playlist item; a single by-id detail read — `getShow`/`getSeason`/`getArtist` — for a filler preset, which stores only the id), and an edit draft is INITIALIZED ONCE from the detail read — never seeded from the list row, never reconciled against a late response — with the form withheld until it lands, the editor failing CLOSED when the response carries no USABLE concurrency token — absent, empty and whitespace-only ETags are ONE case, normalized in one place, so a PUT without `If-Match` is unreachable, and a deadline plus a route back so a hung request cannot strand it. An id NEVER travels without its namespace: search results are cached against `(source, query)` and list-backed options carry the type they were loaded for, so no id from one type can be offered under another. Conflicts are detected at SAVE time via `If-Match` -> 412 -> Reload, and Reload simply drops the draft back to null and re-runs the same initialize-once load, so the form is unmounted while the replacement is in flight; an asynchronously-resolved name is keyed to the id it was resolved for and never overwrites a label naming a different id. The typeahead implements the full ARIA combobox keyboard contract, because it replaces a natively keyboard-operable `<select>`. The other half of the superseded record is UNCHANGED: bounded-by-construction admin lists (collections, multi-collections, smart collections, playlists) still page to completeness via `loadAllPages` and still report `complete`/`hint: incomplete`. Server-side caps are not raised — this is a web-only change.'
-signals: 'library picker typeahead, SearchPicker, searchLibraryPickerOptions, titleContainsQuery, LIBRARY_PICKER_RESULTS, LIBRARY_PICKER_MIN_QUERY, LIBRARY_PICKER_LUCENE_SPECIALS, compile typed text not raw Lucene, Lucene && || escaping, picker truncation hint removed, loadAllPages Class A, LuceneSearchIndex.Search hitsLimit, useIsMountedRef, aria-activedescendant combobox keyboard, initialize-once draft not hydrate-merge, no list-row seeding, fail closed on a missing or blank ETag, usable concurrency token, cross-type id, id never travels without its namespace, results keyed on (source query), failed search not cached as empty, npm run typecheck not tsc --noEmit, stale result set not committable by keyboard OR pointer · paths: `web/src/api/libraryBrowse.ts`, `web/src/schedules/pickers.tsx`, `web/src/hooks.ts`, `web/src/screens/RerunCollectionsScreen.tsx`, `web/src/screens/PlaylistsScreen.tsx`, `web/src/screens/FillerPresetsScreen.tsx`, `web/src/api/paging.ts`, `docs/spa-conventions.md` §3b · issues: #651, #644, #578, #440'
+rule: 'A picker over a media-library table (Episode/Song/Image/Movie/MusicVideo/TelevisionShow/TelevisionSeason/Artist/OtherVideo/RemoteStream) resolves its options by SEARCH — a debounced `SearchPicker` calling `searchLibraryPickerOptions`, which issues at most ONE `getLibraryBrowseItems` request per settled query, bounded to `LIBRARY_PICKER_RESULTS` (25) rows — CLAMPED inside the helper, not merely defaulted — and gated on `LIBRARY_PICKER_MIN_QUERY` (2) characters. It list-loads NOTHING on mount or on a type switch, so there is no truncation to surface and no truncation hint. The typed text is COMPILED (`titleContainsQuery` → `title:*<escaped>*`), never forwarded raw. The current selection renders from the OWNING RECORD, not from the result set (`selectedName` on a rerun collection / playlist item; a single by-id detail read — `getShow`/`getSeason`/`getArtist` — for a filler preset, which stores only the id), and an edit draft is INITIALIZED ONCE from the detail read — never seeded from the list row, never reconciled against a late response — with the form withheld until it lands, the editor failing CLOSED when the response carries no USABLE concurrency token — absent, empty and whitespace-only ETags are ONE case, normalized in one place, so a PUT without `If-Match` is unreachable, and a deadline plus a route back so a hung request cannot strand it. An id NEVER travels without its namespace: search results are cached against `(source, query)` and list-backed options carry the type they were loaded for, so no id from one type can be offered under another; and every id entering editor state — search result, list-backed option, or a selection restored from a detail read — passes ONE shared `isSelectionId` (int32) predicate at that boundary, an unbindable id being treated as ABSENT rather than coerced. Conflicts are detected at SAVE time via `If-Match` -> 412 -> Reload, and Reload simply drops the draft back to null and re-runs the same initialize-once load, so the form is unmounted while the replacement is in flight; an asynchronously-resolved name is keyed to the id it was resolved for and never overwrites a label naming a different id. The typeahead implements the full ARIA combobox keyboard contract, because it replaces a natively keyboard-operable `<select>`. The other half of the superseded record is UNCHANGED: bounded-by-construction admin lists (collections, multi-collections, smart collections, playlists) still page to completeness via `loadAllPages` and still report `complete`/`hint: incomplete`. Server-side caps are not raised — this is a web-only change.'
+signals: 'library picker typeahead, SearchPicker, searchLibraryPickerOptions, titleContainsQuery, LIBRARY_PICKER_RESULTS, LIBRARY_PICKER_MIN_QUERY, LIBRARY_PICKER_LUCENE_SPECIALS, compile typed text not raw Lucene, Lucene && || escaping, picker truncation hint removed, loadAllPages Class A, LuceneSearchIndex.Search hitsLimit, useIsMountedRef, aria-activedescendant combobox keyboard, initialize-once draft not hydrate-merge, no list-row seeding, fail closed on a missing or blank ETag, usable concurrency token, cross-type id, id never travels without its namespace, results keyed on (source query), failed search not cached as empty, selection id int32 boundary predicate, isSelectionId, npm run typecheck not tsc --noEmit, stale result set not committable by keyboard OR pointer · paths: `web/src/api/libraryBrowse.ts`, `web/src/schedules/pickers.tsx`, `web/src/hooks.ts`, `web/src/screens/RerunCollectionsScreen.tsx`, `web/src/screens/PlaylistsScreen.tsx`, `web/src/screens/FillerPresetsScreen.tsx`, `web/src/api/paging.ts`, `docs/spa-conventions.md` §3b · issues: #651, #644, #578, #440'
 mechanics: '`docs/spa-conventions.md` §3b'
 ---
 
diff --git a/docs/spa-conventions.md b/docs/spa-conventions.md
index 4bc63ea0d..6e014681d 100644
--- a/docs/spa-conventions.md
+++ b/docs/spa-conventions.md
@@ -295,6 +295,17 @@ appear once the widget is asynchronous:
   storm** on a persistent outage. Keep the two apart: a `resultsFor.ok` flag says whether the held
   answer is authoritative, and a separate *attempted* key (a ref, so writing it doesn't re-render)
   suppresses automatic retries until an explicit user action — reopen, focus, or edit — re-arms it.
+- **Put a validity predicate at the BOUNDARY the class crosses, not at the site the bug was found.**
+  An entity-reference id (`selectedId`, `collectionId`, `mediaItemId`, …) is bound by the API as a
+  32-bit integer, so `1.5` or `2147483648` renders and commits fine and then fails on write. Such
+  ids enter editor state through *several* doors — search results, list-backed `<select>` options,
+  and the selection restored from a detail read — so a check added to whichever one surfaced the
+  defect leaves the others open (this is how #651 produced the same finding in two consecutive
+  rounds). Share one predicate (`isSelectionId` / `selectionIdOrNull` in `web/src/api/selectionId.ts`)
+  and apply it on every path. **Treat an unbindable id as ABSENT, never coerce it** — rounding
+  `1.5` to `1` would submit a *different* record — so it surfaces as "no selection" with Save
+  disabled, and drop rather than render an option that cannot be selected safely. Prove it per
+  ingress by asserting **zero writes are reachable**, not just that the field looks empty.
 - **A caller-supplied promise needs a deadline, and a 2xx body is not a contract.** `client.ts`
   turns malformed JSON into `undefined` rather than rejecting, so `setResults(undefined)` throws on
   the next render. Validate the **elements, not just the container**: `Array.isArray` accepts
diff --git a/web/src/api/index.ts b/web/src/api/index.ts
index 181107266..e86cad253 100644
--- a/web/src/api/index.ts
+++ b/web/src/api/index.ts
@@ -17,6 +17,7 @@ export * from './imageFolders';
 export * from './languages';
 export * from './libraries';
 export * from './libraryBrowse';
+export * from './selectionId';
 export * from './logs';
 export * from './maintenance';
 export * from './mediaDetail';
diff --git a/web/src/api/selectionId.ts b/web/src/api/selectionId.ts
new file mode 100644
index 000000000..3302bcb9d
--- /dev/null
+++ b/web/src/api/selectionId.ts
@@ -0,0 +1,24 @@
+// A *selection id* is any id an editor stores and later submits as an entity reference —
+// `selectedId` on a rerun collection, `collectionId`/`mediaItemId`/… on a playlist item or filler
+// preset. The API binds every one of them as a 32-bit integer, so a value outside that domain is
+// not merely odd: it renders and commits happily and then fails on write.
+//
+// This lives in ONE place on purpose. #651 round 7 added the check inside the search picker's
+// option validator — the site where the defect was found — leaving list-backed options and the
+// selection restored from a detail read unguarded, so the identical malformed value entered editor
+// state through a different door (round 8). The predicate belongs at the BOUNDARY the class
+// crosses: every path by which an id from the wire becomes editor state.
+export const INT32_MIN = -2_147_483_648;
+export const INT32_MAX = 2_147_483_647;
+
+export function isSelectionId(value: unknown): value is number {
+  return typeof value === 'number' && Number.isInteger(value) && value >= INT32_MIN && value <= INT32_MAX;
+}
+
+// Normalize an id arriving from the wire into editor state. Anything the API cannot bind is treated
+// as ABSENT rather than carried: the editor then shows "no selection" with Save disabled — visible
+// and honest — instead of a value that looks selected and fails on submit. Never silently coerce
+// (rounding 1.5 to 1 would submit a *different* record).
+export function selectionIdOrNull(value: unknown): null | number {
+  return isSelectionId(value) ? value : null;
+}
diff --git a/web/src/schedules/pickers.tsx b/web/src/schedules/pickers.tsx
index ec4d9507d..85992b63b 100644
--- a/web/src/schedules/pickers.tsx
+++ b/web/src/schedules/pickers.tsx
@@ -2,6 +2,7 @@ import { useEffect, useId, useRef, useState, type KeyboardEvent as ReactKeyboard
 import { Check, Search, X } from 'lucide-react';
 import { Spinner } from '../components';
 import { useIsMountedRef } from '../hooks';
+import { isSelectionId } from '../api';
 
 // The shape every search-backed picker resolves to. Deliberately structural rather than the
 // generated `SchedulingPickerOption` DTO: the scheduling pickers pass that DTO straight through,
@@ -44,25 +45,15 @@ const SEARCH_TIMEOUT_MS = 10_000;
 // and throws on `option.id` during render; an element with a missing or wrong-typed `id`/`name`
 // yields a broken option or commits an invalid value (#651 round 6). Nothing between the network
 // and `onSelect` re-checks these, so validate every element before storing it.
-// The id must be what the API can actually BIND — a 32-bit integer. `Number.isFinite` accepts
-// `1.5` and values beyond `int32`, which render and commit happily and then fail server-side on a
-// `selectedId` the model binder cannot parse (#651 round 7).
-const INT32_MIN = -2_147_483_648;
-const INT32_MAX = 2_147_483_647;
-
+// The id must be what the API can actually BIND — see `isSelectionId`. This is one of several
+// ingresses for the same class; the predicate is shared so they cannot drift apart (#651 round 8).
 function isSearchPickerOption(value: unknown): value is SearchPickerOption {
   if (typeof value !== 'object' || value === null) {
     return false;
   }
 
   const candidate = value as { id?: unknown; name?: unknown };
-  return (
-    typeof candidate.id === 'number' &&
-    Number.isInteger(candidate.id) &&
-    candidate.id >= INT32_MIN &&
-    candidate.id <= INT32_MAX &&
-    typeof candidate.name === 'string'
-  );
+  return isSelectionId(candidate.id) && typeof candidate.name === 'string';
 }
 
 export function SearchPicker({
diff --git a/web/src/screens/FillerPresetsScreen.tsx b/web/src/screens/FillerPresetsScreen.tsx
index f8a38c0c9..366b55d99 100644
--- a/web/src/screens/FillerPresetsScreen.tsx
+++ b/web/src/screens/FillerPresetsScreen.tsx
@@ -14,7 +14,9 @@ import {
   getShow,
   messageFromFillerPresetError,
   searchLibraryPickerOptions,
+  selectionIdOrNull,
   updateFillerPreset,
+  isSelectionId,
   LIBRARY_PICKER_MIN_QUERY,
   type CreateFillerPresetRequest,
   type FillerPreset,
@@ -215,19 +217,22 @@ function defaultDraft(): Draft {
 function draftFromPreset(preset: FillerPreset & Draft): Draft {
   return {
     allowWatermarks: preset.allowWatermarks,
-    collectionId: preset.collectionId,
+    // Every entity-reference id is normalized on the way in: a value the API cannot bind is treated
+    // as ABSENT so it surfaces as "no selection" (Save disabled) rather than as an apparently-valid
+    // selection that fails on submit (#651 round 8).
+    collectionId: selectionIdOrNull(preset.collectionId),
     collectionType: preset.collectionType,
     count: preset.count,
     duration: preset.duration,
     expression: preset.expression,
     fillerKind: preset.fillerKind,
     fillerMode: preset.fillerMode,
-    mediaItemId: preset.mediaItemId,
-    multiCollectionId: preset.multiCollectionId,
+    mediaItemId: selectionIdOrNull(preset.mediaItemId),
+    multiCollectionId: selectionIdOrNull(preset.multiCollectionId),
     name: preset.name,
     padToNearestMinute: preset.padToNearestMinute,
-    playlistId: preset.playlistId,
-    smartCollectionId: preset.smartCollectionId,
+    playlistId: selectionIdOrNull(preset.playlistId),
+    smartCollectionId: selectionIdOrNull(preset.smartCollectionId),
     useChaptersAsMediaItems: preset.useChaptersAsMediaItems
   };
 }
@@ -670,7 +675,8 @@ function FillerEditor({ mode }: { mode: { id: number; kind: 'edit' } | { kind: '
       : []),
     ...pickerItems.flatMap((item) => {
       const id = activeConfig?.itemId(item);
-      return id == null ? [] : [{ label: item.title ?? `#${id}`, value: String(id) }];
+      // Drop, don't offer: an option whose id the API cannot bind is unselectable by construction.
+      return isSelectionId(id) ? [{ label: item.title ?? `#${id}`, value: String(id) }] : [];
     })
   ];
 
diff --git a/web/src/screens/PlaylistsScreen.tsx b/web/src/screens/PlaylistsScreen.tsx
index f8751bea9..530499eda 100644
--- a/web/src/screens/PlaylistsScreen.tsx
+++ b/web/src/screens/PlaylistsScreen.tsx
@@ -34,6 +34,8 @@ import {
   messageFromPlaylistError,
   previewPlaylist,
   searchLibraryPickerOptions,
+  selectionIdOrNull,
+  isSelectionId,
   updatePlaylist,
   updatePlaylistGroup,
   LIBRARY_PICKER_MIN_QUERY,
@@ -153,6 +155,13 @@ function orderOptionsWithCurrent(type: CollectionType, current: PlaybackOrder):
   return options.some((option) => option.value === current) ? options : [...options, orderOption(current)];
 }
 
+// See RerunCollectionsScreen: one ingress for list-backed options, dropping ids the API cannot bind.
+function toPickerOptions(list: Array<{ id: unknown; name?: null | string }>): PickerOption[] {
+  return list.flatMap((entry) =>
+    isSelectionId(entry.id) ? [{ id: entry.id, name: entry.name ?? `#${entry.id}` }] : []
+  );
+}
+
 function loadPickerOptions(type: CollectionType, signal?: AbortSignal): Promise<PickerLoadResult> {
   const config = configFor(type);
   if (!config) {
@@ -162,12 +171,12 @@ function loadPickerOptions(type: CollectionType, signal?: AbortSignal): Promise<
   switch (config.source) {
     case 'collection':
       return getCollections().then((list) => {
-        const items = list.map((entry) => ({ id: entry.id, name: entry.name ?? `#${entry.id}` }));
+        const items = toPickerOptions(list);
         return { hint: 'none' as const, items };
       });
     case 'multi':
       return loadAllPages(getMultiCollections, undefined, undefined, signal).then(({ complete, items: list }) => {
-        const items = list.map((entry) => ({ id: entry.id, name: entry.name ?? `#${entry.id}` }));
+        const items = toPickerOptions(list);
         if (!complete && !signal?.aborted) {
           // #644 follow-up F3: a superseded/aborted load (a type switch mid-load) also returns
           // `complete: false` — that's expected, not a defect, so don't warn on it.
@@ -177,7 +186,7 @@ function loadPickerOptions(type: CollectionType, signal?: AbortSignal): Promise<
       });
     case 'smart':
       return getSmartCollections().then((list) => {
-        const items = list.map((entry) => ({ id: entry.id, name: entry.name ?? `#${entry.id}` }));
+        const items = toPickerOptions(list);
         return { hint: 'none' as const, items };
       });
     default:
@@ -227,19 +236,19 @@ function draftFromItem(item: PlaylistItem): DraftItem {
 
   switch (source) {
     case 'collection':
-      selectedId = item.collectionId ?? null;
+      selectedId = selectionIdOrNull(item.collectionId);
       selectedName = item.collectionName ?? '';
       break;
     case 'multi':
-      selectedId = item.multiCollectionId ?? null;
+      selectedId = selectionIdOrNull(item.multiCollectionId);
       selectedName = item.multiCollectionName ?? '';
       break;
     case 'smart':
-      selectedId = item.smartCollectionId ?? null;
+      selectedId = selectionIdOrNull(item.smartCollectionId);
       selectedName = item.smartCollectionName ?? '';
       break;
     default:
-      selectedId = item.mediaItemId ?? null;
+      selectedId = selectionIdOrNull(item.mediaItemId);
       selectedName = item.mediaItemName ?? '';
   }
 
diff --git a/web/src/screens/RerunCollectionsScreen.test.tsx b/web/src/screens/RerunCollectionsScreen.test.tsx
index 90bee56fc..52882f8b8 100644
--- a/web/src/screens/RerunCollectionsScreen.test.tsx
+++ b/web/src/screens/RerunCollectionsScreen.test.tsx
@@ -784,7 +784,10 @@ describe('RerunCollectionsScreen', () => {
   });
 
   it('a padded ETag is TRIMMED and sent as If-Match, not dropped', async () => {
-    // The other half of "one class": a usable token surrounded by whitespace must still be used.
+    // The other half of "one class": a usable token surrounded by whitespace must still be USED.
+    // NOTE this is a regression guard, not a demonstration of a defect — `Headers` strips outer
+    // HTTP whitespace before the app sees it, so this passes pre-#651-round-7 too. It exists so a
+    // future `usableEtag` that rejects (rather than trims) padding cannot land silently.
     const fetchMock = mockApi({
       list: [storedSelection],
       onRequest: (url, method) => {
@@ -908,6 +911,10 @@ describe('RerunCollectionsScreen', () => {
     }
   });
 
+  // Guards the ABORT/RACE COMPOSITION, not a round-6 defect: round 6's race guard already covered
+  // the ordinary case. What this fails is an abort-ONLY implementation whose fetch ignores its
+  // signal — which is exactly the mutation it was written for, and why the stub below deliberately
+  // ignores `init.signal`.
   it('a detail read that settles LATE, after the deadline, cannot revive the editor', async () => {
     vi.useFakeTimers();
     try {
@@ -954,4 +961,67 @@ describe('RerunCollectionsScreen', () => {
       vi.useRealTimers();
     }
   });
+
+  // ---- #651 round 8: the int32 boundary, on EVERY ingress ----
+  //
+  // Round 7 put the predicate inside the search picker's option validator — the site the defect was
+  // found at — leaving the two other doors into `draft.selectedId` open. These pin them.
+
+  it.each([
+    { id: 1.5, label: 'a fractional selectedId' },
+    { id: 2_147_483_648, label: 'a selectedId above int32' },
+    { id: -2_147_483_649, label: 'a selectedId below int32' }
+  ])('round 8: $label in the DETAIL response cannot enable Save or reach a PUT', async ({ id }) => {
+    const fetchMock = mockApi({
+      list: [storedSelection],
+      onRequest: (url, method) =>
+        url === '/api/v1/rerun-collections/9' && method === 'GET'
+          ? detailResponse({ ...storedSelection, collectionType: 'Collection', selectedId: id, selectedName: 'Bogus' })
+          : null
+    });
+
+    render(<RerunCollectionsScreen />);
+    fireEvent.click(await screen.findByText('Stored Rerun'));
+    await screen.findByPlaceholderText('Rerun collection name');
+
+    // Treated as ABSENT — visibly, with the reason — rather than as a selection that fails on write.
+    expect(screen.getByText('A selection is required')).toBeInTheDocument();
+    expect(screen.getByRole('button', { name: 'Save rerun collection' })).toBeDisabled();
+
+    fireEvent.click(screen.getByRole('button', { name: 'Save rerun collection' }));
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(
+      fetchMock.mock.calls.filter(([u, i]) => u === '/api/v1/rerun-collections/9' && (i?.method ?? '').toUpperCase() === 'PUT')
+    ).toHaveLength(0);
+  });
+
+  it.each([
+    { id: 1.5, label: 'a fractional id' },
+    { id: 2_147_483_648, label: 'an id above int32' }
+  ])('round 8: a LIST-BACKED option with $label is not offered, so it cannot be selected or saved', async ({ id }) => {
+    const fetchMock = mockApi({
+      list: [],
+      onRequest: (url, method) =>
+        url === '/api/v1/collections' && method === 'GET'
+          ? jsonResponse([
+              { collectionType: 'Collection', id, name: 'Bogus Collection', state: 'Normal', useCustomPlaybackOrder: false },
+              { collectionType: 'Collection', id: 5, name: 'Favorites', state: 'Normal', useCustomPlaybackOrder: false }
+            ])
+          : null
+    });
+
+    render(<RerunCollectionsScreen />);
+    fireEvent.click(await screen.findByRole('button', { name: 'New rerun collection' }));
+
+    const picker = (await screen.findAllByRole('combobox'))[1];
+    // The bindable option is offered; the malformed one is dropped rather than rendered.
+    expect(await within(picker).findByText('Favorites')).toBeInTheDocument();
+    expect(within(picker).queryByText('Bogus Collection')).not.toBeInTheDocument();
+    expect(within(picker).queryByRole('option', { name: 'Bogus Collection' })).not.toBeInTheDocument();
+
+    // ...and no POST can carry it.
+    expect(
+      fetchMock.mock.calls.filter(([u, i]) => u === '/api/v1/rerun-collections' && (i?.method ?? '').toUpperCase() === 'POST')
+    ).toHaveLength(0);
+  });
 });
diff --git a/web/src/screens/RerunCollectionsScreen.tsx b/web/src/screens/RerunCollectionsScreen.tsx
index 1a37094cb..bded97ede 100644
--- a/web/src/screens/RerunCollectionsScreen.tsx
+++ b/web/src/screens/RerunCollectionsScreen.tsx
@@ -15,7 +15,9 @@ import {
   loadAllPages,
   messageFromRerunCollectionError,
   searchLibraryPickerOptions,
+  selectionIdOrNull,
   updateRerunCollection,
+  isSelectionId,
   LIBRARY_PICKER_MIN_QUERY,
   type CreateRerunCollectionRequest,
   type LibraryBrowseMediaType,
@@ -106,6 +108,15 @@ function orderOptionsWithCurrent(type: RerunCollectionType, current: PlaybackOrd
   return options.some((option) => option.value === current) ? options : [...options, orderOption(current)];
 }
 
+// One ingress for list-backed options. An id the API cannot bind is DROPPED rather than offered:
+// an unselectable option is better than one that fails on save (#651 round 8 — the boundary, not
+// the site).
+function toPickerOptions(list: Array<{ id: unknown; name?: null | string }>): PickerOption[] {
+  return list.flatMap((entry) =>
+    isSelectionId(entry.id) ? [{ id: entry.id, name: entry.name ?? `#${entry.id}` }] : []
+  );
+}
+
 function loadPickerOptions(type: RerunCollectionType, signal?: AbortSignal): Promise<PickerLoadResult> {
   const config = COLLECTION_TYPES.find((entry) => entry.value === type);
   if (!config) {
@@ -115,12 +126,12 @@ function loadPickerOptions(type: RerunCollectionType, signal?: AbortSignal): Pro
   switch (config.source) {
     case 'collection':
       return getCollections().then((list) => {
-        const items = list.map((entry) => ({ id: entry.id, name: entry.name ?? `#${entry.id}` }));
+        const items = toPickerOptions(list);
         return { hint: 'none' as const, items };
       });
     case 'multi':
       return loadAllPages(getMultiCollections, undefined, undefined, signal).then(({ complete, items: list }) => {
-        const items = list.map((entry) => ({ id: entry.id, name: entry.name ?? `#${entry.id}` }));
+        const items = toPickerOptions(list);
         if (!complete && !signal?.aborted) {
           // #644 follow-up F3: a superseded/aborted load (Retry, or a type switch mid-load) also
           // returns `complete: false` — that's expected, not a defect, so don't warn on it.
@@ -130,7 +141,7 @@ function loadPickerOptions(type: RerunCollectionType, signal?: AbortSignal): Pro
       });
     case 'smart':
       return getSmartCollections().then((list) => {
-        const items = list.map((entry) => ({ id: entry.id, name: entry.name ?? `#${entry.id}` }));
+        const items = toPickerOptions(list);
         return { hint: 'none' as const, items };
       });
     default:
@@ -238,7 +249,9 @@ function draftFromRerun(rerun: RerunCollection): Draft {
     firstRunPlaybackOrder: rerun.firstRunPlaybackOrder,
     name: rerun.name ?? '',
     rerunPlaybackOrder: rerun.rerunPlaybackOrder,
-    selectedId: rerun.selectedId ?? null,
+    // The other ingress: a malformed id in an otherwise-successful detail response must not become
+    // an apparently-valid selection. Treated as absent, so Save is disabled and says why.
+    selectedId: selectionIdOrNull(rerun.selectedId),
     selectedName: rerun.selectedName ?? ''
   };
 }