From ee6e71b2eb403bfa513cf2a3465991004a777c65 Mon Sep 17 00:00:00 2001
From: hu13-test <hu13@test.local>
Date: Tue, 27 Oct 2026 19:49:57 +0000
Subject: [PATCH] review #5: harden Pages headers, .forge symlinks, links,
 origin/static parity (#106-#117)

---
 .forge/wiki/deploy         |   5 +
 docs/cloudflare.md         |  12 +-
 functions/inbox/[kind].js  |  25 +-
 src/build.rs               | 262 ++++++++++++++++++--
 src/forge.rs               |  77 ++++--
 src/paths.rs               |  61 ++++-
 src/releases.rs            |  36 ++-
 src/serve.rs               |  21 +-
 src/wiki.rs                |  15 +-
 tests/pages_inbox.test.mjs |  21 +-
 tests/review4_hardening.rs |   6 +-
 tests/review5_hardening.rs | 477 +++++++++++++++++++++++++++++++++++++
 12 files changed, 958 insertions(+), 60 deletions(-)
 create mode 100644 tests/review5_hardening.rs

diff --git a/.forge/wiki/deploy b/.forge/wiki/deploy
index ac9b9d3..d13f21c 100644
--- a/.forge/wiki/deploy
+++ b/.forge/wiki/deploy
@@ -70,6 +70,11 @@ What happens inside (`entrypoint.sh`):
   `/releases/<version>/**` download policy for Pages. On nginx, add the
   equivalent `add_header Content-Disposition attachment` for `/raw/` and
   release artifact directories — committed HTML/SVG must never render.
+- Pages clean-URL redirects: Pages answers `.html` paths with a 308
+  (`/issues/index.html` → `/issues/`, `/files/a.md.html` →
+  `/files/a.md`); the links still resolve, and Docker/nginx serve the
+  exact path. `_redirects` status 200 cannot override this. If exact URL
+  shape matters, use a proxy/Worker or accept the Pages form.
 - Cloudflare Pages inbox: the static `dist/` alone has **no inbox**. The
   Pages Function in `functions/inbox/[kind].js` + R2 binding `INBOX` and
   secret `INBOX_SALT` implement the same contract. See
diff --git a/docs/cloudflare.md b/docs/cloudflare.md
index b561c9e..7e6c420 100644
--- a/docs/cloudflare.md
+++ b/docs/cloudflare.md
@@ -4,6 +4,14 @@ The same `dist/` works on Docker/`hu13 serve`, nginx, and Pages. On
 Pages the inbox is implemented by a Pages Function backed by R2; a
 static-only upload has no working inbox.
 
+Pages normalizes `.html` request paths with a 308 (for example
+`/issues/index.html` → `/issues/` and `/files/a.md.html` →
+`/files/a.md`). Every generated link still reaches the same page; the
+redirect is a Pages platform behavior, not a missing file. Docker/nginx
+serve the exact `.html` path with no redirect. If byte-identical URLs
+matter, put a proxy/Worker in front or accept the Pages canonical form;
+`_redirects` status 200 cannot override these clean-URL redirects.
+
 ## 1. Build the site
 
 ```sh
@@ -94,4 +102,6 @@ it does not read R2. Copy objects down if you want the terminal reader.
 - Committed `/raw/*` bytes and release artifacts under
   `/releases/<version>/*` always download (`Content-Disposition:
   attachment`) on both `serve` and Pages, so hostile HTML/SVG can never
-  execute in the inbox origin.
+  execute in the inbox origin. The Pages `_headers` rule uses one named
+  placeholder plus one splat (`/releases/:version/*`): Pages silently
+  skips rules with two splats.
diff --git a/functions/inbox/[kind].js b/functions/inbox/[kind].js
index 1fa9037..3ef6121 100644
--- a/functions/inbox/[kind].js
+++ b/functions/inbox/[kind].js
@@ -258,13 +258,17 @@ async function saltedIpHash(ip, salt) {
 // rule for /inbox/* is the durable control; this still stops a single
 // hot isolate from storing unlimited submissions.
 const buckets = new Map();
+const MAX_RATE_KEYS = 10000;
 function rateAllowed(key, limit) {
   const now = Date.now();
-  if (buckets.size > 10000) {
+  if (buckets.size >= MAX_RATE_KEYS) {
     for (const [k, v] of buckets) if (v.reset <= now) buckets.delete(k);
   }
   let b = buckets.get(key);
   if (!b || b.reset <= now) {
+    // Fail closed for a new key when the isolate map is full; do not let
+    // source-IP rotation grow it without bound (f0rge #116).
+    if (!b && buckets.size >= MAX_RATE_KEYS) return false;
     b = { count: 0, reset: now + 3600_000 };
     buckets.set(key, b);
   }
@@ -273,9 +277,24 @@ function rateAllowed(key, limit) {
   return true;
 }
 
+// R2 list returns at most 1000 objects per call. Paginate until the
+// configured quota is counted or the listing ends; a truncated page
+// without a cursor fails closed (f0rge #116).
 async function overQuota(bucket, limit) {
-  const listed = await bucket.list({ limit: Math.min(limit, 1000) });
-  return listed.objects.length >= limit;
+  if (!(limit > 0)) return true;
+  let count = 0;
+  let cursor;
+  for (;;) {
+    const page = await bucket.list({
+      limit: Math.min(limit - count, 1000),
+      cursor,
+    });
+    count += page.objects.length;
+    if (count >= limit) return true;
+    if (!page.truncated) return false;
+    if (!page.cursor) return true;
+    cursor = page.cursor;
+  }
 }
 
 function nowRfc3339() {
diff --git a/src/build.rs b/src/build.rs
index 4274e88..a572829 100644
--- a/src/build.rs
+++ b/src/build.rs
@@ -191,14 +191,184 @@ fn safe_url(url: &str) -> bool {
     matches!(scheme, "http" | "https" | "mailto" | "tel")
 }
 
-/// Render markdown to HTML, escaping raw HTML.
-///
-/// `pulldown-cmark` passes `Html`/`InlineHtml` events through untouched
-/// (R1 finding), so map them through [`esc`] first. GFM tables, task
-/// lists and strikethrough are enabled (f0rge #71); link/image
-/// destinations are scheme-filtered (f0rge #62).
-#[must_use]
-pub fn markdown_to_html(md: &str) -> String {
+/// Context for relative markdown destinations: a repo file page uses
+/// `/files/...` + `/raw/...` + `/assets/...`; a wiki page uses
+/// `/wiki/...` + raw/assets for non-page files.
+#[derive(Clone, Copy)]
+enum LinkBase<'a> {
+    Repo(&'a str),
+    Wiki(&'a str),
+}
+
+fn base_path(base: LinkBase<'_>) -> &str {
+    match base {
+        LinkBase::Repo(p) | LinkBase::Wiki(p) => p,
+    }
+}
+
+/// Lexically resolve a relative link against a repo- or wiki-relative
+/// base directory. Returns `None` when it climbs above the root or has
+/// unsafe/absolute components.
+fn rel_join(base: &str, path: &str) -> Option<String> {
+    if path.starts_with('/') || path.contains(['\\', '\0']) {
+        return None;
+    }
+    let mut parts: Vec<&str> = base.split('/').filter(|s| !s.is_empty()).collect();
+    for seg in path.split('/') {
+        match seg {
+            "" | "." => {}
+            ".." => {
+                parts.pop()?;
+            }
+            other => parts.push(other),
+        }
+    }
+    if parts.is_empty() {
+        return None;
+    }
+    Some(parts.join("/"))
+}
+
+/// Extensions safe to display inline from `assets/`: raster/static
+/// images whose bytes cannot execute as a document. SVG and HTML stay
+/// downloads under `raw/`.
+fn is_inline_image(path: &str) -> bool {
+    let base = path.rsplit('/').next().unwrap_or(path);
+    let Some((stem, ext)) = base.rsplit_once('.') else {
+        return false;
+    };
+    !stem.is_empty()
+        && matches!(
+            ext.to_ascii_lowercase().as_str(),
+            "png" | "jpg" | "jpeg" | "gif" | "webp" | "ico" | "avif"
+        )
+}
+
+/// Rewrite one relative markdown destination to the generated route.
+/// External URLs, fragments, absolute paths and anything that cannot be
+/// resolved stay as-is. Query/fragment suffixes are preserved.
+fn rewrite_dest(dest: &str, base: LinkBase<'_>, image: bool) -> Option<String> {
+    let d = dest.trim();
+    if d.is_empty() || d.starts_with(['#', '/']) || d.starts_with("//") {
+        return None;
+    }
+    // A real scheme (`http:`, `mailto:`, ...) is not a relative file.
+    if let Some(colon) = d.find(':') {
+        let scheme = &d[..colon];
+        let mut chars = scheme.chars();
+        if chars.next().is_some_and(|c| c.is_ascii_alphabetic())
+            && chars.all(|c| c.is_ascii_alphanumeric() || matches!(c, '+' | '-' | '.'))
+        {
+            return None;
+        }
+    }
+    let cut = d.find(['?', '#']).unwrap_or(d.len());
+    let (path, suffix) = d.split_at(cut);
+    let target = rel_join(base_path(base), path)?;
+    let target = target.trim_end_matches('/');
+    if target.is_empty() {
+        return None;
+    }
+    let enc = encode_path(target);
+    let asset = match base {
+        LinkBase::Wiki(_) => format!("/assets/.forge/wiki/{enc}"),
+        LinkBase::Repo(_) => format!("/assets/{enc}"),
+    };
+    let route = if is_inline_image(target) {
+        asset
+    } else if image {
+        format!("/raw/{enc}")
+    } else {
+        match base {
+            LinkBase::Wiki(_) => format!("/wiki/{enc}.html"),
+            LinkBase::Repo(_) => {
+                let name = target.rsplit('/').next().unwrap_or(target);
+                if is_markdown(target) || name.eq_ignore_ascii_case("readme") {
+                    format!("/files/{enc}.html")
+                } else {
+                    format!("/raw/{enc}")
+                }
+            }
+        }
+    };
+    Some(format!("{route}{suffix}"))
+}
+
+/// Strip simple inline/block tags for a heading slug. Entity decoding
+/// runs afterwards so `&amp;` becomes a word separator, not `amp`.
+fn heading_text(inner: &str) -> String {
+    let mut out = String::with_capacity(inner.len());
+    let mut in_tag = false;
+    for c in inner.chars() {
+        match c {
+            '<' => in_tag = true,
+            '>' => in_tag = false,
+            _ if !in_tag => out.push(c),
+            _ => {}
+        }
+    }
+    decode_entities(&out)
+}
+
+fn slugify(text: &str) -> String {
+    let mut out = String::new();
+    let mut dash = false;
+    for c in text.chars().flat_map(char::to_lowercase) {
+        if c.is_alphanumeric() {
+            out.push(c);
+            dash = false;
+        } else if !out.is_empty() && !dash {
+            out.push('-');
+            dash = true;
+        }
+    }
+    while out.ends_with('-') {
+        out.pop();
+    }
+    if out.is_empty() {
+        "section".to_string()
+    } else {
+        out
+    }
+}
+
+fn heading_parts(line: &str) -> Option<(usize, &str, &str)> {
+    let b = line.as_bytes();
+    if b.len() < 8 || b[0] != b'<' || b[1] != b'h' || !(b'1'..=b'6').contains(&b[2]) || b[3] != b'>'
+    {
+        return None;
+    }
+    let level = usize::from(b[2] - b'0');
+    let close = format!("</h{level}>");
+    let end = line.find(&close)?;
+    Some((level, &line[4..end], &line[end + close.len()..]))
+}
+
+/// Add deterministic heading ids so `#section` links work. Input is the
+/// renderer's own output, so headings are one per line and contain only
+/// generated tags; code-block lines are entity-escaped and never match.
+fn add_heading_ids(html: &str) -> String {
+    let mut out = String::with_capacity(html.len() + 64);
+    let mut seen: BTreeMap<String, usize> = BTreeMap::new();
+    for line in html.split_inclusive('\n') {
+        if let Some((level, inner, tail)) = heading_parts(line) {
+            let base = slugify(&heading_text(inner));
+            let count = seen.entry(base.clone()).or_insert(0);
+            *count += 1;
+            let id = if *count == 1 {
+                base
+            } else {
+                format!("{base}-{}", *count)
+            };
+            out.push_str(&format!("<h{level} id=\"{id}\">{inner}</h{level}>{tail}"));
+        } else {
+            out.push_str(line);
+        }
+    }
+    out
+}
+
+fn render_markdown(md: &str, base: Option<LinkBase<'_>>) -> String {
     use pulldown_cmark::{html, Event, Options, Parser, Tag};
     let options = Options::ENABLE_TABLES
         | Options::ENABLE_TASKLISTS
@@ -215,7 +385,11 @@ pub fn markdown_to_html(md: &str) -> String {
             id,
         }) => {
             let dest = if safe_url(&dest_url) {
-                decode_entities(&dest_url)
+                let decoded = decode_entities(&dest_url);
+                match base.and_then(|b| rewrite_dest(&decoded, b, false)) {
+                    Some(rewritten) => rewritten,
+                    None => decoded,
+                }
             } else {
                 "#".to_string()
             };
@@ -233,7 +407,11 @@ pub fn markdown_to_html(md: &str) -> String {
             id,
         }) => {
             let dest = if safe_url(&dest_url) {
-                decode_entities(&dest_url)
+                let decoded = decode_entities(&dest_url);
+                match base.and_then(|b| rewrite_dest(&decoded, b, true)) {
+                    Some(rewritten) => rewritten,
+                    None => decoded,
+                }
             } else {
                 "#".to_string()
             };
@@ -249,7 +427,31 @@ pub fn markdown_to_html(md: &str) -> String {
     let mut out = String::from("<div class=\"markdown\">\n");
     html::push_html(&mut out, mapped);
     out.push_str("</div>\n");
-    out
+    add_heading_ids(&out)
+}
+
+/// Render markdown to HTML, escaping raw HTML.
+///
+/// `pulldown-cmark` passes `Html`/`InlineHtml` events through untouched
+/// (R1 finding), so map them through [`esc`] first. GFM tables, task
+/// lists and strikethrough are enabled (f0rge #71); link/image
+/// destinations are scheme-filtered (f0rge #62). Headings get stable
+/// ids so `#section` links resolve (f0rge #112).
+#[must_use]
+pub fn markdown_to_html(md: &str) -> String {
+    render_markdown(md, None)
+}
+
+/// Render markdown from a repo file page or wiki page, rewriting
+/// relative links/images to generated routes (f0rge #112).
+#[must_use]
+pub fn markdown_to_html_in(md: &str, base: &str, wiki: bool) -> String {
+    let base = if wiki {
+        LinkBase::Wiki(base)
+    } else {
+        LinkBase::Repo(base)
+    };
+    render_markdown(md, Some(base))
 }
 
 /// Resolve the clone URL to advertise.
@@ -547,6 +749,12 @@ pub fn now_unix() -> i64 {
 #[must_use]
 pub fn parse_ts_secs(s: &str) -> Option<i64> {
     let s = s.trim();
+    // Timestamps are ASCII by definition. Reject other text before any
+    // byte-index slicing: a 200-char multibyte `created` used to panic
+    // on a non-char-boundary (f0rge #108).
+    if !s.is_ascii() {
+        return None;
+    }
     // Accept both `2026-10-27T14:08:48Z` (RFC3339) and git's
     // `2026-10-27 14:08:48 +0000` / `+00:00` forms.
     let (date, rest) = match s.split_once('T') {
@@ -1154,7 +1362,10 @@ pub const HEADERS_FILE: &str = "\
   X-Content-Type-Options: nosniff
 # Artifacts are build outputs copied from .forge/releases/out/<ver>/;
 # never let an artifact .html/.svg execute in the site origin (f0rge #97).
-/releases/*/*
+# Cloudflare Pages allows one splat per rule. A named `:version`
+# placeholder plus one splat covers every artifact depth (f0rge #106).
+# A two-splat rule is silently skipped by Pages and leaves artifacts active.
+/releases/:version/*
   Content-Disposition: attachment
   X-Content-Type-Options: nosniff
 /*
@@ -1486,6 +1697,17 @@ pub fn run_build(repo: &Path, out: &Path, opts: &BuildOptions) -> Result<BuildSu
             std::fs::write(&dest, &blob.bytes).map_err(|e| format!("hu13: write raw {f}: {e}"))?;
             blobs.insert(f.clone(), blob.bytes);
         }
+        // Raster images mentioned by markdown need an inline route; `/raw`
+        // intentionally downloads everything. Copy only non-executable
+        // image formats under `/assets` (f0rge #112). SVG/HTML stay raw.
+        if is_inline_image(f) {
+            let adest = out.join("assets").join(f);
+            if let Some(parent) = adest.parent() {
+                std::fs::create_dir_all(parent)
+                    .map_err(|e| format!("hu13: create assets parent: {e}"))?;
+            }
+            std::fs::copy(&dest, &adest).map_err(|e| format!("hu13: write asset {f}: {e}"))?;
+        }
     }
 
     // Per-path pages (m6 code-gitea, f0rge #33): Gitea-style file
@@ -1591,7 +1813,8 @@ pub fn run_build(repo: &Path, out: &Path, opts: &BuildOptions) -> Result<BuildSu
                     bytes.len() as u64,
                     Some(display.lines().count()),
                 ));
-                body.push_str(&markdown_to_html(&display));
+                let base = f.rsplit_once('/').map(|(d, _)| d).unwrap_or("");
+                body.push_str(&markdown_to_html_in(&display, base, false));
                 body.push_str(&format!(
                     "<p class=\"muted\"><a href=\"/raw/{}\">view raw</a></p>\n",
                     href_esc(f)
@@ -1733,7 +1956,12 @@ pub fn run_build(repo: &Path, out: &Path, opts: &BuildOptions) -> Result<BuildSu
                 esc(path)
             ));
             if is_markdown(path) || path.to_lowercase().contains("readme") {
-                body.push_str(&markdown_to_html(&blob.display));
+                let (base, wiki) = if let Some(rest) = path.strip_prefix(".forge/wiki/") {
+                    (rest.rsplit_once('/').map(|(d, _)| d).unwrap_or(""), true)
+                } else {
+                    (path.rsplit_once('/').map(|(d, _)| d).unwrap_or(""), false)
+                };
+                body.push_str(&markdown_to_html_in(&blob.display, base, wiki));
             } else {
                 body.push_str(&render_text_pre(&blob.display, path));
             }
@@ -2070,7 +2298,7 @@ mod tests {
         let (_repo, out) = build_fixture();
         let html = std::fs::read_to_string(out.join("files/docs/guide.md.html")).expect("md page");
         assert!(
-            html.contains("<h1>Guide</h1>"),
+            html.contains("<h1 id=\"guide\">Guide</h1>"),
             "markdown rendered, got: {html}"
         );
         assert!(html.contains("/raw/docs/guide.md"), "raw link kept");
@@ -2243,7 +2471,7 @@ mod tests {
     #[test]
     fn markdown_escapes_raw_html() {
         let html = markdown_to_html("# hi\n\n<script>alert(1)</script>\n\n**bold**\n");
-        assert!(html.contains("<h1>hi</h1>"), "heading renders");
+        assert!(html.contains("<h1 id=\"hi\">hi</h1>"), "heading renders");
         assert!(!html.contains("<script>"), "no raw passthrough");
         assert!(html.contains("&lt;script&gt;"), "escaped instead");
         assert!(
@@ -3035,6 +3263,6 @@ mod tests {
         // Agents guide renders its markdown h1; spacing comes from the
         // shared `main>h1:first-child` gap-var rule (CSS assert in layout).
         let agents = read("agents.html");
-        assert!(agents.contains("<h1>"), "agents h1");
+        assert!(agents.contains("<h1"), "agents h1");
     }
 }
diff --git a/src/forge.rs b/src/forge.rs
index ecdbcba..d866287 100644
--- a/src/forge.rs
+++ b/src/forge.rs
@@ -22,7 +22,7 @@ use std::path::Path;
 
 use serde::Deserialize;
 
-use crate::build::markdown_to_html;
+use crate::build::markdown_to_html_in;
 use crate::layout::{diff_html, esc, page_site_with_provenance};
 
 /// `.forge/` files larger than this are skipped (schema SEC-01: 256 KiB).
@@ -89,6 +89,35 @@ fn read_text_capped(path: &Path, label: &str) -> Option<String> {
     }
 }
 
+/// Like [`read_text_capped`], but keeps arbitrary bytes (CI logs may be
+/// lossy UTF-8). Symlinks and oversized files are skipped, so `.forge`
+/// cannot make the build read an unbounded or outside file (f0rge #107).
+fn read_bytes_capped(path: &Path, label: &str) -> Option<Vec<u8>> {
+    match std::fs::symlink_metadata(path) {
+        Ok(m) if m.file_type().is_symlink() => {
+            eprintln!("hu13: forge: skipping {label}: symlink");
+            return None;
+        }
+        _ => {}
+    }
+    let len = std::fs::metadata(path).map(|m| m.len()).unwrap_or(0);
+    if len > FORGE_MAX_BYTES {
+        eprintln!("hu13: forge: skipping {label}: over 256 KiB ({len} bytes)");
+        return None;
+    }
+    match std::fs::read(path) {
+        Ok(bytes) if bytes.len() as u64 <= FORGE_MAX_BYTES => Some(bytes),
+        Ok(_) => {
+            eprintln!("hu13: forge: skipping {label}: over 256 KiB");
+            None
+        }
+        Err(e) => {
+            eprintln!("hu13: forge: skipping {label}: cannot read: {e}");
+            None
+        }
+    }
+}
+
 /// Parse YAML frontmatter; on error warn (naming file via `label` plus the
 /// serde error, which names the field) and return `None` (skip the file).
 fn parse_frontmatter<T>(yaml: &str, label: &str) -> Option<T>
@@ -120,8 +149,13 @@ fn sorted_entries(dir: &Path, only_dirs: bool) -> Vec<String> {
                 continue;
             }
         };
-        let is_dir = ent.file_type().map(|t| t.is_dir()).unwrap_or(false);
-        if is_dir != only_dirs {
+        let meta = match std::fs::symlink_metadata(ent.path()) {
+            Ok(m) => m,
+            Err(_) => continue,
+        };
+        // Never descend or read through a symlink: `.forge` entries are
+        // repo-controlled and must not escape the checkout (f0rge #107).
+        if meta.file_type().is_symlink() || meta.is_dir() != only_dirs {
             continue;
         }
         names.push(ent.file_name().to_string_lossy().into_owned());
@@ -592,6 +626,10 @@ fn load_issues(root: &Path) -> Vec<Issue> {
             eprintln!("hu13: forge: skipping {label}: unsafe id {:?}", fm.id);
             continue;
         }
+        if crate::paths::is_reserved_index(&fm.id) {
+            eprintln!("hu13: forge: skipping {label}: reserved id index");
+            continue;
+        }
         let comments = load_comments(
             &dir.join(&uuid).join("comments"),
             &format!("issues/{uuid}/comments"),
@@ -637,9 +675,13 @@ fn load_prs(root: &Path) -> Vec<Pr> {
             eprintln!("hu13: forge: skipping {label}: unsafe id {:?}", fm.id);
             continue;
         }
-        let patch = std::fs::read(dir.join(&uuid).join("patch.diff"))
-            .ok()
-            .map(|bytes| String::from_utf8_lossy(&bytes).into_owned());
+        if crate::paths::is_reserved_index(&fm.id) {
+            eprintln!("hu13: forge: skipping {label}: reserved id index");
+            continue;
+        }
+        // Symlink-safe and bounded: a hostile patch.diff used to be read
+        // whole, even through a symlink (f0rge #107).
+        let patch = read_text_capped(&dir.join(&uuid).join("patch.diff"), "patch.diff");
         let comments = load_comments(
             &dir.join(&uuid).join("comments"),
             &format!("prs/{uuid}/comments"),
@@ -839,8 +881,12 @@ fn load_ci(root: &Path) -> CiInfo {
             if !name.ends_with(".log") {
                 continue;
             }
-            let bytes = std::fs::read(dir.join("runs").join(&ts).join("steps").join(&name))
-                .unwrap_or_default();
+            let label = format!("ci/runs/{ts}/steps/{name}");
+            let bytes = read_bytes_capped(
+                &dir.join("runs").join(&ts).join("steps").join(&name),
+                &label,
+            )
+            .unwrap_or_default();
             let text = String::from_utf8_lossy(&bytes);
             logs.push((name, truncate_log(&redact_paths(&text, repo_root))));
         }
@@ -874,7 +920,10 @@ fn load_ci(root: &Path) -> CiInfo {
 /// `.forge/` yields empty sections.
 #[must_use]
 pub fn load(repo: &Path) -> ForgeData {
-    let root = repo.join(".forge");
+    // Resolve `.forge` and require it to stay inside the repo. A symlinked
+    // `.forge` used to publish host issues/wiki/releases (f0rge #107).
+    let root = crate::paths::repo_subdir(repo, ".forge")
+        .unwrap_or_else(|| repo.join(".hu13-missing-forge"));
     ForgeData {
         issues: load_issues(&root),
         prs: load_prs(&root),
@@ -971,7 +1020,7 @@ fn render_comment(c: &Comment, now: i64) -> String {
         esc(author),
         time_ago(&c.created, now),
     ));
-    out.push_str(&markdown_to_html(&c.body));
+    out.push_str(&markdown_to_html_in(&c.body, "", false));
     out.push_str("</li>\n");
     out
 }
@@ -1022,7 +1071,7 @@ fn render_issue_page(
         esc(&issue.id)
     ));
     body.push_str(&details);
-    body.push_str(&markdown_to_html(&issue.body));
+    body.push_str(&markdown_to_html_in(&issue.body, "", false));
     body.push_str(&format!("<h2>Comments ({})</h2>\n", issue.comments.len()));
     if issue.comments.is_empty() {
         body.push_str("<p class=\"muted\">No comments yet.</p>\n");
@@ -1096,7 +1145,7 @@ fn render_pr_page(
         esc(&pr.id)
     ));
     body.push_str(&details);
-    body.push_str(&markdown_to_html(&pr.body));
+    body.push_str(&markdown_to_html_in(&pr.body, "", false));
     body.push_str("<h2>Patch</h2>\n");
     match &pr.patch {
         Some(patch) if !patch.is_empty() => {
@@ -1131,7 +1180,7 @@ fn render_pr_page(
                 esc(author),
                 time_ago(&r.created, now),
                 esc(state),
-                markdown_to_html(&r.body),
+                markdown_to_html_in(&r.body, "", false),
             ));
         }
         body.push_str("</ul>\n");
@@ -1312,7 +1361,7 @@ fn render_tasks_index(
                             "<p class=\"muted\">assignee: <code>{}</code></p>\n",
                             esc(a)
                         )),
-                        body_md = markdown_to_html(&t.body),
+                        body_md = markdown_to_html_in(&t.body, "", false),
                     ));
                 }
                 body.push_str("</ul>\n");
diff --git a/src/paths.rs b/src/paths.rs
index 437caaa..049b015 100644
--- a/src/paths.rs
+++ b/src/paths.rs
@@ -7,7 +7,11 @@
 //!
 //! Rules: no absolute paths, no `\` or NUL, no empty/`.`/`..` segments.
 //! The checks are lexical on purpose — they run before anything is
-//! created, so there is nothing to canonicalize yet.
+//! created, so there is nothing to canonicalize yet. Filesystem readers
+//! additionally use [`repo_subdir`] so a symlinked `.forge` cannot point
+//! outside the checkout (f0rge #107).
+
+use std::path::{Path, PathBuf};
 
 /// `true` when `segment` is a single safe path component.
 #[must_use]
@@ -24,6 +28,29 @@ pub fn is_safe_relative(rel: &str) -> bool {
         && rel.split('/').all(is_safe_segment)
 }
 
+/// Resolve `repo/rel` through symlinks and require the result to stay
+/// inside the resolved repo root. Returns `None` for missing paths,
+/// symlink escapes, or the repo root itself. Used for untrusted
+/// `.forge` trees (f0rge #107).
+#[must_use]
+pub fn repo_subdir(repo: &Path, rel: &str) -> Option<PathBuf> {
+    let root = std::fs::canonicalize(repo).ok()?;
+    let target = std::fs::canonicalize(root.join(rel)).ok()?;
+    if target == root || !target.starts_with(&root) {
+        return None;
+    }
+    Some(target)
+}
+
+/// `true` for names that would overwrite a generated section index
+/// (`releases/index.html`, `issues/index.html`, `pulls/index.html`,
+/// `wiki/index.html`). Case-insensitive so a case-insensitive host
+/// cannot collide either (f0rge #110).
+#[must_use]
+pub fn is_reserved_index(name: &str) -> bool {
+    name.eq_ignore_ascii_case("index")
+}
+
 /// `true` when `id` is safe both as a path segment and as a displayed
 /// forge id: ASCII alphanumerics, `-`, `_` only.
 #[must_use]
@@ -71,4 +98,36 @@ mod tests {
             assert!(!is_safe_id(bad), "{bad:?} must be rejected");
         }
     }
+
+    #[test]
+    fn reserved_index_names() {
+        for name in ["index", "INDEX", "Index"] {
+            assert!(is_reserved_index(name));
+        }
+        for name in ["index.html", "indexes", "my-index", ""] {
+            assert!(!is_reserved_index(name));
+        }
+    }
+
+    #[test]
+    fn subdir_stays_inside_repo() {
+        let dir = std::env::temp_dir().join(format!(
+            "hu13-paths-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .map(|d| d.as_nanos())
+                .unwrap_or(0)
+        ));
+        std::fs::create_dir_all(dir.join("inside")).unwrap();
+        std::fs::write(dir.join("inside/x"), "x").unwrap();
+        assert!(repo_subdir(&dir, "inside").is_some());
+        assert!(repo_subdir(&dir, "missing").is_none());
+        #[cfg(unix)]
+        {
+            std::os::unix::fs::symlink("/etc", dir.join("escape")).unwrap();
+            assert!(repo_subdir(&dir, "escape").is_none());
+        }
+        let _ = std::fs::remove_dir_all(&dir);
+    }
 }
diff --git a/src/releases.rs b/src/releases.rs
index 75acf0c..c9b9d28 100644
--- a/src/releases.rs
+++ b/src/releases.rs
@@ -21,7 +21,7 @@ use std::path::{Path, PathBuf};
 
 use serde::Deserialize;
 
-use crate::build::{href_esc, markdown_to_html};
+use crate::build::{href_esc, markdown_to_html_in};
 use crate::layout::{esc, page_site_with_provenance};
 
 /// `.forge/` files larger than this are skipped (schema SEC-01: 256 KiB).
@@ -125,6 +125,11 @@ fn read_text_capped(path: &Path, label: &str) -> Option<String> {
 /// Collect every file under `dir` as `(relative /-separated path, size)`,
 /// sorted by path. No size cap: the maintainer shipped it, hu13 serves it.
 fn collect_artifacts(dir: &Path) -> Vec<Artifact> {
+    // The version directory itself may be a symlink; never list outside.
+    match std::fs::symlink_metadata(dir) {
+        Ok(m) if m.is_dir() && !m.file_type().is_symlink() => {}
+        _ => return Vec::new(),
+    }
     let mut out = Vec::new();
     let mut stack: Vec<PathBuf> = vec![PathBuf::new()];
     while let Some(rel) = stack.pop() {
@@ -179,6 +184,10 @@ fn collect_artifacts(dir: &Path) -> Vec<Artifact> {
 
 /// Copy the WHOLE `src_dir` tree to `dest_dir` (no size cap).
 fn copy_tree(src_dir: &Path, dest_dir: &Path) -> Result<(), String> {
+    match std::fs::symlink_metadata(src_dir) {
+        Ok(m) if m.is_dir() && !m.file_type().is_symlink() => {}
+        _ => return Ok(()),
+    }
     let mut stack: Vec<PathBuf> = vec![PathBuf::new()];
     while let Some(rel) = stack.pop() {
         let src = src_dir.join(&rel);
@@ -226,7 +235,9 @@ fn copy_tree(src_dir: &Path, dest_dir: &Path) -> Result<(), String> {
 /// an empty vec. Order is `(created, version)`.
 #[must_use]
 pub fn load(repo: &Path) -> Vec<Release> {
-    let root = repo.join(".forge").join("releases");
+    let Some(root) = crate::paths::repo_subdir(repo, ".forge/releases") else {
+        return Vec::new();
+    };
     let rd = match std::fs::read_dir(&root) {
         Ok(rd) => rd,
         Err(_) => return Vec::new(),
@@ -280,6 +291,10 @@ pub fn load(repo: &Path) -> Vec<Release> {
             );
             continue;
         }
+        if crate::paths::is_reserved_index(&fm.version) {
+            eprintln!("hu13: releases: skipping {label}: reserved version index");
+            continue;
+        }
         // Artifacts: present only when `out/<version>/` exists at build.
         // Absent -> notes-only, no warning.
         let out_dir = root.join("out").join(&fm.version);
@@ -366,7 +381,7 @@ fn render_release_page(
             esc(sha)
         ));
     }
-    body.push_str(&markdown_to_html(&rel.body));
+    body.push_str(&markdown_to_html_in(&rel.body, "", false));
     if rel.artifacts.is_empty() {
         body.push_str("<p class=\"muted\">No artifacts attached.</p>\n");
     } else {
@@ -428,7 +443,7 @@ pub fn render_loaded(
     short_sha: &str,
     description: Option<&str>,
 ) -> Result<(), String> {
-    let root = repo.join(".forge").join("releases");
+    let root = crate::paths::repo_subdir(repo, ".forge/releases");
     let mut body = String::from("<div class=\"page-head\"><h1>Releases</h1></div>\n");
     if releases.is_empty() {
         body.push_str("<p class=\"muted\">No releases yet.</p>\n");
@@ -472,11 +487,14 @@ pub fn render_loaded(
                 rel.version
             ));
         }
-        // Copy the whole out dir when present (no size cap).
-        let src_dir = root.join("out").join(&rel.version);
-        if src_dir.is_dir() {
-            let dest_dir = out.join("releases").join(&rel.version);
-            copy_tree(&src_dir, &dest_dir)?;
+        // Copy the whole out dir when present (no size cap). The root is
+        // resolved once; copy_tree still refuses a symlinked version dir.
+        if let Some(root) = root.as_ref() {
+            let src_dir = root.join("out").join(&rel.version);
+            if src_dir.is_dir() {
+                let dest_dir = out.join("releases").join(&rel.version);
+                copy_tree(&src_dir, &dest_dir)?;
+            }
         }
         let html = render_release_page(rel, site_name, nav, branch, short_sha, description);
         let page_dest = out.join("releases").join(format!("{}.html", rel.version));
diff --git a/src/serve.rs b/src/serve.rs
index 9edb446..89bf867 100644
--- a/src/serve.rs
+++ b/src/serve.rs
@@ -110,8 +110,12 @@ struct Shared {
 /// startup. Returns `None` when no bundle exists or git fails (serve
 /// continues static-only; `/repo.bundle` still downloads via GET).
 fn prepare_git_dir(www: &Path) -> Option<PathBuf> {
-    let bundle = www.join("repo.bundle");
-    if !bundle.is_file() {
+    // Static serving already rejects an outside symlink; smart HTTP must
+    // use the same resolved-path check (f0rge #117). A symlink pointing
+    // inside www is allowed, but a symlink to a private bundle is not.
+    let www_root = resolve_existing(www);
+    let bundle = resolve_existing(&www.join("repo.bundle"));
+    if bundle == www_root || !bundle.starts_with(&www_root) || !bundle.is_file() {
         return None;
     }
     let dir = std::env::temp_dir().join(format!(
@@ -428,7 +432,7 @@ fn respond(
     body: &[u8],
 ) {
     let mut out = format!(
-        "HTTP/1.1 {code} {}\r\nContent-Type: {content_type}\r\nContent-Length: {}\r\nX-Content-Type-Options: nosniff\r\nConnection: close\r\n",
+        "HTTP/1.1 {code} {}\r\nContent-Type: {content_type}\r\nContent-Length: {}\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: strict-origin-when-cross-origin\r\nConnection: close\r\n",
         reason(code),
         body.len()
     );
@@ -492,6 +496,8 @@ fn content_type_for(name: &str) -> &'static str {
         "image/webp"
     } else if lower.ends_with(".ico") {
         "image/x-icon"
+    } else if lower.ends_with(".avif") {
+        "image/avif"
     } else if lower.ends_with(".webmanifest") {
         "application/manifest+json"
     } else if lower.ends_with(".json") {
@@ -888,7 +894,7 @@ fn respond_file_head(
     len: u64,
 ) {
     let mut out = format!(
-        "HTTP/1.1 {code} {}\r\nContent-Type: {content_type}\r\nContent-Length: {len}\r\nX-Content-Type-Options: nosniff\r\nConnection: close\r\n",
+        "HTTP/1.1 {code} {}\r\nContent-Type: {content_type}\r\nContent-Length: {len}\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: strict-origin-when-cross-origin\r\nConnection: close\r\n",
         reason(code)
     );
     for (k, v) in extra {
@@ -910,7 +916,12 @@ fn static_not_found(stream: &mut TcpStream, head: &Head, shared: &Shared) {
         static_error(stream, 404);
         return;
     }
-    let dest = shared.www.join("404.html");
+    let www = resolve_existing(&shared.www);
+    let dest = resolve_existing(&shared.www.join("404.html"));
+    if dest == www || !dest.starts_with(&www) {
+        static_error(stream, 404);
+        return;
+    }
     let Ok(meta) = std::fs::metadata(&dest) else {
         static_error(stream, 404);
         return;
diff --git a/src/wiki.rs b/src/wiki.rs
index 25bfc48..8465473 100644
--- a/src/wiki.rs
+++ b/src/wiki.rs
@@ -14,7 +14,7 @@
 use std::collections::BTreeMap;
 use std::path::Path;
 
-use crate::build::{href_esc, markdown_to_html};
+use crate::build::{href_esc, markdown_to_html_in};
 use crate::layout::{esc, page_site_with_provenance};
 
 /// Wiki files larger than this are skipped (schema SEC-01: 256 KiB).
@@ -75,7 +75,8 @@ pub fn page_title(body: &str, filename: &str) -> String {
 /// [`render`] would emit for skipped entries.
 #[must_use]
 pub fn page_count(repo: &Path) -> usize {
-    let root = repo.join(".forge").join("wiki");
+    let root = crate::paths::repo_subdir(repo, ".forge/wiki")
+        .unwrap_or_else(|| repo.join(".hu13-missing-wiki"));
     if !root.exists() {
         return 0;
     }
@@ -128,7 +129,7 @@ pub fn page_count(repo: &Path) -> usize {
             };
             if meta.is_dir() {
                 stack.push(rel);
-            } else if meta.is_file() {
+            } else if meta.is_file() && !crate::paths::is_reserved_index(&rel) {
                 rel_files.push(rel);
             }
         }
@@ -169,7 +170,8 @@ pub fn render(
     short_sha: &str,
     description: Option<&str>,
 ) -> Result<Vec<WikiPage>, String> {
-    let root = repo.join(".forge").join("wiki");
+    let root = crate::paths::repo_subdir(repo, ".forge/wiki")
+        .unwrap_or_else(|| repo.join(".hu13-missing-wiki"));
     let mut rel_files: Vec<String> = Vec::new();
     if root.exists() {
         // Iterative walk over `/`-separated relative dirs. Symlinked dirs
@@ -226,7 +228,7 @@ pub fn render(
                 };
                 if meta.is_dir() {
                     stack.push(rel);
-                } else if meta.is_file() {
+                } else if meta.is_file() && !crate::paths::is_reserved_index(&rel) {
                     rel_files.push(rel);
                 }
             }
@@ -317,7 +319,8 @@ pub fn render(
             esc(&p.title),
             esc(&p.path),
         );
-        body.push_str(&markdown_to_html(&text));
+        let base = p.path.rsplit_once('/').map(|(d, _)| d).unwrap_or("");
+        body.push_str(&markdown_to_html_in(&text, base, true));
         let html = page_site_with_provenance(
             &format!("{} — wiki — {site_name}", p.title),
             nav,
diff --git a/tests/pages_inbox.test.mjs b/tests/pages_inbox.test.mjs
index a825c71..1696bae 100644
--- a/tests/pages_inbox.test.mjs
+++ b/tests/pages_inbox.test.mjs
@@ -10,10 +10,16 @@ class FakeBucket {
   constructor() {
     this.objects = new Map();
   }
-  async list({ limit = 1000 } = {}) {
+  async list({ limit = 1000, cursor } = {}) {
+    const keys = [...this.objects.keys()];
+    const start = cursor === undefined ? 0 : Number(cursor);
+    const objects = keys.slice(start, start + limit).map((key) => ({ key }));
+    const next = start + objects.length;
+    const truncated = next < keys.length;
     return {
-      objects: [...this.objects.keys()].slice(0, limit).map((key) => ({ key })),
-      truncated: this.objects.size > limit,
+      objects,
+      truncated,
+      cursor: truncated ? String(next) : undefined,
     };
   }
   async put(key, value) {
@@ -159,6 +165,15 @@ test("quota is enforced before storing", async () => {
   assert.equal(e.INBOX.objects.size, 1);
 });
 
+test("quota above 1000 paginates R2 listings", async () => {
+  const bucket = new FakeBucket();
+  for (let i = 0; i < 1500; i++) bucket.objects.set(`old-${i}.json`, "x");
+  const e = env({ INBOX: bucket, INBOX_QUOTA: "1500" });
+  const { res } = await post("issue", validIssue, {}, e);
+  assert.equal(res.status, 503);
+  assert.equal(bucket.objects.size, 1500, "full inbox did not store");
+});
+
 test("missing R2 binding or salt fails closed", async () => {
   const noBucket = await post("issue", validIssue, {}, { INBOX_SALT: "x" });
   assert.equal(noBucket.res.status, 503);
diff --git a/tests/review4_hardening.rs b/tests/review4_hardening.rs
index 961f0bc..371bdc6 100644
--- a/tests/review4_hardening.rs
+++ b/tests/review4_hardening.rs
@@ -222,7 +222,11 @@ fn review4_build_and_release_hardening() {
     );
 
     let headers = read(&out.join("_headers"));
-    assert!(headers.contains("/releases/*/*"), "{headers}");
+    assert!(headers.contains("/releases/:version/*"), "{headers}");
+    assert!(
+        !headers.contains("/releases/*/*"),
+        "two splats are invalid on Pages: {headers}"
+    );
     assert!(
         headers.contains("Content-Disposition: attachment"),
         "{headers}"
diff --git a/tests/review5_hardening.rs b/tests/review5_hardening.rs
new file mode 100644
index 0000000..9756eaa
--- /dev/null
+++ b/tests/review5_hardening.rs
@@ -0,0 +1,477 @@
+//! Review #5 hardening (f0rge #106–#117): one-splat Pages artifact
+//! headers, symlink-safe `.forge` reads, multibyte timestamps, reserved
+//! indexes, context-aware markdown links/images/anchors, and `serve`
+//! header/404/bundle parity.
+
+use std::io::{BufRead, BufReader, Read, Write};
+use std::net::TcpStream;
+use std::path::{Path, PathBuf};
+use std::process::{Child, Command, Stdio};
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::Duration;
+
+static SEQ: AtomicU64 = AtomicU64::new(0);
+
+fn fresh(prefix: &str) -> PathBuf {
+    let dir = std::env::temp_dir().join(format!(
+        "hu13-review5-{prefix}-{}-{}",
+        std::process::id(),
+        std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .map(|d| d.as_nanos())
+            .unwrap_or(0)
+            .wrapping_add(u128::from(SEQ.fetch_add(1, Ordering::Relaxed)))
+    ));
+    std::fs::create_dir_all(&dir).unwrap();
+    dir
+}
+
+fn git(repo: &Path, args: &[&str]) {
+    let st = Command::new("git")
+        .arg("-C")
+        .arg(repo)
+        .args(args)
+        .status()
+        .expect("spawn git");
+    assert!(st.success(), "git {args:?} failed");
+}
+
+fn write(repo: &Path, rel: &str, body: &str) {
+    let dest = repo.join(rel);
+    std::fs::create_dir_all(dest.parent().expect("parent")).unwrap();
+    std::fs::write(dest, body).unwrap();
+}
+
+fn init_repo() -> PathBuf {
+    let repo = fresh("repo");
+    git(&repo, &["init", "-b", "main"]);
+    git(&repo, &["config", "user.name", "hu13-test"]);
+    git(&repo, &["config", "user.email", "hu13@test.local"]);
+    git(&repo, &["config", "commit.gpgsign", "false"]);
+    repo
+}
+
+fn commit(repo: &Path, msg: &str) {
+    git(repo, &["add", "-A"]);
+    git(repo, &["commit", "-qm", msg]);
+}
+
+fn build(repo: &Path, out: &Path) -> std::process::Output {
+    Command::new(env!("CARGO_BIN_EXE_hu13"))
+        .arg("build")
+        .arg(repo)
+        .arg("-o")
+        .arg(out)
+        .output()
+        .expect("spawn hu13 build")
+}
+
+fn read(path: &Path) -> String {
+    std::fs::read_to_string(path).unwrap_or_else(|e| panic!("read {}: {e}", path.display()))
+}
+
+struct Server {
+    child: Child,
+    addr: String,
+}
+
+impl Drop for Server {
+    fn drop(&mut self) {
+        self.child.kill().ok();
+        self.child.wait().ok();
+    }
+}
+
+fn start(www: &Path, inbox: &Path) -> Server {
+    let mut cmd = Command::new(env!("CARGO_BIN_EXE_hu13"));
+    cmd.arg("serve")
+        .arg("--www")
+        .arg(www)
+        .arg("--inbox-dir")
+        .arg(inbox)
+        .arg("--listen")
+        .arg("127.0.0.1:0")
+        .stdout(Stdio::piped())
+        .stderr(Stdio::null());
+    let mut child = cmd.spawn().expect("spawn serve");
+    let stdout = child.stdout.take().expect("stdout");
+    let mut addr = String::new();
+    for line in BufReader::new(stdout).lines().take(50).flatten() {
+        if let Some(rest) = line.split("listening on ").nth(1) {
+            addr = rest.trim().to_string();
+            break;
+        }
+    }
+    assert!(!addr.is_empty(), "serve printed no listening line");
+    Server { child, addr }
+}
+
+fn get(addr: &str, path: &str) -> String {
+    let mut s = TcpStream::connect(addr).expect("connect");
+    s.set_read_timeout(Some(Duration::from_secs(10))).unwrap();
+    write!(
+        s,
+        "GET {path} HTTP/1.1\r\nHost: {addr}\r\nConnection: close\r\n\r\n"
+    )
+    .unwrap();
+    let mut out = Vec::new();
+    s.read_to_end(&mut out).unwrap();
+    String::from_utf8_lossy(&out).into_owned()
+}
+
+#[test]
+fn pages_headers_use_one_splat_for_artifacts() {
+    let repo = init_repo();
+    write(&repo, "README.md", "# headers\n");
+    commit(&repo, "init");
+    let out = fresh("headers-out");
+    let res = build(&repo, &out);
+    assert!(
+        res.status.success(),
+        "{}",
+        String::from_utf8_lossy(&res.stderr)
+    );
+    let headers = read(&out.join("_headers"));
+    assert!(headers.contains("/releases/:version/*"), "{headers}");
+    assert!(!headers.contains("/releases/*/*"), "invalid two-splat rule");
+    let rules: Vec<&str> = headers.lines().filter(|l| l.starts_with('/')).collect();
+    for rule in rules {
+        assert!(
+            rule.matches('*').count() <= 1,
+            "Pages allows one splat per rule: {rule}"
+        );
+    }
+}
+
+#[test]
+fn multibyte_timestamps_do_not_panic() {
+    let repo = init_repo();
+    write(&repo, "README.md", "# timestamps\n");
+    write(
+        &repo,
+        ".forge/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/issue.md",
+        "---\nid: aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa\ntitle: T\nstate: open\ncreated: \"2026-01-01 12:34:56+€!\"\n---\nbody\n",
+    );
+    commit(&repo, "init");
+    let out = fresh("ts-out");
+    let res = build(&repo, &out);
+    assert!(
+        res.status.success(),
+        "build panicked? {}",
+        String::from_utf8_lossy(&res.stderr)
+    );
+    let issues = read(&out.join("issues/index.html"));
+    assert!(issues.contains("€"), "timestamp text preserved");
+}
+
+#[cfg(unix)]
+#[test]
+fn symlinked_forge_trees_and_files_are_ignored() {
+    let secret = fresh("secret");
+    write(&secret, "wiki/leak.md", "TOP SECRET WIKI\n");
+    write(
+        &secret,
+        "releases/out/v1/leak.html",
+        "TOP SECRET ARTIFACT\n",
+    );
+    write(&secret, "patch.diff", "TOP SECRET PATCH\n");
+    write(&secret, "steps/00.log", "TOP SECRET LOG\n");
+
+    let repo = init_repo();
+    write(&repo, "README.md", "# symlinks\n");
+    write(
+        &repo,
+        ".forge/releases/v1.md",
+        "---\nversion: v1\ncreated: 2026-01-01T00:00:00Z\n---\nnotes\n",
+    );
+    write(
+        &repo,
+        ".forge/prs/cccccccc-cccc-cccc-cccc-cccccccccccc/pr.md",
+        "---\nid: cccccccc-cccc-cccc-cccc-cccccccccccc\ntitle: P\nstate: open\nbase: main\nhead: topic\ncreated: 2026-01-01T00:00:00Z\n---\nbody\n",
+    );
+    write(
+        &repo,
+        ".forge/ci/runs/2026-01-01T00-00-00Z/summary.md",
+        "---\nrun: 2026-01-01T00-00-00Z\nverdict: pass\ncreated: 2026-01-01T00:00:00Z\nsteps: []\n---\nsummary\n",
+    );
+    write(&repo, ".forge/ci/steps/00_test.sh", "true\n");
+    std::fs::create_dir_all(repo.join(".forge/releases/out")).unwrap();
+    std::os::unix::fs::symlink(secret.join("wiki"), repo.join(".forge/wiki")).unwrap();
+    std::os::unix::fs::symlink(
+        secret.join("releases/out/v1"),
+        repo.join(".forge/releases/out/v1"),
+    )
+    .unwrap();
+    std::os::unix::fs::symlink(
+        secret.join("patch.diff"),
+        repo.join(".forge/prs/cccccccc-cccc-cccc-cccc-cccccccccccc/patch.diff"),
+    )
+    .unwrap();
+    std::fs::create_dir_all(repo.join(".forge/ci/runs/2026-01-01T00-00-00Z/steps")).unwrap();
+    std::os::unix::fs::symlink(
+        secret.join("steps/00.log"),
+        repo.join(".forge/ci/runs/2026-01-01T00-00-00Z/steps/00.log"),
+    )
+    .unwrap();
+    commit(&repo, "symlinks");
+
+    let out = fresh("symlink-out");
+    let res = build(&repo, &out);
+    assert!(
+        res.status.success(),
+        "{}",
+        String::from_utf8_lossy(&res.stderr)
+    );
+    let mut hits = Vec::new();
+    for entry in walk(&out) {
+        if let Ok(text) = std::fs::read_to_string(&entry) {
+            if text.contains("TOP SECRET") {
+                hits.push(entry);
+            }
+        }
+    }
+    assert!(hits.is_empty(), "host files published: {hits:?}");
+    assert!(!out.join("wiki/leak.md.html").exists());
+    assert!(!out.join("releases/v1/leak.html").exists());
+}
+
+#[cfg(unix)]
+#[test]
+fn symlinked_forge_root_is_not_read() {
+    let secret = fresh("root-secret");
+    write(&secret, "wiki/leak.md", "TOP SECRET ROOT\n");
+    write(
+        &secret,
+        "releases/v1.md",
+        "---\nversion: v1\ncreated: 2026-01-01T00:00:00Z\n---\nTOP SECRET ROOT\n",
+    );
+    let repo = init_repo();
+    write(&repo, "README.md", "# root\n");
+    std::os::unix::fs::symlink(&secret, repo.join(".forge")).unwrap();
+    commit(&repo, "root symlink");
+    let out = fresh("root-out");
+    let res = build(&repo, &out);
+    assert!(
+        res.status.success(),
+        "{}",
+        String::from_utf8_lossy(&res.stderr)
+    );
+    for entry in walk(&out) {
+        if let Ok(text) = std::fs::read_to_string(&entry) {
+            assert!(!text.contains("TOP SECRET ROOT"), "{}", entry.display());
+        }
+    }
+}
+
+fn walk(root: &Path) -> Vec<PathBuf> {
+    let mut out = Vec::new();
+    let mut stack = vec![root.to_path_buf()];
+    while let Some(dir) = stack.pop() {
+        let Ok(rd) = std::fs::read_dir(&dir) else {
+            continue;
+        };
+        for ent in rd.flatten() {
+            let p = ent.path();
+            if p.is_dir() {
+                stack.push(p);
+            } else {
+                out.push(p);
+            }
+        }
+    }
+    out
+}
+
+#[test]
+fn reserved_index_names_do_not_hijack_section_indexes() {
+    let repo = init_repo();
+    write(&repo, "README.md", "# indexes\n");
+    write(
+        &repo,
+        ".forge/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/issue.md",
+        "---\nid: index\ntitle: Hijack Issue\nstate: open\ncreated: 2026-01-01T00:00:00Z\n---\nbody\n",
+    );
+    write(
+        &repo,
+        ".forge/prs/bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb/pr.md",
+        "---\nid: index\ntitle: Hijack Pull\nstate: open\nbase: main\nhead: topic\ncreated: 2026-01-01T00:00:00Z\n---\nbody\n",
+    );
+    write(
+        &repo,
+        ".forge/releases/index.md",
+        "---\nversion: index\ncreated: 2026-01-01T00:00:00Z\n---\nHijack Release\n",
+    );
+    write(&repo, ".forge/wiki/index", "# Hijack Wiki\n");
+    commit(&repo, "indexes");
+
+    let out = fresh("index-out");
+    let res = build(&repo, &out);
+    assert!(
+        res.status.success(),
+        "{}",
+        String::from_utf8_lossy(&res.stderr)
+    );
+    let stderr = String::from_utf8_lossy(&res.stderr);
+    assert!(stderr.contains("reserved"), "warned: {stderr}");
+    for (rel, marker) in [
+        ("issues/index.html", "Hijack Issue"),
+        ("pulls/index.html", "Hijack Pull"),
+        ("releases/index.html", "Hijack Release"),
+        ("wiki/index.html", "Hijack Wiki"),
+    ] {
+        let page = read(&out.join(rel));
+        assert!(!page.contains(marker), "{rel} hijacked by {marker}");
+    }
+    assert!(read(&out.join("issues/index.html")).contains("Issues"));
+    assert!(read(&out.join("pulls/index.html")).contains("Pulls"));
+    assert!(read(&out.join("releases/index.html")).contains("Releases"));
+    assert!(read(&out.join("wiki/index.html")).contains("Wiki"));
+}
+
+#[test]
+fn markdown_links_images_and_heading_anchors_resolve() {
+    let repo = init_repo();
+    write(
+        &repo,
+        "README.md",
+        "# Root\n\n## Section One\n\n[guide](docs/guide.md#section-one) ![pic](docs/pic.png)\n\n[web](https://example.com)\n",
+    );
+    write(
+        &repo,
+        "docs/guide.md",
+        "# Guide\n\n[peer](peer.md) [root](../README.md) ![pic](pic.png)\n",
+    );
+    write(&repo, "docs/peer.md", "# Peer\n");
+    std::fs::create_dir_all(repo.join("docs")).unwrap();
+    std::fs::write(repo.join("docs/pic.png"), b"\x89PNG\r\n\x1a\n").unwrap();
+    write(
+        &repo,
+        ".forge/wiki/home.md",
+        "# Wiki Home\n\n[other](other.md) ![pic](pic.png)\n",
+    );
+    write(&repo, ".forge/wiki/other.md", "# Other\n");
+    std::fs::write(repo.join(".forge/wiki/pic.png"), b"\x89PNG\r\n\x1a\n").unwrap();
+    write(
+        &repo,
+        ".forge/releases/v1.md",
+        "---\nversion: v1\ncreated: 2026-01-01T00:00:00Z\n---\n# Release\n\n[guide](docs/guide.md) ![pic](docs/pic.png)\n",
+    );
+    write(
+        &repo,
+        ".forge/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/issue.md",
+        "---\nid: aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa\ntitle: Link issue\nstate: open\ncreated: 2026-01-01T00:00:00Z\n---\n# Issue\n\n[guide](docs/guide.md) ![pic](docs/pic.png)\n",
+    );
+    write(
+        &repo,
+        ".forge/prs/bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb/pr.md",
+        "---\nid: bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb\ntitle: Link PR\nstate: open\nbase: main\nhead: topic\ncreated: 2026-01-01T00:00:00Z\n---\n# PR\n\n[guide](docs/guide.md) ![pic](docs/pic.png)\n",
+    );
+    commit(&repo, "markdown");
+
+    let out = fresh("md-out");
+    let res = build(&repo, &out);
+    assert!(
+        res.status.success(),
+        "{}",
+        String::from_utf8_lossy(&res.stderr)
+    );
+
+    let index = read(&out.join("index.html"));
+    assert!(index.contains("id=\"root\""), "{index}");
+    assert!(index.contains("id=\"section-one\""), "{index}");
+    assert!(
+        index.contains("href=\"/files/docs/guide.md.html#section-one\""),
+        "{index}"
+    );
+    assert!(index.contains("src=\"/assets/docs/pic.png\""), "{index}");
+    assert!(
+        index.contains("href=\"https://example.com\""),
+        "external kept"
+    );
+
+    let guide = read(&out.join("files/docs/guide.md.html"));
+    assert!(guide.contains("id=\"guide\""), "{guide}");
+    assert!(
+        guide.contains("href=\"/files/docs/peer.md.html\""),
+        "{guide}"
+    );
+    assert!(guide.contains("href=\"/files/README.md.html\""), "{guide}");
+    assert!(guide.contains("src=\"/assets/docs/pic.png\""), "{guide}");
+
+    let wiki = read(&out.join("wiki/home.md.html"));
+    assert!(wiki.contains("id=\"wiki-home\""), "{wiki}");
+    assert!(wiki.contains("href=\"/wiki/other.md.html\""), "{wiki}");
+    assert!(
+        wiki.contains("src=\"/assets/.forge/wiki/pic.png\""),
+        "{wiki}"
+    );
+    assert!(out.join("assets/docs/pic.png").is_file());
+    assert!(out.join("assets/.forge/wiki/pic.png").is_file());
+
+    for rel in [
+        "releases/v1.html",
+        "issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa.html",
+        "pulls/bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb.html",
+    ] {
+        let page = read(&out.join(rel));
+        assert!(
+            page.contains("href=\"/files/docs/guide.md.html\""),
+            "{rel}: {page}"
+        );
+        assert!(
+            page.contains("src=\"/assets/docs/pic.png\""),
+            "{rel}: {page}"
+        );
+    }
+}
+
+#[cfg(unix)]
+#[test]
+fn serve_404_headers_and_bundle_symlinks_are_safe() {
+    let secret = fresh("serve-secret");
+    write(&secret, "secret.html", "TOP SECRET 404\n");
+    let www = fresh("serve-www");
+    write(&www, "index.html", "<p>ok</p>\n");
+    std::os::unix::fs::symlink(secret.join("secret.html"), www.join("404.html")).unwrap();
+
+    let src = fresh("bundle-src");
+    git(&src, &["init", "-b", "main"]);
+    git(&src, &["config", "user.name", "hu13-test"]);
+    git(&src, &["config", "user.email", "hu13@test.local"]);
+    write(&src, "a.txt", "secret\n");
+    commit(&src, "init");
+    let bundle = fresh("private-bundle");
+    git(
+        &src,
+        &[
+            "bundle",
+            "create",
+            bundle.join("repo.bundle").to_str().unwrap(),
+            "main",
+        ],
+    );
+    std::os::unix::fs::symlink(bundle.join("repo.bundle"), www.join("repo.bundle")).unwrap();
+
+    let inbox = fresh("serve-inbox");
+    let srv = start(&www, &inbox);
+    std::thread::sleep(Duration::from_millis(100));
+
+    let root = get(&srv.addr, "/");
+    assert!(root.starts_with("HTTP/1.1 200"), "{root}");
+    assert!(
+        root.contains("Referrer-Policy: strict-origin-when-cross-origin"),
+        "{root}"
+    );
+
+    let missing = get(&srv.addr, "/nope");
+    assert!(missing.starts_with("HTTP/1.1 404"), "{missing}");
+    assert!(!missing.contains("TOP SECRET 404"), "{missing}");
+    assert!(
+        missing.contains("Referrer-Policy: strict-origin-when-cross-origin"),
+        "{missing}"
+    );
+
+    let refs = get(&srv.addr, "/repo.bundle/info/refs?service=git-upload-pack");
+    assert!(refs.starts_with("HTTP/1.1 404"), "{refs}");
+    assert!(!refs.contains("git-upload-pack-advertisement"), "{refs}");
+}
-- 
2.56.0