@@ -10,7 +10,8 @@
 // impression row) redirect to the site rather than dead-ending.
 
 import { NextRequest, NextResponse } from "next/server";
-import { resolveClick } from "@/lib/ads/serve";
+import { BLOCKED_CLICK, resolveClick } from "@/lib/ads/serve";
+import { blockedClickResponse } from "@/lib/ads/blocked-click";
 import { serviceClient } from "@/lib/supabase/service";
 import { lookupGeo } from "@/lib/tracker/geo";
 import { adClickIp } from "@/lib/ads/client-ip";
@@ -107,6 +108,7 @@ export async function GET(request: NextRequest, ctx: { params: Promise<{ id: str
       },
     });
 
+    if (dest === BLOCKED_CLICK) return blockedClickResponse();
     if (!dest) return NextResponse.redirect(fallback, { status: 302 });
     if (crawler) return NextResponse.redirect(dest, { status: 302, headers: { "cache-control": "no-store", "x-robots-tag": "noindex, nofollow" } });
 
 
@@ -3,7 +3,8 @@
 // still redirect somewhere safe rather than dead-ending the user.
 
 import { NextRequest, NextResponse } from "next/server";
-import { resolveClick } from "@/lib/ads/serve";
+import { BLOCKED_CLICK, resolveClick } from "@/lib/ads/serve";
+import { blockedClickResponse } from "@/lib/ads/blocked-click";
 import { lookupGeo } from "@/lib/tracker/geo";
 import { adClickIp } from "@/lib/ads/client-ip";
 import { parseDevice } from "@/lib/tracker/device";
@@ -39,6 +40,7 @@ export async function GET(request: NextRequest) {
       ctx: { visitorId, ip, country: geo?.countryCode ?? null, device },
     });
 
+    if (dest === BLOCKED_CLICK) return blockedClickResponse();
     return NextResponse.redirect(dest ?? fallback, { status: 302 });
   } catch {
     return NextResponse.redirect(fallback, { status: 302 });
 
@@ -0,0 +1,22 @@
+// What a refused click gets back (see BLOCKED_CLICK in ./serve).
+//
+// 410 rather than a redirect to the homepage: a redirect is a reward, and the
+// harvesting crawler would simply follow it and crawl us instead. The body
+// carries no link to the advertiser for the same reason. noindex/nofollow and
+// no-store so nothing between us and it keeps the answer or the URL.
+
+import { NextResponse } from "next/server";
+
+export function blockedClickResponse(): NextResponse {
+  return new NextResponse(
+    "<!doctype html><meta charset=utf-8><title>Link expired</title><p>This ad link has expired.</p>",
+    {
+      status: 410,
+      headers: {
+        "content-type": "text/html; charset=utf-8",
+        "cache-control": "no-store",
+        "x-robots-tag": "noindex, nofollow",
+      },
+    },
+  );
+}
@@ -717,15 +717,28 @@ async function resolveClickVisitor(
   }
 }
 
+/**
+ * resolveClick's answer for a click that is refused outright: no row, no
+ * redirect. Today that is exactly one case, a click trailing an impression
+ * past its device's ceiling (see maxClickAgeMs). Those were recorded as
+ * invalid and still sent to the advertiser, which is what kept the harvesting
+ * crawler coming back — ~37k a month, every one of them replaying a feed-item
+ * link days to weeks after it was fetched. Nobody real is refused by it: no
+ * browser click in 30 days trailed its impression past 6h, and feed-reader
+ * impressions have no ceiling at all.
+ */
+export const BLOCKED_CLICK = Symbol("blocked-click");
+
 // Resolve a click: record it, return the destination URL (with ?ref=) to
-// redirect to. Returns null if the campaign/creative can't be resolved.
+// redirect to. Returns null if the campaign/creative can't be resolved, and
+// BLOCKED_CLICK if the click is refused.
 export async function resolveClick(input: {
   impressionId?: string | null;
   slotId?: string | null;
   campaignId?: string | null;
   creativeId?: string | null;
   ctx?: ServeContext;
-}): Promise<string | null> {
+}): Promise<string | null | typeof BLOCKED_CLICK> {
   const sb = serviceClient();
   if (!input.campaignId) return null;
 
@@ -753,6 +766,7 @@ export async function resolveClick(input: {
       ipHashes: rotatingIpHashCandidates(input.ctx?.ip ?? null, CLICK_DEDUPE_WINDOW_MS),
       device: input.ctx?.device,
     });
+    if (validity.reason === "stale_impression") return BLOCKED_CLICK;
     if (validity.valid) {
       const admission = await claimClickCooldown({ visitorId, ip: input.ctx?.ip });
       if (!admission.allowed) validity = { valid: false, reason: admission.reason };
 
@@ -0,0 +1,68 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+// A click trailing its impression past the device ceiling is refused outright:
+// no ad_clicks row, no redirect to the advertiser. Recording it as invalid and
+// still redirecting is what kept the feed-link harvester coming back.
+
+const state = vi.hoisted(() => ({
+  validity: { valid: true } as { valid: boolean; reason?: string },
+  inserts: [] as Record<string, unknown>[],
+  rpc: vi.fn(),
+}));
+vi.mock("@/lib/supabase/service", () => ({ serviceClient: () => ({
+  rpc: state.rpc,
+  from(table: string) {
+    const q = {
+      select: () => q, eq: () => q,
+      insert(row: Record<string, unknown>) { state.inserts.push(row); return q; },
+      maybeSingle: async () => ({ data: table === "ad_campaigns"
+        ? { id: "campaign", destination_url: "https://example.com/offer", ref_slug: "ad-test", bid_credits: 4 }
+        : { visitor_id: "visitor" } }),
+    };
+    return q;
+  },
+}) }));
+vi.mock("@/lib/ads/fraud", async (original) => ({
+  ...await original<object>(), assessClickValidity: async () => state.validity,
+}));
+vi.mock("@/lib/ads/click-cooldown", () => ({ claimClickCooldown: async () => ({ allowed: true }) }));
+vi.mock("@/lib/ads/promos", () => ({ promoForCampaign: async () => null }));
+vi.mock("@/lib/ads/bids", () => ({ paperCharge: vi.fn() }));
+import { BLOCKED_CLICK, resolveClick } from "@/lib/ads/serve";
+import { blockedClickResponse } from "@/lib/ads/blocked-click";
+
+beforeEach(() => {
+  state.validity = { valid: true };
+  state.inserts = [];
+  state.rpc.mockReset();
+  state.rpc.mockResolvedValue({ data: [{ click_id: "click", valid: true, charged_cents: 20 }] });
+});
+
+const click = () => resolveClick({
+  campaignId: "campaign", slotId: "slot", impressionId: "imp",
+  ctx: { ip: "8.8.8.8", visitorId: "visitor", device: "desktop" },
+});
+
+describe("stale ad clicks", () => {
+  it("are refused: no row, no charge, no destination", async () => {
+    state.validity = { valid: false, reason: "stale_impression" };
+    expect(await click()).toBe(BLOCKED_CLICK);
+    expect(state.inserts).toHaveLength(0);
+    expect(state.rpc).not.toHaveBeenCalled();
+  });
+
+  it("leave every other invalid click recorded and redirected", async () => {
+    state.validity = { valid: false, reason: "duplicate" };
+    expect(await click()).toBe("https://example.com/offer?ref=ad-test");
+    expect(state.inserts).toHaveLength(1);
+  });
+
+  it("get a 410 that links nowhere and is kept by nothing", async () => {
+    const res = blockedClickResponse();
+    expect(res.status).toBe(410);
+    expect(res.headers.get("location")).toBeNull();
+    expect(res.headers.get("cache-control")).toBe("no-store");
+    expect(res.headers.get("x-robots-tag")).toContain("nofollow");
+    expect(await res.text()).not.toContain("example.com");
+  });
+});