diff --git a/resources/translations/messages.en.yaml b/resources/translations/messages.en.yaml
index b3fb139..a5400f1 100644
--- a/resources/translations/messages.en.yaml
+++ b/resources/translations/messages.en.yaml
@@ -192,6 +192,7 @@ offers:
   empty_hint: 'Create your first offer — a URL with {click_id}/{country}/{payout} macros, plus a default payout.'
 
 flows:
+  parameter_name: Parameter name
   title: Flows
   list_title: 'Flows: {campaign}'
   create: Create flow
@@ -262,6 +263,7 @@ schemas:
   16: JS Redirect
 
 filter_fields:
+  query_parameter: Query parameter
   country: Country
   region: Region
   city: City
diff --git a/resources/translations/messages.ru.yaml b/resources/translations/messages.ru.yaml
index b54e716..50bfb5d 100644
--- a/resources/translations/messages.ru.yaml
+++ b/resources/translations/messages.ru.yaml
@@ -204,6 +204,7 @@ offers:
   empty_hint: 'Создайте первый офер — URL с макросами {click_id}/{country}/{payout}, и payout по умолчанию.'
 
 flows:
+  parameter_name: Имя параметра
   title: Потоки
   list_title: 'Потоки: {campaign}'
   create: Создать поток
@@ -276,6 +277,7 @@ schemas:
   16: JS Redirect
 
 filter_fields:
+  query_parameter: Параметр запроса
   country: Страна
   region: Регион
   city: Город
diff --git a/resources/views/admin/flows/form.php b/resources/views/admin/flows/form.php
index 8da81ad..570ae82 100644
--- a/resources/views/admin/flows/form.php
+++ b/resources/views/admin/flows/form.php
@@ -10,7 +10,7 @@
     : url('/admin/campaigns/' . $campaign->id . '/flows/' . $flow->id);
 $titleKey = $flow === null ? 'flows.create' : 'flows.edit';
 
-$initialFilters      = $flow?->filters ?? [];
+$initialFilters      = json_decode(old('filters', json_encode($flow?->filters ?? [])), true) ?? [];
 $initialTargetOffers = $flow?->targetOffers ?? [];
 $initialSchemaConfig = $flow?->schemaConfig ?? [];
 
@@ -143,6 +143,7 @@
         <div class="form-section">
             <span class="form-section-label"><?= e(t('flows.filters')) ?></span>
             <p style="font-size:0.8rem;color:var(--color-stone-400);font-family:var(--font-sans);margin-bottom:12px"><?= e(t('flows.no_filters')) ?></p>
+            <?php if (isset($errors['filters'])): ?><p class="form-error"><?= e(t($errors['filters'])) ?></p><?php endif; ?>
 
             <template x-for="(group, gi) in filters" :key="gi">
                 <div style="border:1px solid var(--color-stone-200);border-radius:4px;padding:12px;margin-bottom:10px;background:var(--color-stone-50)">
@@ -152,12 +153,18 @@
                                 style="font-size:0.8rem;color:var(--color-stone-400);background:none;border:none;cursor:pointer;padding:0 4px">&times;</button>
                     </div>
                     <template x-for="(cond, ci) in group" :key="ci">
-                        <div style="display:flex;align-items:center;gap:8px;margin-bottom:8px">
-                            <select x-model="cond.field" class="input" style="max-width:180px;font-size:0.8rem">
+                        <div style="display:flex;flex-wrap:wrap;align-items:center;gap:8px;margin-bottom:8px">
+                            <select :value="cond.field.startsWith('param:') ? 'param:' : cond.field" @change="cond.field = $event.target.value" data-filter-field class="input" style="max-width:180px;font-size:0.8rem">
                                 <?php foreach ($filterFields as $ff): ?>
                                     <option value="<?= e($ff) ?>"><?= e(t('filter_fields.' . $ff)) ?></option>
                                 <?php endforeach; ?>
+                                <option value="param:"><?= e(t('filter_fields.query_parameter')) ?></option>
                             </select>
+                            <template x-if="cond.field.startsWith('param:')">
+                                <input :value="cond.field.slice(6)" @input="cond.field = 'param:' + $event.target.value"
+                                       data-param-name aria-label="<?= e(t('flows.parameter_name')) ?>" placeholder="<?= e(t('flows.parameter_name')) ?>"
+                                       class="input" style="max-width:180px;font-size:0.8rem;font-family:var(--font-mono)" autocomplete="off">
+                            </template>
                             <select x-model="cond.op" class="input" style="max-width:100px;font-size:0.8rem">
                                 <?php foreach ($filterOps as $op): ?>
                                     <option value="<?= e($op) ?>"><?= e(t('filter_ops.' . $op)) ?></option>
diff --git a/src/Admin/Form/FlowForm.php b/src/Admin/Form/FlowForm.php
index f298df9..6433b69 100644
--- a/src/Admin/Form/FlowForm.php
+++ b/src/Admin/Form/FlowForm.php
@@ -6,7 +6,10 @@
 
 final class FlowForm
 {
-    /** @param array<string,mixed> $data  @return array<string,string> */
+    /**
+     * @param array<string,mixed> $data
+     * @return array<string,string>
+     */
     public function validate(array $data): array
     {
         $errors = [];
@@ -31,6 +34,17 @@ public function validate(array $data): array
         $filters = json_decode($filtersRaw, true);
         if (!is_array($filters)) {
             $errors['filters'] = 'validation.pattern';
+        } else {
+            foreach ($filters as $group) {
+                if (!is_array($group)) continue;
+                foreach ($group as $condition) {
+                    $field = is_array($condition) ? ($condition['field'] ?? '') : '';
+                    if (is_string($field) && str_starts_with($field, 'param:')
+                        && !preg_match('/\A[A-Za-z_][A-Za-z0-9_-]{0,63}\z/', substr($field, 6))) {
+                        $errors['filters'] = 'validation.pattern';
+                    }
+                }
+            }
         }
 
         // target_offers JSON must decode
diff --git a/src/Engine/Context.php b/src/Engine/Context.php
index fd1e350..4df721c 100644
--- a/src/Engine/Context.php
+++ b/src/Engine/Context.php
@@ -51,4 +51,12 @@ public function __construct(
         public readonly string $campaignSlug,
         public readonly int $timestamp,        // unix
     ) {}
+
+    public function queryParam(string $name): ?string
+    {
+        if (!preg_match('/\A[A-Za-z_][A-Za-z0-9_-]{0,63}\z/', $name)) return null;
+        $value = $this->query[$name] ?? null;
+        if (!is_string($value) || strlen($value) > 2048 || preg_match('/[\x00-\x1F\x7F]/', $value)) return null;
+        return $value;
+    }
 }
diff --git a/src/Engine/FilterCompiler.php b/src/Engine/FilterCompiler.php
index 64f3d16..9bb6a2d 100644
--- a/src/Engine/FilterCompiler.php
+++ b/src/Engine/FilterCompiler.php
@@ -75,6 +75,10 @@ private function compileCondition(array $cond): Closure
 
     private static function fieldExtractor(string $field): Closure
     {
+        if (str_starts_with($field, 'param:')) {
+            $name = substr($field, 6);
+            return static fn (Context $c) => $c->queryParam($name);
+        }
         return match ($field) {
             'country'        => static fn (Context $c) => $c->country,
             'region'         => static fn (Context $c) => $c->region,
diff --git a/src/Engine/MacroExpander.php b/src/Engine/MacroExpander.php
index 2fd08f7..efe967f 100644
--- a/src/Engine/MacroExpander.php
+++ b/src/Engine/MacroExpander.php
@@ -18,6 +18,7 @@ public function expand(string $template, Context $ctx): string
     private function resolve(string $name, string $arg, Context $ctx): ?string
     {
         return match ($name) {
+            'param'        => rawurlencode($ctx->queryParam($arg) ?? ''),
             'country'      => $ctx->country,
             'region'       => $ctx->region,
             'city'         => $ctx->city,
diff --git a/tests/Browser/QueryParamsBrowser.test.php b/tests/Browser/QueryParamsBrowser.test.php
new file mode 100644
index 0000000..d1f31d1
--- /dev/null
+++ b/tests/Browser/QueryParamsBrowser.test.php
@@ -0,0 +1,63 @@
+<?php
+
+declare(strict_types=1);
+
+if (getenv('BROWSER_TESTS') !== '1') {
+    test('query editor browser tests skipped', function () {})->skip('set BROWSER_TESTS=1');
+    return;
+}
+
+beforeEach(function (): void {
+    browserAdmin('query-editor-pass');
+    $pdo = browserPdo();
+    $pdo->exec("DELETE FROM core.campaigns WHERE slug = 'query-browser'");
+    $pdo->exec("INSERT INTO core.campaigns (name, slug) VALUES ('Ember', 'query-browser')");
+    $this->cid = $pdo->query("SELECT id FROM core.campaigns WHERE slug = 'query-browser'")->fetchColumn();
+});
+
+afterEach(function (): void {
+    browserPdo()->exec("DELETE FROM core.campaigns WHERE slug = 'query-browser'");
+});
+
+test('named query editor saves reopens and switches existing country in RU and EN', function (string $lang, string $name, string $label, string $nameLabel): void {
+    $page = visit(browserUrl('/admin/login'), ['locale' => $lang === 'en' ? 'en-US' : 'ru-RU']);
+    $page->fill('login', 'admin')->fill('password', 'query-editor-pass')->press('button[type=submit]');
+    $page->navigate(browserUrl('/admin/campaigns/' . $this->cid . '/flows/new?lang=' . $lang));
+    expect($page->script('Alpine.$data(document.querySelector("[x-data^=flowBuilder]")).filters'))->toBe([]);
+    expect($page->script('document.querySelector("[name=name]").validity.valueMissing'))->toBeTrue();
+    expect($page->script('document.querySelector("button[type=submit]").disabled'))->toBeFalse();
+    $page->fill('name', 'Ember')->select('target_type', 'none');
+    $page->click('button[\@click="addGroup()"]');
+    $page->select('select[data-filter-field]', 'param:');
+    $page->assertVisible('select[data-filter-field]')->assertVisible('input[data-param-name]');
+    expect($page->script('document.querySelector("select[data-filter-field]").selectedOptions[0].textContent'))->toBe($label);
+    expect($page->script('document.querySelector("input[data-param-name]").getAttribute("aria-label")'))->toBe($nameLabel);
+    $page->fill('input[data-param-name]', $name)->select('select[x-model="cond.op"]', 'eq')->fill('input[x-model="cond.value"]', 'ember');
+    $page->press('button[type=submit]');
+    $pdo = browserPdo();
+    $stmt = $pdo->prepare('SELECT id, filters FROM core.flows WHERE campaign_id = ?');
+    $stmt->execute([$this->cid]);
+    $flow = $stmt->fetch(PDO::FETCH_ASSOC);
+    expect(json_decode($flow['filters'], true))->toEqual([[['field' => 'param:' . $name, 'op' => 'eq', 'value' => 'ember']]]);
+    $edit = '/admin/campaigns/' . $this->cid . '/flows/' . $flow['id'] . '/edit?lang=' . $lang;
+    $page->navigate(browserUrl($edit))->assertValue('select[data-filter-field]', 'param:')->assertValue('input[data-param-name]', $name)
+        ->assertValue('select[x-model="cond.op"]', 'eq')->assertValue('input[x-model="cond.value"]', 'ember');
+    $page->select('select[data-filter-field]', 'country')->fill('input[x-model="cond.value"]', 'us')->press('button[type=submit]');
+    $page->navigate(browserUrl($edit))->assertValue('select[data-filter-field]', 'country')->assertValue('input[x-model="cond.value"]', 'us');
+    $stmt->execute([$this->cid]);
+    expect(json_decode($stmt->fetch(PDO::FETCH_ASSOC)['filters'], true))->toEqual([[['field' => 'country', 'op' => 'eq', 'value' => 'us']]]);
+})->with([['en', 'brand', 'Query parameter', 'Parameter name'], ['ru', 'sub_id_30', 'Параметр запроса', 'Имя параметра']]);
+
+test('invalid query name is retained safely after server rejection', function (): void {
+    $page = visit(browserUrl('/admin/login'), ['locale' => 'en-US']);
+    $page->fill('login', 'admin')->fill('password', 'query-editor-pass')->press('button[type=submit]');
+    $page->navigate(browserUrl('/admin/campaigns/' . $this->cid . '/flows/new?lang=en'))->fill('name', 'Ember')->select('target_type', 'none');
+    $page->click('button[\@click="addGroup()"]')->select('select[data-filter-field]', 'param:');
+    $name = '<img src=x onerror=alert(1)>';
+    $page->fill('input[data-param-name]', $name)->select('select[x-model="cond.op"]', 'neq')->fill('input[x-model="cond.value"]', 'cinder')->press('button[type=submit]');
+    $page->assertValue('input[data-param-name]', $name)->assertValue('select[x-model="cond.op"]', 'neq')->assertValue('input[x-model="cond.value"]', 'cinder')->assertVisible('.form-error');
+    expect($page->script('document.querySelectorAll("img[src=x]").length'))->toBe(0);
+    $stmt = browserPdo()->prepare('SELECT count(*) FROM core.flows WHERE campaign_id = ?');
+    $stmt->execute([$this->cid]);
+    expect((int)$stmt->fetchColumn())->toBe(0);
+});
diff --git a/tests/Integration/Admin/FlowQueryParamsTest.php b/tests/Integration/Admin/FlowQueryParamsTest.php
new file mode 100644
index 0000000..4c6e33a
--- /dev/null
+++ b/tests/Integration/Admin/FlowQueryParamsTest.php
@@ -0,0 +1,72 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Admin\Controller\FlowController;
+use App\Admin\Form\FlowForm;
+use App\Admin\Repository\CampaignRepository;
+use App\Admin\Repository\FlowRepository;
+use App\Admin\Repository\OfferRepository;
+use App\Shared\Asset\Manifest;
+use App\Shared\CampaignIdGenerator;
+use App\Shared\Db\Connection;
+use App\Shared\I18n\I18n;
+use App\Shared\I18n\TranslatorFactory;
+use App\Shared\View\View;
+use Slim\Psr7\Factory\ServerRequestFactory;
+use Slim\Psr7\Response;
+
+beforeEach(function (): void {
+    $_SESSION = [];
+    $GLOBALS['__old_bag__'] = [];
+    $this->pdo = pdo();
+    $this->pdo->beginTransaction();
+    $db = new Connection($this->pdo);
+    $campaigns = new CampaignRepository($db, new CampaignIdGenerator());
+    $this->campaign = $campaigns->create(['name' => 'Ember', 'slug' => 'query-editor']);
+    $this->flows = new FlowRepository($db);
+    $this->controller = new FlowController($this->flows, $campaigns, new OfferRepository($db), new FlowForm());
+    $root = dirname(__DIR__, 3);
+    $this->view = new View($root . '/resources/views', new Manifest($root . '/public/assets/manifest.json'), new I18n((new TranslatorFactory($root . '/resources/translations'))->create()));
+});
+
+afterEach(function (): void {
+    $this->pdo->rollBack();
+    $GLOBALS['__old_bag__'] = [];
+    $_SESSION = [];
+});
+
+test('creates updates and reopens named filter JSON', function (): void {
+    $cid = $this->campaign->id;
+    $data = ['name' => 'Ember', 'schema_id' => 2, 'target_type' => 'none', 'filters' => json_encode([[['field' => 'param:brand', 'op' => 'eq', 'value' => 'ember']]])];
+    $request = (new ServerRequestFactory())->createServerRequest('POST', '/')->withParsedBody($data);
+    expect($this->controller->create($request, new Response(), $cid)->getHeaderLine('Location'))->toBe("/admin/campaigns/{$cid}/edit#flows");
+    $flow = $this->flows->forCampaign($cid)[0];
+    expect($flow->filters)->toEqual(json_decode($data['filters'], true));
+    $data['filters'] = json_encode([[['field' => 'param:brand', 'op' => 'neq', 'value' => 'cinder']]]);
+    expect($this->controller->update($request->withParsedBody($data), new Response(), $cid, $flow->id)->getStatusCode())->toBe(302);
+    expect($this->flows->findById($flow->id)->filters)->toEqual(json_decode($data['filters'], true));
+    $html = (string)$this->controller->edit($request, new Response(), $this->view, $cid, $flow->id)->getBody();
+    expect(html_entity_decode($html, ENT_QUOTES))->toContain('param:brand', 'cinder', 'neq');
+});
+
+test('rejects invalid create and update and renders retained escaped filters', function (string $name): void {
+    $cid = $this->campaign->id;
+    $data = ['name' => 'Ember', 'schema_id' => 2, 'target_type' => 'none', 'filters' => json_encode([[['field' => 'param:' . $name, 'op' => 'neq', 'value' => 'cinder']]])];
+    $request = (new ServerRequestFactory())->createServerRequest('POST', '/')->withParsedBody($data);
+    expect($this->controller->create($request, new Response(), $cid)->getHeaderLine('Location'))->toBe("/admin/campaigns/{$cid}/flows/new");
+    expect($this->flows->forCampaign($cid))->toBe([]);
+    expect($_SESSION['_errors'])->toHaveKey('filters', 'validation.pattern');
+    expect($_SESSION['_old']['filters'])->toBe($data['filters']);
+    // Same per-request snapshot as SessionMiddleware.
+    $GLOBALS['__old_bag__'] = $_SESSION['_old'];
+    $html = (string)$this->controller->new_($request, new Response(), $this->view, $cid)->getBody();
+    expect(html_entity_decode($html, ENT_QUOTES))->toContain('param:' . $name, 'cinder', 'neq');
+    expect($html)->not->toContain('<img src=x onerror=alert(1)>')->toContain('form-error');
+    $flow = $this->flows->create($cid, ['name' => 'Saved', 'schema_id' => 2, 'filters' => '[]']);
+    expect($this->controller->update($request, new Response(), $cid, $flow->id)->getHeaderLine('Location'))->toBe("/admin/campaigns/{$cid}/flows/{$flow->id}/edit");
+    expect($this->flows->findById($flow->id)->filters)->toBe([]);
+    $GLOBALS['__old_bag__'] = $_SESSION['_old'];
+    $html = (string)$this->controller->edit($request, new Response(), $this->view, $cid, $flow->id)->getBody();
+    expect(html_entity_decode($html, ENT_QUOTES))->toContain('param:' . $name, 'cinder', 'neq');
+})->with(['', 'bad.name', str_repeat('a', 65), '<img src=x onerror=alert(1)>']);
diff --git a/tests/Integration/Engine/QueryParamsTest.php b/tests/Integration/Engine/QueryParamsTest.php
new file mode 100644
index 0000000..34ad385
--- /dev/null
+++ b/tests/Integration/Engine/QueryParamsTest.php
@@ -0,0 +1,114 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Admin\Repository\CampaignRepository;
+use App\Admin\Repository\FlowRepository;
+use App\Admin\Repository\OfferRepository;
+use App\Engine\BotDetector;
+use App\Engine\ClickHandler;
+use App\Engine\DeviceDetector;
+use App\Engine\FilterCompiler;
+use App\Engine\FlowMatcher;
+use App\Engine\GeoLookup;
+use App\Engine\MacroExpander;
+use App\Engine\OfferPicker;
+use App\Engine\Schema\SchemaRegistry;
+use App\Engine\VisitorResolver;
+use App\Shared\CampaignIdGenerator;
+use App\Shared\TestLink;
+use App\Admin\Repository\SettingsRepository;
+use App\Shared\Db\Connection;
+use App\Shared\Notification\NotificationRegistry;
+use App\Shared\Telegram\TelegramNotifier;
+use Slim\Psr7\Factory\ServerRequestFactory;
+use Slim\Psr7\Response;
+
+beforeEach(function (): void {
+    $pdo = pdo();
+    $pdo->exec('DELETE FROM stats.clicks');
+    $pdo->exec('DELETE FROM stats.visitors_fingerprints');
+    $pdo->exec('DELETE FROM core.flows');
+    $pdo->exec('DELETE FROM core.offers');
+    $pdo->exec('DELETE FROM core.campaigns');
+    $this->db = new Connection($pdo);
+    $cRepo = new CampaignRepository($this->db, new CampaignIdGenerator());
+    $oRepo = new OfferRepository($this->db);
+    $fRepo = new FlowRepository($this->db);
+    $compiler = new FilterCompiler();
+    $this->handler = new ClickHandler(
+        $cRepo, $oRepo,
+        new VisitorResolver($this->db),
+        new DeviceDetector(),
+        new GeoLookup(),
+        new BotDetector($this->db),
+        new FlowMatcher($fRepo, $compiler),
+        new OfferPicker(),
+        new MacroExpander(),
+        new SchemaRegistry(),
+        $this->db,
+        new TelegramNotifier(null, null),
+        new SettingsRepository($this->db),
+        new NotificationRegistry(),
+    );
+
+    $this->campaign = $cRepo->create(['name' => 'Named query test', 'slug' => 'params01', 'is_active' => '1']);
+    $accept = $oRepo->create(['name' => 'Accept', 'url' => 'https://accept.example/?p={param:brand}&country={country}&query={param:country}', 'is_active' => '1']);
+    $fallback = $oRepo->create(['name' => 'Fallback', 'url' => 'https://fallback.example/?p={param:brand}', 'is_active' => '1']);
+    $this->acceptFlow = $fRepo->create($this->campaign->id, [
+        'name' => 'brand match',
+        'filters' => [[['field' => 'param:brand', 'op' => 'eq', 'value' => 'ember']]],
+        'target_type' => 'offers',
+        'target_offers' => [['offer_id' => $accept->id, 'weight' => 100]],
+        'schema_id' => 2,
+        'is_active' => '1',
+    ]);
+    $fRepo->create($this->campaign->id, [
+        'name' => 'fallback',
+        'filters' => [],
+        'target_type' => 'offers',
+        'target_offers' => [['offer_id' => $fallback->id, 'weight' => 100]],
+        'schema_id' => 2,
+        'is_active' => '1',
+    ]);
+});
+
+test('named query parameters route actual PSR requests to exact destinations', function (array $query, string $location): void {
+    // Campaign test links supply deterministic geo while retaining real filter evaluation.
+    $request = (new ServerRequestFactory())->createServerRequest('GET', '/params01')
+        ->withQueryParams($query + ['_t' => TestLink::campaignKey($this->campaign->id), '_geo' => 'ru'])
+        ->withHeader('User-Agent', 'Mozilla/5.0 TestBrowser');
+    $response = $this->handler->handle($request, new Response(), 'params01');
+    expect($response->getStatusCode())->toBe(302);
+    expect($response->getHeaderLine('Location'))->toBe($location);
+})->with([
+    'accept' => [['brand' => 'ember', 'country' => 'us'], 'https://accept.example/?p=ember&country=ru&query=us'],
+    'reject' => [['brand' => 'ash'], 'https://fallback.example/?p=ash'],
+    'missing' => [[], 'https://fallback.example/?p='],
+    'zero' => [['brand' => '0'], 'https://fallback.example/?p=0'],
+    'empty' => [['brand' => ''], 'https://fallback.example/?p='],
+    'array' => [['brand' => ['ember']], 'https://fallback.example/?p='],
+    'null' => [['brand' => null], 'https://fallback.example/?p='],
+    'control' => [['brand' => "ember\r\nLocation: bad"], 'https://fallback.example/?p='],
+    'oversize' => [['brand' => str_repeat('x', 2049)], 'https://fallback.example/?p='],
+    'encoded' => [['brand' => 'a &%/é%20'], 'https://fallback.example/?p=a%20%26%25%2F%C3%A9%2520'],
+]);
+
+test('named query parameters route arbitrary field names and boundary values in the pipeline', function (string $name, string $value): void {
+    $this->db->execute(
+        'UPDATE core.flows SET filters = :filters::jsonb WHERE id = :id',
+        ['filters' => json_encode([[['field' => 'param:' . $name, 'op' => 'eq', 'value' => $value]]], JSON_THROW_ON_ERROR), 'id' => $this->acceptFlow->id],
+    );
+    $request = (new ServerRequestFactory())->createServerRequest('GET', '/params01')
+        ->withQueryParams([$name => $value, 'brand' => $value, '_t' => TestLink::campaignKey($this->campaign->id), '_geo' => 'ru'])
+        ->withHeader('User-Agent', 'Mozilla/5.0 TestBrowser');
+    $response = $this->handler->handle($request, new Response(), 'params01');
+    expect($response->getStatusCode())->toBe(302);
+    expect($response->getHeaderLine('Location'))->toBe('https://accept.example/?p=' . rawurlencode($value) . '&country=ru&query=');
+})->with([
+    'slot 30' => ['sub_id_30', 'ember'],
+    'no finite slot cap' => ['sub_id_31', 'ember'],
+    'custom' => ['_custom-2', 'ember'],
+    '64 name' => [str_repeat('a', 64), 'ember'],
+    '2048 value' => ['brand', str_repeat('x', 2048)],
+]);
diff --git a/tests/Unit/Admin/FlowFormTest.php b/tests/Unit/Admin/FlowFormTest.php
new file mode 100644
index 0000000..c493b20
--- /dev/null
+++ b/tests/Unit/Admin/FlowFormTest.php
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Admin\Form\FlowForm;
+
+test('accepts bounded named parameters and existing fields', function (string $field): void {
+    $data = ['name' => 'Ember', 'schema_id' => 2, 'filters' => json_encode([[['field' => $field, 'op' => 'eq', 'value' => 'ember']]])];
+    expect((new FlowForm())->validate($data))->toBe([]);
+})->with(['param:brand', 'param:sub_id_30', 'param:_', 'param:A-b_0', 'param:' . str_repeat('a', 64), 'country', 'region', 'city', 'asn', 'device', 'os', 'browser', 'lang', 'is_bot', 'bot_name', 'is_uniq', 'referer', 'referer_domain', 'utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'time_hour', 'day_of_week', 'ip_in_list', 'campaign']);
+
+test('rejects invalid parameter names without changing submitted data', function (string $name): void {
+    $data = ['name' => 'Ember', 'schema_id' => 2, 'filters' => json_encode([[['field' => 'param:' . $name, 'op' => 'neq', 'value' => 'ember']]])];
+    $before = $data;
+    expect((new FlowForm())->validate($data))->toHaveKey('filters', 'validation.pattern');
+    expect($data)->toBe($before);
+})->with(['', '1brand', 'bad.name', 'bad name', 'бренд', "brand\n", '<img src=x onerror=alert(1)>', str_repeat('a', 65)]);
+
+test('retains existing empty filters and form validation', function (): void {
+    $form = new FlowForm();
+    expect($form->validate(['name' => 'Ember', 'schema_id' => 2, 'filters' => '[]']))->toBe([]);
+    expect($form->validate(['name' => '', 'schema_id' => 17, 'filters' => '{', 'target_offers' => '{', 'weight' => 1001]))
+        ->toHaveKeys(['name', 'schema_id', 'filters', 'target_offers', 'weight']);
+});
diff --git a/tests/Unit/Engine/FilterCompilerTest.php b/tests/Unit/Engine/FilterCompilerTest.php
index 9407708..ae4213d 100644
--- a/tests/Unit/Engine/FilterCompilerTest.php
+++ b/tests/Unit/Engine/FilterCompilerTest.php
@@ -80,3 +80,68 @@ function ctx(array $overrides = []): Context {
     $b = $compiler->compile([[['field' => 'country', 'op' => 'eq', 'value' => 'ru']]]);
     expect($a)->toBe($b);
 });
+
+test('named query parameters use existing operators for arbitrary names', function (string $name): void {
+    $compiler = new FilterCompiler();
+    foreach (['eq' => true, 'neq' => false, 'in' => true, 'not_in' => false, 'exists' => true] as $op => $matches) {
+        $value = in_array($op, ['in', 'not_in'], true) ? ['ember', 'other'] : 'ember';
+        $filter = $compiler->compile([[['field' => 'param:' . $name, 'op' => $op, 'value' => $value]]]);
+        expect($filter(ctx(['query' => [$name => 'ember']])))->toBe($matches);
+        expect($filter(ctx(['query' => [$name => 'reject']])))->toBe($op === 'exists' || !$matches);
+        expect($filter(ctx()))->toBe(in_array($op, ['neq', 'not_in'], true));
+    }
+})->with(['brand', 'sub_id_30', 'sub_id_31', '_custom-2', 'Campaign', str_repeat('a', 64)]);
+
+test('named query parameters retain empty and zero strings and maximum byte value', function (): void {
+    $compiler = new FilterCompiler();
+    foreach (['', '0', str_repeat('x', 2048), str_repeat('é', 1024)] as $value) {
+        expect(ctx(['query' => ['brand' => $value]])->queryParam('brand'))->toBe($value);
+        $filter = $compiler->compile([[['field' => 'param:brand', 'op' => 'eq', 'value' => $value]]]);
+        expect($filter(ctx(['query' => ['brand' => $value]])))->toBeTrue();
+    }
+    $exists = $compiler->compile([[['field' => 'param:brand', 'op' => 'exists', 'value' => null]]]);
+    expect($exists(ctx(['query' => ['brand' => '']])))->toBeFalse();
+    expect($exists(ctx(['query' => ['brand' => '0']])))->toBeTrue();
+    expect(ctx()->queryParam('brand'))->toBeNull();
+});
+
+test('named query parameters treat invalid names and values as missing', function (string $name, mixed $value): void {
+    $compiler = new FilterCompiler();
+    $context = ctx(['query' => [$name => $value]]);
+    expect($context->queryParam($name))->toBeNull();
+    expect($context->query)->toBe([$name => $value]);
+    foreach (['eq' => false, 'neq' => true, 'in' => false, 'not_in' => true, 'exists' => false] as $op => $matches) {
+        $filter = $compiler->compile([[['field' => 'param:' . $name, 'op' => $op, 'value' => 'ember']]]);
+        expect($filter(ctx(['query' => [$name => $value]])))->toBe($matches);
+    }
+})->with([
+    'empty name' => ['', 'ember'],
+    '65 character name' => [str_repeat('a', 65), 'ember'],
+    'digit first' => ['1brand', 'ember'],
+    'hyphen first' => ['-brand', 'ember'],
+    'dot' => ['br.and', 'ember'],
+    'colon' => ['brand:other', 'ember'],
+    'unicode name' => ['бренд', 'ember'],
+    'newline name' => ["brand\n", 'ember'],
+    'array' => ['brand', ['ember']],
+    'null' => ['brand', null],
+    'integer' => ['brand', 0],
+    'boolean' => ['brand', true],
+    '2049 bytes' => ['brand', str_repeat('x', 2049)],
+    'multibyte oversize' => ['brand', str_repeat('é', 1025)],
+    ...array_combine(
+        array_map(fn (int $i) => 'control ' . $i, [...range(0, 31), 127]),
+        array_map(fn (int $i) => ['brand', 'ember' . chr($i)], [...range(0, 31), 127]),
+    ),
+]);
+
+test('named query parameters preserve builtin fields and malformed prefixes stay unknown', function (): void {
+    $compiler = new FilterCompiler();
+    $context = ctx(['country' => 'ru', 'query' => ['country' => 'us', 'brand' => 'ember']]);
+    foreach (['country' => 'ru', 'param:country' => 'us'] as $field => $value) {
+        expect(($compiler->compile([[['field' => $field, 'op' => 'eq', 'value' => $value]]]))($context))->toBeTrue();
+    }
+    foreach (['param', 'Param:brand', 'parambrand', 'param::brand'] as $field) {
+        expect(($compiler->compile([[['field' => $field, 'op' => 'eq', 'value' => 'ember']]]))($context))->toBeFalse();
+    }
+});
diff --git a/tests/Unit/Engine/MacroExpanderTest.php b/tests/Unit/Engine/MacroExpanderTest.php
index 513d82d..012cf74 100644
--- a/tests/Unit/Engine/MacroExpanderTest.php
+++ b/tests/Unit/Engine/MacroExpanderTest.php
@@ -75,3 +75,42 @@
     }
     expect(array_keys($seen))->toEqualCanonicalizing(['a', 'b', 'c']);
 });
+
+test('named query parameters encode URL components for arbitrary names', function (string $name): void {
+    $this->ctx->query[$name] = 'a &%/é%20';
+    expect($this->expander->expand('https://example.com/?p={param:' . $name . '}', $this->ctx))
+        ->toBe('https://example.com/?p=a%20%26%25%2F%C3%A9%2520');
+})->with(['brand', 'sub_id_30', 'sub_id_31', '_custom-2', 'Campaign', str_repeat('a', 64)]);
+
+test('named query parameters expand missing and invalid recognized tokens to empty', function (string $name, mixed $value): void {
+    $this->ctx->query[$name] = $value;
+    expect($this->expander->expand('p={param:' . $name . '}', $this->ctx))->toBe('p=');
+})->with([
+    'empty name' => ['', 'ember'],
+    '65 character name' => [str_repeat('a', 65), 'ember'],
+    'digit first' => ['1brand', 'ember'],
+    'hyphen first' => ['-brand', 'ember'],
+    'space' => ['br and', 'ember'],
+    'colon' => ['brand:other', 'ember'],
+    'unicode name' => ['бренд', 'ember'],
+    'newline name' => ["brand\n", 'ember'],
+    'array' => ['brand', ['ember']],
+    'null' => ['brand', null],
+    'integer' => ['brand', 0],
+    'boolean' => ['brand', true],
+    '2049 bytes' => ['brand', str_repeat('x', 2049)],
+    'multibyte oversize' => ['brand', str_repeat('é', 1025)],
+    ...array_combine(
+        array_map(fn (int $i) => 'control ' . $i, [...range(0, 31), 127]),
+        array_map(fn (int $i) => ['brand', 'ember' . chr($i)], [...range(0, 31), 127]),
+    ),
+]);
+
+test('named query parameters preserve zero empty maximum values builtins and unknown policy', function (): void {
+    $this->ctx->query = ['country' => 'us', 'zero' => '0', 'empty' => '', 'max' => str_repeat('x', 2048)];
+    expect($this->expander->expand('{country}/{param:country}/{param:zero}/{param:empty}/{param:missing}/{unknown}', $this->ctx))
+        ->toBe('ru/us/0///{unknown}');
+    expect($this->expander->expand('{param:max}', $this->ctx))->toBe(str_repeat('x', 2048));
+    $this->ctx->query['max'] = str_repeat('é', 1024);
+    expect($this->expander->expand('{param:max}', $this->ctx))->toBe(str_repeat('%C3%A9', 1024));
+});