From 0a94db4a6c23eb8d9301f210f7985045985887f2 Mon Sep 17 00:00:00 2001
From: Shadi Sharaf <shady@sharaf.me>
Date: Thu, 10 Sep 2026 15:56:21 +0300
Subject: [PATCH] feat(user-picker): add accessible Ajax user combobox over the
 preload cap (XWPENG-55)

User pickers (records filter, settings exclude rules, alert author
trigger) now share one decision point, Admin::get_preload_users_max()
(new wp_stream_preload_users_max filter, default 50):

- Under the cap: the native <select> from the previous commit.
- Over the cap: an accessible combobox (src/js/utils/user-combobox.js)
  searching the existing wp_stream_filters endpoint. The hidden input is
  the only submitted value; blur and form-submit restore the last
  committed selection so a half-typed query can never win a race against
  Filter/Save. Roles render as a group inside the listbox
  (data-role-options), filtered client-side alongside Ajax user results,
  keeping one control in both modes like the previous Select2 dropdown.
  Stored values (role slug or user id, including 0 for WP-CLI) keep
  working unchanged.

Supporting changes:

- Extract a stateless User_Picker collaborator (classes/class-user-picker.php)
  and register it on Plugin; DB shrinks back to the stream-record store
  and Alert_Trigger_Author, Settings_Renderer, Admin_Ajax, and
  Alerts_List no longer depend on it.
- Alert author trigger: save_fields stores any user id (membership checks
  are impossible when options are not server-rendered); quick edit seeds
  the saved author from hidden row inputs, fixing the long-standing loss
  of the value on inline save; the numeric string '0' (WP-CLI) is no
  longer falsy-dropped in get_display_value() and check_record(), so
  WP-CLI alerts display and match correctly.
- Type Alert::$alert_meta as array, correcting the long-wrong @var int
  docblock; alert_meta is always an array in practice.
- Fix a swapped ($form, $picker) argument order in the exclude-rule
  renderer's row loop that the unit suite caught before commit.

Tests: User_Picker_Test (modes, labels, search, default-cap canary),
Log role-exclusion coverage, alert trigger mode/save/display/matching
units, ajax nonce rejection, renderer dual-mode markup; e2e suites for
the combobox (search/select/clear, race guard, keyboard + aria, wp.a11y
announcements, screen options, role/user round trips), alert author
trigger end-to-end (fires only for the trigger author, WP-CLI title,
quick edit), functional exclude rules, WP-CLI picker labels, multi-IP
round trip.

Signed-off-by: Shadi Sharaf <shady@sharaf.me>
---
 alerts/class-alert-trigger-author.php         |  82 ++-
 changelog.md                                  |   2 +-
 classes/class-admin-ajax.php                  |  69 +-
 classes/class-admin-assets.php                |  49 +-
 classes/class-admin.php                       |  20 +
 classes/class-alert.php                       |  10 +-
 classes/class-alerts-admin-ui.php             |  12 +-
 classes/class-alerts-list.php                 |   7 +
 classes/class-form-generator.php              |  70 ++
 classes/class-list-table.php                  |  63 +-
 classes/class-plugin.php                      |   6 +
 classes/class-settings-renderer.php           | 136 ++--
 classes/class-user-picker.php                 | 220 +++++++
 playwright.config.js                          |   2 +
 src/css/user-combobox.scss                    | 100 +++
 src/js/admin-exclude.js                       |   3 +
 src/js/admin.js                               |  13 +-
 src/js/alerts.js                              |  17 +
 src/js/utils/relative-time.js                 |  13 +
 src/js/utils/user-combobox.js                 | 601 ++++++++++++++++++
 tests/e2e/alert-author-trigger.spec.js        | 223 +++++++
 tests/e2e/exclude-rules.spec.js               | 129 ++++
 tests/e2e/helpers/stream-plugin.js            |  75 +++
 tests/e2e/records-filter.spec.js              |  44 ++
 tests/e2e/settings-save.spec.js               |  82 ++-
 tests/e2e/user-combobox.spec.js               | 384 +++++++++++
 tests/phpunit/Admin_Ajax_Test.php             |  28 +-
 tests/phpunit/Admin_Screen_Records_Test.php   |  11 +
 tests/phpunit/Log_Test.php                    |  41 ++
 tests/phpunit/User_Picker_Test.php            | 160 +++++
 .../alerts/Alert_Trigger_Author_Test.php      |  48 ++
 .../unit/Alerts_Admin_UI_Unit_Test.php        |  20 +-
 .../unit/Settings_Renderer_Unit_Test.php      |  92 ++-
 tests/testcase.php                            |  17 +
 34 files changed, 2695 insertions(+), 154 deletions(-)
 create mode 100644 classes/class-user-picker.php
 create mode 100644 src/css/user-combobox.scss
 create mode 100644 src/js/utils/user-combobox.js
 create mode 100644 tests/e2e/alert-author-trigger.spec.js
 create mode 100644 tests/e2e/exclude-rules.spec.js
 create mode 100644 tests/e2e/user-combobox.spec.js
 create mode 100644 tests/phpunit/User_Picker_Test.php

diff --git a/alerts/class-alert-trigger-author.php b/alerts/class-alert-trigger-author.php
index f00fe41b0..859245db4 100644
--- a/alerts/class-alert-trigger-author.php
+++ b/alerts/class-alert-trigger-author.php
@@ -37,7 +37,10 @@ class Alert_Trigger_Author extends Alert_Trigger {
 	 * @return bool False on failure, otherwise should return original value of $success.
 	 */
 	public function check_record( $success, $record_id, $recordarr, $alert ) {
-		if ( ! empty( $alert->alert_meta['trigger_author'] ) && intval( $alert->alert_meta['trigger_author'] ) !== intval( $recordarr['user_id'] ) ) {
+		// The stored value may be '0' (WP-CLI), which empty() would drop and
+		// turn the trigger into "any author".
+		$trigger_author = isset( $alert->alert_meta['trigger_author'] ) ? (string) $alert->alert_meta['trigger_author'] : '';
+		if ( '' !== $trigger_author && (int) $trigger_author !== (int) $recordarr['user_id'] ) {
 			return false;
 		}
 
@@ -60,12 +63,30 @@ public function add_fields( $form, $alert = array() ) {
 			$value = $alert->alert_meta['trigger_author'];
 		}
 
+		$picker = $this->plugin->user_picker->get( $this->plugin->admin->get_preload_users_max() );
+
+		// Over the preload cap: Ajax user combobox instead of a preloaded select.
+		if ( $picker['ajax'] ) {
+			$form->add_field(
+				'user_combobox',
+				array(
+					'name'           => esc_attr( $this->field_key ),
+					'value'          => esc_attr( $value ),
+					'selected_label' => $this->plugin->user_picker->label_for_value( $value ),
+					'data'           => array(
+						'placeholder' => __( 'Any Author', 'stream' ),
+					),
+				)
+			);
+			return;
+		}
+
 		$form->add_field(
 			'grouped_select',
 			array(
 				'name'    => esc_attr( $this->field_key ),
 				'value'   => esc_attr( $value ),
-				'options' => $this->get_values(),
+				'options' => $this->append_stored_value_option( $this->get_values(), $value ),
 				'data'    => array(
 					'placeholder' => __( 'Any Author', 'stream' ),
 				),
@@ -113,7 +134,7 @@ function ( $login ) {
 			$all_records[] = array(
 				'id'    => $user->id,
 				'value' => $user->id,
-				'text'  => $user->get_display_name(),
+				'text'  => $this->plugin->user_picker->label( $user->id ),
 			);
 		}
 
@@ -131,11 +152,37 @@ function ( $login ) {
 	 */
 	public function save_fields( $alert ) {
 		$input = wp_stream_filter_input( INPUT_POST, $this->field_key );
-		if ( array_key_exists( $input, $this->get_values( $alert ) ) ) {
-			$alert->alert_meta['trigger_author'] = $input;
-		} else {
-			$alert->alert_meta['trigger_author'] = '';
+		$input = is_scalar( $input ) ? (string) $input : '';
+
+		// Only a user ID (or 0 for WP-CLI) is stored; anything else clears the
+		// trigger. Membership checks are impossible in combobox (Ajax) mode,
+		// where the option list is not rendered server-side.
+		$alert->alert_meta['trigger_author'] = ctype_digit( $input ) ? $input : '';
+	}
+
+	/**
+	 * Append the stored author to the option list when missing (e.g. deleted user).
+	 *
+	 * @param array  $options Picker options.
+	 * @param string $current Stored author id.
+	 * @return array
+	 */
+	private function append_stored_value_option( array $options, $current ) {
+		if ( ! ctype_digit( (string) $current ) ) {
+			return $options;
 		}
+
+		$values = array_map( 'strval', array_column( $options, 'value' ) );
+		if ( in_array( (string) $current, $values, true ) ) {
+			return $options;
+		}
+
+		$options[] = array(
+			'value' => (string) $current,
+			'text'  => $this->plugin->user_picker->label( (int) $current ),
+		);
+
+		return $options;
 	}
 
 	/**
@@ -149,18 +196,17 @@ public function save_fields( $alert ) {
 	 * @return string
 	 */
 	public function get_display_value( $context = 'normal', $alert = null ) {
-		$author = ( ! empty( $alert->alert_meta['trigger_author'] ) ) ? $alert->alert_meta['trigger_author'] : null;
-		if ( empty( $author ) ) {
-			$author = __( 'Any User', 'stream' );
-		} elseif ( is_numeric( $author ) ) {
-			$author_data = get_userdata( $author );
-			if ( $author_data ) {
-				$author = $author_data->display_name;
-			} else {
-				$author = __( 'Unknown User', 'stream' );
-			}
+		// Note: the stored value may be '0' (WP-CLI), which is falsy — use isset().
+		$trigger_author = $alert?->alert_meta['trigger_author'] ?? '';
+
+		if ( '' === $trigger_author ) {
+			return __( 'Any User', 'stream' );
+		}
+
+		if ( ctype_digit( $trigger_author ) ) {
+			return $this->plugin->user_picker->label( (int) $trigger_author );
 		}
 
-		return ucfirst( $author );
+		return ucfirst( $trigger_author );
 	}
 }
diff --git a/changelog.md b/changelog.md
index f4ecea5e1..9517e6fd5 100644
--- a/changelog.md
+++ b/changelog.md
@@ -9,7 +9,7 @@
 ### Enhancements
 
 - Add an Outgoing Webhook alert (HTTP POST or PUT, optional headers, JSON body with record-field placeholders). IFTTT is no longer offered when creating a new alert; existing IFTTT alerts still fire. To keep using Maker, configure a webhook whose URL is `https://maker.ifttt.com/trigger/{event}/with/key/{key}`.
-- Replace Select2 with native `<select>` elements across the admin (records filters, settings exclude rules, alert triggers). Author/role filters offer every user in grouped native selects; IP exclusion rules accept a comma-separated list in a plain text field. Relative timestamps now use `Intl.RelativeTimeFormat` (locale-aware) with the same bold relative + absolute date presentation as before. The `select2` and `jquery-timeago` dependencies and their bundled vendor copies are gone, and the unused `stream_get_users` and `stream_get_ips` Ajax actions were removed. Editing an alert now also regenerates its list title ("Author > Context > Action") so it matches the saved triggers instead of keeping the creation-time summary.
+- Replace Select2 with native `<select>` elements across the admin (records filters, settings exclude rules, alert triggers). Author/role filters offer every user in grouped native selects; IP exclusion rules accept a comma-separated list in a plain text field. Relative timestamps now use `Intl.RelativeTimeFormat` (locale-aware) with the same bold relative + absolute date presentation as before. The `select2` and `jquery-timeago` dependencies and their bundled vendor copies are gone, and the unused `stream_get_users` and `stream_get_ips` Ajax actions were removed. User pickers preload every user in a native `<select>` while the site stays under the new `wp_stream_preload_users_max` filter (default 50); larger sites get an accessible Ajax combobox (keyboard navigation, `wp.a11y` announcements) backed by the same `wp_stream_filters` endpoint. Quick-editing an alert no longer drops its author trigger; `WP-CLI` shows as itself instead of "N/A" in pickers and alert summaries; and a stored `WP-CLI` author trigger now actually matches only WP-CLI records (the numeric string `"0"` was previously treated as unset). Editing an alert now also regenerates its list title ("Author > Context > Action") so it matches the saved triggers instead of keeping the creation-time summary.
 - Stop tracking Jetpack modules that no longer exist (Google+ authorship, Mobile theme, Custom CSS). Remaining Jetpack module logging was audited against Jetpack 15.5 on 2026-09-07.
 
 ### Development
diff --git a/classes/class-admin-ajax.php b/classes/class-admin-ajax.php
index fb561888d..f6b8bd092 100644
--- a/classes/class-admin-ajax.php
+++ b/classes/class-admin-ajax.php
@@ -137,34 +137,15 @@ public function ajax_filters() {
 		check_ajax_referer( 'stream_filters_user_search_nonce', 'nonce' );
 
 		switch ( wp_stream_filter_input( INPUT_GET, 'filter' ) ) {
+			// User picker search: shared by the records filter, settings exclude
+			// rules, and alert author trigger comboboxes. See the DB user picker
+			// section for the option-source contract.
 			case 'user_id':
-				$users = array_merge(
-					array(
-						0 => (object) array(
-							'display_name' => 'WP-CLI',
-						),
-					),
-					get_users()
-				);
-
 				$search = wp_stream_filter_input( INPUT_GET, 'q' );
-				if ( is_string( $search ) && '' !== $search ) {
-					// `search` arg for get_users() is not enough.
-					$filtered = array();
-					foreach ( $users as $key => $user ) {
-						if ( self::user_display_name_contains( $user, $search ) ) {
-							$filtered[ $key ] = $user;
-						}
-					}
-					$users = $filtered;
-				}
-
-				if ( count( $users ) > $this->admin->preload_users_max ) {
-					$users = array_slice( $users, 0, $this->admin->preload_users_max );
-				}
-
-				// Get gravatar / roles for final result set.
-				$results = $this->get_users_record_meta( $users );
+				$search = is_string( $search ) ? $search : '';
+				$limit  = max( 20, $this->admin->get_preload_users_max() );
+
+				$results = $this->admin->plugin->user_picker->search( $search, $limit );
 
 				break;
 		}
@@ -175,31 +156,6 @@ public function ajax_filters() {
 
 		die();
 	}
-
-	/**
-	 * Return relevant user meta data for Ajax filter results.
-	 *
-	 * @param array $authors Author data keyed by user ID.
-	 * @return array
-	 */
-	public function get_users_record_meta( $authors ) {
-		$authors_records = array();
-
-		foreach ( $authors as $user_id => $args ) {
-			$author = new Author( $args->ID );
-
-			$authors_records[ $user_id ] = array(
-				'text'  => $author->get_display_name(),
-				'id'    => $author->id,
-				'label' => $author->get_display_name(),
-				'icon'  => $author->get_avatar_src( 32 ),
-				'title' => '',
-			);
-		}
-
-		return $authors_records;
-	}
-
 	/**
 	 * Render confirmation notices keyed by the wp_stream_message query arg.
 	 *
@@ -230,15 +186,4 @@ public function maybe_display_message() {
 			esc_html( $notices[ $message ] )
 		);
 	}
-
-	/**
-	 * Whether a user display name contains the search needle.
-	 *
-	 * @param object $user   User-like object with display_name.
-	 * @param string $search Search needle.
-	 * @return bool
-	 */
-	private static function user_display_name_contains( $user, string $search ): bool {
-		return false !== mb_strpos( mb_strtolower( $user->display_name ), mb_strtolower( $search ) );
-	}
 }
diff --git a/classes/class-admin-assets.php b/classes/class-admin-assets.php
index d1df9f9b4..05fe03401 100644
--- a/classes/class-admin-assets.php
+++ b/classes/class-admin-assets.php
@@ -30,6 +30,29 @@ private function register_hooks(): void {
 		add_action( 'admin_enqueue_scripts', array( $this, 'admin_menu_css' ) );
 	}
 
+	/**
+	 * Script data shared by every screen that renders the user combobox.
+	 *
+	 * @return array{userSearchNonce: string, userSearchI18n: array<string, string>}
+	 */
+	public function user_combobox_l10n(): array {
+		return array(
+			'userSearchNonce' => wp_create_nonce( 'stream_filters_user_search_nonce' ),
+			'userSearchI18n'  => array(
+				'noUsers'       => __( 'No users found.', 'stream' ),
+				'searchError'   => __( 'Unable to search users.', 'stream' ),
+				'minChars'      => __( 'Type at least 2 characters to search users.', 'stream' ),
+				/* translators: %d: number of matching users */
+				'foundSingular' => _n( '%d user found.', '%d users found.', 1, 'stream' ),
+				/* translators: %d: number of matching users */
+				'foundPlural'   => _n( '%d user found.', '%d users found.', 2, 'stream' ),
+				'rolesHeader'   => __( 'Roles', 'stream' ),
+				'usersHeader'   => __( 'Users', 'stream' ),
+				'searchUsersHint' => __( 'Start typing to search users.', 'stream' ),
+			),
+		);
+	}
+
 	/**
 	 * Enqueue scripts/styles for admin screen
 	 *
@@ -43,22 +66,32 @@ public function admin_enqueue_scripts( $hook ) {
 		if ( in_array( $hook, $this->admin->menu->screen_id, true ) ) {
 			$this->admin->plugin->enqueue_asset(
 				'admin',
-				array(),
 				array(
-					'i18n'       => array(
-						'confirm_purge'    => __( 'Are you sure you want to delete all Stream activity records from the database? This cannot be undone.', 'stream' ),
-						'confirm_defaults' => __( 'Are you sure you want to reset all site settings to default? This cannot be undone.', 'stream' ),
+					'wp-a11y',
+				),
+				array_merge(
+					array(
+						'i18n'       => array(
+							'confirm_purge'    => __( 'Are you sure you want to delete all Stream activity records from the database? This cannot be undone.', 'stream' ),
+							'confirm_defaults' => __( 'Are you sure you want to reset all site settings to default? This cannot be undone.', 'stream' ),
+						),
+						'locale'     => strtolower( substr( get_locale(), 0, 2 ) ),
+						'gmt_offset' => get_option( 'gmt_offset' ),
 					),
-					'locale'     => strtolower( substr( get_locale(), 0, 2 ) ),
-					'gmt_offset' => get_option( 'gmt_offset' ),
+					$this->user_combobox_l10n()
 				)
 			);
 
 			$this->admin->plugin->enqueue_asset(
 				'admin-exclude',
-				array(),
 				array(
-					'getActionsNonce' => wp_create_nonce( 'stream_get_actions' ),
+					'wp-a11y',
+				),
+				array_merge(
+					array(
+						'getActionsNonce' => wp_create_nonce( 'stream_get_actions' ),
+					),
+					$this->user_combobox_l10n()
 				)
 			);
 
diff --git a/classes/class-admin.php b/classes/class-admin.php
index efbacc79b..00a68dfca 100644
--- a/classes/class-admin.php
+++ b/classes/class-admin.php
@@ -128,6 +128,26 @@ class Admin {
 	 */
 	public int $preload_users_max = 50;
 
+	/**
+	 * Filtered preload cap for user pickers.
+	 *
+	 * @return int
+	 */
+	public function get_preload_users_max(): int {
+		/**
+		 * Filters the maximum number of users preloaded into a picker.
+		 *
+		 * Above this cap the picker switches to Ajax search. Zero forces Ajax.
+		 *
+		 * @since 5.0.0
+		 *
+		 * @param int $preload_users_max Default cap (50).
+		 */
+		$max = apply_filters( 'wp_stream_preload_users_max', $this->preload_users_max );
+
+		return max( 0, (int) $max );
+	}
+
 	/**
 	 * Admin notices, collected and displayed on proper action
 	 */
diff --git a/classes/class-alert.php b/classes/class-alert.php
index 11d7d3131..e9cbe95e8 100644
--- a/classes/class-alert.php
+++ b/classes/class-alert.php
@@ -52,9 +52,9 @@ class Alert {
 	/**
 	 * Alert meta data
 	 *
-	 * @var int
+	 * @var array
 	 */
-	public $alert_meta;
+	public array $alert_meta;
 
 	/**
 	 * Class constructor
@@ -71,7 +71,11 @@ public function __construct( $item, public $plugin ) {
 		$this->author = isset( $item->author ) ? $item->author : null;
 
 		$this->alert_type = isset( $item->alert_type ) ? $item->alert_type : null;
-		$this->alert_meta = isset( $item->alert_meta ) ? $item->alert_meta : array();
+		// get_post_meta() returns an empty string for posts with no stored
+		// meta; only accept real arrays so the typed property stays honest.
+		$this->alert_meta = isset( $item->alert_meta ) && is_array( $item->alert_meta )
+			? $item->alert_meta
+			: array();
 	}
 
 	/**
diff --git a/classes/class-alerts-admin-ui.php b/classes/class-alerts-admin-ui.php
index 850afeda0..4ca0f1d59 100644
--- a/classes/class-alerts-admin-ui.php
+++ b/classes/class-alerts-admin-ui.php
@@ -101,11 +101,15 @@ public function register_scripts() {
 			'alerts',
 			array(
 				'inline-edit-post',
+				'wp-a11y',
 			),
-			array(
-				'any'             => __( 'Any', 'stream' ),
-				'anyContext'      => __( 'Any Context', 'stream' ),
-				'getActionsNonce' => wp_create_nonce( 'stream_get_actions' ),
+			array_merge(
+				array(
+					'any'             => __( 'Any', 'stream' ),
+					'anyContext'      => __( 'Any Context', 'stream' ),
+					'getActionsNonce' => wp_create_nonce( 'stream_get_actions' ),
+				),
+				$this->plugin->admin->assets->user_combobox_l10n()
 			)
 		);
 	}
diff --git a/classes/class-alerts-list.php b/classes/class-alerts-list.php
index dfecc1f79..a9dfff5d1 100644
--- a/classes/class-alerts-list.php
+++ b/classes/class-alerts-list.php
@@ -141,6 +141,13 @@ public function column_data( $column_name, $post_id ) {
 				<input type="hidden" name="wp_stream_trigger_context" value="<?php echo esc_attr( $trigger_context ); ?>" />
 				<input type="hidden" name="wp_stream_trigger_action" value="<?php echo esc_attr( $trigger_action ); ?>" />
 				<?php
+				$trigger_author = isset( $alert->alert_meta['trigger_author'] )
+					? (string) $alert->alert_meta['trigger_author']
+					: '';
+				?>
+				<input type="hidden" name="wp_stream_trigger_author" value="<?php echo esc_attr( $trigger_author ); ?>" />
+				<input type="hidden" name="wp_stream_trigger_author_label" value="<?php echo esc_attr( $this->plugin->user_picker->label_for_value( $trigger_author ) ); ?>" />
+				<?php
 				echo wp_kses_post( $this->custom_column_actions( $post_id ) );
 				break;
 			case 'alert_type':
diff --git a/classes/class-form-generator.php b/classes/class-form-generator.php
index a9f58be95..e46dff58e 100644
--- a/classes/class-form-generator.php
+++ b/classes/class-form-generator.php
@@ -197,6 +197,9 @@ public function render_field( $field_type, $args, $echo_output = true ) {
 
 				$output .= '</select>';
 				break;
+			case 'user_combobox':
+				$output = $this->render_user_combobox( $args );
+				break;
 			case 'checkbox':
 				$output = sprintf(
 					'<input type="checkbox" name="%1$s" id="%1$s" value="1" %2$s>%3$s',
@@ -221,6 +224,73 @@ public function render_field( $field_type, $args, $echo_output = true ) {
 		echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 	}
 
+	/**
+	 * Accessible user search combobox (hidden value + search input + listbox).
+	 *
+	 * Optional `role_options` render as a "Roles" group inside the listbox
+	 * (single control), mirroring the previous Select2 dropdown's grouping.
+	 * The hidden input carries the submitted value: a user id or role slug.
+	 *
+	 * @param array $args Field args.
+	 * @return string Markup.
+	 */
+	private function render_user_combobox( $args ) {
+		$placeholder = '';
+		if ( ! empty( $args['data']['placeholder'] ) ) {
+			$placeholder = (string) $args['data']['placeholder'];
+		}
+
+		$selected_label = isset( $args['selected_label'] ) ? (string) $args['selected_label'] : '';
+		$search_label   = $placeholder ? $placeholder : __( 'Search users', 'stream' );
+		$value          = (string) $args['value'];
+		$hidden_classes = trim( 'stream-user-combobox__value ' . (string) $args['classes'] );
+
+		$role_options_attr = '';
+		if ( ! empty( $args['role_options'] ) && is_array( $args['role_options'] ) ) {
+			$role_data = array();
+			foreach ( $args['role_options'] as $role_option ) {
+				$role_option = wp_parse_args(
+					$role_option,
+					array(
+						'value' => '',
+						'text'  => '',
+					)
+				);
+				if ( '' === (string) $role_option['value'] ) {
+						continue;
+				}
+				$role_data[] = array(
+					'value' => (string) $role_option['value'],
+					'label' => (string) $role_option['text'],
+				);
+			}
+			$role_options_attr = sprintf(
+				' data-role-options="%s"',
+				esc_attr( wp_json_encode( $role_data ) )
+			);
+		}
+
+		$hidden_id = '';
+		if ( ! empty( $args['id'] ) ) {
+			$hidden_id = (string) $args['id'];
+		} elseif ( false === strpos( (string) $args['name'], '[' ) ) {
+			$hidden_id = (string) $args['name'];
+		}
+		$id_attr = '' !== $hidden_id ? sprintf( ' id="%s"', esc_attr( $hidden_id ) ) : '';
+
+		return sprintf(
+			'<div class="stream-user-combobox" data-placeholder="%1$s" data-selected-label="%2$s"%3$s><input type="search" class="stream-user-combobox__input" role="combobox" aria-expanded="false" aria-autocomplete="list" autocomplete="off" placeholder="%4$s" aria-label="%4$s" /><input type="hidden" name="%5$s"%6$s class="%7$s" value="%8$s" /><ul class="stream-user-combobox__listbox" role="listbox" hidden></ul></div>',
+			esc_attr( $placeholder ),
+			esc_attr( $selected_label ),
+			$role_options_attr,
+			esc_attr( $search_label ),
+			esc_attr( $args['name'] ),
+			$id_attr,
+			esc_attr( $hidden_classes ),
+			esc_attr( $value )
+		);
+	}
+
 	/**
 	 * Render a single <option> for a native select.
 	 *
diff --git a/classes/class-list-table.php b/classes/class-list-table.php
index 11ee026ed..52348626a 100644
--- a/classes/class-list-table.php
+++ b/classes/class-list-table.php
@@ -19,6 +19,13 @@ class List_Table extends \WP_List_Table {
 	 */
 	private List_Table_Query_Builder $query_builder;
 
+	/**
+	 * Whether the user filter is using Ajax search.
+	 *
+	 * @var bool
+	 */
+	private bool $user_filter_ajax = false;
+
 	/**
 	 * Renders record cell HTML.
 	 *
@@ -337,6 +344,23 @@ public function assemble_records( $column ) {
 		if ( 'user_id' === $column ) {
 			$all_records = array();
 
+			// Over the preload cap the select becomes an Ajax combobox: preload
+			// only the currently selected user, if any.
+			$picker = $this->plugin->user_picker->get( $this->plugin->admin->get_preload_users_max() );
+
+			if ( $picker['ajax'] ) {
+				$this->user_filter_ajax = true;
+				$selected_user          = (string) wp_stream_filter_input( INPUT_GET, 'user_id' );
+				$selected_label         = $this->plugin->user_picker->label_for_value( $selected_user );
+				if ( '' === $selected_user || '' === $selected_label ) {
+					return array();
+				}
+
+				return array(
+					$selected_user => $selected_label,
+				);
+			}
+
 			$users = array_map(
 				function ( $user_id ) {
 					return new Author( $user_id );
@@ -368,7 +392,7 @@ function ( $login ) {
 			);
 
 			foreach ( $users as $user ) {
-				$all_records[ $user->id ] = $user->get_display_name();
+				$all_records[ $user->id ] = $this->plugin->user_picker->label( $user->id );
 			}
 		} else {
 			$prefixed_column = sprintf( 'stream_%s', $column );
@@ -440,7 +464,7 @@ public function get_filters() {
 		$filters['user_id'] = array(
 			'title' => __( 'users', 'stream' ),
 			'items' => $users,
-			'ajax'  => count( $users ) <= 0,
+			'ajax'  => $this->user_filter_ajax,
 		);
 
 		$filters['context'] = array(
@@ -592,6 +616,31 @@ public function filter_select( $name, $title, $items, $ajax = false ) {
 
 		echo '<div class="stream-filter-control">';
 
+		if ( $ajax && 'user_id' === $name ) {
+			$selected_label = isset( $items[ $selected ] ) && is_array( $items[ $selected ] )
+				? (string) $items[ $selected ]['label']
+				: ( is_string( $items[ $selected ] ?? null ) ? $items[ $selected ] : '' );
+
+			$form = new Form_Generator();
+			$html = $form->render_field(
+				'user_combobox',
+				array(
+					'name'           => $name,
+					'id'             => $select_id,
+					'value'          => $selected,
+					'selected_label' => $selected_label,
+					'classes'        => 'chosen-select',
+					'data'           => array(
+						'placeholder' => $placeholder,
+					),
+				),
+				false
+			);
+			echo $html; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+			echo '</div>';
+			return;
+		}
+
 		printf(
 			'<label class="screen-reader-text" for="%1$s">%2$s</label>',
 			esc_attr( $select_id ),
@@ -974,13 +1023,15 @@ public function get_users_dropdown_items( $users ) {
 		$record_meta = array();
 
 		foreach ( $users as $user_id => $args ) {
-			$user = new Author( $user_id );
+			// Picker labels keep user 0 ("WP-CLI") and deleted users readable.
+			$label = $this->plugin->user_picker->label( (int) $user_id );
+			$icon  = $this->plugin->user_picker->icon( (int) $user_id );
 
 			$record_meta[ $user_id ] = array(
-				'text'     => $user->get_display_name(),
+				'text'     => $label,
 				'id'       => $user_id,
-				'label'    => $user->get_display_name(),
-				'icon'     => $user->get_avatar_src( 32 ),
+				'label'    => $label,
+				'icon'     => $icon,
 				'title'    => '',
 				'disabled' => ! empty( $args['disabled'] ),
 			);
diff --git a/classes/class-plugin.php b/classes/class-plugin.php
index ae2c569fb..c12d31bf1 100755
--- a/classes/class-plugin.php
+++ b/classes/class-plugin.php
@@ -93,6 +93,11 @@ class Plugin {
 	 */
 	public ?Settings $settings = null;
 
+	/**
+	 * Server-side backend for user pickers (native select / Ajax combobox).
+	 */
+	public ?User_Picker $user_picker = null;
+
 	/**
 	 * Process DB migrations.
 	 */
@@ -341,6 +346,7 @@ public function init() {
 		$this->alerts      = new Alerts( $this );
 		$this->alerts_list = new Alerts_List( $this );
 		$this->abilities   = new Abilities( $this );
+		$this->user_picker = new User_Picker();
 	}
 
 	/**
diff --git a/classes/class-settings-renderer.php b/classes/class-settings-renderer.php
index 09935d97d..2d0bfe23c 100644
--- a/classes/class-settings-renderer.php
+++ b/classes/class-settings-renderer.php
@@ -274,6 +274,7 @@ public function render_field( $field, $options, $option_key ) {
 	private function render_rule_list( $field, $current_value, $option_key, $section, $name, $description ) {
 		unset( $field );
 
+		$picker = $this->plugin->user_picker->get( $this->plugin->admin->get_preload_users_max() );
 		$form   = new Form_Generator();
 		$output = '<p class="description">' . esc_html( $description ) . '</p>';
 
@@ -315,6 +316,7 @@ private function render_rule_list( $field, $current_value, $option_key, $section
 		foreach ( $current_value['exclude_row'] as $key => $value ) {
 			$exclude_rows[] = $this->render_rule_list_row(
 				$form,
+				$picker,
 				$current_value,
 				$key,
 				$option_key,
@@ -343,6 +345,7 @@ private function render_rule_list( $field, $current_value, $option_key, $section
 	 * Render a single exclude-rule table row.
 	 *
 	 * @param Form_Generator $form          Form helper.
+	 * @param array          $picker        User picker state (ajax + items).
 	 * @param array          $current_value Stored rule list value.
 	 * @param string|int     $key           Row key.
 	 * @param string         $option_key    Settings option key.
@@ -350,7 +353,7 @@ private function render_rule_list( $field, $current_value, $option_key, $section
 	 * @param string         $name          Field name.
 	 * @return string
 	 */
-	private function render_rule_list_row( $form, $current_value, $key, $option_key, $section, $name ) {
+	private function render_rule_list_row( $form, $picker, $current_value, $key, $option_key, $section, $name ) {
 		$author_or_role = isset( $current_value['author_or_role'][ $key ] ) ? $current_value['author_or_role'][ $key ] : '';
 		$connector      = isset( $current_value['connector'][ $key ] ) ? $current_value['connector'][ $key ] : '';
 		$context        = isset( $current_value['context'][ $key ] ) ? $current_value['context'][ $key ] : '';
@@ -365,42 +368,14 @@ private function render_rule_list_row( $form, $current_value, $key, $option_key,
 			);
 		}
 
-		$author_or_role_values = array(
-			array(
-				'text'     => __( 'Roles', 'stream' ),
-				'children' => $role_options,
-			),
-			array(
-				'text'     => __( 'Users', 'stream' ),
-				'children' => $this->get_exclude_user_options(),
-			),
-		);
-
-		// Stored value missing from the lists (e.g. a deleted user): keep it selectable.
-		if ( '' !== (string) $author_or_role && ctype_digit( (string) $author_or_role ) ) {
-			$known = array_map( 'strval', array_column( $author_or_role_values[1]['children'], 'value' ) );
-			if ( ! in_array( (string) $author_or_role, $known, true ) ) {
-				$user                                   = get_userdata( (int) $author_or_role );
-				$author_or_role_values[1]['children'][] = array(
-					'value' => (string) $author_or_role,
-					'text'  => ( $user && $user->ID ) ? $user->display_name : esc_html__( 'N/A', 'stream' ),
-				);
-			}
-		}
-
-		$author_or_role_input = $form->render_field(
-			'grouped_select',
-			array(
-				'name'    => esc_attr( sprintf( '%1$s[%2$s_%3$s][%4$s][]', $option_key, $section, $name, 'author_or_role' ) ),
-				'value'   => (string) $author_or_role,
-				'options' => $author_or_role_values,
-				'classes' => 'author_or_role',
-				// Data attributes are escaped in Form_Generator::prepare_data_attributes_string().
-				'data'    => array(
-					'placeholder' => __( 'Any Author or Role', 'stream' ),
-				),
-			),
-			false
+		$author_or_role_input = $this->render_exclude_author_control(
+			$form,
+			$picker,
+			$role_options,
+			(string) $author_or_role,
+			$option_key,
+			$section,
+			$name
 		);
 
 		$context_values = array();
@@ -571,6 +546,93 @@ public function get_terms_labels( $column ) {
 		return $return_labels;
 	}
 
+	/**
+	 * Author-or-role control: one picker in both modes — a native select with
+	 * Roles/Users optgroups under the preload cap, an Ajax combobox whose
+	 * listbox carries the same Roles group plus user search results over it.
+	 *
+	 * @param Form_Generator $form         Form helper.
+	 * @param array          $picker       User picker state (ajax + items).
+	 * @param array          $role_options Role options.
+	 * @param string         $current      Stored value (user ID or role slug).
+	 * @param string         $option_key   Option key.
+	 * @param string         $section      Section.
+	 * @param string         $name         Field name.
+	 * @return string
+	 */
+	private function render_exclude_author_control( $form, $picker, $role_options, $current, $option_key, $section, $name ) {
+		$field_name  = sprintf( '%1$s[%2$s_%3$s][%4$s][]', $option_key, $section, $name, 'author_or_role' );
+		$placeholder = __( 'Any Author or Role', 'stream' );
+
+		if ( ! empty( $picker['ajax'] ) ) {
+			// One control for both: whichever label matches the stored value
+			// (role slug or user id) is seeded into the combobox.
+			$selected_label = '';
+
+			foreach ( $role_options as $role_option ) {
+				if ( (string) $role_option['value'] === $current ) {
+					$selected_label = (string) $role_option['text'];
+				}
+			}
+
+			if ( '' === $selected_label && ctype_digit( $current ) ) {
+				$selected_label = $this->plugin->user_picker->label( (int) $current );
+			}
+
+			return $form->render_field(
+				'user_combobox',
+				array(
+					'name'           => esc_attr( $field_name ),
+					'value'          => $current,
+					'selected_label' => $selected_label,
+					'classes'        => 'author_or_role',
+					'role_options'   => $role_options,
+					'data'           => array(
+						'placeholder' => $placeholder,
+					),
+				),
+				false
+			);
+		}
+
+		$author_or_role_values = array(
+			array(
+				'text'     => __( 'Roles', 'stream' ),
+				'children' => $role_options,
+			),
+			array(
+				'text'     => __( 'Users', 'stream' ),
+				'children' => $this->get_exclude_user_options(),
+			),
+		);
+
+		// Stored value missing from the lists (e.g. a deleted user): keep it selectable.
+		if ( '' !== $current && ctype_digit( $current ) ) {
+			$known = array_map( 'strval', array_column( $author_or_role_values[1]['children'], 'value' ) );
+			if ( ! in_array( $current, $known, true ) ) {
+				$user                                   = get_userdata( (int) $current );
+				$author_or_role_values[1]['children'][] = array(
+					'value' => $current,
+					'text'  => ( $user && $user->ID ) ? $user->display_name : esc_html__( 'N/A', 'stream' ),
+				);
+			}
+		}
+
+		return $form->render_field(
+			'grouped_select',
+			array(
+				'name'    => esc_attr( $field_name ),
+				'value'   => $current,
+				'options' => $author_or_role_values,
+				'classes' => 'author_or_role',
+				'data'    => array(
+					'placeholder' => $placeholder,
+				),
+			),
+			false
+		);
+	}
+
 	/**
 	 * User options for the exclude-rules author/role select.
 	 *
diff --git a/classes/class-user-picker.php b/classes/class-user-picker.php
new file mode 100644
index 000000000..55253f4a9
--- /dev/null
+++ b/classes/class-user-picker.php
@@ -0,0 +1,220 @@
+<?php
+/**
+ * Server-side backend for every "pick a user" control.
+ *
+ * @package WP_Stream
+ */
+
+namespace WP_Stream;
+
+/**
+ * Class User_Picker
+ *
+ * One shared decision for the records filter, settings exclude rules, and the
+ * alert author trigger: under the preload cap (Admin::get_preload_users_max(),
+ * filterable) every user is preloaded into a native <select>; over the cap the
+ * control becomes the Ajax combobox (src/js/utils/user-combobox.js) whose
+ * search hits Admin_Ajax::ajax_filters() -> User_Picker::search().
+ *
+ * The option source is wp_users (+ network super-admins on multisite, plus the
+ * WP-CLI pseudo-user id 0) — the same set the previous Select2 Ajax dropdowns
+ * offered. Labels come from Author; 0 renders as "WP-CLI" and deleted users as
+ * "Unknown user {id}" so stored values always display.
+ *
+ * Stateless: no Plugin dependency, safe to instantiate anywhere.
+ *
+ * @package WP_Stream
+ */
+class User_Picker {
+
+	/**
+	 * Picker state for the current preload cap.
+	 *
+	 * Under the cap every user (plus network super-admins on multisite and the
+	 * WP-CLI pseudo-user) is preloaded into the picker, sorted by display name.
+	 * Over the cap the picker switches to Ajax search and no items are sent.
+	 *
+	 * @param int $cap Preload cap (see Admin::get_preload_users_max()).
+	 * @return array{ajax: bool, items: array<int, array{id: int, text: string, label: string, icon: string|false}>}
+	 */
+	public function get( int $cap ): array {
+		if ( $cap < 1 ) {
+			return array(
+				'ajax'  => true,
+				'items' => array(),
+			);
+		}
+
+		$user_count  = count_users();
+		$total_users = $user_count['total_users'];
+
+		if ( $total_users > $cap ) {
+			return array(
+				'ajax'  => true,
+				'items' => array(),
+			);
+		}
+
+		return array(
+			'ajax'  => false,
+			'items' => $this->label_items( $this->user_ids() ),
+		);
+	}
+
+	/**
+	 * Ajax search results for a user picker.
+	 *
+	 * Matches logins, names, emails, and URLs (so network super-admins surface
+	 * when their own fields match), and offers the WP-CLI pseudo-user for
+	 * system-ish searches.
+	 *
+	 * @param string $term  Search term.
+	 * @param int    $limit Maximum rows to return.
+	 * @return array<int, array{id: int, text: string, label: string, icon: string|false}>
+	 */
+	public function search( string $term, int $limit ): array {
+		$term  = trim( $term );
+		$limit = max( 1, $limit );
+
+		if ( '' === $term ) {
+			return array();
+		}
+
+		$query = new \WP_User_Query(
+			array(
+				'search'         => '*' . $term . '*',
+				'search_columns' => array(
+					'user_login',
+					'user_nicename',
+					'user_email',
+					'user_url',
+					'display_name',
+				),
+				'orderby'        => 'display_name',
+				'number'         => $limit,
+				'fields'         => 'ID',
+				'count_total'    => false,
+			)
+		);
+
+		$ids = array_map( 'intval', $query->get_results() );
+
+		// Note: super-admins are NOT appended unconditionally (the previous
+		// exclude-screen endpoint did that); the search itself covers logins,
+		// emails, URLs, and display names, so they surface when relevant.
+
+		if ( preg_match( '/wp|cli|system|unknown/i', $term ) ) {
+			$ids[] = 0;
+		}
+
+		return array_slice( $this->label_items( array_values( array_unique( $ids ) ) ), 0, $limit );
+	}
+
+	/**
+	 * Display label for a picker user.
+	 *
+	 * @param int $user_id User ID. Zero is WP-CLI.
+	 * @return string
+	 */
+	public function label( int $user_id ): string {
+		if ( 0 === $user_id ) {
+			return 'WP-CLI';
+		}
+
+		$author = new Author( $user_id );
+
+		if ( $author->is_deleted() ) {
+			return sprintf(
+				/* translators: %d: user ID */
+				__( 'Unknown user %d', 'stream' ),
+				$user_id
+			);
+		}
+
+		return $author->get_display_name();
+	}
+
+	/**
+	 * Display label for a stored picker value (form input, alert meta, query arg).
+	 *
+	 * @param mixed $value Raw stored value.
+	 * @return string Label, or empty string when the value is not a user ID.
+	 */
+	public function label_for_value( $value ): string {
+		$value = (string) $value;
+
+		return ctype_digit( $value ) ? $this->label( (int) $value ) : '';
+	}
+
+	/**
+	 * Avatar URL for a picker user.
+	 *
+	 * @param int $user_id User ID. Zero is WP-CLI.
+	 * @return string|false Image URL, or false when avatars are disabled or missing.
+	 */
+	public function icon( int $user_id ) {
+		return ( new Author( $user_id ) )->get_avatar_src( 32 );
+	}
+
+	/**
+	 * All user IDs offered by a picker: site users, network super-admins, WP-CLI.
+	 *
+	 * @return int[]
+	 */
+	private function user_ids(): array {
+		$ids = array_map( 'intval', get_users( array( 'fields' => 'ID' ) ) );
+
+		if ( is_multisite() && is_super_admin() ) {
+			foreach ( get_super_admins() as $login ) {
+				$super = get_user_by( 'login', $login );
+				if ( $super ) {
+					$ids[] = (int) $super->ID;
+				}
+			}
+		}
+
+		$ids[] = 0; // WP-CLI pseudo-user.
+
+		return array_values( array_unique( $ids ) );
+	}
+
+	/**
+	 * Attach labels, icons, and natural name order to picker user IDs.
+	 *
+	 * @param int[] $ids User IDs (0 is WP-CLI).
+	 * @return array<int, array{id: int, text: string, label: string, icon: string|false}>
+	 */
+	private function label_items( array $ids ): array {
+		$lookup = array();
+		foreach ( $ids as $user_id ) {
+			if ( $user_id > 0 ) {
+				$lookup[] = $user_id;
+			}
+		}
+
+		if ( array() !== $lookup && function_exists( 'cache_users' ) ) {
+			cache_users( $lookup );
+		}
+
+		$items = array();
+		foreach ( $ids as $user_id ) {
+			$label   = $this->label( $user_id );
+			$icon    = $this->icon( $user_id );
+			$items[] = array(
+				'id'    => $user_id,
+				'text'  => $label,
+				'label' => $label,
+				'icon'  => $icon,
+			);
+		}
+
+		usort(
+			$items,
+			static function ( $a, $b ) {
+				return strnatcasecmp( $a['label'], $b['label'] );
+			}
+		);
+
+		return $items;
+	}
+}
diff --git a/playwright.config.js b/playwright.config.js
index a9db9283a..a30029622 100644
--- a/playwright.config.js
+++ b/playwright.config.js
@@ -27,6 +27,8 @@ const settingsUiSpecs = [
 	'**/alert-create.spec.js',
 	'**/export-download.spec.js',
 	'**/records-filter.spec.js',
+	'**/exclude-rules.spec.js',
+	'**/user-combobox.spec.js',
 ];
 
 /**
diff --git a/src/css/user-combobox.scss b/src/css/user-combobox.scss
new file mode 100644
index 000000000..c0ca09e3e
--- /dev/null
+++ b/src/css/user-combobox.scss
@@ -0,0 +1,100 @@
+.stream-user-combobox {
+	position: relative;
+	display: inline-block;
+	vertical-align: top;
+	max-width: 100%;
+}
+
+.stream-user-combobox__input {
+	display: block;
+	width: 100%;
+	max-width: 100%;
+	margin: 0;
+}
+
+.stream-user-combobox__listbox {
+	position: absolute;
+	z-index: 100000;
+	top: 100%;
+	left: 0;
+	right: 0;
+	margin: 0;
+	padding: 0;
+	max-height: 220px;
+	overflow: auto;
+	list-style: none;
+	background: #fff;
+	border: 1px solid #8c8f94;
+	box-shadow: 0 2px 6px rgba(0, 0, 0, 0.08);
+}
+
+.stream-user-combobox__group {
+	margin: 0;
+	padding: 6px 8px 2px;
+	font-size: 11px;
+	font-weight: 600;
+	line-height: 1.4;
+	color: #646970;
+	text-transform: uppercase;
+	cursor: default;
+}
+
+.stream-user-combobox__hint {
+	margin: 0;
+	padding: 4px 8px 6px;
+	color: #646970;
+	font-style: italic;
+}
+
+.stream-user-combobox__option {
+	display: flex;
+	align-items: center;
+	gap: 8px;
+	margin: 0;
+	padding: 4px 8px;
+	cursor: pointer;
+}
+
+.stream-user-combobox__avatar {
+	flex: 0 0 24px;
+	width: 24px;
+	height: 24px;
+	border-radius: 2px;
+	object-fit: cover;
+	background: #dcdcde;
+}
+
+.stream-user-combobox__name {
+	flex: 1 1 auto;
+	min-width: 0;
+	overflow: hidden;
+	text-overflow: ellipsis;
+	white-space: nowrap;
+}
+
+.stream-user-combobox__option[aria-selected="true"],
+.stream-user-combobox__option.is-active {
+	background: #2271b1;
+	color: #fff;
+}
+
+.stream-user-combobox__empty {
+	margin: 0;
+	padding: 6px 8px;
+	color: #646970;
+}
+
+.toplevel_page_wp_stream .stream-filter-control .stream-user-combobox {
+	min-width: 180px;
+}
+
+.toplevel_page_wp_stream .stream-filter-control .stream-user-combobox__input {
+	height: 28px;
+	margin: 0;
+}
+
+.toplevel_page_wp_stream .stream-filter-control .stream-user-combobox__avatar {
+	flex: 0 0 20px;
+	width: 20px;
+	height: 20px;
+}
diff --git a/src/js/admin-exclude.js b/src/js/admin-exclude.js
index 06ce886e4..852609c4f 100644
--- a/src/js/admin-exclude.js
+++ b/src/js/admin-exclude.js
@@ -8,6 +8,7 @@ import $ from 'jquery';
  * Internal dependencies
  */
 import wp_stream_regenerate_alt_rows from './utils/wp-stream-regenerate-alt-rows';
+import initUserComboboxes from './utils/user-combobox';
 
 const $excludeRows = $( '.stream-exclude-list tbody tr:not(.hidden)' );
 const $placeholderRow = $( '.stream-exclude-list tr.helper' );
@@ -30,6 +31,8 @@ function initExcludeRows( $rows ) {
 		},
 	);
 
+	initUserComboboxes( $( '.stream-user-combobox', $rows ), window[ 'wp-stream-admin-exclude' ] );
+
 	$( '.exclude_rules_remove_rule_row', $rows ).on(
 		'click', function( e ) {
 			const $thisRow = $( this ).closest( 'tr' );
diff --git a/src/js/admin.js b/src/js/admin.js
index f60530277..2bf9135db 100644
--- a/src/js/admin.js
+++ b/src/js/admin.js
@@ -10,9 +10,17 @@ import $ from 'jquery';
 import '../css/admin.scss';
 import getQueryVars from './utils/get-query-vars';
 import formatRelativeTime from './utils/relative-time';
+import initUserComboboxes from './utils/user-combobox';
 
 $( 'li.toplevel_page_wp_stream ul li.wp-first-item.current' ).parent().parent().find( '.update-plugins' ).remove();
 
+/**
+ * Bind Ajax user comboboxes on the records screen.
+ */
+function initRecordsUserSearch() {
+	initUserComboboxes( $( '#record-filter-form .stream-user-combobox' ), window[ 'wp-stream-admin' ] );
+}
+
 /**
  * Filter control wrapper (or the select itself) for screen-option visibility.
  *
@@ -180,7 +188,7 @@ $( document ).ready(
 				all_hidden = false;
 			}
 
-			$( 'div.alignleft.actions select.chosen-select' ).each(
+			$( 'div.alignleft.actions select.chosen-select, div.alignleft.actions .stream-user-combobox__value' ).each(
 				function() {
 					const name = $( this ).prop( 'name' );
 					if ( 'date_predefined' === name ) {
@@ -209,7 +217,7 @@ $( document ).ready(
 			$( 'div.date-interval' ).hide();
 		}
 
-		$( 'div.actions select.chosen-select' ).each(
+		$( 'div.actions select.chosen-select, div.actions .stream-user-combobox__value' ).each(
 			function() {
 				const name = $( this ).prop( 'name' );
 				if ( 'date_predefined' === name ) {
@@ -445,6 +453,7 @@ const intervals = {
 $( document ).ready(
 	function() {
 		intervals.init( $( '.date-interval' ) );
+		initRecordsUserSearch();
 
 		// Disable option groups whose children are all disabled
 		$( 'select[name="context"] .level-1' ).each(
diff --git a/src/js/alerts.js b/src/js/alerts.js
index 90bef15e0..187a99233 100644
--- a/src/js/alerts.js
+++ b/src/js/alerts.js
@@ -4,6 +4,11 @@
  */
 import $ from 'jquery';
 
+/**
+ * Internal dependencies
+ */
+import initUserComboboxes, { setUserComboboxSelection } from './utils/user-combobox';
+
 let $post_row,
 	$edit_row;
 function bindTriggerSelects( id ) {
@@ -31,6 +36,8 @@ function bindTriggerSelects( id ) {
 			$( el ).val( parts.join( '-' ) ).trigger( 'change' );
 		},
 	);
+
+	initUserComboboxes( $target.find( '.stream-user-combobox' ), window[ 'wp-stream-alerts' ] );
 }
 const $alertSettingSelect = $( '#wp_stream_alert_type' );
 
@@ -229,6 +236,16 @@ window.inlineEditPost.edit = function( id ) {
 		$edit_row.find( 'select[name="wp_stream_alert_status"] option[value="' + alert_status + '"]' ).attr( 'selected', 'selected' );
 		bindTriggerSelects( '#edit-' + post_id );
 
+		// Seed the author trigger with the saved value (previously dropped on inline edit).
+		const alert_trigger_author = $post_row.find( 'input[name="wp_stream_trigger_author"]' ).val();
+		const alert_trigger_author_label = $post_row.find( 'input[name="wp_stream_trigger_author_label"]' ).val();
+		const $authorCombobox = $edit_row.find( '.stream-user-combobox' );
+		if ( $authorCombobox.length ) {
+			setUserComboboxSelection( $authorCombobox, alert_trigger_author, alert_trigger_author_label );
+		} else {
+			$edit_row.find( 'select[name="wp_stream_trigger_author"]' ).val( alert_trigger_author );
+		}
+
 		// Alert type handling
 		$( '#wp_stream_alert_type_form' ).hide();
 		const alert_type = $post_row.find( 'input[name="wp_stream_alert_type"]' ).val();
diff --git a/src/js/utils/relative-time.js b/src/js/utils/relative-time.js
index 96bed4de1..36251c556 100644
--- a/src/js/utils/relative-time.js
+++ b/src/js/utils/relative-time.js
@@ -1,3 +1,16 @@
+/*
+ * Locale-aware relative timestamps (replaces the jquery-timeago plugin).
+ *
+ * - Locale resolution: document <html lang> first, then the admin script
+ *   locale passed from PHP, then the runtime default.
+ * - One Intl.RelativeTimeFormat instance per locale is memoized; each table
+ *   row only calls format().
+ * - Division thresholds mirror the previous timeago output (seconds → years
+ *   with 4.34524-week months).
+ * - Presentation is unchanged from the jquery-timeago UI: callers prepend a
+ *   bold <strong><time class="timeago"> next to the original absolute date.
+ */
+
 const DIVISIONS = [
 	{ amount: 60, unit: 'second' },
 	{ amount: 60, unit: 'minute' },
diff --git a/src/js/utils/user-combobox.js b/src/js/utils/user-combobox.js
new file mode 100644
index 000000000..f393481ba
--- /dev/null
+++ b/src/js/utils/user-combobox.js
@@ -0,0 +1,601 @@
+/*
+ * Accessible Ajax user combobox used by Stream user pickers.
+ *
+ * Rendered server-side by Form_Generator::render_user_combobox() as:
+ *   .stream-user-combobox
+ *   ├── .stream-user-combobox__input             <input role="combobox">
+ *   ├── .stream-user-combobox__value             <input type="hidden"> (submitted)
+ *   └── .stream-user-combobox__listbox           <ul role="listbox" hidden>
+ *
+ * Pickers that also accept roles (settings exclude rules) pass them via a
+ * data-role-options JSON attribute; they render as a "Roles" group inside the
+ * same listbox (filtered client-side alongside Ajax user results), mirroring
+ * the previous Select2 dropdown's Roles/Users grouping in one control. The
+ * hidden value stores whichever was picked: a role slug or a user id.
+ *
+ * Behaviour contract:
+ * - Results come from the `wp_stream_filters` endpoint (`filter=user_id`,
+ *   `q=<term>`), nonce supplied via Admin_Assets::user_combobox_l10n().
+ * - The hidden input holds the only submitted value. The visible input is a
+ *   search box, never a value source, so a half-typed query cannot win a
+ *   race against Filter / Save: blur and form-submit both restore the last
+ *   committed selection (see restoreCommitted()).
+ * - Roles (when provided) are always selectable from the listbox; picking
+ *   either a role or a user replaces the previous selection.
+ * - Keyboard: ArrowDown/ArrowUp move (or reopen the cached list), Enter picks
+ *   the active option, Escape closes (and, when closed, clears). wp.a11y
+ *   announces result counts, empty results, and errors.
+ */
+
+/**
+ * External dependencies
+ */
+import $ from 'jquery';
+
+/**
+ * Internal dependencies
+ */
+import '../../css/user-combobox.scss';
+
+const USER_SEARCH_MIN_LENGTH = 2;
+const USER_SEARCH_DELAY_MS = 500;
+
+let comboboxSerial = 0;
+
+/**
+ * Write a committed selection into a combobox root (hidden value, visible label, role reset).
+ *
+ * Shared by the module and by callers that seed a cloned form (alerts inline edit).
+ *
+ * @param {Object} $root jQuery `.stream-user-combobox` root.
+ * @param {string} id    User id ('' clears).
+ * @param {string} label Display name ('' clears).
+ */
+export function setUserComboboxSelection( $root, id, label ) {
+	const value = id || '';
+	const text = label || '';
+
+	$root.find( '.stream-user-combobox__value' ).val( value ).data( 'committedValue', value );
+	$root.find( '.stream-user-combobox__input' ).val( text );
+	$root.data( 'selectedLabel', text );
+}
+
+/**
+ * Normalize wp_stream_filters JSON (array or object map) into a list.
+ *
+ * @param {*} data Ajax payload.
+ * @return {Array} User result objects.
+ */
+function normalizeUserFilterResults( data ) {
+	if ( Array.isArray( data ) ) {
+		return data;
+	}
+	if ( data && 'object' === typeof data ) {
+		return Object.keys( data ).map( function( key ) {
+			return data[ key ];
+		} );
+	}
+	return [];
+}
+
+/**
+ * Announce a message to assistive technology.
+ *
+ * @param {string} message Text to speak.
+ */
+function speakMessage( message ) {
+	if ( ! message ) {
+		return;
+	}
+	if ( window.wp && window.wp.a11y && 'function' === typeof window.wp.a11y.speak ) {
+		window.wp.a11y.speak( message, 'polite' );
+	}
+}
+
+/**
+ * Parse the data-role-options JSON attribute into role entries.
+ *
+ * @param {string} attr Raw attribute value.
+ * @return {Array<{value: string, label: string}>} Role options.
+ */
+function parseRoleOptions( attr ) {
+	try {
+		const parsed = JSON.parse( attr || '[]' );
+		return Array.isArray( parsed ) ? parsed.filter( ( role ) => role && role.value ) : [];
+	} catch {
+		return [];
+	}
+}
+
+/**
+ * Roles whose label contains the needle (case-insensitive).
+ *
+ * @param {Array<{value: string, label: string}>} roles  Role options.
+ * @param {string}                                needle Search term.
+ * @return {Array<{value: string, label: string}>} Matching roles.
+ */
+function filterRoles( roles, needle ) {
+	if ( ! needle ) {
+		return roles;
+	}
+	const lower = needle.toLowerCase();
+	return roles.filter( ( role ) => ( role.label || '' ).toLowerCase().includes( lower ) );
+}
+
+/**
+ * Whether a picker row has a usable avatar URL.
+ *
+ * @param {*} icon Candidate from Ajax (`icon` may be false or empty).
+ * @return {boolean} True when `icon` is a non-empty string.
+ */
+function hasIconUrl( icon ) {
+	return 'string' === typeof icon && '' !== icon;
+}
+
+/**
+ * Apply a `%d` count into a PHP-translated template.
+ *
+ * @param {string} template Localized string with a `%d` placeholder.
+ * @param {number} count    Matching-user count.
+ * @return {string} Filled string.
+ */
+function formatCount( template, count ) {
+	return String( template || '' ).replace( '%d', String( count ) );
+}
+
+/**
+ * Map a result item to id/label/icon.
+ *
+ * @param {Object} item Ajax user row.
+ * @return {{id: string, label: string, icon: string}} Normalized option.
+ */
+function toOption( item ) {
+	const id = undefined !== item.id ? String( item.id ) : '';
+	const label = item.label || item.text || '';
+	const icon = hasIconUrl( item.icon ) ? item.icon : '';
+	return { id, label, icon };
+}
+
+/**
+ * Bind one combobox root.
+ *
+ * @param {Object} $root jQuery root.
+ * @param {string} nonce `wp_stream_filters` nonce.
+ * @param {Object} i18n  PHP-translated strings from `user_combobox_l10n()`.
+ */
+function bindCombobox( $root, nonce, i18n ) {
+	if ( $root.data( 'streamUserComboboxReady' ) ) {
+		return;
+	}
+	$root.data( 'streamUserComboboxReady', true );
+
+	comboboxSerial += 1;
+	const uid = 'stream-user-cb-' + String( comboboxSerial );
+	const $input = $root.find( '.stream-user-combobox__input' );
+	const $hidden = $root.find( '.stream-user-combobox__value' );
+	const $list = $root.find( '.stream-user-combobox__listbox' );
+
+	// Roles render inside the listbox (single control, like the previous
+	// Select2 dropdown); pickers without roles simply have none.
+	const roleOptions = parseRoleOptions( $root.attr( 'data-role-options' ) );
+
+	$input.attr( 'id', uid + '-input' );
+	$input.attr( 'aria-controls', uid + '-listbox' );
+	$list.attr( 'id', uid + '-listbox' );
+
+	// Server-rendered selection: a user id or role slug, plus its label.
+	const selectedLabel = $root.attr( 'data-selected-label' ) || '';
+	if ( selectedLabel && $hidden.val() ) {
+		setUserComboboxSelection( $root, $hidden.val(), selectedLabel );
+	} else {
+		$hidden.data( 'committedValue', $hidden.val() );
+	}
+
+	/**
+	 * Close the listbox.
+	 */
+	function closeList() {
+		// A selection or escape inside the debounce window must not reopen the list later.
+		window.clearTimeout( $root.data( 'userSearchTimer' ) );
+		const pending = $root.data( 'userSearchXhr' );
+		if ( pending && pending.abort ) {
+			pending.abort();
+		}
+		$list.attr( 'hidden', 'hidden' ).empty();
+		$input.attr( 'aria-expanded', 'false' ).removeAttr( 'aria-activedescendant' );
+	}
+
+	/**
+	 * Active option node.
+	 *
+	 * @return {Object} jQuery option.
+	 */
+	function getActiveOption() {
+		return $list.find( '.stream-user-combobox__option.is-active' );
+	}
+
+	/**
+	 * Highlight an option by index.
+	 *
+	 * @param {number} index Option index.
+	 */
+	function setActiveIndex( index ) {
+		const $options = $list.find( '.stream-user-combobox__option' );
+		if ( ! $options.length ) {
+			return;
+		}
+		const next = Math.max( 0, Math.min( index, $options.length - 1 ) );
+		$options.removeClass( 'is-active' ).attr( 'aria-selected', 'false' );
+		const $active = $options.eq( next );
+		$active.addClass( 'is-active' ).attr( 'aria-selected', 'true' );
+		$input.attr( 'aria-activedescendant', $active.attr( 'id' ) );
+		const node = $active.get( 0 );
+		if ( node && node.scrollIntoView ) {
+			node.scrollIntoView( { block: 'nearest' } );
+		}
+	}
+
+	/**
+	 * Apply a chosen user.
+	 *
+	 * @param {string} id    User id.
+	 * @param {string} label Display name.
+	 */
+	function selectUser( id, label ) {
+		setUserComboboxSelection( $root, id, label );
+		closeList();
+	}
+
+	/**
+	 * Clear the committed user (and role, if any).
+	 */
+	function clearSelection() {
+		setUserComboboxSelection( $root, '', '' );
+		closeList();
+	}
+
+	/**
+	 * Put the last committed user or role back into the hidden field.
+	 *
+	 * Used on blur and on form submit so a keystroke that cleared the live
+	 * value cannot win the race against Filter / Save.
+	 */
+	function restoreCommitted() {
+		const committed = $hidden.data( 'committedValue' );
+		const label = $root.data( 'selectedLabel' );
+		if ( ! $hidden.val() && committed && label ) {
+			$hidden.val( committed );
+			$input.val( label );
+		}
+	}
+
+	/**
+	 * Reopen the listbox from keyboard (cached rows, or a new search).
+	 */
+	function openListFromKeyboard() {
+		const cached = $root.data( 'userSearchOptions' );
+		if ( Array.isArray( cached ) ) {
+			renderOptions( filterRoles( roleOptions, '' ), cached );
+			return;
+		}
+
+		const needle = String( $input.val() || '' ).trim();
+		if ( needle.length >= USER_SEARCH_MIN_LENGTH ) {
+			requestUsers( needle );
+			return;
+		}
+
+		// Nothing typed yet: offer the roles straight away (users need a query).
+		if ( roleOptions.length ) {
+			renderOptions( roleOptions, [] );
+		}
+	}
+
+	/**
+	 * Clicking into the control opens the roles view, like the previous
+	 * Select2 dropdown did (users still need a search query).
+	 */
+	$input.on( 'focus', function() {
+		if ( ! $list.is( '[hidden]' ) ) {
+			return;
+		}
+		if ( String( $input.val() || '' ).trim() || ! roleOptions.length ) {
+			return;
+		}
+		renderOptions( roleOptions, [] );
+	} );
+
+	/**
+	 * Render role and user entries in the listbox as grouped options.
+	 *
+	 * @param {Array<{value: string, label: string}>} roles Matching roles.
+	 * @param {Array}                                 users Ajax user results.
+	 */
+	function renderOptions( roles, users ) {
+		$list.empty();
+		$root.data( 'userSearchOptions', users );
+
+		const optionCount = roles.length + users.length;
+
+		if ( 0 === optionCount ) {
+			const none = i18n.noUsers || '';
+			$list.append(
+				$( '<li></li>' )
+					.addClass( 'stream-user-combobox__empty' )
+					.attr( 'role', 'presentation' )
+					.text( none ),
+			);
+			$list.removeAttr( 'hidden' );
+			$input.attr( 'aria-expanded', 'true' ).removeAttr( 'aria-activedescendant' );
+			speakMessage( none );
+			return;
+		}
+
+		let index = 0;
+
+		if ( roles.length ) {
+			$list.append( groupHeader( i18n.rolesHeader || 'Roles' ) );
+			roles.forEach( function( role ) {
+				$list.append( buildOption( { id: role.value, label: role.label, icon: '' }, index++ ) );
+			} );
+		}
+
+		if ( users.length ) {
+			$list.append( groupHeader( i18n.usersHeader || 'Users' ) );
+			users.forEach( function( item ) {
+				const option = toOption( item );
+				if ( option.id ) {
+					$list.append( buildOption( option, index++ ) );
+				}
+			} );
+		}
+
+		// Users need a query; when only roles are shown say so.
+		if ( roles.length && ! users.length && ! String( $input.val() || '' ).trim() ) {
+			$list.append(
+				$( '<li></li>' )
+					.addClass( 'stream-user-combobox__hint' )
+					.attr( 'role', 'presentation' )
+					.text( i18n.searchUsersHint || '' ),
+			);
+		}
+
+		$list.removeAttr( 'hidden' );
+		$input.attr( 'aria-expanded', 'true' );
+		setActiveIndex( 0 );
+		speakMessage(
+			formatCount(
+				1 === optionCount ? i18n.foundSingular : i18n.foundPlural,
+				optionCount,
+			),
+		);
+	}
+
+	/**
+	 * Non-interactive group header row for the listbox.
+	 *
+	 * @param {string} label Header text.
+	 * @return {Object} jQuery <li>.
+	 */
+	function groupHeader( label ) {
+		return $( '<li></li>' )
+			.addClass( 'stream-user-combobox__group' )
+			.attr( 'role', 'presentation' )
+			.text( label );
+	}
+
+	/**
+	 * Build one selectable listbox option node.
+	 *
+	 * @param {{id: string, label: string, icon: string}} option Option data.
+	 * @param {number}                                    index  Stable index for ids.
+	 * @return {Object} jQuery <li role="option">.
+	 */
+	function buildOption( option, index ) {
+		const $option = $( '<li></li>' )
+			.addClass( 'stream-user-combobox__option' )
+			.attr( {
+				id: `${ uid }-opt-${ index }`,
+				role: 'option',
+				'aria-selected': 'false',
+				'data-id': option.id,
+				'data-label': option.label,
+			} );
+
+		if ( option.icon ) {
+			$option.append(
+				$( '<img>' )
+					.addClass( 'stream-user-combobox__avatar' )
+					.attr( {
+						src: option.icon,
+						alt: '',
+						width: 32,
+						height: 32,
+					} ),
+			);
+		}
+
+		$option.append(
+			$( '<span></span>' )
+				.addClass( 'stream-user-combobox__name' )
+				.text( option.label ),
+		);
+
+		return $option;
+	}
+
+	/**
+	 * Request remote users.
+	 *
+	 * @param {string} query Search needle.
+	 */
+	function requestUsers( query ) {
+		const pending = $root.data( 'userSearchXhr' );
+		if ( pending && pending.abort ) {
+			pending.abort();
+		}
+
+		$input.attr( 'aria-busy', 'true' );
+
+		const xhr = $.ajax(
+			{
+				type: 'GET',
+				url: window.ajaxurl,
+				dataType: 'json',
+				data: {
+					action: 'wp_stream_filters',
+					nonce,
+					filter: 'user_id',
+					q: query,
+				},
+				success( data ) {
+					renderOptions(
+						filterRoles( roleOptions, String( $input.val() || '' ).trim() ),
+						normalizeUserFilterResults( data ),
+					);
+				},
+				error( jqXHR, textStatus ) {
+					if ( 'abort' === textStatus ) {
+						return;
+					}
+					speakMessage( i18n.searchError || '' );
+				},
+				complete() {
+					$input.removeAttr( 'aria-busy' );
+				},
+			},
+		);
+
+		$root.data( 'userSearchXhr', xhr );
+	}
+
+	$input.on( 'input search', function( event ) {
+		window.clearTimeout( $root.data( 'userSearchTimer' ) );
+
+		const query = String( $input.val() || '' ).trim();
+		if ( '' === query ) {
+			clearSelection();
+			return;
+		}
+
+		if ( 'search' === event.type ) {
+			return;
+		}
+
+		// Searching invalidates the live value; blur/submit restores the
+		// committed selection (user or role).
+		$hidden.val( '' );
+
+		const timer = window.setTimeout(
+			function() {
+				const needle = String( $input.val() || '' ).trim();
+				if ( needle.length < USER_SEARCH_MIN_LENGTH ) {
+					closeList();
+					if ( needle.length > 0 ) {
+						speakMessage( i18n.minChars || '' );
+					}
+					return;
+				}
+				requestUsers( needle );
+			},
+			USER_SEARCH_DELAY_MS,
+		);
+
+		$root.data( 'userSearchTimer', timer );
+	} );
+
+	$input.on( 'keydown', function( event ) {
+		const isOpen = ! $list.is( '[hidden]' );
+
+		if ( 'ArrowDown' === event.key ) {
+			if ( ! isOpen ) {
+				event.preventDefault();
+				openListFromKeyboard();
+				return;
+			}
+			const $options = $list.find( '.stream-user-combobox__option' );
+			if ( ! $options.length ) {
+				return;
+			}
+			event.preventDefault();
+			setActiveIndex( $options.index( getActiveOption() ) + 1 );
+			return;
+		}
+
+		if ( 'ArrowUp' === event.key ) {
+			if ( ! isOpen ) {
+				event.preventDefault();
+				openListFromKeyboard();
+				return;
+			}
+			const $options = $list.find( '.stream-user-combobox__option' );
+			if ( ! $options.length ) {
+				return;
+			}
+			event.preventDefault();
+			setActiveIndex( $options.index( getActiveOption() ) - 1 );
+			return;
+		}
+
+		if ( 'Enter' === event.key ) {
+			const $active = getActiveOption();
+			if ( isOpen && $active.length ) {
+				event.preventDefault();
+				selectUser( $active.attr( 'data-id' ), $active.attr( 'data-label' ) );
+				return;
+			}
+			restoreCommitted();
+			return;
+		}
+
+		if ( 'Escape' === event.key ) {
+			if ( isOpen ) {
+				closeList();
+				return;
+			}
+			if ( $hidden.data( 'committedValue' ) ) {
+				event.preventDefault();
+				clearSelection();
+			}
+		}
+	} );
+
+	$list.on( 'mousedown', '.stream-user-combobox__option', function( event ) {
+		event.preventDefault();
+		selectUser(
+			this.getAttribute( 'data-id' ),
+			this.getAttribute( 'data-label' ),
+		);
+	} );
+
+	$input.on( 'blur', function() {
+		window.setTimeout(
+			function() {
+				closeList();
+				restoreCommitted();
+			},
+			150,
+		);
+	} );
+
+	$input.closest( 'form' ).on( 'submit', restoreCommitted );
+}
+
+/**
+ * Initialize user comboboxes in a jQuery collection.
+ *
+ * @param {Object} $nodes    jQuery collection of `.stream-user-combobox` roots.
+ * @param {Object} localized Script data from Admin_Assets user_combobox_l10n() (`userSearchNonce`, `userSearchI18n`).
+ */
+export default function initUserComboboxes( $nodes, localized ) {
+	if ( ! $nodes || ! $nodes.length ) {
+		return;
+	}
+	const nonce = ( localized && localized.userSearchNonce ) || '';
+	const i18n = ( localized && localized.userSearchI18n ) || {};
+	$nodes.each(
+		function() {
+			bindCombobox( $( this ), nonce, i18n );
+		},
+	);
+}
diff --git a/tests/e2e/alert-author-trigger.spec.js b/tests/e2e/alert-author-trigger.spec.js
new file mode 100644
index 000000000..209d48454
--- /dev/null
+++ b/tests/e2e/alert-author-trigger.spec.js
@@ -0,0 +1,223 @@
+/**
+ * Alert author trigger end-to-end: picking, titling, firing, and quick edit.
+ *
+ * Covers the user-picker migration's core promise — an alert bound to one
+ * author fires only for that author — plus the title regeneration and
+ * quick-edit seeding fixes. Runs in both picker modes.
+ */
+
+/**
+ * WordPress dependencies
+ */
+import { test, expect } from '@wordpress/e2e-test-utils-playwright';
+
+/**
+ * Internal dependencies
+ */
+import {
+	forceUserComboboxViaWpCli,
+	newAuthedPage,
+	restorePreloadUsersCapViaWpCli,
+	seedAuthorRecordViaWpCli,
+	selectUserCombobox,
+} from './helpers/stream-plugin';
+
+test.describe.configure( { mode: 'serial' } );
+
+const ALICE_ID = '3';
+const ALICE_NAME = 'Alice Editor';
+
+/** Row ids created by this spec, trashed in afterAll. */
+const createdRowIds = [];
+
+test.afterAll( async ( { browser } ) => {
+	const page = await newAuthedPage( browser );
+	await page.goto( '/wp-admin/edit.php?post_type=wp_stream_alerts' );
+	for ( const rowId of createdRowIds ) {
+		await page.evaluate( async ( id ) => {
+			await fetch( `/wp-admin/post.php?post=${ id }&action=trash`, {
+				credentials: 'same-origin',
+			} ).catch( () => {} );
+		}, rowId );
+	}
+	await page.context().close();
+} );
+
+/**
+ * Create an alert via the Add New row with the given author.
+ *
+ * @param {import('@playwright/test').Page} page      Authed page.
+ * @param {string}                          author    Author user id ('' = any).
+ * @param {Function}                        setAuthor Mode-specific picker callback.
+ * @return {Promise<string>} New row id (`post-{ID}`).
+ */
+async function createAlertWithAuthor( page, author, setAuthor ) {
+	await page.goto( '/wp-admin/edit.php?post_type=wp_stream_alerts' );
+	const existingIds = await listAlertRowIds( page );
+	await page.locator( 'a.page-title-action' ).click();
+	const form = page.locator( '#add-new-alert' );
+	await expect( form ).toBeVisible();
+	await page.waitForTimeout( 400 );
+
+	await setAuthor();
+
+	await form.locator( '#wp_stream_alert_type' ).selectOption( 'highlight' );
+	await form.locator( '#wp_stream_highlight_color' ).selectOption( 'blue' );
+	await form.locator( 'button.button-primary.save' ).click( { noWaitAfter: true } );
+	await expect( page.locator( '#add-new-alert' ) ).toHaveCount( 0, {
+		timeout: 20_000,
+	} );
+
+	const afterIds = await listAlertRowIds( page );
+	const newRowId = afterIds.find( ( id ) => ! existingIds.includes( id ) ) || '';
+	expect( newRowId, 'Alert row should appear after save' ).toBeTruthy();
+	createdRowIds.push( newRowId );
+	return newRowId;
+}
+
+/**
+ * Row ids currently listed on the Alerts table.
+ *
+ * @param {import('@playwright/test').Page} wpPage Page.
+ * @return {Promise<string[]>} `post-{ID}` values.
+ */
+async function listAlertRowIds( wpPage ) {
+	return wpPage
+		.locator( '#the-list tr.type-wp_stream_alerts' )
+		.evaluateAll( ( rows ) => rows.map( ( row ) => row.id ).filter( Boolean ) );
+}
+
+test.describe( 'Alert author trigger (native picker)', () => {
+	test( 'pick saves, titles the alert, and fires only for that author', async ( {
+		page,
+	} ) => {
+		const setAuthor = () =>
+			page.evaluate(
+				( author ) => {
+					const select = document.querySelector(
+						'#add-new-alert select[name="wp_stream_trigger_author"]',
+					);
+					select.value = author;
+					select.dispatchEvent( new Event( 'change', { bubbles: true } ) );
+				},
+				ALICE_ID,
+			);
+
+		const rowId = await createAlertWithAuthor( page, ALICE_ID, setAuthor );
+
+		// The list title regenerates from the saved trigger.
+		await expect( page.locator( `#${ rowId }` ) ).toContainText( ALICE_NAME );
+
+		// Fire uniquely-titled records as two different authors and judge the
+		// alert only by rows carrying our marker (and our highlight color, so
+		// pre-existing alerts on the install cannot skew the result).
+		const marker = `E2E fires ${ Date.now() } `;
+		seedAuthorRecordViaWpCli( 1, marker + 'by-admin' );
+		seedAuthorRecordViaWpCli( ALICE_ID, marker + 'by-alice' );
+
+		await page.goto( '/wp-admin/admin.php?page=wp_stream' );
+		const adminRow = page
+			.locator( '#the-list tr:not(.no-items)' )
+			.filter( { hasText: marker + 'by-admin' } );
+		const aliceRow = page
+			.locator( '#the-list tr:not(.no-items)' )
+			.filter( { hasText: marker + 'by-alice' } );
+
+		await expect( adminRow ).toHaveCount( 1 );
+		await expect( adminRow ).not.toHaveClass( /highlight-blue/ );
+		await expect( aliceRow ).toHaveCount( 1 );
+		await expect( aliceRow ).toHaveClass( /highlight-blue/ );
+		await expect( aliceRow.locator( '.column-user_id' ) ).toContainText(
+			ALICE_NAME,
+		);
+	} );
+
+	test( 'WP-CLI author titles the alert as WP-CLI', async ( { page } ) => {
+		const setAuthor = () =>
+			page.evaluate( () => {
+				const select = document.querySelector(
+					'#add-new-alert select[name="wp_stream_trigger_author"]',
+				);
+				select.value = '0';
+				select.dispatchEvent( new Event( 'change', { bubbles: true } ) );
+			} );
+
+		const rowId = await createAlertWithAuthor( page, '0', setAuthor );
+
+		await expect( page.locator( `#${ rowId }` ) ).toContainText( 'WP-CLI' );
+	} );
+
+	test( 'quick edit seeds the saved author and editing updates the title', async ( {
+		page,
+	} ) => {
+		const setAuthor = () =>
+			page.evaluate(
+				( author ) => {
+					const select = document.querySelector(
+						'#add-new-alert select[name="wp_stream_trigger_author"]',
+					);
+					select.value = author;
+					select.dispatchEvent( new Event( 'change', { bubbles: true } ) );
+				},
+				ALICE_ID,
+			);
+		const rowId = await createAlertWithAuthor( page, ALICE_ID, setAuthor );
+
+		// Open Quick Edit on the new row.
+		await page.evaluate( ( id ) => {
+			document
+				.querySelector( `#the-list #${ id } .row-actions .editinline` )
+				?.click();
+		}, rowId );
+		const editRow = page.locator( `#edit-${ rowId.replace( 'post-', '' ) }` );
+		await expect( editRow ).toBeVisible();
+
+		// The saved author is preselected (the previously-dropped value).
+		await expect(
+			editRow.locator( 'select[name="wp_stream_trigger_author"]' ),
+		).toHaveValue( ALICE_ID );
+
+		// Change it to admin and save; the title follows (regeneration fix).
+		await editRow.locator( 'select[name="wp_stream_trigger_author"]' ).selectOption( '1' );
+		await editRow.locator( 'button.save' ).click( { noWaitAfter: true } );
+		await page.waitForTimeout( 2500 );
+		await expect( page.locator( `#${ rowId }` ) ).toContainText( /(^|\s)admin/ );
+	} );
+} );
+
+test.describe( 'Alert author trigger (combobox picker)', () => {
+	test.beforeAll( () => {
+		forceUserComboboxViaWpCli();
+	} );
+
+	test.afterAll( () => {
+		restorePreloadUsersCapViaWpCli();
+	} );
+
+	test( 'combobox pick saves, titles, and quick edit seeds the combobox', async ( {
+		page,
+	} ) => {
+		const setAuthor = async () => {
+			const combobox = page.locator( '#add-new-alert .stream-user-combobox' );
+			await selectUserCombobox( combobox, 'alice' );
+			await expect(
+				combobox.locator( '.stream-user-combobox__value' ),
+			).not.toHaveValue( '' );
+		};
+
+		const rowId = await createAlertWithAuthor( page, '', setAuthor );
+		await expect( page.locator( `#${ rowId }` ) ).toContainText( ALICE_NAME );
+
+		// Quick Edit seeds the combobox with the saved author's label.
+		await page.evaluate( ( id ) => {
+			document
+				.querySelector( `#the-list #${ id } .row-actions .editinline` )
+				?.click();
+		}, rowId );
+		const editRow = page.locator( `#edit-${ rowId.replace( 'post-', '' ) }` );
+		await expect( editRow ).toBeVisible();
+		await expect(
+			editRow.locator( '.stream-user-combobox__input' ),
+		).toHaveValue( ALICE_NAME );
+	} );
+} );
diff --git a/tests/e2e/exclude-rules.spec.js b/tests/e2e/exclude-rules.spec.js
new file mode 100644
index 000000000..302a4c0a6
--- /dev/null
+++ b/tests/e2e/exclude-rules.spec.js
@@ -0,0 +1,129 @@
+/**
+ * Functional exclude-rule coverage: a rule saved through the UI must actually
+ * suppress records. Covers both author-or-role kinds in whatever picker mode
+ * the environment renders (native select or combobox).
+ */
+
+/**
+ * WordPress dependencies
+ */
+import { test, expect } from '@wordpress/e2e-test-utils-playwright';
+
+/**
+ * Internal dependencies
+ */
+import {
+	dropAllNetworkExcludeRulesViaWpCli,
+	newAuthedPage,
+	seedAuthorRecordViaWpCli,
+} from './helpers/stream-plugin';
+
+const NETWORK_EXCLUDE_URL =
+	'/wp-admin/network/admin.php?page=wp_stream_network_settings&tab=exclude';
+/** Alice Editor (id 3) has the editor role on this install. */
+const EDITOR_ID = 3;
+
+test.describe.configure( { mode: 'serial' } );
+
+test.afterAll( () => {
+	dropAllNetworkExcludeRulesViaWpCli();
+} );
+
+/**
+ * Count Stream records for a fresh, unique title marker.
+ *
+ * @param {import('@playwright/test').Page} page   Authed page.
+ * @param {string}                          marker Unique substring of the seeded titles.
+ * @return {Promise<number>} Rows shown for the marker.
+ */
+async function countRecordsFor( page, marker ) {
+	await page.goto( '/wp-admin/admin.php?page=wp_stream' );
+	await page.waitForSelector( 'table.wp-list-table' );
+	return page
+		.locator( '#the-list tr:not(.no-items)' )
+		.filter( { hasText: marker } )
+		.count();
+}
+
+/**
+ * Add an exclude rule with the given author-or-role value via the UI.
+ *
+ * @param {import('@playwright/test').Page} page         Authed page on the exclude tab.
+ * @param {string}                          desiredValue 'editor' (role) or '3' (user id).
+ * @param {string}                          desiredLabel Label to pick in the control.
+ */
+async function addAuthorOrRoleRule( page, desiredValue, desiredLabel ) {
+	await page.goto( NETWORK_EXCLUDE_URL );
+	await page.locator( '#exclude_rules_new_rule' ).click();
+	await page.waitForTimeout( 400 );
+
+	const row = page
+		.locator( '.stream-exclude-list tbody tr:not(.hidden):not(.helper)' )
+		.last();
+	const nativeSelect = row.locator( 'select.author_or_role' );
+
+	if ( await nativeSelect.count() ) {
+		await nativeSelect.selectOption( desiredValue );
+	} else {
+		const combobox = row.locator( '.stream-user-combobox' );
+		await combobox.locator( '.stream-user-combobox__input' ).click();
+		const option = combobox
+			.locator( '.stream-user-combobox__option', { hasText: desiredLabel } )
+			.first();
+		await option.waitFor( { state: 'visible', timeout: 10_000 } );
+		await option.evaluate( ( node ) => {
+			node.dispatchEvent( new MouseEvent( 'mousedown', { bubbles: true } ) );
+		} );
+	}
+
+	await Promise.all( [
+		page.waitForURL( /settings-updated=true/ ),
+		page.getByRole( 'button', { name: 'Save Changes' } ).click( {
+			noWaitAfter: true,
+		} ),
+	] );
+	await page.waitForLoadState( 'load' );
+	await page.waitForTimeout( 500 );
+}
+
+test.describe( 'Exclude rules suppress records', () => {
+	test( 'role rule excludes records by that role', async ( { browser } ) => {
+		const page = await newAuthedPage( browser );
+		const marker = 'E2E role rule ' + Date.now();
+
+		await addAuthorOrRoleRule( page, 'editor', 'Editor' );
+
+		seedAuthorRecordViaWpCli( EDITOR_ID, marker );
+		const visible = await countRecordsFor( page, marker );
+		expect( visible ).toBe( 0 );
+
+		// Removing the rule lets the (already fired) record show up.
+		dropAllNetworkExcludeRulesViaWpCli();
+		seedAuthorRecordViaWpCli( EDITOR_ID, marker );
+		await expect
+			.poll( () => countRecordsFor( page, marker ) )
+			.toBeGreaterThan( 0 );
+
+		await page.close();
+	} );
+
+	test( 'user rule excludes records by that user', async ( { browser } ) => {
+		const page = await newAuthedPage( browser );
+		const marker = 'E2E user rule ' + Date.now();
+
+		await addAuthorOrRoleRule( page, '3', 'Alice Editor' );
+
+		seedAuthorRecordViaWpCli( EDITOR_ID, marker );
+		await expect
+			.poll( () => countRecordsFor( page, marker ) )
+			.toBe( 0 );
+
+		dropAllNetworkExcludeRulesViaWpCli();
+		seedAuthorRecordViaWpCli( EDITOR_ID, marker );
+		await expect
+			.poll( () => countRecordsFor( page, marker ) )
+			.toBeGreaterThan( 0 );
+
+		await page.close();
+	} );
+} );
diff --git a/tests/e2e/helpers/stream-plugin.js b/tests/e2e/helpers/stream-plugin.js
index 736e7be0f..03d8c5ac8 100644
--- a/tests/e2e/helpers/stream-plugin.js
+++ b/tests/e2e/helpers/stream-plugin.js
@@ -206,6 +206,20 @@ async function saveOptionsGeneral( page ) {
  * link leaves a pending reaper, so the next suite would see the running
  * copy instead of the idle-state link.
  */
+/**
+ * Trigger a Stream record as a specific user (wp-cli).
+ *
+ * Publishes a unique post as that user; the posts connector logs reliably
+ * from wp-cli (option updates do not on this install).
+ *
+ * @param {number|string} userId      User to act as.
+ * @param {string}        titlePrefix Marker included in the post title.
+ */
+export function seedAuthorRecordViaWpCli( userId = 1, titlePrefix = 'E2E author trigger' ) {
+	const php = `wp_set_current_user( intval( '${ userId }' ) ); $suffix = substr( md5( uniqid( '', true ) ), 0, 8 ); wp_insert_post( array( 'post_type' => 'post', 'post_status' => 'publish', 'post_title' => '${ titlePrefix } ' . $suffix ) );`;
+	runWpCli( [ 'eval', php ] );
+}
+
 export function clearAutoPurgeQueueViaWpCli() {
 	runWpCli( [
 		'db',
@@ -225,12 +239,43 @@ export function clearAutoPurgeQueueViaWpCli() {
  *
  * @param {string} [ipAddress] IP of the row this run added (TEST-NET-3).
  */
+/**
+ * Remove every network exclude rule (unconditional, unlike the selective clear).
+ */
+export function dropAllNetworkExcludeRulesViaWpCli() {
+	const php = `$opt = (array) get_site_option( "wp_stream_network", array() ); unset( $opt["exclude_rules"] ); update_site_option( "wp_stream_network", $opt );`;
+	runWpCli( [ 'eval', php ] );
+}
+
 export function clearNetworkExcludeRulesViaWpCli( ipAddress = '203.0.113.44' ) {
 	const dropIp = JSON.stringify( ipAddress || '' );
 	const php = `$opt = (array) get_site_option( "wp_stream_network", array() ); if ( empty( $opt["exclude_rules"] ) || ! is_array( $opt["exclude_rules"] ) ) { return; } $rules = $opt["exclude_rules"]; $rows = isset( $rules["exclude_row"] ) && is_array( $rules["exclude_row"] ) ? $rules["exclude_row"] : array(); $drop_ip = ${ dropIp }; $keys = array( "exclude_row", "author_or_role", "connector", "context", "action", "ip_address" ); $keep = array(); foreach ( $rows as $row_id => $marker ) { $ip = isset( $rules["ip_address"][ $row_id ] ) ? (string) $rules["ip_address"][ $row_id ] : ""; $is_empty = true; foreach ( $keys as $key ) { if ( ! empty( $rules[ $key ][ $row_id ] ) ) { $is_empty = false; break; } } if ( $is_empty || ( "" !== $drop_ip && $ip === $drop_ip ) ) { continue; } $keep[] = $row_id; } if ( empty( $keep ) ) { unset( $opt["exclude_rules"] ); } else { $filtered = array(); foreach ( $keys as $key ) { if ( ! isset( $rules[ $key ] ) || ! is_array( $rules[ $key ] ) ) { continue; } foreach ( $keep as $row_id ) { if ( array_key_exists( $row_id, $rules[ $key ] ) ) { $filtered[ $key ][ $row_id ] = $rules[ $key ][ $row_id ]; } } } $opt["exclude_rules"] = $filtered; } update_site_option( "wp_stream_network", $opt );`;
 	runWpCli( [ 'eval', php ] );
 }
 
+const PRELOAD_CAP_MU_PLUGIN = 'stream-e2e-preload-users-max.php';
+
+/**
+ * Force every Stream user picker into Ajax combobox mode.
+ *
+ * Pickers preload a native `<select>` while distinct record authors stay
+ * under `wp_stream_preload_users_max` (50). A fresh wp-env has a handful of
+ * authors, so specs that exercise the combobox drop a one-line mu-plugin
+ * that pins the cap to 0. Pair with `restorePreloadUsersCapViaWpCli()`.
+ */
+export function forceUserComboboxViaWpCli() {
+	const php = `if ( ! is_dir( WPMU_PLUGIN_DIR ) ) { mkdir( WPMU_PLUGIN_DIR, 0755, true ); } file_put_contents( WPMU_PLUGIN_DIR . "/${ PRELOAD_CAP_MU_PLUGIN }", "<?php add_filter( \\"wp_stream_preload_users_max\\", \\"__return_zero\\" );" );`;
+	runWpCli( [ 'eval', php ] );
+}
+
+/**
+ * Remove the mu-plugin added by `forceUserComboboxViaWpCli()`.
+ */
+export function restorePreloadUsersCapViaWpCli() {
+	const php = `$file = WPMU_PLUGIN_DIR . "/${ PRELOAD_CAP_MU_PLUGIN }"; if ( file_exists( $file ) ) { unlink( $file ); }`;
+	runWpCli( [ 'eval', php ] );
+}
+
 /**
  * Publish a post on a subdirectory site via wp-cli.
  *
@@ -285,6 +330,36 @@ export async function setJQuerySelect( page, selector, value, optionSelector ) {
 	);
 }
 
+/**
+ * Search a Stream user combobox and pick the first matching option.
+ *
+ * @param {import('@playwright/test').Locator} combobox Combobox root.
+ * @param {string}                             query    Search term (min 2 chars).
+ */
+export async function selectUserCombobox( combobox, query ) {
+	const search = combobox.locator( '.stream-user-combobox__input' );
+	await search.fill( query );
+	const option = combobox.locator( '[role="option"]' ).first();
+	await option.waitFor( { state: 'visible', timeout: 10_000 } );
+	await option.evaluate( ( node ) => {
+		node.dispatchEvent( new MouseEvent( 'mousedown', { bubbles: true } ) );
+	} );
+}
+
+/**
+ * Clear a Stream user combobox the way the native search "×" does
+ * (empty value + `input` and `search` events), which also clears the hidden field.
+ *
+ * @param {import('@playwright/test').Locator} combobox Combobox root.
+ */
+export async function clearUserCombobox( combobox ) {
+	await combobox.locator( '.stream-user-combobox__input' ).evaluate( ( input ) => {
+		input.value = '';
+		input.dispatchEvent( new Event( 'input', { bubbles: true } ) );
+		input.dispatchEvent( new Event( 'search', { bubbles: true } ) );
+	} );
+}
+
 /**
  * Origin used for wp-cli `--url`, matching Playwright's baseURL.
  *
diff --git a/tests/e2e/records-filter.spec.js b/tests/e2e/records-filter.spec.js
index ddece7f86..c12514635 100644
--- a/tests/e2e/records-filter.spec.js
+++ b/tests/e2e/records-filter.spec.js
@@ -8,8 +8,11 @@ import { test, expect } from '@wordpress/e2e-test-utils-playwright';
  */
 import {
 	followAdminLink,
+	forceUserComboboxViaWpCli,
 	seedSettingsRecord,
 	setJQuerySelect,
+	selectUserCombobox,
+	restorePreloadUsersCapViaWpCli,
 } from './helpers/stream-plugin';
 
 /**
@@ -59,6 +62,20 @@ test.describe( 'Records filters', () => {
 		await expectVisibleRows( page );
 	} );
 
+	test( 'user filter labels the system user as WP-CLI', async ( { page } ) => {
+		await page.goto( '/wp-admin/admin.php?page=wp_stream' );
+		await expect(
+			page.locator( 'select[name="user_id"] option[value="0"]' ),
+		).toHaveText( 'WP-CLI' );
+	} );
+
+	test( 'date range select shows the All Time placeholder option', async ( { page } ) => {
+		await page.goto( '/wp-admin/admin.php?page=wp_stream' );
+		await expect(
+			page.locator( 'select[name="date_predefined"] option' ).first(),
+		).toHaveText( 'All Time' );
+	} );
+
 	test( 'filters by connector (parent context option)', async ( { page } ) => {
 		await page.goto( '/wp-admin/admin.php?page=wp_stream' );
 		const connector = await page.evaluate( () => {
@@ -179,6 +196,33 @@ test.describe( 'Records filters', () => {
 	} );
 } );
 
+test.describe( 'Records filters (user combobox)', () => {
+	test.beforeAll( () => {
+		forceUserComboboxViaWpCli();
+	} );
+
+	test.afterAll( () => {
+		restorePreloadUsersCapViaWpCli();
+	} );
+
+	test( 'filters by user via combobox search', async ( { page } ) => {
+		await page.goto( '/wp-admin/admin.php?page=wp_stream' );
+		const combobox = page.locator(
+			'#record-filter-form .stream-user-combobox',
+		);
+		await expect( combobox ).toHaveCount( 1 );
+		await selectUserCombobox( combobox, 'adm' );
+		await expect( combobox.locator( '.stream-user-combobox__value' ) ).not.toHaveValue(
+			'',
+		);
+		const userId = await combobox
+			.locator( '.stream-user-combobox__value' )
+			.inputValue();
+		await submitFilters( page, new RegExp( `user_id=${ userId }` ) );
+		await expectVisibleRows( page );
+	} );
+} );
+
 /**
  * Submit the records filter form and wait for the query string to match.
  *
diff --git a/tests/e2e/settings-save.spec.js b/tests/e2e/settings-save.spec.js
index 19139b15c..3668005cf 100644
--- a/tests/e2e/settings-save.spec.js
+++ b/tests/e2e/settings-save.spec.js
@@ -7,8 +7,9 @@ import { test, expect } from '@wordpress/e2e-test-utils-playwright';
  * Internal dependencies
  */
 import {
-	newAuthedPage,
 	clearNetworkExcludeRulesViaWpCli,
+	newAuthedPage,
+	setJQuerySelect,
 } from './helpers/stream-plugin';
 
 /**
@@ -34,6 +35,85 @@ test.afterAll( async ( { browser } ) => {
 } );
 
 test.describe( 'Settings save', () => {
+	test( 'multi-IP exclude rule round trips through save and reload', async ( {
+		page,
+	} ) => {
+		const firstIp = '198.51.100.23';
+		const secondIp = '203.0.113.77';
+
+		await page.goto( `${ SETTINGS_URL }&tab=exclude` );
+		await page.locator( '#exclude_rules_new_rule' ).click();
+		await page
+			.locator(
+				'.stream-exclude-list tbody tr:not(.hidden):not(.helper) input.ip_address',
+			)
+			.last()
+			.fill( `${ firstIp }, ${ secondIp }` );
+		await page.evaluate( ( v ) => {
+			window.__expectedIp = v;
+		}, `${ firstIp }, ${ secondIp }` );
+		await Promise.all( [
+			page.waitForURL( /settings-updated=true/ ),
+			page.getByRole( 'button', { name: 'Save Changes' } ).click( {
+				noWaitAfter: true,
+			} ),
+		] );
+		await page.waitForLoadState( 'load' );
+
+		await expect
+			.poll( () =>
+				page
+					.locator( '.stream-exclude-list input.ip_address' )
+					.evaluateAll(
+						( els, expected ) => els.map( ( el ) => el.value ).includes( expected ),
+						`${ firstIp }, ${ secondIp }`,
+					),
+			)
+			.toBe( true );
+	} );
+
+	test( 'role exclude rule round trips and deletes', async ( { page } ) => {
+		await page.goto( `${ SETTINGS_URL }&tab=exclude` );
+		await page.locator( '#exclude_rules_new_rule' ).click();
+		await setJQuerySelect(
+			page,
+			'.stream-exclude-list tbody tr:not(.hidden):not(.helper) select.author_or_role',
+			'editor',
+			'optgroup[label="Users"] option, optgroup[label="Roles"] option',
+		);
+
+		await Promise.all( [
+			page.waitForURL( /settings-updated=true/ ),
+			page.getByRole( 'button', { name: 'Save Changes' } ).click( {
+				noWaitAfter: true,
+			} ),
+		] );
+		await page.waitForLoadState( 'load' );
+
+		// Reloaded row keeps the role selected.
+		await expect(
+			page.locator(
+				'.stream-exclude-list tbody tr:not(.hidden):not(.helper) select.author_or_role',
+			)
+				.first(),
+		).toHaveValue( 'editor' );
+
+		// Deleting the row removes it (guards the Delete Selected Rules flow).
+		await page
+			.locator(
+				'.stream-exclude-list tbody tr:not(.hidden):not(.helper) input.cb-select',
+			)
+			.first()
+			.check();
+		await page.locator( '#exclude_rules_remove_rules' ).click();
+		await page.waitForTimeout( 300 );
+		await expect(
+			page.locator(
+				'.stream-exclude-list tbody tr:not(.hidden):not(.helper) select.author_or_role',
+			),
+		).toHaveCount( 0 );
+	} );
+
 	test( 'persists one change per tab after save and reload', async ( {
 		page,
 	} ) => {
diff --git a/tests/e2e/user-combobox.spec.js b/tests/e2e/user-combobox.spec.js
new file mode 100644
index 000000000..c6ac20b39
--- /dev/null
+++ b/tests/e2e/user-combobox.spec.js
@@ -0,0 +1,384 @@
+/**
+ * WordPress dependencies
+ */
+import { test, expect } from '@wordpress/e2e-test-utils-playwright';
+
+/**
+ * Internal dependencies
+ */
+import {
+	clearNetworkExcludeRulesViaWpCli,
+	clearUserCombobox,
+	forceUserComboboxViaWpCli,
+	newAuthedPage,
+	restorePreloadUsersCapViaWpCli,
+	seedSettingsRecord,
+	selectUserCombobox,
+} from './helpers/stream-plugin';
+
+test.describe.configure( { mode: 'serial' } );
+
+let seeded = false;
+let createdAlertRowId = '';
+
+test.beforeAll( () => {
+	forceUserComboboxViaWpCli();
+} );
+
+test.beforeEach( async ( { page } ) => {
+	if ( ! seeded ) {
+		await seedSettingsRecord( page );
+		seeded = true;
+	}
+} );
+
+test.afterAll( async ( { browser } ) => {
+	try {
+		const page = await newAuthedPage( browser );
+		clearNetworkExcludeRulesViaWpCli();
+		if ( createdAlertRowId ) {
+			await page.goto( '/wp-admin/edit.php?post_type=wp_stream_alerts' );
+			const row = page.locator( `#the-list tr#${ createdAlertRowId }` );
+			if ( await row.isVisible().catch( () => false ) ) {
+				await row.hover();
+				const trash = row.getByRole( 'link', { name: /Trash/i } );
+				if ( await trash.isVisible().catch( () => false ) ) {
+					await trash.click();
+				}
+			}
+		}
+		await page.context().close();
+	} finally {
+		restorePreloadUsersCapViaWpCli();
+	}
+} );
+
+/**
+ * Ensure the user filter control is visible (a persisted screen-options
+ * preference can hide it between runs).
+ *
+ * @param {import('@playwright/test').Page} page Authed page on the records screen.
+ */
+async function ensureUserFilterVisible( page ) {
+	const combobox = page.locator( '#record-filter-form .stream-user-combobox' );
+	if ( await combobox.isVisible().catch( () => false ) ) {
+		return;
+	}
+	await page.locator( '#show-settings-link' ).click();
+	const toggle = page.locator( '#user_id-hide' );
+	if ( await toggle.isVisible().catch( () => false ) ) {
+		await toggle.check();
+	}
+	await expect( combobox ).toBeVisible();
+}
+
+test.describe( 'User combobox', () => {
+	test( 'records filter can search, select, and clear a user', async ( {
+		page,
+	} ) => {
+		await page.goto( '/wp-admin/admin.php?page=wp_stream' );
+		await ensureUserFilterVisible( page );
+		const combobox = page.locator( '#record-filter-form .stream-user-combobox' );
+		await expect( combobox ).toHaveCount( 1 );
+
+		await combobox.locator( '.stream-user-combobox__input' ).fill( 'adm' );
+		const option = combobox.locator( '[role="option"]' ).first();
+		await expect( option ).toBeVisible( { timeout: 10_000 } );
+		await expect( option.locator( 'img.stream-user-combobox__avatar' ) ).toHaveCount(
+			1,
+		);
+		await selectUserCombobox( combobox, 'adm' );
+		await expect( combobox.locator( '.stream-user-combobox__value' ) ).not.toHaveValue(
+			'',
+		);
+
+		await clearUserCombobox( combobox );
+		await expect( combobox.locator( '.stream-user-combobox__value' ) ).toHaveValue(
+			'',
+		);
+	} );
+
+	test( 'records filter keeps the committed user when Filter races a keystroke', async ( {
+		page,
+	} ) => {
+		await page.goto( '/wp-admin/admin.php?page=wp_stream' );
+		await ensureUserFilterVisible( page );
+		const combobox = page.locator( '#record-filter-form .stream-user-combobox' );
+		await selectUserCombobox( combobox, 'adm' );
+		const userId = await combobox
+			.locator( '.stream-user-combobox__value' )
+			.inputValue();
+		expect( userId ).toBeTruthy();
+
+		await combobox.locator( '.stream-user-combobox__input' ).pressSequentially( 'x' );
+		await Promise.all( [
+			page.waitForURL( new RegExp( `user_id=${ userId }` ) ),
+			page.locator( '#record-query-submit' ).click( { noWaitAfter: true } ),
+		] );
+	} );
+
+	test( 'records filter reopens the listbox with ArrowDown after Escape', async ( {
+		page,
+	} ) => {
+		await page.goto( '/wp-admin/admin.php?page=wp_stream' );
+		await ensureUserFilterVisible( page );
+		const combobox = page.locator( '#record-filter-form .stream-user-combobox' );
+		const input = combobox.locator( '.stream-user-combobox__input' );
+		await input.fill( 'adm' );
+		await expect( combobox.locator( '[role="option"]' ).first() ).toBeVisible( {
+			timeout: 10_000,
+		} );
+		await input.press( 'Escape' );
+		await expect( combobox.locator( '[role="option"]' ) ).toHaveCount( 0 );
+		await input.press( 'ArrowDown' );
+		await expect( combobox.locator( '[role="option"]' ).first() ).toBeVisible();
+	} );
+
+	test( 'settings exclude rule can search and select a user', async ( {
+		page,
+	} ) => {
+		await page.goto(
+			'/wp-admin/network/admin.php?page=wp_stream_network_settings&tab=exclude',
+		);
+		await page.locator( '#exclude_rules_new_rule' ).click();
+		const combobox = page.locator(
+			'.stream-exclude-list tbody tr:not(.hidden):not(.helper) .stream-user-combobox',
+		).last();
+		await selectUserCombobox( combobox, 'adm' );
+		await expect( combobox.locator( '.stream-user-combobox__value' ) ).not.toHaveValue(
+			'',
+		);
+	} );
+
+	test( 'settings exclude picks roles and users from the single combobox', async ( {
+		page,
+	} ) => {
+		await page.goto(
+			'/wp-admin/network/admin.php?page=wp_stream_network_settings&tab=exclude',
+		);
+		await page.locator( '#exclude_rules_new_rule' ).click();
+		const combobox = page.locator(
+			'.stream-exclude-list tbody tr:not(.hidden):not(.helper) .stream-user-combobox',
+		).last();
+
+		// One control: opening it with an empty query offers the Roles group.
+		await combobox.locator( '.stream-user-combobox__input' ).click();
+		await expect(
+			combobox.locator( '.stream-user-combobox__group', { hasText: 'Roles' } ),
+		).toBeVisible();
+		await expect(
+			combobox.locator( '.stream-user-combobox__hint' ),
+		).toBeVisible();
+
+		// Pick a role from the listbox.
+		const roleOption = combobox
+			.locator( '.stream-user-combobox__option', { hasText: 'Administrator' } )
+			.first();
+		await roleOption.evaluate( ( node ) => {
+			node.dispatchEvent( new MouseEvent( 'mousedown', { bubbles: true } ) );
+		} );
+		await expect( combobox.locator( '.stream-user-combobox__value' ) ).toHaveValue(
+			'administrator',
+		);
+		await expect( combobox.locator( '.stream-user-combobox__input' ) ).toHaveValue(
+			'Administrator',
+		);
+
+		// Searching keeps matching roles visible next to user results.
+		await combobox.locator( '.stream-user-combobox__input' ).fill( 'admin' );
+		const list = combobox.locator( '.stream-user-combobox__option' );
+		await list.first().waitFor( { state: 'visible', timeout: 10_000 } );
+		await expect(
+			combobox.locator( '.stream-user-combobox__option', { hasText: 'Administrator' } ),
+		).toBeVisible();
+
+		// Picking a user replaces the role (users carry avatars; roles do not).
+		const userOption = combobox
+			.locator( '.stream-user-combobox__option:has(.stream-user-combobox__avatar)' )
+			.first();
+		await userOption.waitFor( { state: 'visible', timeout: 10_000 } );
+		await userOption.evaluate( ( node ) => {
+			node.dispatchEvent( new MouseEvent( 'mousedown', { bubbles: true } ) );
+		} );
+		await expect( combobox.locator( '.stream-user-combobox__value' ) ).not.toHaveValue(
+			'administrator',
+		);
+		await expect(
+			combobox.locator( '.stream-user-combobox__value' ),
+		).not.toHaveValue( '' );
+	} );
+
+	test( 'records filter combobox is hidden and shown by screen options', async ( {
+		page,
+	} ) => {
+		await page.goto( '/wp-admin/admin.php?page=wp_stream' );
+		const combobox = page.locator( '#record-filter-form .stream-user-combobox' );
+		await expect( combobox ).toBeVisible();
+
+		await page.locator( '#show-settings-link' ).click();
+		const toggle = page.locator( '#user_id-hide' );
+		try {
+			await toggle.uncheck();
+			await expect( combobox ).toBeHidden();
+		} finally {
+			// Always restore visibility: the preference persists across runs
+			// and would hide the combobox for every later test.
+			await toggle.check();
+		}
+		await expect( combobox ).toBeVisible();
+	} );
+
+	test( 'combobox announces results through wp.a11y', async ( { page } ) => {
+		await page.goto( '/wp-admin/admin.php?page=wp_stream' );
+		await ensureUserFilterVisible( page );
+
+		// wp.a11y's live regions are not observable in the DOM in this WP
+		// version, so assert the speak() contract instead.
+		await page.evaluate( () => {
+			window.__spoken = [];
+			// wp.a11y.speak is a read-only property, but window.wp.a11y itself
+			// is writable — swap the whole object for a spying shim.
+			const real = window.wp.a11y;
+			window.wp.a11y = Object.assign( Object.create( Object.getPrototypeOf( real ) ), real, {
+				speak( message, context ) {
+					window.__spoken.push( message );
+					real.speak( message, context );
+				},
+			} );
+		} );
+
+		const combobox = page.locator( '#record-filter-form .stream-user-combobox' );
+		await selectUserCombobox( combobox, 'adm' );
+
+		await expect
+			.poll( async () =>
+				page.evaluate( () => ( window.__spoken || [] ).join( ' | ' ) ),
+			)
+			.toMatch( /user/i );
+	} );
+
+	test( 'keyboard navigation moves aria-activedescendant and commits roles', async ( {
+		page,
+	} ) => {
+		await page.goto(
+			'/wp-admin/network/admin.php?page=wp_stream_network_settings&tab=exclude',
+		);
+		await page.locator( '#exclude_rules_new_rule' ).click();
+		const combobox = page
+			.locator( '.stream-exclude-list tbody tr:not(.hidden):not(.helper) .stream-user-combobox' )
+			.last();
+
+		// Drive the keyboard flow inside one page tick so the assertion reads
+		// the DOM in the exact state the widget produced.
+		const step1 = await combobox.evaluate( ( root ) => {
+			const input = root.querySelector( '.stream-user-combobox__input' );
+			input.focus();
+			return {
+				optionCount: root.querySelectorAll( '.stream-user-combobox__option' ).length,
+				firstId: root.querySelector( '.stream-user-combobox__option' )?.id || '',
+				active: input.getAttribute( 'aria-activedescendant' ),
+			};
+		} );
+		expect( step1.optionCount ).toBeGreaterThan( 1 );
+		expect( step1.active ).toBe( step1.firstId );
+
+		const step2 = await combobox.evaluate( ( root ) => {
+			const input = root.querySelector( '.stream-user-combobox__input' );
+			input.dispatchEvent(
+				new KeyboardEvent( 'keydown', { key: 'ArrowDown', bubbles: true } ),
+			);
+			const second = root.querySelectorAll( '.stream-user-combobox__option' )[ 1 ];
+			return {
+				secondId: second?.id || '',
+				secondSlug: second?.getAttribute( 'data-id' ) || '',
+				active: input.getAttribute( 'aria-activedescendant' ),
+			};
+		} );
+		expect( step2.active ).toBe( step2.secondId );
+		expect( step2.secondSlug ).toBeTruthy();
+
+		const step3 = await combobox.evaluate( ( root ) => {
+			const input = root.querySelector( '.stream-user-combobox__input' );
+			input.dispatchEvent(
+				new KeyboardEvent( 'keydown', { key: 'Enter', bubbles: true } ),
+			);
+			return {
+				value: root.querySelector( '.stream-user-combobox__value' ).value,
+				label: input.value,
+				closed: root
+					.querySelector( '.stream-user-combobox__listbox' )
+					.hasAttribute( 'hidden' ),
+			};
+		} );
+		expect( step3.value ).toBe( step2.secondSlug );
+		expect( step3.label ).toBeTruthy();
+		expect( step3.closed ).toBe( true );
+	} );
+
+	test( 'exclude user rule round trips through save and reload', async ( { page } ) => {
+		await page.goto(
+			'/wp-admin/network/admin.php?page=wp_stream_network_settings&tab=exclude',
+		);
+		await page.locator( '#exclude_rules_new_rule' ).click();
+		const combobox = page
+			.locator( '.stream-exclude-list tbody tr:not(.hidden):not(.helper) .stream-user-combobox' )
+			.last();
+		await selectUserCombobox( combobox, 'alice' );
+		const picked = await combobox
+			.locator( '.stream-user-combobox__value' )
+			.inputValue();
+		expect( picked ).toBeTruthy();
+
+		await Promise.all( [
+			page.waitForURL( /settings-updated=true/ ),
+			page.getByRole( 'button', { name: 'Save Changes' } ).click( {
+				noWaitAfter: true,
+			} ),
+		] );
+		await page.waitForLoadState( 'load' );
+		await page.waitForTimeout( 500 );
+
+		const reloaded = page
+			.locator( '.stream-exclude-list .stream-user-combobox' )
+			.first();
+		await expect( reloaded.locator( '.stream-user-combobox__value' ) ).toHaveValue(
+			picked,
+		);
+		await expect( reloaded.locator( '.stream-user-combobox__input' ) ).toHaveValue(
+			/Alice|admin|Editor|Author|Contributor|Shopper|Beta|Alpha|Gamma|Charlie|Bob|Eve|Frank|Grace|Dana/i,
+		);
+	} );
+
+	test( 'new alert author can search, select, and clear', async ( { page } ) => {
+		await page.goto( '/wp-admin/edit.php?post_type=wp_stream_alerts' );
+		await page.locator( 'a.page-title-action' ).click();
+		const form = page.locator( '#add-new-alert' );
+		await expect( form ).toBeVisible();
+
+		const combobox = form.locator( '.stream-user-combobox' );
+		await expect( combobox ).toHaveCount( 1 );
+		await selectUserCombobox( combobox, 'adm' );
+		await expect( combobox.locator( '.stream-user-combobox__value' ) ).not.toHaveValue(
+			'',
+		);
+
+		await clearUserCombobox( combobox );
+		await expect( combobox.locator( '.stream-user-combobox__value' ) ).toHaveValue(
+			'',
+		);
+
+		await form.locator( '#wp_stream_alert_type' ).selectOption( 'highlight' );
+		const existingIds = await page
+			.locator( '#the-list tr.type-wp_stream_alerts' )
+			.evaluateAll( ( rows ) => rows.map( ( row ) => row.id ).filter( Boolean ) );
+		await form.locator( 'button.button-primary.save' ).click( { noWaitAfter: true } );
+		await expect( page.locator( '#add-new-alert' ) ).toHaveCount( 0, {
+			timeout: 20_000,
+		} );
+		const afterIds = await page
+			.locator( '#the-list tr.type-wp_stream_alerts' )
+			.evaluateAll( ( rows ) => rows.map( ( row ) => row.id ).filter( Boolean ) );
+		createdAlertRowId =
+			afterIds.find( ( id ) => ! existingIds.includes( id ) ) || '';
+	} );
+} );
diff --git a/tests/phpunit/Admin_Ajax_Test.php b/tests/phpunit/Admin_Ajax_Test.php
index cbb231a1a..c7a24a259 100644
--- a/tests/phpunit/Admin_Ajax_Test.php
+++ b/tests/phpunit/Admin_Ajax_Test.php
@@ -318,6 +318,10 @@ public function test_ajax_filters() {
 		$this->assertNotFalse( $data );
 		$this->assertNotEmpty( $data );
 		$this->assertIsArray( $data );
+		$this->assertObjectHasProperty( 'id', $data[0] );
+		$this->assertObjectHasProperty( 'text', $data[0] );
+		$this->assertObjectHasProperty( 'label', $data[0] );
+		$this->assertObjectHasProperty( 'icon', $data[0] );
 	}
 
 	public function test_ajax_clean_orphan_meta_schedules_reaper() {
@@ -378,16 +382,22 @@ public function test_ajax_clean_orphan_meta_denies_users_without_settings_cap()
 		}
 	}
 
-	public function test_get_users_record_meta() {
-		$user_id = $this->admin_user_id;
-		$authors = array(
-			$user_id => get_user_by( 'id', $user_id ),
-		);
+	/**
+	 * Reject wp_stream_filters when the nonce is invalid.
+	 *
+	 * @group ajax
+	 */
+	public function test_ajax_filters_requires_valid_nonce() {
+		if ( ! defined( 'DOING_AJAX' ) ) {
+			define( 'DOING_AJAX', true );
+		}
 
-		$records = $this->ajax->get_users_record_meta( $authors );
+		$this->_setRole( 'administrator' );
+		$_GET['filter'] = 'user_id';
+		$_GET['q']      = 'adm';
+		$_GET['nonce']  = 'not-a-valid-nonce';
 
-		$this->assertArrayHasKey( $user_id, $records );
-		$this->assertArrayHasKey( 'text', $records[ $user_id ] );
-		$this->assertEquals( 'test_admin', $records[ $user_id ]['text'] );
+		$this->expectException( \WPAjaxDieStopException::class );
+		$this->_handleAjax( 'wp_stream_filters' );
 	}
 }
diff --git a/tests/phpunit/Admin_Screen_Records_Test.php b/tests/phpunit/Admin_Screen_Records_Test.php
index 745c79a0d..ce9c1f478 100644
--- a/tests/phpunit/Admin_Screen_Records_Test.php
+++ b/tests/phpunit/Admin_Screen_Records_Test.php
@@ -42,6 +42,17 @@ public function test_render_list_table() {
 		$this->assertStringContainsString( 'record-filter-form', $html );
 	}
 
+	public function test_user_filter_labels_wp_cli_not_na() {
+		$this->records->register_list_table();
+
+		$filters = $this->admin->list_table->get_filters();
+		$items   = $filters['user_id']['items'];
+
+		$this->assertNotEmpty( $items );
+		$this->assertArrayHasKey( 0, $items, 'WP-CLI pseudo-user should be listed' );
+		$this->assertSame( 'WP-CLI', $items[0]['label'], 'User 0 must render as WP-CLI, not N/A' );
+	}
+
 	public function test_register_list_table() {
 		$this->records->register_list_table();
 
diff --git a/tests/phpunit/Log_Test.php b/tests/phpunit/Log_Test.php
index db462c7aa..9bf30065f 100644
--- a/tests/phpunit/Log_Test.php
+++ b/tests/phpunit/Log_Test.php
@@ -193,4 +193,45 @@ public function test_can_match_record_id_address() {
 			'Whitespace after commas in a free-text IP list must not break matching'
 		);
 	}
+	/**
+	 * Role exclude rules must match records by the acting user's role.
+	 *
+	 * @covers WP_Stream\Log::is_record_excluded
+	 */
+	public function test_record_excluded_by_role_rule() {
+		$editor_id = self::factory()->user->create( array( 'role' => 'editor' ) );
+		$editor    = get_userdata( $editor_id );
+		$admin     = get_userdata( 1 );
+
+		$this->plugin->settings->options['exclude_rules'] = array(
+			'exclude_row'    => array( 'rule1' => '1' ),
+			'author_or_role' => array( 'rule1' => 'editor' ),
+			'connector'      => array( 'rule1' => '' ),
+			'context'        => array( 'rule1' => '' ),
+			'action'         => array( 'rule1' => '' ),
+			'ip_address'     => array( 'rule1' => '' ),
+		);
+
+		$this->assertTrue(
+			$this->plugin->log->is_record_excluded( 'posts', 'post', 'created', $editor ),
+			'A record by an editor must be excluded by an editor-role rule'
+		);
+		$this->assertFalse(
+			$this->plugin->log->is_record_excluded( 'posts', 'post', 'created', $admin ),
+			'A record by an administrator must not match an editor-role rule'
+		);
+
+		// Role + connector combination: only both together exclude.
+		$this->plugin->settings->options['exclude_rules']['connector'] = array( 'rule1' => 'posts' );
+		$this->assertTrue(
+			$this->plugin->log->is_record_excluded( 'posts', 'post', 'created', $editor )
+		);
+		$this->assertFalse(
+			$this->plugin->log->is_record_excluded( 'media', 'attachment', 'added', $editor ),
+			'A rule scoped to the posts connector must not exclude other connectors'
+		);
+
+		unset( $this->plugin->settings->options['exclude_rules'] );
+		self::delete_user_completely( $editor_id );
+	}
 }
diff --git a/tests/phpunit/User_Picker_Test.php b/tests/phpunit/User_Picker_Test.php
new file mode 100644
index 000000000..592f3c84a
--- /dev/null
+++ b/tests/phpunit/User_Picker_Test.php
@@ -0,0 +1,160 @@
+<?php
+/**
+ * Tests for the user picker API (wp_users-backed, combobox support).
+ *
+ * @package WP_Stream
+ */
+
+namespace WP_Stream;
+
+/**
+ * Class User_Picker_Test
+ *
+ * @package WP_Stream
+ */
+class User_Picker_Test extends WP_StreamTestCase {
+
+	/**
+	 * IDs created for this test.
+	 *
+	 * @var int[]
+	 */
+	private array $user_ids = array();
+
+	/**
+	 * Picker under test (stateless).
+	 *
+	 * @var User_Picker
+	 */
+	private User_Picker $picker;
+
+	public function setUp(): void {
+		parent::setUp();
+		$this->picker = new User_Picker();
+
+		$names = array(
+			'WendyPicker Alpha',
+			'XanderPicker Beta',
+			'YannickPicker Gamma',
+		);
+		foreach ( $names as $name ) {
+			$this->user_ids[] = self::factory()->user->create(
+				array(
+					'role'         => 'editor',
+					'display_name' => $name,
+					'user_login'   => strtolower( str_replace( ' ', '', $name ) ),
+				)
+			);
+		}
+	}
+
+	public function tearDown(): void {
+		foreach ( $this->user_ids as $user_id ) {
+			self::delete_user_completely( $user_id );
+		}
+
+		parent::tearDown();
+	}
+
+	public function test_default_preload_cap_is_fifty() {
+		// Guards the documented default; a stray edit here silently forces
+		// every picker into combobox mode on small sites.
+		$this->assertSame( 50, $this->plugin->admin->preload_users_max );
+	}
+
+	public function test_picker_under_cap_lists_all_users_and_wp_cli_sorted() {
+		$cap     = 50 + count( $this->user_ids ) + 5;
+		$picker  = $this->picker->get( $cap );
+		$labels  = wp_list_pluck( $picker['items'], 'label' );
+		$by_name = array_values(
+			array_filter(
+				$labels,
+				function ( $label ) {
+					return false !== strpos( $label, 'Picker ' );
+				}
+			)
+		);
+
+		$this->assertFalse( $picker['ajax'] );
+		$this->assertCount( 3, $by_name, 'All created users should be listed' );
+		$this->assertContains( 'WP-CLI', $labels, 'WP-CLI pseudo-user should be listed' );
+
+		$sorted = $labels;
+		usort(
+			$sorted,
+			function ( $a, $b ) {
+				return strnatcasecmp( $a, $b );
+			}
+		);
+		$this->assertSame( $sorted, $labels, 'Picker items should be sorted by display label' );
+
+		foreach ( $picker['items'] as $item ) {
+			$this->assertArrayHasKey( 'id', $item );
+			$this->assertArrayHasKey( 'text', $item );
+			$this->assertArrayHasKey( 'label', $item );
+			$this->assertArrayHasKey( 'icon', $item );
+		}
+	}
+
+	public function test_picker_over_cap_switches_to_ajax() {
+		$total  = count_users();
+		$picker = $this->picker->get( max( 1, $total['total_users'] - 1 ) );
+
+		$this->assertTrue( $picker['ajax'] );
+		$this->assertSame( array(), $picker['items'] );
+	}
+
+	public function test_picker_zero_cap_forces_ajax() {
+		$picker = $this->picker->get( 0 );
+
+		$this->assertTrue( $picker['ajax'] );
+		$this->assertSame( array(), $picker['items'] );
+	}
+
+	public function test_labels_for_wp_cli_and_deleted_users() {
+		$this->assertSame( 'WP-CLI', $this->picker->label( 0 ) );
+
+		$deleted_id = self::factory()->user->create( array( 'display_name' => 'Deleted Picker User' ) );
+		self::delete_user_completely( $deleted_id );
+
+		$this->assertSame(
+			sprintf( 'Unknown user %d', $deleted_id ),
+			$this->picker->label( $deleted_id )
+		);
+	}
+
+	public function test_label_for_value_rejects_non_numeric_input() {
+		$this->assertSame( '', $this->picker->label_for_value( 'banana' ) );
+		$this->assertSame( '', $this->picker->label_for_value( '1e5' ) );
+		$this->assertSame( 'WP-CLI', $this->picker->label_for_value( '0' ) );
+	}
+
+	public function test_search_matches_display_name_and_login() {
+		$results = $this->picker->search( 'WendyPicker', 50 );
+		$this->assertNotEmpty( $results );
+		$this->assertSame( 'WendyPicker Alpha', $results[0]['label'] );
+
+		$results = $this->picker->search( 'yannickpickergamma', 50 );
+		$this->assertNotEmpty( $results, 'Search should match user logins' );
+		$this->assertSame( 'YannickPicker Gamma', $results[0]['label'] );
+	}
+
+	public function test_search_offers_wp_cli_for_system_queries() {
+		$results = $this->picker->search( 'cli', 50 );
+		$labels  = wp_list_pluck( $results, 'label' );
+
+		$this->assertContains( 'WP-CLI', $labels );
+	}
+
+	public function test_search_without_matches_returns_empty_list() {
+		$results = $this->picker->search( 'no-such-user-zzz', 50 );
+
+		$this->assertSame( array(), $results );
+	}
+
+	public function test_search_respects_limit() {
+		$results = $this->picker->search( 'Picker', 2 );
+
+		$this->assertCount( 2, $results );
+	}
+}
diff --git a/tests/phpunit/alerts/Alert_Trigger_Author_Test.php b/tests/phpunit/alerts/Alert_Trigger_Author_Test.php
index 5fb64132e..eb06ced7b 100644
--- a/tests/phpunit/alerts/Alert_Trigger_Author_Test.php
+++ b/tests/phpunit/alerts/Alert_Trigger_Author_Test.php
@@ -32,6 +32,54 @@ public function test_save_fields() {
 		$this->trigger->save_fields( $this->alert );
 		$this->assertEquals( '0', $this->alert->alert_meta['trigger_author'] );
 
+		$_POST['wp_stream_trigger_author'] = '12';
+		$this->trigger->save_fields( $this->alert );
+		$this->assertEquals( '12', $this->alert->alert_meta['trigger_author'] );
+
+		$_POST['wp_stream_trigger_author'] = '1e5';
+		$this->trigger->save_fields( $this->alert );
+		$this->assertSame( '', $this->alert->alert_meta['trigger_author'] );
+
+		$_POST['wp_stream_trigger_author'] = array( '12' );
+		$this->trigger->save_fields( $this->alert );
+		$this->assertSame( '', $this->alert->alert_meta['trigger_author'] );
+
 		unset( $_POST['wp_stream_trigger_author'] );
 	}
+	public function test_check_record_wp_cli_does_not_match_other_users() {
+		$this->alert->alert_meta['trigger_author'] = '0';
+
+		$other = $this->dummy_stream_data();
+		$this->assertFalse(
+			$this->trigger->check_record( true, null, $other, $this->alert )
+		);
+
+		$cli            = $this->dummy_stream_data();
+		$cli['user_id'] = '0';
+		$this->assertTrue(
+			$this->trigger->check_record( true, null, $cli, $this->alert )
+		);
+	}
+
+	public function test_get_display_value_for_wp_cli() {
+		$this->alert->alert_meta['trigger_author'] = '0';
+		$this->assertSame( 'WP-CLI', $this->trigger->get_display_value( 'list_table', $this->alert ) );
+
+		$this->alert->alert_meta['trigger_author'] = '';
+		$this->assertSame( 'Any User', $this->trigger->get_display_value( 'list_table', $this->alert ) );
+	}
+
+	public function test_add_fields_uses_combobox_over_cap() {
+		$this->plugin->admin->preload_users_max = 0;
+		$form                                   = new Form_Generator();
+		$this->trigger->add_fields( $form, $this->alert );
+		$this->assertSame( 'user_combobox', $form->fields[0]['type'] );
+	}
+
+	public function test_add_fields_uses_grouped_select_under_cap() {
+		$this->plugin->admin->preload_users_max = 50;
+		$form                                   = new Form_Generator();
+		$this->trigger->add_fields( $form, $this->alert );
+		$this->assertSame( 'grouped_select', $form->fields[0]['type'] );
+	}
 }
diff --git a/tests/phpunit/unit/Alerts_Admin_UI_Unit_Test.php b/tests/phpunit/unit/Alerts_Admin_UI_Unit_Test.php
index a9d17de85..746606a13 100644
--- a/tests/phpunit/unit/Alerts_Admin_UI_Unit_Test.php
+++ b/tests/phpunit/unit/Alerts_Admin_UI_Unit_Test.php
@@ -284,14 +284,30 @@ public function test_register_scripts_enqueues_alerts_asset_on_list_screen() {
 			)
 		);
 		Functions\when( 'wp_create_nonce' )->justReturn( 'stream-nonce' );
+
+		$assets = Mockery::mock( Admin_Assets::class );
+		$assets->shouldReceive( 'user_combobox_l10n' )->once()->andReturn(
+			array(
+				'userSearchNonce' => 'stream-nonce',
+				'userSearchI18n'  => array(
+					'noUsers' => 'No users found.',
+				),
+			)
+		);
+		$admin               = Mockery::mock( Admin::class );
+		$admin->assets       = $assets;
+		$this->plugin->admin = $admin;
+
 		$this->plugin->shouldReceive( 'enqueue_asset' )
 			->once()
 			->with(
 				'alerts',
-				array( 'inline-edit-post' ),
+				array( 'inline-edit-post', 'wp-a11y' ),
 				Mockery::on(
 					static function ( $l10n ) {
-						return isset( $l10n['getActionsNonce'] ) && 'stream-nonce' === $l10n['getActionsNonce'];
+						return isset( $l10n['getActionsNonce'], $l10n['userSearchNonce'] )
+							&& 'stream-nonce' === $l10n['getActionsNonce']
+							&& 'stream-nonce' === $l10n['userSearchNonce'];
 					}
 				)
 			);
diff --git a/tests/phpunit/unit/Settings_Renderer_Unit_Test.php b/tests/phpunit/unit/Settings_Renderer_Unit_Test.php
index a15664783..81fb35cec 100644
--- a/tests/phpunit/unit/Settings_Renderer_Unit_Test.php
+++ b/tests/phpunit/unit/Settings_Renderer_Unit_Test.php
@@ -16,6 +16,13 @@ class Settings_Renderer_Unit_Test extends TestCase {
 	 */
 	protected $renderer;
 
+	/**
+	 * Picker state returned by the db mock.
+	 *
+	 * @var array
+	 */
+	protected $picker_state;
+
 	/**
 	 * Plugin mock with connectors stubs.
 	 *
@@ -54,7 +61,28 @@ class_alias( Settings_Registry_Wp_Roles_Stub::class, 'WP_Roles' );
 		);
 		Functions\when( 'get_userdata' )->justReturn( false );
 
-		$this->plugin                          = Mockery::mock( Plugin::class );
+		$this->plugin = Mockery::mock( Plugin::class );
+
+		$this->picker_state = array(
+			'ajax'  => false,
+			'items' => array(),
+		);
+		$picker = Mockery::mock( User_Picker::class );
+		$picker->allows( 'get' )->andReturnUsing(
+			function () {
+				return $this->picker_state;
+			}
+		);
+		$picker->allows( 'label' )->andReturnUsing(
+			static function ( int $user_id ) {
+				return 0 === $user_id ? 'WP-CLI' : 'STUB_LABEL_' . $user_id;
+			}
+		);
+		$this->plugin->user_picker = $picker;
+		$admin               = Mockery::mock( Admin::class );
+		$admin->allows( 'get_preload_users_max' )->andReturn( 50 );
+		$this->plugin->admin = $admin;
+
 		$this->plugin->connectors              = Mockery::mock( Connectors::class );
 		$this->plugin->connectors->term_labels = array(
 			'stream_action'    => array(
@@ -346,6 +374,68 @@ public function test_rule_list_labels_missing_user_as_not_available() {
 		$this->assertStringContainsString( '>N/A</option>', $html );
 	}
 
+	public function test_rule_list_over_cap_renders_user_combobox_with_roles() {
+		$this->picker_state = array(
+			'ajax'  => true,
+			'items' => array(),
+		);
+
+		$html = $this->renderer->render_field(
+			$this->make_field(
+				array(
+					'type'    => 'rule_list',
+					'section' => 'exclude',
+					'name'    => 'rules',
+					'desc'    => 'Exclude',
+				)
+			),
+			array(
+				'exclude_rules' => array(
+					'exclude_row'    => array( 'row1' => '1' ),
+					'author_or_role' => array( 'row1' => '42' ),
+				),
+			),
+			'wp_stream'
+		);
+
+		$this->assertStringContainsString( 'stream-user-combobox', $html );
+		// Roles render inside the combobox (single control), not as a select.
+		$this->assertStringContainsString( 'data-role-options=', $html );
+		$this->assertStringContainsString( '"value":"administrator"', $html );
+		$this->assertStringNotContainsString( 'stream-user-combobox__roles', $html );
+		$this->assertStringContainsString( 'value="42"', $html );
+		$this->assertStringNotContainsString( '<optgroup label="Users">', $html );
+	}
+
+	public function test_rule_list_over_cap_seeds_stored_role_label() {
+		$this->picker_state = array(
+			'ajax'  => true,
+			'items' => array(),
+		);
+
+		$html = $this->renderer->render_field(
+			$this->make_field(
+				array(
+					'type'    => 'rule_list',
+					'section' => 'exclude',
+					'name'    => 'rules',
+					'desc'    => 'Exclude',
+				)
+			),
+			array(
+				'exclude_rules' => array(
+					'exclude_row'    => array( 'row1' => '1' ),
+					'author_or_role' => array( 'row1' => 'editor' ),
+				),
+			),
+			'wp_stream'
+		);
+
+		// Stored role: hidden value keeps the slug, label seeds the combobox.
+		$this->assertStringContainsString( 'value="editor"', $html );
+		$this->assertStringContainsString( 'data-selected-label="Editor"', $html );
+	}
+
 	public function test_render_field_returns_empty_when_required_keys_missing() {
 		$this->assertSame( '', $this->renderer->render_field( array( 'type' => 'text' ), array(), 'wp_stream' ) );
 	}
diff --git a/tests/testcase.php b/tests/testcase.php
index 811bf0713..74cec01de 100644
--- a/tests/testcase.php
+++ b/tests/testcase.php
@@ -237,6 +237,23 @@ protected function do_action_validation( array $tests = array(), $function_call
 		}
 	}
 
+	/**
+	 * Delete a user from the current site, or the network when tests run as multisite.
+	 *
+	 * `wp_delete_user()` only removes the account from the blog on a network, so
+	 * `get_userdata()` would still succeed and picker labels would keep the display name.
+	 *
+	 * @param int $user_id User ID.
+	 * @return bool
+	 */
+	protected static function delete_user_completely( int $user_id ): bool {
+		if ( is_multisite() ) {
+			return wpmu_delete_user( $user_id );
+		}
+
+		return wp_delete_user( $user_id );
+	}
+
 	/**
 	 * Helper function to check validity of filters
 	 *