Verify the signed URL, then proxy the JPEG from the storage service under a scoped token. Any failure → placeholder (see module docstring).

Dual-served at both /api/thumbnails (new, provider-neutral) and the legacy /api/drive-thumbnails. The original reason was in-flight signed URLs (6h TTL) during the signer-base flip, and that window closed long ago. The mount STAYS for a different reason, measured 2026-09-01.

145 of 3,085 rows in pozeidon.transcripts still carry the old path in their stored events (newest 2026-06-04; nothing has emitted it since — sign_thumbnail_url builds only /api/thumbnails). Row count alone does not justify the mount, because /api/transcripts lists a tenant's newest 50 (200 max) — so most of those are past the end of the list. Ranking them per tenant is what decides it:

tenant                       old  best_rank  in_50  in_200
t_019e4d70…bc292bd5dead      107       1574      0       0
t_019dbe27…ef5a22c56db7       33         23      5      33
t_019e8283…889aec7c0d33        5          6      5       5

107 are indeed unreachable. But 38 sit inside the visible list for two tenants, and 10 of those are on the first page — one tenant's 6th-most- recent conversation is among them, because that tenant has barely run anything since June, so its June history IS its recent history.

Those signatures are long expired, so the route answers them with the placeholder; drop the mount and those 38 render a broken-image icon on the first screen two tenants see. One decorator is cheaper than that.

Re-run the query above before removing this: when the two tenants push those rows past rank 200, the mount has nothing left to protect.