diff --git a/.changeset/codeql-backlog-security.md b/.changeset/codeql-backlog-security.md
new file mode 100644
index 00000000..9d3facba
--- /dev/null
+++ b/.changeset/codeql-backlog-security.md
@@ -0,0 +1,14 @@
+---
+"@cloudhal/core-ts": patch
+"@cloudhal/astro-renderer": patch
+"@cloudhal/api": patch
+"@cloudhal/mcp-server": patch
+"@cloudhal/cloudflare": patch
+"@cloudhal/cli": patch
+---
+
+Security fixes from the CodeQL backlog on `main`.
+
+- **Prototype pollution.** A2UI `updateDataModel` paths (`@cloudhal/core-ts/interop`) that name `__proto__`, `constructor` or `prototype` at any depth are now refused with an `InteropError` instead of being skipped, step into arrays by index only, and write own properties only; an input whose component id is one of those keys gets the data key `<id>-value`. Surface pointers the page writes through (an input's `value`/`checked`, a Scrolly's `step`, a Button action's `path`) may not name those keys (a `checkSurface` issue); read bindings still may. The Build eval's sample inputs never write through them, and `set_chrome` and `update_entry`'s `fields` merge patch refuse them as keys. `RESERVED_KEYS` and `isReservedKey` are new in `@cloudhal/core-ts/names`.
+- **Plain text from HTML.** `htmlText` (meta and feed descriptions, JSON-LD, table-of-contents labels) is plain text: `&lt;script&gt;` in markdown is the text `<script>`, as before, and every place it goes escapes it (now tested sink by sink). Tags are dropped with a linear scan, and entities are decoded once (`&amp;#60;` is the text `&#60;`, no longer `<`).
+- **Linear scans (AGENTS.md rule 13).** The svg sniff of uploads (exponential on `<!--` followed by many `--><!--`), the code-fence opener of surface bodies, the rich-text-to-text and text-to-rich-text field conversions, hostname normalization, the leading-H1 check of articles, the table of contents, the `::embed` check, the sender-address check (`isMailAddress`, new in `@cloudhal/api`; `MAIL_ADDRESS` in `@cloudhal/cloudflare/mail` is deprecated) and Studio's origin trim no longer backtrack. Each gives the old regex's answers; one intended difference: an svg comment ends at its first `-->`.
diff --git a/packages/api/src/build-eval.ts b/packages/api/src/build-eval.ts
index 707a6ce4..9003ee9d 100644
--- a/packages/api/src/build-eval.ts
+++ b/packages/api/src/build-eval.ts
@@ -409,9 +409,12 @@ export function withSampleInputs(page: Page): { page: Page; inputs: number } {
       if (c.component !== "NumberField" && c.component !== "RadioGroup") continue;
       inputs++;
       const keys = bound.path.split("/").slice(1);
+      // The store refuses these in pointers; checked again here because this writes through them.
+      if (keys.some((k) => k === "__proto__" || k === "constructor" || k === "prototype")) continue;
       let at: Record<string, unknown> = data;
       for (const k of keys.slice(0, -1)) {
-        if (typeof at[k] !== "object" || at[k] === null) at[k] = {};
+        const next = Object.hasOwn(at, k) ? at[k] : undefined;
+        if (typeof next !== "object" || next === null) at[k] = {};
         at = at[k] as Record<string, unknown>;
       }
       const last = keys[keys.length - 1] as string;
diff --git a/packages/api/src/email.ts b/packages/api/src/email.ts
index be2905bd..6555a792 100644
--- a/packages/api/src/email.ts
+++ b/packages/api/src/email.ts
@@ -19,3 +19,17 @@ export function isEmailAddress(value: string): boolean {
   // `[^\s@]+\.[^\s@]+`: a dot that is neither the domain's first nor its last character.
   return value.slice(at + 2, -1).includes(".");
 }
+
+/**
+ * A sender address (`mail.from` in cloudhal.json, `CLOUDHAL_MAIL_FROM`): a plain `local@domain`
+ * with no display name, no whitespace or line breaks and no `<`, `>` or `"`. It accepts exactly
+ * what `/^[^\s@<>"]+@[^\s@<>"]+\.[^\s@<>"]+$/` accepted, linearly: that regex backtracked
+ * quadratically on `a@` followed by many `.x` (CodeQL js/polynomial-redos). No length cap here;
+ * callers that need one check `EMAIL_MAX_LENGTH`.
+ */
+export function isMailAddress(value: string): boolean {
+  if (/[\s<>"]/.test(value)) return false;
+  const at = value.indexOf("@");
+  if (at < 1 || value.indexOf("@", at + 1) !== -1) return false;
+  return value.slice(at + 2, -1).includes(".");
+}
diff --git a/packages/api/src/index.ts b/packages/api/src/index.ts
index 51787671..60fc1722 100644
--- a/packages/api/src/index.ts
+++ b/packages/api/src/index.ts
@@ -40,6 +40,7 @@ export {
   TOOL_EVAL_BRIEFS,
 } from "./build-eval.ts";
 export type { ActorResolver, ApiDeps } from "./context.ts";
+export { EMAIL_MAX_LENGTH, isEmailAddress, isMailAddress } from "./email.ts";
 export type { ApiErrorBody } from "./errors.ts";
 export { MailError, type MailMessage, type MailSender } from "./mail.ts";
 export { oauthClientsPruneJob } from "./oauth-prune-job.ts";
diff --git a/packages/api/src/tokens.ts b/packages/api/src/tokens.ts
index 2eaca5cb..016b978e 100644
--- a/packages/api/src/tokens.ts
+++ b/packages/api/src/tokens.ts
@@ -4,6 +4,7 @@
  * returned once, travels in a URL fragment, and never appears in audit rows or logs.
  */
 import { sha256Hex } from "@cloudhal/core-ts";
+import { trimEndChar } from "@cloudhal/core-ts/names";
 import type { Context } from "hono";
 import type { Env } from "./context.ts";
 import { apiError } from "./errors.ts";
@@ -135,7 +136,8 @@ export function studioOrigin(
   configured: string | undefined,
   trusted: ReadonlySet<string>,
 ): string {
-  if (configured) return configured.replace(/\/+$/, "");
+  // `trimEndChar`, not `/\/+$/`, which backtracks on a long run of "/" (js/polynomial-redos).
+  if (configured) return trimEndChar(configured, "/");
   const own = new URL(c.req.url).origin;
   const origin = c.req.header("origin");
   return origin && (origin === own || trusted.has(origin)) ? origin : own;
diff --git a/packages/api/test/design-pass.test.ts b/packages/api/test/design-pass.test.ts
index fb5eae0f..e247c9ea 100644
--- a/packages/api/test/design-pass.test.ts
+++ b/packages/api/test/design-pass.test.ts
@@ -435,5 +435,27 @@ describe("tool briefs (RFC-0022 22e)", () => {
       ],
     } as never);
     expect((kept.page.sections[0] as { data: unknown }).data).toEqual({ kg: 70 });
+    // a pointer through a reserved key is skipped: nothing is written to Object.prototype
+    for (const path of ["/__proto__/kg", "/constructor/prototype/kg"]) {
+      const skipped = withSampleInputs({
+        sections: [
+          {
+            id: "sec_x0000001",
+            kind: "surface",
+            catalog: "blog@1",
+            data: {},
+            components: [
+              {
+                id: "root",
+                component: "NumberField",
+                props: { label: "W", min: 1, value: { path } },
+              },
+            ],
+          },
+        ],
+      } as never);
+      expect((skipped.page.sections[0] as { data: unknown }).data).toEqual({});
+      expect(({} as Record<string, unknown>).kg).toBeUndefined();
+    }
   });
 });
diff --git a/packages/api/test/linear-checks.test.ts b/packages/api/test/linear-checks.test.ts
new file mode 100644
index 00000000..3c334843
--- /dev/null
+++ b/packages/api/test/linear-checks.test.ts
@@ -0,0 +1,62 @@
+/** CodeQL alerts 11 and 19: the sender-address check and Studio's origin trim, linear (rule 13). */
+import { describe, expect, it } from "vitest";
+import { isMailAddress } from "../src/email.ts";
+import { studioOrigin } from "../src/tokens.ts";
+
+const OLD_MAIL_ADDRESS = /^[^\s@<>"]+@[^\s@<>"]+\.[^\s@<>"]+$/;
+
+/** Every string of up to `max` characters over `alphabet`. */
+function* strings(alphabet: readonly string[], max: number): Generator<string> {
+  let all = [""];
+  yield "";
+  for (let len = 1; len <= max; len++) {
+    all = all.flatMap((s) => alphabet.map((c) => s + c));
+    yield* all;
+  }
+}
+
+const fast = (f: () => void) => {
+  const start = performance.now();
+  f();
+  expect(performance.now() - start).toBeLessThan(1500);
+};
+
+describe("isMailAddress (alert 19)", () => {
+  it("accepts exactly what the old regex accepted", () => {
+    for (const s of [
+      "studio@example.com",
+      "Studio <studio@example.com>",
+      '"q"@example.com',
+      "a@b.c",
+      "a@b.c\n",
+      " a@b.c",
+      `${"a".repeat(300)}@b.c`,
+    ])
+      expect(isMailAddress(s), JSON.stringify(s)).toBe(OLD_MAIL_ADDRESS.test(s));
+    for (const s of strings(["a", ".", "@", " ", "<", '"'], 6))
+      expect(isMailAddress(s), JSON.stringify(s)).toBe(OLD_MAIL_ADDRESS.test(s));
+  });
+
+  it("is linear on a long run of .x after the @", () => {
+    fast(() => expect(isMailAddress(`!@!.${"!.".repeat(100_000)} `)).toBe(false));
+    fast(() => expect(isMailAddress(`a@b${".c".repeat(100_000)}`)).toBe(true));
+  });
+});
+
+describe("studioOrigin (alert 11)", () => {
+  const origin = (configured: string) => studioOrigin({} as never, configured, new Set());
+  it("trims trailing slashes as /\\/+$/ did", () => {
+    for (const s of [
+      "https://studio.example",
+      "https://studio.example/",
+      "https://s.example///",
+      "/",
+    ])
+      expect(origin(s)).toBe(s.replace(/\/+$/, ""));
+    // An empty result falls through to the request's own origin, as before: not tested here.
+  });
+  it("is linear on a long run of / with something after it", () => {
+    const inner = `https://a${"/".repeat(100_000)}b`;
+    fast(() => expect(origin(`${inner}/`)).toBe(inner));
+  });
+});
diff --git a/packages/astro-renderer/src/embed-client.ts b/packages/astro-renderer/src/embed-client.ts
index 57258e58..60bb9f18 100644
--- a/packages/astro-renderer/src/embed-client.ts
+++ b/packages/astro-renderer/src/embed-client.ts
@@ -10,6 +10,7 @@
  * version (`/_cloudhal/*` is cached as immutable): bump it with any change to the code; a test
  * pins the code's hash to the version.
  */
+import { hasEmbedLine } from "./text-scan.ts";
 
 /** The only hosts an `embed` player may load from (also the CSP `frame-src`). */
 export const EMBED_FRAME_ORIGINS = [
@@ -88,7 +89,7 @@ export function usesEmbeds(content: {
   markdown?: string | undefined;
   sections?: readonly { kind: string; type?: string; format?: string; body?: string }[] | undefined;
 }): boolean {
-  const md = (s: string | undefined) => !!s && /(^|\n)\s*(?:>\s*)*::embed\b/.test(s);
+  const md = (s: string | undefined) => !!s && hasEmbedLine(s);
   if (md(content.markdown)) return true;
   return (content.sections ?? []).some(
     (s) =>
diff --git a/packages/astro-renderer/src/kit.ts b/packages/astro-renderer/src/kit.ts
index 31a18a96..28e83e78 100644
--- a/packages/astro-renderer/src/kit.ts
+++ b/packages/astro-renderer/src/kit.ts
@@ -5,6 +5,7 @@
  */
 import type { ContentEntry, Correction } from "@cloudhal/core-contracts";
 import { htmlText, renderBody, renderInlineMarkdown } from "./markdown.ts";
+import { renderedHeadings } from "./text-scan.ts";
 
 /** One heading of an article's table of contents; `id` is the anchor the rendered body carries. */
 export interface TocItem {
@@ -22,18 +23,12 @@ export interface ArticleOutline {
 /** Words per minute when a theme sets none (RFC-0018 §1 `readingSpeed`). */
 export const READING_SPEED = 230;
 
-const HEADING = /<h([23]) id="([^"]+)">([\s\S]*?)<\/h\1>/g;
-
 /**
  * Headings of HTML rendered by `renderMarkdown`/`renderBody` (their ids come from `headingSlug`).
  * HTML bodies keep no ids through the sanitizer, so they have no table of contents.
  */
 export function tableOfContents(html: string): TocItem[] {
-  return [...html.matchAll(HEADING)].map((m) => ({
-    id: m[2] as string,
-    text: htmlText(m[3] as string),
-    depth: Number(m[1]) as 2 | 3,
-  }));
+  return renderedHeadings(html).map((h) => ({ id: h.id, text: htmlText(h.inner), depth: h.depth }));
 }
 
 /**
diff --git a/packages/astro-renderer/src/markdown.ts b/packages/astro-renderer/src/markdown.ts
index 4fdb2f38..36f65c7a 100644
--- a/packages/astro-renderer/src/markdown.ts
+++ b/packages/astro-renderer/src/markdown.ts
@@ -19,6 +19,7 @@ import {
 import { safeHref, safeSrc } from "./safe-urls.ts";
 import { sanitizeHtml } from "./sanitize.ts";
 import { renderSurface, surfaceProblems } from "./surfaces.ts";
+import { htmlText, leadingHeading, stripTags } from "./text-scan.ts";
 
 export type { MediaContext } from "./media.ts";
 
@@ -357,14 +358,6 @@ export function renderInlineMarkdown(source: string): string {
   }
 }
 
-const ENTITIES: Record<string, string> = {
-  "&amp;": "&",
-  "&lt;": "<",
-  "&gt;": ">",
-  "&quot;": '"',
-  "&#39;": "'",
-};
-
 /** Markdown as plain text (meta descriptions): rendered safely, then tags dropped and entities decoded. */
 export function markdownText(source: string): string {
   return htmlText(renderMarkdown(source));
@@ -372,20 +365,10 @@ export function markdownText(source: string): string {
 
 /** Inline markdown as plain text: inline tags go without leaving gaps ("**537**," → "537,"). */
 export function inlineMarkdownText(source: string): string {
-  return htmlText(renderInlineMarkdown(source).replace(/<[^>]*>/g, ""));
+  return htmlText(stripTags(renderInlineMarkdown(source), ""));
 }
 
-/** Text of HTML this module produced: tags dropped, entities decoded, whitespace collapsed. */
-export function htmlText(html: string): string {
-  return html
-    .replace(/<[^>]*>/g, " ")
-    .replace(/&(?:amp|lt|gt|quot|#39);/g, (m) => ENTITIES[m] ?? m)
-    .replace(/&#(\d{1,7});/g, (m, n: string) =>
-      Number(n) <= 0x10ffff ? String.fromCodePoint(Number(n)) : m,
-    )
-    .replace(/\s+/g, " ")
-    .trim();
-}
+export { htmlText };
 
 /**
  * `markdown` bodies are rendered as data; `html` bodies go through the allowlist sanitizer
@@ -492,9 +475,9 @@ export function entryArticleParts(
 ): { body: ContentEntry["body"]; header: string; cover: string; media: MediaContext } {
   let body = entry.body;
   if (body.format === "markdown") {
-    const m = body.value.match(/^\s*#\s+(.+?)\s*#*\s*(?:\r?\n|$)/);
-    if (m && m[1]?.trim().toLowerCase() === entry.title.trim().toLowerCase())
-      body = { ...body, value: body.value.slice(m[0].length) };
+    const h1 = leadingHeading(body.value);
+    if (h1 && h1.text.trim().toLowerCase() === entry.title.trim().toLowerCase())
+      body = { ...body, value: body.value.slice(h1.length) };
   }
   const when = entry.publishedAt ?? undefined;
   const date = when
diff --git a/packages/astro-renderer/src/text-scan.ts b/packages/astro-renderer/src/text-scan.ts
new file mode 100644
index 00000000..d37c1b3e
--- /dev/null
+++ b/packages/astro-renderer/src/text-scan.ts
@@ -0,0 +1,183 @@
+/**
+ * Linear scanners for text the renderer reads from markdown and from the HTML it rendered
+ * (AGENTS.md rule 13). Each replaces a regex CodeQL reported as polynomial backtracking
+ * (js/polynomial-redos) and gives the same answers on ordinary input; `test/text-scan.test.ts`
+ * checks each against the regex it replaced and against a 100k-character adversarial input.
+ */
+
+const isSpace = (c: string | undefined): boolean => c !== undefined && /\s/.test(c);
+const LINE_BREAK = /[\n\r\u2028\u2029]/;
+
+/**
+ * `html` with every tag (`<` up to the next `>`) replaced by `gap`: what
+ * `.replace(/<[^>]*>/g, gap)` did, without rescanning to the end from every `<` when no `>`
+ * follows. As there, a `<` with no `>` after it stays.
+ */
+export function stripTags(html: string, gap: string): string {
+  let out = "";
+  let at = 0;
+  for (;;) {
+    const open = html.indexOf("<", at);
+    if (open === -1) break;
+    const close = html.indexOf(">", open + 1);
+    if (close === -1) break;
+    out += html.slice(at, open) + gap;
+    at = close + 1;
+  }
+  return at === 0 ? html : out + html.slice(at);
+}
+
+const NAMED: Record<string, string> = { amp: "&", lt: "<", gt: ">", quot: '"', "#39": "'" };
+
+/**
+ * Text of HTML this module's callers rendered (meta and feed descriptions, JSON-LD,
+ * table-of-contents labels, heading ids, reading time): tags dropped, entities decoded once,
+ * whitespace collapsed.
+ *
+ * **Plain text, not HTML.** Decoding is the point (`Array&lt;string&gt;` reads `Array<string>`),
+ * so the result can hold `<script>` when the source said `&lt;script&gt;`. Every sink escapes it
+ * for its context, and `test/html-text-sinks.test.ts` checks each one with that input: Astro
+ * attributes and text (meta, og, twitter, the table of contents), `jsonLdText` (JSON-LD:
+ * `<`, `>` and `&` as `\u003c`…, so no `</script>` or `<!--`), the feeds' `xml()` (RSS). A new
+ * caller must put the result through an escaping sink too, never `set:html`.
+ *
+ * Entities are decoded in one pass, so `&amp;lt;` is the text `&lt;`, and `&amp;#60;` the text
+ * `&#60;` (the regex chain before decoded those twice).
+ */
+export function htmlText(html: string): string {
+  return stripTags(html, " ")
+    .replace(/&(amp|lt|gt|quot|#39|#(\d{1,7}));/g, (m, name: string, code: string | undefined) => {
+      if (code === undefined) return NAMED[name] ?? m;
+      const n = Number(code);
+      return n <= 0x10ffff ? String.fromCodePoint(n) : m;
+    })
+    .replace(/\s+/g, " ")
+    .trim();
+}
+
+/** `\s` runs and the last `\n` inside them, for `leadingHeading`. */
+function skipSpace(text: string, from: number): { end: number; lastNl: number } {
+  let i = from;
+  let lastNl = -1;
+  for (; isSpace(text[i]); i++) if (text[i] === "\n") lastNl = i;
+  return { end: i, lastNl };
+}
+
+/**
+ * Where `\s*#*\s*(?:\r?\n|$)` from `at` ends (the old regex's tail, with its backtracking worked
+ * out): at the end of the text when only whitespace and `#`s are left; else after the last `\n`
+ * of the whitespace after the `#`s; else after the last `\n` of the whitespace before them; -1
+ * when none of those exist.
+ */
+function headingTailEnd(text: string, at: number): number {
+  const before = skipSpace(text, at);
+  if (before.end === text.length) return text.length;
+  let hashes = before.end;
+  while (text[hashes] === "#") hashes++;
+  const after = skipSpace(text, hashes);
+  if (after.end === text.length) return text.length;
+  if (after.lastNl !== -1) return after.lastNl + 1;
+  return before.lastNl !== -1 ? before.lastNl + 1 : -1;
+}
+
+/**
+ * The opening ATX heading of a markdown body (`# Title`, closing `#`s allowed): its text, and how
+ * much of the body it takes (the blank lines and `#`-only lines after it too). Exactly what
+ * `/^\s*#\s+(.+?)\s*#*\s*(?:\r?\n|$)/` matched (text trimmed), in one pass: that regex was cubic
+ * on a heading line of spaces (CodeQL js/polynomial-redos, alert 17).
+ */
+export function leadingHeading(markdown: string): { text: string; length: number } | undefined {
+  let p = 0;
+  while (isSpace(markdown[p])) p++;
+  if (markdown[p] !== "#") return undefined;
+  p++;
+  // `\s+`: at least one, and it may cross line breaks.
+  const r = skipSpace(markdown, p).end;
+  if (r === p) return undefined;
+  if (r < markdown.length) {
+    // `(.+?)` from `r` up to the line's end: the shortest text whose rest of line is `\s*#*\s*`.
+    let lineEnd = r;
+    while (lineEnd < markdown.length && !LINE_BREAK.test(markdown[lineEnd] as string)) lineEnd++;
+    // The tail must cover the rest of the line (it holds no `\n` there), so the text ends where
+    // the line's last `\s*#*\s*` starts. Past the line the tail runs on through whitespace (a
+    // `\u2028` or a lone `\r` is whitespace, not a `\n`), so where the `#`s fall can differ: a
+    // text ending before the line's closing `#`s, or one keeping them and ending before the
+    // trailing whitespace. The earlier one that works is the regex's (lazy) answer.
+    let trailing = lineEnd;
+    while (trailing > r && isSpace(markdown[trailing - 1])) trailing--;
+    let closing = trailing;
+    while (closing > r && markdown[closing - 1] === "#") closing--;
+    while (closing > r && isSpace(markdown[closing - 1])) closing--;
+    for (const e of new Set([Math.max(closing, r + 1), Math.max(trailing, r + 1)])) {
+      const end = headingTailEnd(markdown, e);
+      if (end !== -1) return { text: markdown.slice(r, e).trim(), length: end };
+    }
+  }
+  // No text from `r` works (or the whitespace runs to the end): the regex backs `\s+` off,
+  // keeping at least one, until `(.+?)` can take one whitespace character that is not a line
+  // break and the tail after it ends: at the end of the text, or after a `\n` before `r`.
+  const run = skipSpace(markdown, p);
+  const tailEnd = r === markdown.length ? r : run.lastNl;
+  for (let q = tailEnd - 1; q > p; q--)
+    if (!LINE_BREAK.test(markdown[q] as string))
+      return { text: "", length: r === markdown.length ? r : run.lastNl + 1 };
+  return undefined;
+}
+
+/** A heading `renderMarkdown` wrote: `<h2 id="…">…</h2>` or `<h3 …>`. */
+export interface HeadingMatch {
+  depth: 2 | 3;
+  id: string;
+  inner: string;
+}
+
+/**
+ * The `<h2 id="…">…</h2>` and `<h3 id="…">…</h3>` of rendered HTML, in order: what
+ * `/<h([23]) id="([^"]+)">([\s\S]*?)<\/h\1>/g` found, without rescanning to the end from every
+ * opening tag when its closing tag is missing.
+ */
+export function renderedHeadings(html: string): HeadingMatch[] {
+  const out: HeadingMatch[] = [];
+  // Where the next `</h2>` / `</h3>` is (-1: none after the last search), so each is searched once.
+  const closer = { 2: -2, 3: -2 } as Record<2 | 3, number>;
+  let at = 0;
+  for (;;) {
+    const open = html.indexOf("<h", at);
+    if (open === -1) return out;
+    at = open + 1;
+    const digit = html[open + 2];
+    if (digit !== "2" && digit !== "3") continue;
+    if (!html.startsWith(' id="', open + 3)) continue;
+    const idStart = open + 8;
+    const idEnd = html.indexOf('"', idStart);
+    if (idEnd <= idStart || html[idEnd + 1] !== ">") continue;
+    const depth = digit === "2" ? 2 : 3;
+    const innerStart = idEnd + 2;
+    if (closer[depth] !== -1 && closer[depth] < innerStart)
+      closer[depth] = html.indexOf(`</h${depth}>`, innerStart);
+    const end = closer[depth];
+    if (end === -1) continue;
+    out.push({ depth, id: html.slice(idStart, idEnd), inner: html.slice(innerStart, end) });
+    at = end + 5;
+  }
+}
+
+const isWordChar = (c: string | undefined): boolean => c !== undefined && /\w/.test(c);
+
+/**
+ * Whether a line of `markdown`, after leading whitespace and `>` quote markers, starts with an
+ * `::embed` directive: what `/(^|\n)\s*(?:>\s*)*::embed\b/` tested, in one pass. That regex
+ * retried its whitespace run from every line start of a run of blank lines.
+ */
+export function hasEmbedLine(markdown: string): boolean {
+  let at = 0;
+  for (;;) {
+    let i = at;
+    while (i < markdown.length && (markdown[i] === ">" || isSpace(markdown[i]))) i++;
+    if (markdown.startsWith("::embed", i) && !isWordChar(markdown[i + 7])) return true;
+    // Line starts inside the skipped run lead to the same place; the next one after it may not.
+    const nl = markdown.indexOf("\n", i);
+    if (nl === -1) return false;
+    at = nl + 1;
+  }
+}
diff --git a/packages/astro-renderer/test/html-text-sinks.test.ts b/packages/astro-renderer/test/html-text-sinks.test.ts
new file mode 100644
index 00000000..5f08664c
--- /dev/null
+++ b/packages/astro-renderer/test/html-text-sinks.test.ts
@@ -0,0 +1,227 @@
+/**
+ * `htmlText` returns plain text, `<` included: `&lt;script&gt;` in markdown is the text
+ * `<script>` (CodeQL alert 41). Safety is each sink's job. This file feeds that text through every
+ * sink its callers reach and parses the output the way a browser does (parse5): no element and no
+ * comment may come out of it, only text or an attribute value.
+ *
+ * Callers → sinks: `markdownText` → archive `description` → `<meta name=description>`,
+ * `og:description`, `twitter:description` (Astro attributes) and JSON-LD (`jsonLdText`), and the
+ * archive feed's RSS `<description>` (`xml()`); `inlineMarkdownText` → correction notes in JSON-LD;
+ * `tableOfContents` → TOC labels (Astro text, `{item.text}`); Studio's archive preview
+ * (`renderArchivePreview`) → its `<meta name=description>` (`esc()`). Search snippets and `llms.txt` do
+ * not go through `htmlText`; the snippet's own sink (`snippetHtml`, inserted as HTML) is checked
+ * here too, and `llms.txt` is Markdown served as `text/plain`.
+ */
+import type { ContentEntry, Site } from "@cloudhal/core-contracts";
+import { MARK_CLOSE, MARK_OPEN, SiteGraphStore, seedStarterSite } from "@cloudhal/core-ts";
+import { MemoryBlobStore } from "@cloudhal/storage";
+import { BetterSqlite3Driver } from "@cloudhal/storage/sqlite";
+import { addAttribute, escapeHTML } from "astro/runtime/server/index.js";
+import { type DefaultTreeAdapterMap, parse, parseFragment } from "parse5";
+import { describe, expect, it } from "vitest";
+import { archiveFeedXml } from "../src/feeds.ts";
+import { tableOfContents } from "../src/kit.ts";
+import { markdownText, renderMarkdown } from "../src/markdown.ts";
+import { renderArchivePreview } from "../src/preview.ts";
+import { snippetHtml } from "../src/search.ts";
+import { archiveHead, entryHead, jsonLdText } from "../src/seo.ts";
+
+type Node = DefaultTreeAdapterMap["node"];
+
+const ATTACK =
+  "&lt;script&gt;alert(1)&lt;/script&gt; &lt;!-- c --&gt; &lt;img src=x onerror=alert(2)&gt; &quot;&gt;&lt;svg onload=alert(3)&gt;";
+const DECODED =
+  '<script>alert(1)</script> <!-- c --> <img src=x onerror=alert(2)> "><svg onload=alert(3)>';
+const ORIGIN = "https://haber.example";
+
+/** Every element and comment under `node` (its own tag included when it is one). */
+function markup(node: Node, out: string[] = []): string[] {
+  if (node.nodeName === "#comment") out.push("#comment");
+  else if ("tagName" in node) out.push(node.tagName);
+  for (const child of "childNodes" in node ? node.childNodes : []) markup(child as Node, out);
+  if ("content" in node && node.content) markup(node.content as Node, out);
+  return out;
+}
+
+/** The first `tag` element under `node`, depth first. */
+function firstElement(node: Node, tag: string): DefaultTreeAdapterMap["element"] | undefined {
+  if ("tagName" in node && node.tagName === tag) return node;
+  for (const child of "childNodes" in node ? node.childNodes : []) {
+    const found = firstElement(child as Node, tag);
+    if (found) return found;
+  }
+  return undefined;
+}
+
+/** The elements and comments an HTML fragment parses to. */
+const fragmentMarkup = (html: string) => markup(parseFragment(html) as unknown as Node);
+
+/** The elements and comments inside `<head>` when `html` is all the head holds. */
+function headMarkup(html: string): string[] {
+  const doc = parse(`<!doctype html><html><head>${html}</head><body></body></html>`);
+  const head = doc.childNodes
+    .flatMap((n) => ("childNodes" in n ? n.childNodes : []))
+    .find((n) => n.nodeName === "head") as Node;
+  return markup(head).slice(1);
+}
+
+const site = {
+  id: "site_aaaaaaaaaaaa",
+  name: "Haber",
+  slug: "haber",
+  defaultLocale: "en",
+  locales: ["en"],
+  domains: [],
+} as unknown as Site;
+
+const archive = {
+  locale: "en",
+  page: 1,
+  path: "/category/news",
+  root: "/category/news",
+  shown: {
+    name: "News",
+    slug: "news",
+    href: "/category/news",
+    taxonomy: { key: "category", labels: { en: { plural: "Categories" } } },
+  },
+  trail: [],
+  total: 0,
+  perPage: 10,
+  term: { labels: { en: { name: "News", description: `Intro ${ATTACK}` } } },
+  taxonomy: { key: "category" },
+  entries: [],
+} as never;
+
+describe("htmlText's sinks with decoded markup in the text (alert 41)", () => {
+  const head = archiveHead(site, archive, ORIGIN);
+
+  it("the description is the decoded text, verbatim", () => {
+    expect(markdownText(`Intro ${ATTACK}`)).toBe(`Intro ${DECODED}`);
+    expect(head.description).toBe(`Intro ${DECODED}`);
+  });
+
+  it("meta description, og: and twitter: tags: an attribute value, never markup", () => {
+    // What SeoHead.astro writes for `meta.description`, `meta.openGraph` and `meta.twitter`.
+    const tags = [
+      `<meta name="description"${addAttribute(head.description, "content")}>`,
+      ...head.openGraph.map(
+        ([p, c]) => `<meta${addAttribute(p, "property")}${addAttribute(c, "content")}>`,
+      ),
+      ...head.twitter.map(
+        ([n, c]) => `<meta${addAttribute(n, "name")}${addAttribute(c, "content")}>`,
+      ),
+    ];
+    expect(head.openGraph).toContainEqual(["og:description", `Intro ${DECODED}`]);
+    for (const tag of tags) expect(headMarkup(tag), tag).toEqual(["meta"]);
+    const meta = firstElement(parse(`<head>${tags[0]}</head>`) as unknown as Node, "meta");
+    expect(meta?.attrs.find((a) => a.name === "content")?.value).toBe(`Intro ${DECODED}`);
+  });
+
+  it("JSON-LD: no </script>, <!-- or < at all inside the script element", () => {
+    expect(head.jsonLd.length).toBeGreaterThan(0);
+    for (const doc of head.jsonLd) {
+      const text = jsonLdText(doc);
+      expect(text).not.toMatch(/[<>]/);
+      const html = `<script type="application/ld+json">${text}</script>`;
+      expect(headMarkup(html)).toEqual(["script"]);
+      expect(JSON.parse(text)).toEqual(JSON.parse(JSON.stringify(doc)));
+    }
+    expect(JSON.stringify(head.jsonLd)).toContain(JSON.stringify(DECODED).slice(1, -1));
+  });
+
+  it("correction notes (inlineMarkdownText) in the article's JSON-LD", () => {
+    const entry = {
+      id: "entry_story0001",
+      siteId: site.id,
+      collection: "posts",
+      slug: "story",
+      locale: "en",
+      status: "published",
+      title: "A story",
+      body: { format: "markdown", value: "Body" },
+      fields: {},
+      tags: [],
+      author: { kind: "human", id: "user_writer0001", name: "A" },
+      publishedAt: "2026-10-15T10:00:00.000Z",
+      createdAt: "2026-10-15T10:00:00.000Z",
+      updatedAt: "2026-10-15T10:00:00.000Z",
+      corrections: [
+        { id: "crx_first0001", kind: "correction", at: "2026-10-16T08:00:00.000Z", note: ATTACK },
+      ],
+    } as unknown as ContentEntry;
+    const meta = entryHead(site, entry, ORIGIN);
+    const article = meta.jsonLd[0] as { correction: { text: string }[] };
+    expect(article.correction[0]?.text).toBe(DECODED);
+    for (const doc of meta.jsonLd)
+      expect(headMarkup(`<script type="application/ld+json">${jsonLdText(doc)}</script>`)).toEqual([
+        "script",
+      ]);
+  });
+
+  it("the archive's RSS <description>: escaped text", () => {
+    const xml = archiveFeedXml({ site, origin: ORIGIN, archive });
+    const description = xml.match(/<channel>[\s\S]*?<description>([^<]*)<\/description>/)?.[1];
+    // `xml()` escapes the decoded text back to what the markdown said
+    expect(description).toBe(`Intro ${ATTACK}`);
+    expect(xml).not.toMatch(/<script|<img|<svg|<!-- c/);
+  });
+
+  it("table-of-contents labels: Astro text, escaped", () => {
+    const toc = tableOfContents(renderMarkdown(`## One ${ATTACK}\n\ntext\n\n## Two\n\n## Three`));
+    expect(toc[0]?.text).toBe(`One ${DECODED}`);
+    // What Article.astro writes: `<a href={`#${item.id}`}>{item.text}</a>`
+    const html = `<a${addAttribute(`#${toc[0]?.id}`, "href")}>${escapeHTML(toc[0]?.text ?? "")}</a>`;
+    expect(fragmentMarkup(html)).toEqual(["a"]);
+  });
+
+  it("search snippets (not htmlText, but inserted as HTML): only the <mark>s are markup", () => {
+    const html = snippetHtml(`a ${MARK_OPEN}${DECODED}${MARK_CLOSE} b`);
+    expect(fragmentMarkup(html)).toEqual(["mark"]);
+  });
+
+  it("Studio's archive preview: the description meta through esc(), the intro as rendered markdown", async () => {
+    const store = new SiteGraphStore({
+      sql: await BetterSqlite3Driver.open(":memory:"),
+      blobs: new MemoryBlobStore(),
+    });
+    await store.init();
+    const seeded = await seedStarterSite(store, { name: "Archive", slug: "archive" });
+    const terms = await store.listTerms(seeded.id);
+    const news = terms.find((t) => t.slug === "news") as (typeof terms)[0];
+    const locale = seeded.defaultLocale;
+    const intro = `Intro ${ATTACK}`;
+    const doc = renderArchivePreview(seeded, {
+      taxonomies: await store.listTaxonomies(seeded.id),
+      terms: terms.map((t) =>
+        t.id === news.id
+          ? {
+              ...t,
+              labels: {
+                ...t.labels,
+                [locale]: { ...(t.labels[locale] as object), name: "News", description: intro },
+              },
+            }
+          : t,
+      ),
+      termId: news.id,
+      entries: await store.listContentEntries(seeded.id, {}),
+    });
+    const tree = parse(doc.html) as unknown as Node;
+    const meta = firstElement(tree, "meta");
+    expect(meta).toBeDefined();
+    const description = [tree]
+      .flatMap(function all(n: Node): Node[] {
+        return [n, ...("childNodes" in n ? n.childNodes.flatMap((c) => all(c as Node)) : [])];
+      })
+      .find(
+        (n) =>
+          "tagName" in n &&
+          n.tagName === "meta" &&
+          n.attrs.some((a) => a.name === "name" && a.value === "description"),
+      ) as DefaultTreeAdapterMap["element"] | undefined;
+    expect(description?.attrs.find((a) => a.name === "content")?.value).toBe(`Intro ${DECODED}`);
+    const found = markup(tree);
+    for (const tag of ["script", "img", "svg", "#comment"]) expect(found, tag).not.toContain(tag);
+  });
+});
diff --git a/packages/astro-renderer/test/text-scan.test.ts b/packages/astro-renderer/test/text-scan.test.ts
new file mode 100644
index 00000000..62a5ad50
--- /dev/null
+++ b/packages/astro-renderer/test/text-scan.test.ts
@@ -0,0 +1,236 @@
+/**
+ * The renderer's linear scanners (AGENTS.md rule 13, CodeQL alerts 12, 13, 16, 17 and 41): each
+ * gives the regex it replaced's answers on ordinary input and stays fast on 100k adversarial ones.
+ */
+import { describe, expect, it } from "vitest";
+import { usesEmbeds } from "../src/embed-client.ts";
+import { tableOfContents } from "../src/kit.ts";
+import { inlineMarkdownText, markdownText, renderMarkdown } from "../src/markdown.ts";
+import {
+  hasEmbedLine,
+  htmlText,
+  leadingHeading,
+  renderedHeadings,
+  stripTags,
+} from "../src/text-scan.ts";
+
+const N = 100_000;
+/** Runs `f` and fails when it takes longer than a linear scan of 100k characters ever should. */
+function fast<T>(f: () => T): T {
+  const start = performance.now();
+  const out = f();
+  expect(performance.now() - start).toBeLessThan(1500);
+  return out;
+}
+
+// The regex versions, as they were.
+const oldStrip = (html: string, gap: string) => html.replace(/<[^>]*>/g, gap);
+const ENTITIES: Record<string, string> = {
+  "&amp;": "&",
+  "&lt;": "<",
+  "&gt;": ">",
+  "&quot;": '"',
+  "&#39;": "'",
+};
+const oldHtmlText = (html: string) =>
+  html
+    .replace(/<[^>]*>/g, " ")
+    .replace(/&(?:amp|lt|gt|quot|#39);/g, (m) => ENTITIES[m] ?? m)
+    .replace(/&#(\d{1,7});/g, (m, n: string) =>
+      Number(n) <= 0x10ffff ? String.fromCodePoint(Number(n)) : m,
+    )
+    .replace(/\s+/g, " ")
+    .trim();
+const oldH1 = (md: string) => {
+  const m = md.match(/^\s*#\s+(.+?)\s*#*\s*(?:\r?\n|$)/);
+  return m ? { text: (m[1] as string).trim(), length: m[0].length } : undefined;
+};
+const oldHeadings = (html: string) =>
+  [...html.matchAll(/<h([23]) id="([^"]+)">([\s\S]*?)<\/h\1>/g)].map((m) => ({
+    depth: Number(m[1]),
+    id: m[2],
+    inner: m[3],
+  }));
+const oldEmbed = (md: string) => /(^|\n)\s*(?:>\s*)*::embed\b/.test(md);
+
+describe("stripTags", () => {
+  it("drops tags as /<[^>]*>/g did", () => {
+    for (const html of [
+      "",
+      "plain",
+      "<p>a <strong>b</strong></p>",
+      "a < b > c",
+      "<a<b>c",
+      "x < y",
+      "<unclosed",
+      "<p>one</p><p>two",
+      "<<>>",
+      '<img alt="a>b">',
+    ])
+      for (const gap of [" ", ""]) expect(stripTags(html, gap)).toBe(oldStrip(html, gap));
+  });
+
+  it("is linear on a long run of < without >", () => {
+    expect(fast(() => stripTags("<".repeat(N), " "))).toBe("<".repeat(N));
+    expect(fast(() => stripTags(`${"<a".repeat(N / 2)}>`, ""))).toBe("");
+  });
+});
+
+describe("htmlText", () => {
+  it("gives the regex version's text on ordinary HTML", () => {
+    for (const html of [
+      "<p>Hello <em>world</em></p>\n<p>Two &amp; three</p>",
+      "<p>&quot;Quoted&quot; and it&#39;s &#8217;fine&#8217;</p>",
+      '<h2 id="x">A &lt; B &gt; C</h2>',
+      "<p>x &lt; 5 and 3 &gt; 2</p>",
+      "  spaced\n\t out  ",
+      "&#1114112; stays",
+      "<h2>Using <code>Array&lt;string&gt;</code> with &lt;dialog&gt;</h2>",
+      "<p>&lt;script&gt;alert(1)&lt;/script&gt; &lt;!-- c --&gt; when x&lt;y</p>",
+      "",
+    ])
+      expect(htmlText(html)).toBe(oldHtmlText(html));
+  });
+
+  it("keeps the decoded text verbatim, `<` included (the sinks escape it)", () => {
+    expect(htmlText("<h2>Using <code>Array&lt;string&gt;</code> with &lt;dialog&gt;</h2>")).toBe(
+      "Using Array<string> with <dialog>",
+    );
+    expect(htmlText("<p>when x&lt;y</p>")).toBe("when x<y");
+    expect(htmlText("<p>&lt;script&gt;alert(1)&lt;/script&gt;</p>")).toBe(
+      "<script>alert(1)</script>",
+    );
+    // decoded once: `&amp;lt;` is the text `&lt;`, `&amp;#60;` the text `&#60;`
+    expect(htmlText("&amp;lt;b&amp;gt; &amp;#60;i")).toBe("&lt;b&gt; &#60;i");
+    expect(oldHtmlText("&amp;#60;i")).toBe("<i");
+  });
+
+  it("is linear on adversarial HTML", () => {
+    expect(fast(() => htmlText("<".repeat(N)))).toBe("<".repeat(N));
+    expect(fast(() => htmlText("&lt;a".repeat(N / 5))).length).toBe((N / 5) * 2);
+    expect(fast(() => htmlText(`a${" \t\n".repeat(N / 3)}b`))).toBe("a b");
+  });
+});
+
+describe("markdown and inline markdown as text", () => {
+  it("decode entities after rendering, as before (the sinks: test/html-text-sinks.test.ts)", () => {
+    expect(markdownText("Intro &lt;b&gt; and **bold**")).toBe("Intro <b> and bold");
+    expect(inlineMarkdownText("**537**, &lt;script&gt;")).toBe("537, <script>");
+  });
+});
+
+describe("leadingHeading", () => {
+  it("matches the regex version on ordinary bodies", () => {
+    for (const md of [
+      "# Title\n\nBody",
+      "# Title",
+      "# Title\n",
+      "  # Title ##\r\nBody",
+      "\n\n# Title\nBody",
+      "# Title\n  \n\t\nBody",
+      "# Title\n\n\n",
+      "# Title #\nBody",
+      "# C#\nBody",
+      "#   Spaced   title   \nBody",
+      "# Other\nBody",
+      "#Title\nBody",
+      "Body\n# Title",
+      "## Title\nBody",
+      "",
+    ])
+      expect(leadingHeading(md), JSON.stringify(md)).toEqual(oldH1(md));
+  });
+
+  it("takes the #-only lines and blank lines after the heading, as the regex did", () => {
+    for (const md of ["# Title\n#\nBody", "# Title\n\n##\n\nBody", "#\nTitle\nBody", "#  ", "# "])
+      expect(leadingHeading(md), JSON.stringify(md)).toEqual(oldH1(md));
+    expect(leadingHeading("# Title\n#\nBody")).toEqual({ text: "Title", length: 10 });
+  });
+
+  it("is linear on a heading line of spaces", () => {
+    fast(() => leadingHeading(`# ${"  ".repeat(N / 2)}x\rx`));
+    expect(fast(() => leadingHeading(`# a${" ".repeat(N)}`))).toEqual({ text: "a", length: N + 3 });
+    expect(fast(() => leadingHeading(`${"\n".repeat(N)}#`))).toBeUndefined();
+    expect(fast(() => leadingHeading(`#${"\u2028".repeat(N)}`))).toBeUndefined();
+    fast(() => leadingHeading(`# x${"#\u2028".repeat(N / 2)}y`));
+    fast(() => leadingHeading(`# x${" ".repeat(N)}#${"\u2028".repeat(N)}\n`));
+  });
+});
+
+describe("renderedHeadings and the table of contents", () => {
+  it("finds what the regex found", () => {
+    const html = renderMarkdown(
+      "# Top\n\n## One\n\ntext\n\n### One *a*\n\n## Two `code`\n\n#### Deep\n\n## One",
+    );
+    for (const h of [
+      html,
+      '<h2 id="a">A</h2><h3 id="b">B <h2 id="c">C</h2></h3>',
+      '<h2 id="a">open <h2 id="b">B</h2>',
+      '<h2 id="">empty</h2><h2 id="x" class="y">attrs</h2><h3 id="z">Z</h2></h3>',
+      '<h2 id="a">no closer',
+      "",
+    ])
+      expect(renderedHeadings(h)).toEqual(oldHeadings(h));
+    expect(tableOfContents(html).map((t) => t.text)).toEqual(["One", "One a", "Two code", "One"]);
+  });
+
+  it("is linear on many headings without a closer", () => {
+    expect(fast(() => renderedHeadings('<h2 id="!">a'.repeat(N / 12)))).toEqual([]);
+    expect(fast(() => renderedHeadings(`${'<h3 id="x">'.repeat(N / 11)}</h2>`))).toEqual([]);
+  });
+});
+
+describe("hasEmbedLine", () => {
+  it("answers as the regex did", () => {
+    for (const md of [
+      "::embed{url=x}",
+      "text\n::embed{url=x}",
+      "  > > ::embed{url=x}",
+      ">\n::embed",
+      "\n\n  ::embed",
+      "::embedded",
+      "::embed_x",
+      "text ::embed",
+      "a\r\n::embed",
+      "\t>::embed-",
+      "",
+      "nothing here",
+    ])
+      expect(hasEmbedLine(md), JSON.stringify(md)).toBe(oldEmbed(md));
+    expect(usesEmbeds({ markdown: "> ::embed{url=x}" })).toBe(true);
+  });
+
+  it("is linear on long runs of blank and quote lines", () => {
+    expect(fast(() => hasEmbedLine(`${"\n".repeat(N)}x`))).toBe(false);
+    expect(fast(() => hasEmbedLine(`${">\n".repeat(N / 2)}x`))).toBe(false);
+    expect(fast(() => hasEmbedLine(`${"> ".repeat(N / 2)}::embed`))).toBe(true);
+  });
+});
+
+describe("random inputs over the characters that matter", () => {
+  let s = 41;
+  const next = () => {
+    s = (s * 1103515245 + 12345) & 0x7fffffff;
+    return s;
+  };
+  const random = (tokens: readonly string[], max: number) => {
+    let t = "";
+    for (let i = next() % max; i > 0; i--) t += tokens[next() % tokens.length];
+    return t;
+  };
+  it("agree with the regexes they replaced", () => {
+    for (let n = 0; n < 20_000; n++) {
+      const html = random(["<", ">", "a", " ", "/", "\n"], 14);
+      expect(stripTags(html, " "), JSON.stringify(html)).toBe(oldStrip(html, " "));
+      const md = random(["\n", " ", ">", "::embed", "x", "\r", "\t", "_"], 10);
+      expect(hasEmbedLine(md), JSON.stringify(md)).toBe(oldEmbed(md));
+      const h1 = random(["#", " ", "\n", "\r", "x", "\t", "\u2028"], 14);
+      expect(leadingHeading(h1), JSON.stringify(h1)).toEqual(oldH1(h1));
+      const h = random(
+        ['<h2 id="a">', '<h3 id="b">', "</h2>", "</h3>", "x", '"', ">", "<h2 id=", '<h3 id="'],
+        10,
+      );
+      expect(renderedHeadings(h), JSON.stringify(h)).toEqual(oldHeadings(h));
+    }
+  });
+});
diff --git a/packages/cli/src/config.ts b/packages/cli/src/config.ts
index 0d3b72f6..f95ace07 100644
--- a/packages/cli/src/config.ts
+++ b/packages/cli/src/config.ts
@@ -95,8 +95,18 @@ export interface ObservabilityConfig {
  */
 export type AiConfig = Record<string, never>;
 
-/** A plain `local@domain` address: no display name, no spaces or line breaks. */
-const MAIL_ADDRESS = /^[^\s@<>"]+@[^\s@<>"]+\.[^\s@<>"]+$/;
+/**
+ * A plain `local@domain` address: no display name, no spaces or line breaks, no `<`, `>` or `"`.
+ * The same answers as `isMailAddress` in `@cloudhal/api` and the regex both replaced
+ * (`/^[^\s@<>"]+@[^\s@<>"]+\.[^\s@<>"]+$/`, quadratic on long `.x` runs), in one linear pass;
+ * not imported from there, so reading `cloudhal.json` never loads the API.
+ */
+export function isMailAddress(value: string): boolean {
+  if (/[\s<>"]/.test(value)) return false;
+  const at = value.indexOf("@");
+  if (at < 1 || value.indexOf("@", at + 1) !== -1) return false;
+  return value.slice(at + 2, -1).includes(".");
+}
 
 /** `cloudhal.json` at the project root. Kept tiny; everything else lives in the store. */
 export interface ProjectConfig {
@@ -235,7 +245,7 @@ export function parseMailConfig(input: unknown): MailConfig | undefined {
     throw new Error(`${CONFIG_FILE}: mail must be an object like {"from": "studio@example.com"}`);
   const o = input as Record<string, unknown>;
   const from = typeof o.from === "string" ? o.from.trim() : "";
-  if (!MAIL_ADDRESS.test(from) || from.length > 254)
+  if (!isMailAddress(from) || from.length > 254)
     throw new Error(
       `${CONFIG_FILE}: mail.from must be a plain address like "studio@example.com" (no display name; use mail.fromName)`,
     );
diff --git a/packages/cli/test/mail-address.test.ts b/packages/cli/test/mail-address.test.ts
new file mode 100644
index 00000000..1b8f57c7
--- /dev/null
+++ b/packages/cli/test/mail-address.test.ts
@@ -0,0 +1,23 @@
+/** `mail.from` in cloudhal.json: the linear sender check gives the old regex's answers (rule 13). */
+import { describe, expect, it } from "vitest";
+import { isMailAddress, parseMailConfig } from "../src/config.ts";
+
+const OLD = /^[^\s@<>"]+@[^\s@<>"]+\.[^\s@<>"]+$/;
+
+describe("isMailAddress", () => {
+  it("accepts exactly what the old regex accepted", () => {
+    let all = [""];
+    for (let len = 1; len <= 6; len++) {
+      all = all.flatMap((s) => ["a", ".", "@", " ", ">"].map((c) => s + c));
+      for (const s of all) expect(isMailAddress(s), JSON.stringify(s)).toBe(OLD.test(s));
+    }
+    expect(parseMailConfig({ from: "studio@example.com" })?.from).toBe("studio@example.com");
+    expect(() => parseMailConfig({ from: "Studio <studio@example.com>" })).toThrow(/plain address/);
+  });
+
+  it("is linear on a long run of .x", () => {
+    const start = performance.now();
+    expect(isMailAddress(`a@b${".".repeat(100_000)} `)).toBe(false);
+    expect(performance.now() - start).toBeLessThan(1500);
+  });
+});
diff --git a/packages/cloudflare/src/mail.ts b/packages/cloudflare/src/mail.ts
index 28589bbc..8bf6e3e9 100644
--- a/packages/cloudflare/src/mail.ts
+++ b/packages/cloudflare/src/mail.ts
@@ -4,7 +4,7 @@
  * `CLOUDHAL_MAIL_FROM` / `CLOUDHAL_MAIL_FROM_NAME`. Plain text only; bodies are never logged (they
  * carry one-time links).
  */
-import { MailError, type MailMessage, type MailSender } from "@cloudhal/api";
+import { isMailAddress, MailError, type MailMessage, type MailSender } from "@cloudhal/api";
 
 /** The part of the binding's structured `send()` this sender uses. */
 export interface SendEmailBinding {
@@ -25,7 +25,11 @@ export interface MailEnv {
   CLOUDHAL_MAIL_FROM_NAME?: string;
 }
 
-/** A plain `local@domain` address: no display name, no spaces or line breaks. */
+/**
+ * A plain `local@domain` address: no display name, no spaces or line breaks.
+ * @deprecated Use `isMailAddress` from `@cloudhal/api`: the same answers in one linear pass (this
+ * pattern backtracks quadratically on long `.x` runs).
+ */
 export const MAIL_ADDRESS = /^[^\s@<>"]+@[^\s@<>"]+\.[^\s@<>"]+$/;
 
 const oneLine = (s: string) => s.replace(/[\r\n]+/g, " ").trim();
@@ -61,7 +65,7 @@ export function cloudflareEmailSender(
 /** The deployment's sender, when the binding and a valid `CLOUDHAL_MAIL_FROM` are both there. */
 export function adminMail(env: MailEnv): MailSender | undefined {
   const from = env.CLOUDHAL_MAIL_FROM?.trim();
-  if (!env.EMAIL || !from || !MAIL_ADDRESS.test(from)) return undefined;
+  if (!env.EMAIL || !from || !isMailAddress(from)) return undefined;
   return cloudflareEmailSender(env.EMAIL, {
     email: from,
     ...(env.CLOUDHAL_MAIL_FROM_NAME ? { name: env.CLOUDHAL_MAIL_FROM_NAME } : {}),
diff --git a/packages/core-ts/src/domains.ts b/packages/core-ts/src/domains.ts
index f66ce634..eee08ba5 100644
--- a/packages/core-ts/src/domains.ts
+++ b/packages/core-ts/src/domains.ts
@@ -8,12 +8,29 @@ const HOSTNAME = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
 
 /** A hostname as a person might type it ("https://News.Example.com/") → "news.example.com". */
 export function normalizeHostname(input: string): string {
-  return input
-    .trim()
-    .toLowerCase()
-    .replace(/^[a-z]+:\/\//, "")
-    .replace(/[/?#].*$/, "")
-    .replace(/\.$/, "");
+  return cutPathPart(
+    input
+      .trim()
+      .toLowerCase()
+      .replace(/^[a-z]+:\/\//, ""),
+  ).replace(/\.$/, "");
+}
+
+/**
+ * `text` up to its path, query or fragment: what `.replace(/[/?#].*$/, "")` left, in one linear
+ * pass. That regex rescanned to the end from every `/`, `?` or `#` when a line break followed
+ * (js/polynomial-redos). As in it, the cut is at the first of those after the last line break
+ * (`.` stops at line breaks, `$` is the end).
+ */
+function cutPathPart(text: string): string {
+  let from = 0;
+  for (const br of ["\n", "\r", "\u2028", "\u2029"])
+    from = Math.max(from, text.lastIndexOf(br) + 1);
+  for (let i = from; i < text.length; i++) {
+    const c = text[i];
+    if (c === "/" || c === "?" || c === "#") return text.slice(0, i);
+  }
+  return text;
 }
 
 export function isHostname(value: string): boolean {
diff --git a/packages/core-ts/src/fields/conversions.ts b/packages/core-ts/src/fields/conversions.ts
index c4dca205..052727d8 100644
--- a/packages/core-ts/src/fields/conversions.ts
+++ b/packages/core-ts/src/fields/conversions.ts
@@ -19,6 +19,7 @@
  * Every result must also fit the new definition (`valueIssues`); anything else is unconvertible.
  */
 import type { FieldDefinition } from "@cloudhal/core-contracts";
+import { escapeAtLineStarts, unlink } from "./markdown-scan.ts";
 import type { FieldType } from "./types.ts";
 import { valueIssues } from "./value-checks.ts";
 
@@ -54,13 +55,22 @@ type Step = (value: unknown, to: FieldDefinition, ctx: ConvertContext) => Conver
 const fail = (reason: string): Conversion => ({ ok: false, reason });
 const ok = (value: unknown): Conversion => ({ ok: true, value });
 
+/** Characters that open block markup at a line's start (headings, quotes, lists, setext rules). */
+const LINE_MARKERS = "#>+=-";
+const DIGIT = /^\d$/;
+
 /** CommonMark escapes for the characters that would turn plain words into markup. */
 export function escapeMarkdown(text: string): string {
-  return text
-    .replace(/[\\`*_[\]<>|~&]/g, "\\$&")
-    .replace(/^(\s*)([#>+=-])/gm, "$1\\$2")
-    .replace(/^(\s*\d+)([.)])/gm, "$1\\$2")
-    .replace(/:(?=:)/g, "\\:");
+  // Line starts through linear scans: `/^(\s*)([#>+=-])/gm` and `/^(\s*\d+)([.)])/gm` backtracked
+  // quadratically on many blank lines (`\s*` runs across them).
+  const marked = escapeAtLineStarts(text.replace(/[\\`*_[\]<>|~&]/g, "\\$&"), (t, at) =>
+    LINE_MARKERS.includes(t[at] ?? " ") ? at : -1,
+  );
+  return escapeAtLineStarts(marked, (t, at) => {
+    let end = at;
+    while (DIGIT.test(t[end] ?? "")) end++;
+    return end > at && (t[end] === "." || t[end] === ")") ? end : -1;
+  }).replace(/:(?=:)/g, "\\:");
 }
 
 /** The words of a markdown string: no markup, link text without targets, no directives. */
@@ -69,12 +79,17 @@ export function markdownToPlain(markdown: string, multiline: boolean): string {
   for (const raw of markdown.split(/\r?\n/)) {
     const line = raw.trim();
     if (line.startsWith("```") || line.startsWith("~~~") || line.startsWith("::")) continue;
-    const words = line
-      .replace(/^#{1,6}\s+/, "")
-      .replace(/^>\s?/, "")
-      .replace(/^(?:[-*+]|\d+[.)])\s+/, "")
-      .replace(/!\[([^\]]*)\]\([^)]*\)/g, "$1")
-      .replace(/\[([^\]]*)\]\([^)]*\)/g, "$1")
+    // Images, then links, through linear scans (the regexes before them were quadratic on "![").
+    const words = unlink(
+      unlink(
+        line
+          .replace(/^#{1,6}\s+/, "")
+          .replace(/^>\s?/, "")
+          .replace(/^(?:[-*+]|\d+[.)])\s+/, ""),
+        "![",
+      ),
+      "[",
+    )
       .replace(/(\*\*|__|~~|\*|_|`)/g, "")
       .replace(/\\([!-/:-@[-`{-~])/g, "$1")
       .trim();
diff --git a/packages/core-ts/src/fields/markdown-scan.ts b/packages/core-ts/src/fields/markdown-scan.ts
new file mode 100644
index 00000000..8075d4f3
--- /dev/null
+++ b/packages/core-ts/src/fields/markdown-scan.ts
@@ -0,0 +1,70 @@
+/**
+ * Linear scanners behind `escapeMarkdown` and `markdownToPlain` (AGENTS.md rule 13). Each gives
+ * the same answers as the regex it replaced; those backtracked quadratically on field values
+ * with many `![` or `](` (CodeQL js/polynomial-redos, alert 23) or many blank lines.
+ */
+
+const isBreak = (c: string | undefined): boolean =>
+  c === "\n" || c === "\r" || c === "\u2028" || c === "\u2029";
+const isSpace = (c: string | undefined): boolean => c !== undefined && /\s/.test(c);
+
+/** The start of the line after the first line break at or after `from` (`-1`: none). */
+function nextLineStart(text: string, from: number): number {
+  for (let k = from; k < text.length; k++) if (isBreak(text[k])) return k + 1;
+  return -1;
+}
+
+/**
+ * A `\` inserted where `find` says, once per line start: what
+ * `.replace(/^(\s*)…/gm, "$1\\…")` did. As in that regex, `\s*` runs across blank lines, and a
+ * line start inside a run already tried leads to the same place, so it is not tried again.
+ * `find(text, at)` gets the first non-space position and returns where the `\` goes, or -1.
+ */
+export function escapeAtLineStarts(
+  text: string,
+  find: (text: string, at: number) => number,
+): string {
+  let out = "";
+  let copied = 0;
+  for (let start = 0; start !== -1; ) {
+    let at = start;
+    while (isSpace(text[at])) at++;
+    const insert = find(text, at);
+    let next = at;
+    if (insert !== -1) {
+      out += `${text.slice(copied, insert)}\\`;
+      copied = insert;
+      next = insert + 1;
+    }
+    start = nextLineStart(text, next);
+  }
+  return copied === 0 && out === "" ? text : out + text.slice(copied);
+}
+
+/**
+ * `line` with each `[text](target)` (or `![alt](src)` for `"!["`) replaced by its text: what
+ * `.replace(/!?\[([^\]]*)\]\([^)]*\)/g, "$1")` did, without rescanning to the end from every
+ * opener when no `]` or `)` follows.
+ */
+export function unlink(line: string, opener: "[" | "!["): string {
+  let out = "";
+  let copied = 0;
+  let at = 0;
+  for (;;) {
+    const open = line.indexOf(opener, at);
+    if (open === -1) break;
+    const textStart = open + opener.length;
+    const close = line.indexOf("]", textStart);
+    if (close === -1) break;
+    // Every opener before this `]` stops at it too, and fails the same way.
+    if (line[close + 1] !== "(") {
+      at = close + 1;
+      continue;
+    }
+    const end = line.indexOf(")", close + 2);
+    if (end === -1) break;
+    out += line.slice(copied, open) + line.slice(textStart, close);
+    copied = at = end + 1;
+  }
+  return copied === 0 ? line : out + line.slice(copied);
+}
diff --git a/packages/core-ts/src/media/sniff.ts b/packages/core-ts/src/media/sniff.ts
index 61a234fd..144bfbeb 100644
--- a/packages/core-ts/src/media/sniff.ts
+++ b/packages/core-ts/src/media/sniff.ts
@@ -48,12 +48,52 @@ const ACTIVE_TEXT =
 /** Never inside a data file's sniffed window, wherever it appears. */
 const ACTIVE_ANYWHERE = /<(?:script|html|!doctype\s+html|iframe|object|embed)\b/i;
 
-function isSvgText(text: string): boolean {
-  // An optional BOM, XML declaration, comments and whitespace, then the svg root element.
-  const t = text.replace(/^/, "");
-  return /^\s*(?:<\?xml[^>]*\?>\s*)?(?:<!--[\s\S]*?-->\s*)*(?:<!DOCTYPE\s+svg[^>]*>\s*)?(?:<!--[\s\S]*?-->\s*)*<svg[\s>]/i.test(
-    t,
-  );
+const isSpace = (c: string | undefined): boolean => c !== undefined && /\s/.test(c);
+const skipSpace = (t: string, i: number): number => {
+  while (isSpace(t[i])) i++;
+  return i;
+};
+const startsWithCi = (t: string, word: string, at: number): boolean =>
+  t.slice(at, at + word.length).toLowerCase() === word;
+/** Past any `<!-- … -->` comments (each ends at its first `-->`) and the whitespace after them; -1 when one never ends. */
+function skipComments(t: string, at: number): number {
+  let i = at;
+  while (t.startsWith("<!--", i)) {
+    const end = t.indexOf("-->", i + 4);
+    if (end === -1) return -1;
+    i = skipSpace(t, end + 3);
+  }
+  return i;
+}
+
+/**
+ * An optional BOM, XML declaration, comments and whitespace, an optional svg DOCTYPE, then the svg
+ * root element. A linear scan in place of
+ * `/^\s*(?:<\?xml[^>]*\?>\s*)?(?:<!--[\s\S]*?-->\s*)*(?:<!DOCTYPE\s+svg[^>]*>\s*)?(?:<!--[\s\S]*?-->\s*)*<svg[\s>]/i`,
+ * which backtracked exponentially on uploads starting `<!--` with many `--><!--` (CodeQL
+ * js/redos, alerts 24, 35, 36). Same answers, except that a comment ends at its first `-->` as in
+ * HTML and XML (the regex could stretch one over a later `-->`), which only ever answers "not svg".
+ */
+export function isSvgText(text: string): boolean {
+  const t = text.startsWith("\uFEFF") ? text.slice(1) : text;
+  let i = skipSpace(t, 0);
+  if (startsWithCi(t, "<?xml", i)) {
+    // `[^>]*\?>`: the declaration ends at its first `>`, which must follow a `?`.
+    const gt = t.indexOf(">", i + 5);
+    if (gt === -1 || gt - 1 < i + 5 || t[gt - 1] !== "?") return false;
+    i = skipSpace(t, gt + 1);
+  }
+  i = skipComments(t, i);
+  if (i === -1) return false;
+  if (startsWithCi(t, "<!doctype", i) && isSpace(t[i + 9])) {
+    const name = skipSpace(t, i + 9);
+    if (!startsWithCi(t, "svg", name)) return false;
+    const gt = t.indexOf(">", name + 3);
+    if (gt === -1) return false;
+    i = skipComments(t, skipSpace(t, gt + 1));
+    if (i === -1) return false;
+  }
+  return startsWithCi(t, "<svg", i) && (t[i + 4] === ">" || isSpace(t[i + 4]));
 }
 
 /**
diff --git a/packages/core-ts/src/names.ts b/packages/core-ts/src/names.ts
index 0c0d6e76..8f8b1d84 100644
--- a/packages/core-ts/src/names.ts
+++ b/packages/core-ts/src/names.ts
@@ -47,6 +47,21 @@ export function trimEndChar(text: string, ch: string): string {
   return end === text.length ? text : text.slice(0, end);
 }
 
+/**
+ * Keys a path, pointer or merge from outside input must never write: through them an assignment
+ * reaches an object's prototype (`obj.__proto__.x = 1`, `obj.constructor.prototype.x = 1`) and,
+ * from there, every object (CodeQL js/prototype-polluting-assignment). Writers refuse them with an
+ * error rather than skipping them, so the caller learns its input was not applied.
+ */
+export const RESERVED_KEYS: ReadonlySet<string> = new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+]);
+
+/** Whether `key` is one of {@link RESERVED_KEYS}. */
+export const isReservedKey = (key: string): boolean => RESERVED_KEYS.has(key);
+
 /**
  * Folds a name for comparison: NFKC, Turkish-aware lower-casing (İ, I and ı all become i),
  * diacritics removed, apostrophes and dots dropped (`A.I.` → `ai`), every other run of
diff --git a/packages/core-ts/src/surface-interop-data.ts b/packages/core-ts/src/surface-interop-data.ts
new file mode 100644
index 00000000..d43d75cb
--- /dev/null
+++ b/packages/core-ts/src/surface-interop-data.ts
@@ -0,0 +1,101 @@
+/**
+ * The data model of surface interop (RFC-0020 §9): JSON Pointer reads and writes over the data an
+ * A2UI agent sends (`updateDataModel`) or a component binds. Pointers come from agent and MCP
+ * input, so writes refuse the reserved keys `__proto__`, `constructor` and `prototype` at every
+ * depth with an `InteropError`, step into arrays by index only, and read and write own properties
+ * only (CodeQL js/prototype-polluting-assignment, alerts 42–44). Worker-safe: pure functions.
+ */
+import { isReservedKey } from "./names.ts";
+import { isObj } from "./surfaces/shared.ts";
+
+type Json = Record<string, unknown>;
+
+/** A document that cannot be converted at all (not a wrong prop: those are notes or store issues). */
+export class InteropError extends Error {
+  override readonly name = "InteropError";
+}
+
+const ARRAY_INDEX = /^\d+$/;
+
+/**
+ * The data key an input with a literal value gets: its component id, with a suffix when the id
+ * is a reserved key (an A2UI id such as "prototype"), so a valid document never fails on a path
+ * it never wrote.
+ */
+export function dataKeyFor(id: string): string {
+  const key = id.replace(/[^a-z0-9-]/g, "-");
+  return isReservedKey(key) ? `${key}-value` : key;
+}
+
+/** RFC 6901 segments of `pointer` (`/a/b~1c` → `["a", "b/c"]`). */
+const segmentsOf = (pointer: string): string[] =>
+  pointer
+    .replace(/^\//, "")
+    .split("/")
+    .map((s) => s.replace(/~1/g, "/").replace(/~0/g, "~"));
+
+/** The value at `pointer` in `data` (own properties only), or `undefined`. */
+export function pointerGet(data: unknown, pointer: string): unknown {
+  if (pointer === "" || pointer === "/") return data;
+  let cur = data;
+  for (const seg of segmentsOf(pointer)) {
+    if (Array.isArray(cur)) cur = ARRAY_INDEX.test(seg) ? cur[Number(seg)] : undefined;
+    else if (isObj(cur) && Object.hasOwn(cur, seg)) cur = cur[seg];
+    else return undefined;
+  }
+  return cur;
+}
+
+/** Defines `key` as an own data property: never a setter, never the prototype chain. */
+function defineOwn(target: Json, key: string, value: unknown): void {
+  Object.defineProperty(target, key, {
+    value,
+    writable: true,
+    enumerable: true,
+    configurable: true,
+  });
+}
+
+/** Refuses a segment that would reach a prototype, or a non-index step into an array. */
+function checkSegment(container: Json | unknown[], seg: string, pointer: string): void {
+  // Compared inline at each step, so every write below sits behind the check.
+  if (seg === "__proto__" || seg === "constructor" || seg === "prototype")
+    throw new InteropError(`data path ${pointer} uses the reserved key "${seg}"`);
+  if (Array.isArray(container) && !ARRAY_INDEX.test(seg))
+    throw new InteropError(`data path ${pointer}: "${seg}" is not an array index`);
+}
+
+/** The child container at `seg`, created (an array when `nextSeg` is an index) when missing. */
+function child(cur: Json | unknown[], seg: string, nextSeg: string): Json | unknown[] {
+  const next: unknown = Array.isArray(cur)
+    ? cur[Number(seg)]
+    : Object.hasOwn(cur, seg)
+      ? cur[seg]
+      : undefined;
+  if (isObj(next) || Array.isArray(next)) return next;
+  const made: Json | unknown[] = ARRAY_INDEX.test(nextSeg) ? [] : {};
+  if (Array.isArray(cur)) cur[Number(seg)] = made;
+  else defineOwn(cur, seg, made);
+  return made;
+}
+
+/** `data` with `value` written at `pointer` (deleted when `value` is undefined), on a copy. */
+export function pointerSet(data: Json, pointer: string, value: unknown): Json {
+  if (pointer === "" || pointer === "/") return isObj(value) ? structuredClone(value) : {};
+  const segs = segmentsOf(pointer);
+  const out = structuredClone(data);
+  let cur: Json | unknown[] = out;
+  for (let i = 0; i < segs.length - 1; i++) {
+    const seg = segs[i] as string;
+    checkSegment(cur, seg, pointer);
+    cur = child(cur, seg, segs[i + 1] as string);
+  }
+  const last = segs.at(-1) as string;
+  checkSegment(cur, last, pointer);
+  if (Array.isArray(cur)) {
+    if (value === undefined) cur.splice(Number(last), 1);
+    else cur[Number(last)] = value;
+  } else if (value !== undefined) defineOwn(cur, last, value);
+  else if (Object.hasOwn(cur, last)) delete cur[last];
+  return out;
+}
diff --git a/packages/core-ts/src/surface-interop.ts b/packages/core-ts/src/surface-interop.ts
index a67ad64f..f751bc91 100644
--- a/packages/core-ts/src/surface-interop.ts
+++ b/packages/core-ts/src/surface-interop.ts
@@ -14,6 +14,9 @@
 import type { SurfaceComponent, SurfaceSection } from "@cloudhal/core-contracts";
 import { nearestIcon } from "./icon-names.ts";
 import { trimChar } from "./names.ts";
+import { dataKeyFor, InteropError, pointerGet, pointerSet } from "./surface-interop-data.ts";
+
+export { InteropError };
 
 export const A2UI_VERSION = "v0.9";
 export const A2UI_BASIC_CATALOG = "https://a2ui.org/specification/v0_9/catalogs/basic/catalog.json";
@@ -70,45 +73,6 @@ class Ids {
   }
 }
 
-function pointerGet(data: unknown, pointer: string): unknown {
-  if (pointer === "" || pointer === "/") return data;
-  let cur = data;
-  for (const raw of pointer.replace(/^\//, "").split("/")) {
-    const seg = raw.replace(/~1/g, "/").replace(/~0/g, "~");
-    if (Array.isArray(cur)) cur = /^\d+$/.test(seg) ? cur[Number(seg)] : undefined;
-    else if (isObj(cur) && Object.hasOwn(cur, seg)) cur = cur[seg];
-    else return undefined;
-  }
-  return cur;
-}
-
-function pointerSet(data: Json, pointer: string, value: unknown): Json {
-  if (pointer === "" || pointer === "/") return isObj(value) ? structuredClone(value) : {};
-  const segs = pointer
-    .replace(/^\//, "")
-    .split("/")
-    .map((s) => s.replace(/~1/g, "/").replace(/~0/g, "~"));
-  if (segs.some((s) => s === "__proto__" || s === "prototype" || s === "constructor")) return data;
-  const out = structuredClone(data);
-  let cur: Json | unknown[] = out;
-  for (let i = 0; i < segs.length - 1; i++) {
-    const s = segs[i] as string;
-    const next: unknown = Array.isArray(cur) ? cur[Number(s)] : cur[s];
-    const container: Json | unknown[] =
-      isObj(next) || Array.isArray(next) ? next : /^\d+$/.test(segs[i + 1] ?? "") ? [] : {};
-    if (Array.isArray(cur)) cur[Number(s)] = container;
-    else cur[s] = container;
-    cur = container;
-  }
-  const last = segs.at(-1) as string;
-  if (value === undefined) {
-    if (Array.isArray(cur)) cur.splice(Number(last), 1);
-    else delete cur[last];
-  } else if (Array.isArray(cur)) cur[Number(last)] = value;
-  else cur[last] = value;
-  return out;
-}
-
 // ── A2UI → Cloudhal ─────────────────────────────────────────────────────────────────────────
 
 interface A2uiState {
@@ -514,7 +478,7 @@ export function fromA2ui(
         // A literal value becomes the surface's data, so the input can write to it.
         let path = isObj(bound) && typeof bound.path === "string" ? bound.path : undefined;
         if (!path) {
-          path = `/${id.replace(/[^a-z0-9-]/g, "-")}`;
+          path = `/${dataKeyFor(id)}`;
           data = pointerSet(
             data,
             path,
@@ -1226,8 +1190,3 @@ export function toJsonRender(surface: Pick<SurfaceSection, "components" | "data"
     notes: notes.list,
   };
 }
-
-/** A document that cannot be converted at all (not a wrong prop: those are notes or store issues). */
-export class InteropError extends Error {
-  override readonly name = "InteropError";
-}
diff --git a/packages/core-ts/src/surfaces/bindings/values.ts b/packages/core-ts/src/surfaces/bindings/values.ts
index 7df7f2ad..990233c1 100644
--- a/packages/core-ts/src/surfaces/bindings/values.ts
+++ b/packages/core-ts/src/surfaces/bindings/values.ts
@@ -1,5 +1,6 @@
 /** Bound values: paths and calls, JSON Pointers, conditions (RFC-0020 §3, RFC-0022 §1). */
 import type { PropsIssue } from "../../blocks.ts";
+import { isReservedKey } from "../../names.ts";
 import { isObj, isScalar, SURFACE_LIMITS } from "../shared.ts";
 
 // ── bindings, functions, conditions ──────────────────────────────────────────────────────────
@@ -80,6 +81,18 @@ export function checkPointer(pointer: unknown, path: string, out: PropsIssue[]):
     out.push({ path, message: "a JSON Pointer into the surface's data, such as /plans/0/price" });
 }
 
+/**
+ * A pointer the page writes through (an input's model, a Scrolly's `step`, a Button action's
+ * `path`): no reserved key (`__proto__`, `constructor`, `prototype`) on the way, since a write
+ * there would reach a prototype (the page's runtime and the Build eval's sample inputs write
+ * through these). Read bindings may name such keys: `getPointer` reads own properties only.
+ */
+export function checkWrittenPointer(pointer: unknown, path: string, out: PropsIssue[]): void {
+  const segments = typeof pointer === "string" ? pointerSegments(pointer) : undefined;
+  if (segments?.some(isReservedKey))
+    out.push({ path, message: "__proto__, constructor and prototype are reserved keys here" });
+}
+
 export function checkOperand(v: unknown, path: string, out: PropsIssue[]): void {
   if (isPathValue(v)) checkPointer(v.path, `${path}/path`, out);
   else if (!isScalar(v)) out.push({ path, message: "a text, number, true/false or {path}" });
diff --git a/packages/core-ts/src/surfaces/body.ts b/packages/core-ts/src/surfaces/body.ts
index f3b00487..dd317524 100644
--- a/packages/core-ts/src/surfaces/body.ts
+++ b/packages/core-ts/src/surfaces/body.ts
@@ -8,11 +8,49 @@ import { isObj } from "./shared.ts";
 
 // ── surfaces in markdown bodies (RFC-0020 §5) ────────────────────────────────────────────────
 
-/** A fence opening a surface: ```surface {"id":"pricing","catalog":"blog@1"} (or ~~~). */
-export const FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})[ \t]*([^\s`]*)(.*)$/;
+const LINE_BREAK = /[\n\r\u2028\u2029]/;
+const isSpace = (c: string) => /\s/.test(c);
+
+/**
+ * A line opening a code fence: the fence (```` ``` ```` or `~~~`, three or more), the info string's
+ * first word and the rest of the line, as in ```surface {"id":"pricing","catalog":"blog@1"}.
+ * What `/^ {0,3}(`{3,}|~{3,})[ \t]*([^\s`]*)(.*)$/` matched, in one pass: that regex was
+ * quadratic on a fence followed by many tabs and a lone `\r` (js/polynomial-redos, alert 30).
+ */
+export function fenceOpen(line: string): [fence: string, word: string, rest: string] | undefined {
+  // `.` and `$` (no `m` flag): the regex never matched a line holding a line break.
+  if (LINE_BREAK.test(line)) return undefined;
+  let i = 0;
+  while (i < 3 && line[i] === " ") i++;
+  const ch = line[i];
+  if (ch !== "`" && ch !== "~") return undefined;
+  const start = i;
+  while (line[i] === ch) i++;
+  if (i - start < 3) return undefined;
+  const fence = line.slice(start, i);
+  while (line[i] === " " || line[i] === "\t") i++;
+  const word = i;
+  while (i < line.length && line[i] !== "`" && !isSpace(line[i] as string)) i++;
+  return [fence, line.slice(word, i), line.slice(i)];
+}
 export const SURFACE_ID = /^[a-z][a-z0-9-]{0,40}$/;
 export const CATALOG_ID = /^[a-z][a-z0-9-]{0,40}@[0-9]{1,4}$/;
 
+/**
+ * Whether `line` closes a fence opened with `fence`: up to three spaces, at least as many of its
+ * character, then only spaces or tabs. What `^ {0,3}`{n,}[ \t]*$` tested, without building a
+ * RegExp from the body's text for every fence (CodeQL followed the line into it, alert 45).
+ */
+export function closesFence(line: string, fence: string): boolean {
+  let i = 0;
+  while (i < 3 && line[i] === " ") i++;
+  const start = i;
+  while (line[i] === fence[0]) i++;
+  if (i - start < fence.length) return false;
+  while (line[i] === " " || line[i] === "\t") i++;
+  return i === line.length;
+}
+
 /** One ```surface fence of a body, parsed line by line. */
 export interface BodySurface {
   /** The fence's `id` (unique in the body). */
@@ -116,15 +154,13 @@ export function bodySurfaces(markdown: string): BodySurface[] {
   const lines = markdown.split(/\r?\n/);
   const out: BodySurface[] = [];
   for (let i = 0; i < lines.length; i++) {
-    const m = FENCE_OPEN.exec(lines[i] as string);
+    const m = fenceOpen(lines[i] as string);
     if (!m) continue;
-    const fence = m[1] as string;
-    const closes = (l: string) =>
-      new RegExp(`^ {0,3}${fence[0] === "`" ? "`" : "~"}{${fence.length},}[ \\t]*$`).test(l);
+    const [fence, word, rest] = m;
     let j = i + 1;
-    while (j < lines.length && !closes(lines[j] as string)) j++;
-    if (m[2] === "surface")
-      out.push(parseSurfaceFence((m[3] ?? "").trim(), lines.slice(i + 1, j), j < lines.length, i));
+    while (j < lines.length && !closesFence(lines[j] as string, fence)) j++;
+    if (word === "surface")
+      out.push(parseSurfaceFence(rest.trim(), lines.slice(i + 1, j), j < lines.length, i));
     i = j;
   }
   return out;
diff --git a/packages/core-ts/src/surfaces/checks/component.ts b/packages/core-ts/src/surfaces/checks/component.ts
index cfbdf4d4..4139f25f 100644
--- a/packages/core-ts/src/surfaces/checks/component.ts
+++ b/packages/core-ts/src/surfaces/checks/component.ts
@@ -1,8 +1,8 @@
 /** Rules for one component of a surface: children, props, bindings, motion and per-kind limits. */
 import type { SurfaceComponent } from "@cloudhal/core-contracts";
-import { checkCondition, isPathValue } from "../bindings/values.ts";
+import { checkCondition, checkWrittenPointer, isPathValue } from "../bindings/values.ts";
 import { type CatalogEntry, childRule } from "../catalog/index.ts";
-import { INPUT_MODEL } from "../catalog/props.ts";
+import { INPUT_COMPONENTS, INPUT_MODEL } from "../catalog/props.ts";
 import { checkMotion } from "../motion.ts";
 import { isObj } from "../shared.ts";
 import { kidsOf, type SurfaceGraph } from "./graph.ts";
@@ -51,11 +51,29 @@ export function checkComponent(
     });
   if (c.component === "Button" && isObj(c.props) && isObj(c.props.onClick))
     checkAction(c.props.onClick, `${at}/props/onClick`, issues);
+  checkWrites(c, at, issues);
   if (c.visible !== undefined) checkCondition(c.visible, `${at}/visible`, issues);
   if (c.motion !== undefined) checkMotion(c.motion, c.component, `${at}/motion`, issues);
   checkEffects(g, c, at);
 }
 
+/** The pointers this component writes through: no reserved keys on the way (see `checkWrittenPointer`). */
+function checkWrites(c: SurfaceComponent, at: string, issues: SurfaceGraph["issues"]): void {
+  if (!isObj(c.props)) return;
+  const model = INPUT_COMPONENTS.has(c.component)
+    ? (INPUT_MODEL[c.component] ?? "value")
+    : undefined;
+  const bound = model ? c.props[model] : c.component === "Scrolly" ? c.props.step : undefined;
+  if (isPathValue(bound))
+    checkWrittenPointer(bound.path, `${at}/props/${model ?? "step"}/path`, issues);
+  if (
+    c.component === "Button" &&
+    isObj(c.props.onClick) &&
+    typeof c.props.onClick.path === "string"
+  )
+    checkWrittenPointer(c.props.onClick.path, `${at}/props/onClick/path`, issues);
+}
+
 /** RFC-0024: ambient presets, marquees, rotating and split text, scroll stories. */
 function checkEffects(g: SurfaceGraph, c: SurfaceComponent, at: string): void {
   const { issues } = g;
diff --git a/packages/core-ts/src/surfaces/patch/json-patch.ts b/packages/core-ts/src/surfaces/patch/json-patch.ts
index a5bb69c2..2b5af724 100644
--- a/packages/core-ts/src/surfaces/patch/json-patch.ts
+++ b/packages/core-ts/src/surfaces/patch/json-patch.ts
@@ -1,4 +1,5 @@
 /** RFC 6902 JSON Patch over plain JSON, with forbidden keys refused. */
+import { RESERVED_KEYS } from "../../names.ts";
 import { pointerSegments } from "../bindings/values.ts";
 import { isObj, SURFACE_LIMITS } from "../shared.ts";
 
@@ -24,7 +25,8 @@ export class PatchError extends Error {
 }
 
 export const OPS = new Set(["add", "remove", "replace", "move", "copy", "test"]);
-export const FORBIDDEN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+/** The reserved keys of `@cloudhal/core-ts/names`, refused at every level of a patch path. */
+export const FORBIDDEN_KEYS = RESERVED_KEYS;
 
 export function container(doc: unknown, segments: string[], index: number, path: string): unknown {
   let cur = doc;
diff --git a/packages/core-ts/test/interop-pollution.test.ts b/packages/core-ts/test/interop-pollution.test.ts
new file mode 100644
index 00000000..79c31f00
--- /dev/null
+++ b/packages/core-ts/test/interop-pollution.test.ts
@@ -0,0 +1,195 @@
+/**
+ * A2UI `updateDataModel` paths come from agent and MCP input: reserved keys are refused at every
+ * level with an `InteropError`, and nothing reaches `Object.prototype` (CodeQL
+ * js/prototype-polluting-assignment, alerts 42–44).
+ */
+import { afterEach, describe, expect, it } from "vitest";
+import { A2UI_BASIC_CATALOG, fromA2ui, InteropError } from "../src/surface-interop.ts";
+import { checkSurface, createCatalog } from "../src/surfaces.ts";
+
+const catalog = createCatalog({ name: "blog", major: 1 });
+const v = "v0.9";
+
+const withData = (path: string, value: unknown) => [
+  { version: v, createSurface: { surfaceId: "s", catalogId: A2UI_BASIC_CATALOG } },
+  {
+    version: v,
+    updateComponents: {
+      surfaceId: "s",
+      components: [{ id: "root", component: "Text", text: { path: "/title" } }],
+    },
+  },
+  { version: v, updateDataModel: { surfaceId: "s", path, value } },
+];
+
+const convert = (path: string, value: unknown = { polluted: true }) =>
+  fromA2ui(withData(path, value), { sectionId: "sec_pollute001", catalog: catalog.id });
+
+const POINTERS = [
+  "/__proto__/x",
+  "/__proto__",
+  "/constructor/prototype/x",
+  "/a/__proto__/x",
+  "/a/b/constructor/prototype/x",
+  "/list/0/__proto__/x",
+  "/prototype/x",
+  // `~1` decodes to `/`, `~0` to `~`: the decoded segment is what is checked
+  "/a~1b/__proto__/x",
+];
+
+afterEach(() => {
+  // Belt and braces: never leave a polluted prototype behind for other tests.
+  for (const k of ["x", "polluted"]) delete (Object.prototype as Record<string, unknown>)[k];
+});
+
+describe("A2UI data paths with reserved keys", () => {
+  it.each(POINTERS)("refuses %s with an error and leaves Object.prototype alone", (pointer) => {
+    expect(() => convert(pointer)).toThrow(InteropError);
+    expect(() => convert(pointer)).toThrow(/reserved key/);
+    expect(({} as Record<string, unknown>).x).toBeUndefined();
+    expect(({} as Record<string, unknown>).polluted).toBeUndefined();
+    expect(Object.getPrototypeOf({})).toBe(Object.prototype);
+  });
+
+  it("refuses a delete (no value) through a reserved key too", () => {
+    expect(() => convert("/__proto__/hasOwnProperty", undefined)).toThrow(InteropError);
+    expect(typeof Object.prototype.hasOwnProperty).toBe("function");
+  });
+
+  it("refuses a non-index step into an array", () => {
+    const messages = [
+      ...withData("/list", ["a"]),
+      { version: v, updateDataModel: { surfaceId: "s", path: "/list/length", value: 0 } },
+    ];
+    expect(() => fromA2ui(messages, { sectionId: "sec_pollute001", catalog: catalog.id })).toThrow(
+      /not an array index/,
+    );
+  });
+
+  it("still writes ordinary paths, inherited names included, as own data", () => {
+    const r = fromA2ui(
+      [
+        ...withData("/title", "Hello"),
+        { version: v, updateDataModel: { surfaceId: "s", path: "/toString/y", value: 1 } },
+        { version: v, updateDataModel: { surfaceId: "s", path: "/list/1/name", value: "Pro" } },
+      ],
+      { sectionId: "sec_pollute001", catalog: catalog.id },
+    );
+    expect(r.surface.data).toEqual({
+      title: "Hello",
+      toString: { y: 1 },
+      list: [undefined, { name: "Pro" }],
+    });
+    expect(Object.hasOwn(r.surface.data as object, "toString")).toBe(true);
+    expect(checkSurface(r.surface, catalog).issues).toEqual([]);
+  });
+});
+
+describe("A2UI inputs whose component id is a reserved key", () => {
+  it.each(["prototype", "constructor", "Prototype"])(
+    "convert, with %s-value as the data key",
+    (raw) => {
+      const r = fromA2ui(
+        [
+          { version: v, createSurface: { surfaceId: "s", catalogId: A2UI_BASIC_CATALOG } },
+          {
+            version: v,
+            updateComponents: {
+              surfaceId: "s",
+              components: [
+                { id: "root", component: "Column", children: [raw, "ok"] },
+                { id: raw, component: "TextField", label: "Name", text: "Ada" },
+                { id: "ok", component: "CheckBox", label: "Agree", value: true },
+              ],
+            },
+          },
+        ],
+        { sectionId: "sec_pollute003", catalog: catalog.id },
+      );
+      const key = `${raw.toLowerCase()}-value`;
+      expect(r.surface.data).toEqual({ [key]: "Ada", ok: true });
+      expect(r.surface.components.find((c) => c.component === "TextField")?.props).toMatchObject({
+        value: { path: `/${key}` },
+      });
+      expect(checkSurface(r.surface, catalog).issues).toEqual([]);
+    },
+  );
+});
+
+describe("an A2UI input whose component id is __proto__", () => {
+  it("converts: the id is folded to a plain one, and so is its data key", () => {
+    const r = fromA2ui(
+      [
+        { version: v, createSurface: { surfaceId: "s", catalogId: A2UI_BASIC_CATALOG } },
+        {
+          version: v,
+          updateComponents: {
+            surfaceId: "s",
+            components: [
+              { id: "root", component: "Column", children: ["__proto__"] },
+              { id: "__proto__", component: "TextField", label: "Name", text: "Ada" },
+            ],
+          },
+        },
+      ],
+      { sectionId: "sec_pollute004", catalog: catalog.id },
+    );
+    expect(r.surface.data).toEqual({ proto: "Ada" });
+    expect(Object.getPrototypeOf(r.surface.data)).toBe(Object.prototype);
+    expect(r.surface.components.find((c) => c.component === "TextField")).toMatchObject({
+      id: "proto",
+      props: { value: { path: "/proto" } },
+    });
+    expect(({} as Record<string, unknown>).Ada).toBeUndefined();
+    expect(checkSurface(r.surface, catalog).issues).toEqual([]);
+  });
+});
+
+describe("surface pointers with reserved keys", () => {
+  const surface = (data: unknown, components: unknown[]) =>
+    ({ id: "sec_pollute002", kind: "surface", catalog: catalog.id, data, components }) as never;
+  const reserved = (issues: { message: string }[]) =>
+    issues.filter((i) => /reserved keys/.test(i.message));
+
+  it.each(["/__proto__/x", "/constructor/prototype/x", "/a/__proto__", "/a/prototype"])(
+    "checkSurface refuses %s where the page writes through it",
+    (path) => {
+      const written = [
+        { id: "root", component: "TextField", props: { label: "N", value: { path } } },
+      ];
+      expect(reserved(checkSurface(surface({}, written), catalog).issues)).toEqual([
+        expect.objectContaining({ path: "/components/0/props/value/path" }),
+      ]);
+      const checkbox = [
+        { id: "root", component: "Checkbox", props: { label: "N", checked: { path } } },
+      ];
+      expect(reserved(checkSurface(surface({}, checkbox), catalog).issues)).toHaveLength(1);
+      const button = [
+        {
+          id: "root",
+          component: "Button",
+          props: { label: "Go", onClick: { action: "toggle", path } },
+        },
+      ];
+      expect(reserved(checkSurface(surface({}, button), catalog).issues)).toEqual([
+        expect.objectContaining({ path: "/components/0/props/onClick/path" }),
+      ]);
+      const scrolly = [
+        { id: "root", component: "Scrolly", props: { step: { path } }, children: ["s1"] },
+        { id: "s1", component: "Step", children: [] },
+      ];
+      expect(reserved(checkSurface(surface({}, scrolly), catalog).issues)).toEqual([
+        expect.objectContaining({ path: "/components/0/props/step/path" }),
+      ]);
+    },
+  );
+
+  it("accepts read bindings through a data key named constructor or prototype", () => {
+    const page = surface({ stages: { prototype: "Q1", constructor: "Q2" } }, [
+      { id: "root", component: "Column", children: ["a", "b"] },
+      { id: "a", component: "Text", props: { text: { path: "/stages/prototype" } } },
+      { id: "b", component: "Text", props: { text: { path: "/stages/constructor" } } },
+    ]);
+    expect(checkSurface(page, catalog).issues).toEqual([]);
+  });
+});
diff --git a/packages/core-ts/test/linear-scans.test.ts b/packages/core-ts/test/linear-scans.test.ts
new file mode 100644
index 00000000..3ee815bf
--- /dev/null
+++ b/packages/core-ts/test/linear-scans.test.ts
@@ -0,0 +1,235 @@
+/**
+ * core-ts's linear scanners (AGENTS.md rule 13, CodeQL alerts 20, 23, 24, 30, 35, 36): each gives
+ * the regex it replaced's answers on ordinary input and stays fast on 100k adversarial ones.
+ */
+import { describe, expect, it } from "vitest";
+import { normalizeHostname } from "../src/domains.ts";
+import { escapeMarkdown, markdownToPlain } from "../src/fields/conversions.ts";
+import { isSvgText, sniff } from "../src/media/sniff.ts";
+import { bodySurfaces, closesFence, fenceOpen } from "../src/surfaces/body.ts";
+
+const N = 100_000;
+function fast<T>(f: () => T): T {
+  const start = performance.now();
+  const out = f();
+  expect(performance.now() - start).toBeLessThan(1500);
+  return out;
+}
+
+describe("isSvgText (alerts 24, 35, 36)", () => {
+  const old = (text: string) =>
+    /^\s*(?:<\?xml[^>]*\?>\s*)?(?:<!--[\s\S]*?-->\s*)*(?:<!DOCTYPE\s+svg[^>]*>\s*)?(?:<!--[\s\S]*?-->\s*)*<svg[\s>]/i.test(
+      text.replace(/^/, ""),
+    );
+  it("answers as the regex did on real headers", () => {
+    for (const t of [
+      '<svg xmlns="http://www.w3.org/2000/svg"></svg>',
+      "<svg>",
+      '  <?xml version="1.0" encoding="UTF-8"?>\n<svg viewBox="0 0 1 1">',
+      '<?xml version="1.0"?><!-- made with x --><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "x.dtd">\n<svg\n>',
+      "<!-- a --> <!-- b -->\n<SVG width='1'>",
+      "<!DOCTYPE svg><!-- c --><svg>",
+      "<!DOCTYPE html><svg>",
+      "<!DOCTYPEsvg><svg>",
+      "<?xml?><svg>",
+      "<?xml><svg>",
+      "<?xml version='1.0'><svg>",
+      "<svgx>",
+      "<svg",
+      "<html><svg>",
+      "<!-- unclosed <svg>",
+      "plain text",
+      "",
+      "<!---->",
+      "<!----><svg/>",
+      "<svg/>",
+    ])
+      expect(isSvgText(t), JSON.stringify(t)).toBe(old(t));
+  });
+  it("ends a comment at its first --> (the one intended difference: never more svg)", () => {
+    const t = "<!-- a --> x --> <svg>";
+    expect(old(t)).toBe(true);
+    expect(isSvgText(t)).toBe(false);
+  });
+  it("is linear on the exponential inputs", () => {
+    expect(fast(() => isSvgText(`<!--${"--><!--".repeat(N / 7)}`))).toBe(false);
+    expect(fast(() => isSvgText(`<!--${"<!---->".repeat(N / 7)}`))).toBe(false);
+    expect(fast(() => isSvgText(`${"<!---->".repeat(N / 7)}<svg>`))).toBe(true);
+    const bytes = new TextEncoder().encode(`<!--${"--><!--".repeat(N / 7)}`);
+    expect(fast(() => sniff(bytes)).kind).toBe("refused");
+  });
+});
+
+describe("fenceOpen (alert 30)", () => {
+  const old = (line: string) => {
+    const m = /^ {0,3}(`{3,}|~{3,})[ \t]*([^\s`]*)(.*)$/.exec(line);
+    return m ? [m[1], m[2], m[3]] : undefined;
+  };
+  it("matches what the regex matched", () => {
+    for (const line of [
+      "```",
+      '```surface {"id":"p"}',
+      "   ~~~~ surface  x",
+      "    ```four spaces",
+      "``",
+      "~~~\tjs title",
+      "```js`no",
+      "````` a b c ",
+      "``` x",
+      "```a\rb",
+      "text ```",
+      "",
+      "~~~~~~",
+    ])
+      expect(fenceOpen(line), JSON.stringify(line)).toEqual(old(line));
+  });
+  it("is linear on a fence with many tabs and a lone \\r", () => {
+    expect(fast(() => fenceOpen(`\`\`\`${"\t".repeat(N)}\r`))).toBeUndefined();
+    expect(fast(() => fenceOpen(`\`\`\`${"\t".repeat(N)}x`))?.[1]).toBe("x");
+    const body = `\`\`\`surface${"\t".repeat(N)}\rx\n`;
+    expect(fast(() => bodySurfaces(body))).toEqual([]);
+  });
+});
+
+describe("markdownToPlain and escapeMarkdown (alert 23)", () => {
+  const oldPlain = (markdown: string, multiline: boolean) => {
+    const lines: string[] = [];
+    for (const raw of markdown.split(/\r?\n/)) {
+      const line = raw.trim();
+      if (line.startsWith("```") || line.startsWith("~~~") || line.startsWith("::")) continue;
+      const words = line
+        .replace(/^#{1,6}\s+/, "")
+        .replace(/^>\s?/, "")
+        .replace(/^(?:[-*+]|\d+[.)])\s+/, "")
+        .replace(/!\[([^\]]*)\]\([^)]*\)/g, "$1")
+        .replace(/\[([^\]]*)\]\([^)]*\)/g, "$1")
+        .replace(/(\*\*|__|~~|\*|_|`)/g, "")
+        .replace(/\\([!-/:-@[-`{-~])/g, "$1")
+        .trim();
+      if (words) lines.push(words);
+    }
+    return lines.join(multiline ? "\n" : " ");
+  };
+  const oldEscape = (text: string) =>
+    text
+      .replace(/[\\`*_[\]<>|~&]/g, "\\$&")
+      .replace(/^(\s*)([#>+=-])/gm, "$1\\$2")
+      .replace(/^(\s*\d+)([.)])/gm, "$1\\$2")
+      .replace(/:(?=:)/g, "\\:");
+  const samples = [
+    "# Title\n\nSome **bold** and [a link](https://x.test) and ![alt](/i.png).",
+    "- item [one](a) [two](b)\n1. first\n> quote",
+    "[no target] and [x] (y) and [a](b and ![c](d",
+    "[[nested](x)](y) ![![i](a)](b) []() ![]()",
+    "a [b](c(d)e) f",
+    "```\ncode\n```\n::embed{x}\nafter \\*escaped\\*",
+    "",
+    "  \n\n  - lead\n\t# hash\n  12. num\n= setext\n+ plus\n3) paren\n\n\n-",
+    "1.5 is a number\n100) items\na::b::c\n",
+    "line\r\n# crlf\r\n  > quoted
- sep",
+  ];
+  it("gives the regex versions' answers", () => {
+    for (const md of samples) {
+      expect(markdownToPlain(md, true), JSON.stringify(md)).toBe(oldPlain(md, true));
+      expect(markdownToPlain(md, false)).toBe(oldPlain(md, false));
+      expect(escapeMarkdown(md), JSON.stringify(md)).toBe(oldEscape(md));
+    }
+  });
+  it("is linear on many openers and blank lines", () => {
+    expect(fast(() => markdownToPlain("![".repeat(N / 2), false))).toBe("![".repeat(N / 2));
+    expect(fast(() => markdownToPlain(`![](${"![](".repeat(N / 4)}`, false))).toBe(
+      `![](${"![](".repeat(N / 4)}`,
+    );
+    const brackets = `[\\](${"[!](".repeat(N / 4)}`;
+    expect(markdownToPlain(brackets.slice(0, 4000), false)).toBe(
+      oldPlain(brackets.slice(0, 4000), false),
+    );
+    expect(fast(() => markdownToPlain(brackets, false))).toBe(`[](${"[!](".repeat(N / 4)}`);
+    expect(fast(() => escapeMarkdown(`${"\n".repeat(N)}x`))).toBe(`${"\n".repeat(N)}x`);
+    expect(fast(() => escapeMarkdown(`${" \n".repeat(N / 2)}-`))).toBe(`${" \n".repeat(N / 2)}\\-`);
+  });
+});
+
+describe("normalizeHostname (alert 20)", () => {
+  const old = (input: string) =>
+    input
+      .trim()
+      .toLowerCase()
+      .replace(/^[a-z]+:\/\//, "")
+      .replace(/[/?#].*$/, "")
+      .replace(/\.$/, "");
+  it("gives the regex version's answers", () => {
+    for (const input of [
+      "https://News.Example.com/",
+      "news.example.com.",
+      "example.com/a/b?c#d",
+      "example.com?x",
+      "example.com#frag",
+      "  HTTP://A.B  ",
+      "a/b\nc/d",
+      "a/b\rc",
+      "plain",
+      "",
+    ])
+      expect(normalizeHostname(input), JSON.stringify(input)).toBe(old(input));
+  });
+  it("is linear on many # before a line break", () => {
+    expect(fast(() => normalizeHostname(`${"#".repeat(N)}\nx`))).toBe(`${"#".repeat(N)}\nx`);
+    expect(fast(() => normalizeHostname(`a${"/".repeat(N)}`))).toBe("a");
+  });
+});
+
+describe("random inputs over the characters that matter", () => {
+  let s = 2026;
+  const next = () => {
+    s = (s * 1103515245 + 12345) & 0x7fffffff;
+    return s;
+  };
+  const random = (tokens: readonly string[], max: number) => {
+    let t = "";
+    for (let i = next() % max; i > 0; i--) t += tokens[next() % tokens.length];
+    return t;
+  };
+  const oldFence = (line: string) => {
+    const m = /^ {0,3}(`{3,}|~{3,})[ \t]*([^\s`]*)(.*)$/.exec(line);
+    return m ? [m[1], m[2], m[3]] : undefined;
+  };
+  const oldEscape = (text: string) =>
+    text
+      .replace(/[\\`*_[\]<>|~&]/g, "\\$&")
+      .replace(/^(\s*)([#>+=-])/gm, "$1\\$2")
+      .replace(/^(\s*\d+)([.)])/gm, "$1\\$2")
+      .replace(/:(?=:)/g, "\\:");
+  const oldLinks = (line: string) =>
+    line.replace(/!\[([^\]]*)\]\([^)]*\)/g, "$1").replace(/\[([^\]]*)\]\([^)]*\)/g, "$1");
+  const oldHost = (input: string) =>
+    input
+      .trim()
+      .toLowerCase()
+      .replace(/^[a-z]+:\/\//, "")
+      .replace(/[/?#].*$/, "")
+      .replace(/\.$/, "");
+
+  it("agree with the regexes they replaced", () => {
+    for (let n = 0; n < 20_000; n++) {
+      const line = random(["`", "``", "~", " ", "\t", "a", "\r", " ", "``"], 12);
+      expect(fenceOpen(line), JSON.stringify(line)).toEqual(oldFence(line));
+      for (const fence of ["```", "````", "~~~"]) {
+        const closer = new RegExp(
+          `^ {0,3}${fence[0] === "`" ? "`" : "~"}{${fence.length},}[ \\t]*$`,
+        );
+        expect(closesFence(line, fence), JSON.stringify([line, fence])).toBe(closer.test(line));
+      }
+      const text = random(["\n", " ", "#", "1", ".", ")", "-", "a", "\r", ":", "
"], 14);
+      expect(escapeMarkdown(text), JSON.stringify(text)).toBe(oldEscape(text));
+      const md = random(["!", "[", "]", "(", ")", "a", " ", "*"], 14);
+      expect(markdownToPlain(md, false), JSON.stringify(md)).toBe(
+        oldLinks(md)
+          .replace(/(\*\*|__|~~|\*|_|`)/g, "")
+          .trim(),
+      );
+      const host = random(["/", "?", "#", "\n", "a", ".", "\r", "A", ":"], 12);
+      expect(normalizeHostname(host), JSON.stringify(host)).toBe(oldHost(host));
+    }
+  });
+});
diff --git a/packages/mcp-server/src/chrome-tools.ts b/packages/mcp-server/src/chrome-tools.ts
index db652f28..a09342dd 100644
--- a/packages/mcp-server/src/chrome-tools.ts
+++ b/packages/mcp-server/src/chrome-tools.ts
@@ -16,6 +16,7 @@ import {
   resolveChrome,
   type SiteChrome,
 } from "@cloudhal/core-ts/chrome";
+import { isReservedKey } from "@cloudhal/core-ts/names";
 import { id, mapError, obj, type ToolContext, type ToolDefinition, ToolError } from "./common.ts";
 
 async function requireSite(ctx: ToolContext, siteId: string): Promise<Site> {
@@ -24,12 +25,18 @@ async function requireSite(ctx: ToolContext, siteId: string): Promise<Site> {
   return site;
 }
 
-/** `patch` onto `current`: a value replaces the part, null removes it. */
+/**
+ * `patch` onto `current`: a value replaces the part, null removes it. A reserved key
+ * (`__proto__`, `constructor`, `prototype`) is refused: JSON input can carry `__proto__` as an own
+ * key, and assigning it would swap the part's prototype instead of setting a field.
+ */
 function merge<T extends object>(current: T | undefined, patch: Record<string, unknown>): T {
   const out: Record<string, unknown> = { ...(current ?? {}) };
-  for (const [k, v] of Object.entries(patch))
+  for (const [k, v] of Object.entries(patch)) {
+    if (isReservedKey(k)) throw new ToolError("invalid", `"${k}" is a reserved key`);
     if (v === null) delete out[k];
     else out[k] = v;
+  }
   return out as T;
 }
 
diff --git a/packages/mcp-server/src/entry-fields.ts b/packages/mcp-server/src/entry-fields.ts
index 4f708769..aed43a97 100644
--- a/packages/mcp-server/src/entry-fields.ts
+++ b/packages/mcp-server/src/entry-fields.ts
@@ -18,7 +18,8 @@ import {
   refuseFieldIssues,
 } from "@cloudhal/core-ts/fields";
 import { fieldAssetIssues, fieldAssetRefs } from "@cloudhal/core-ts/media";
-import { type JsonSchema, quote, type ToolContext } from "./common.ts";
+import { isReservedKey } from "@cloudhal/core-ts/names";
+import { type JsonSchema, quote, type ToolContext, ToolError } from "./common.ts";
 
 type Values = Record<string, unknown>;
 
@@ -36,10 +37,15 @@ export const FIELDS_PATCH: JsonSchema = {
     "Typed custom fields to change, as a merge patch: given keys are set, null removes a key, others stay. The collection's fieldsSchema (list_collections) lists the keys and allowed values.",
 };
 
-/** The stored `fields` with `patch` applied: `null` removes a key. */
+/**
+ * The stored `fields` with `patch` applied: `null` removes a key. A reserved key (`__proto__`,
+ * `constructor`, `prototype`) is refused, also for collections without field definitions: JSON
+ * input can carry `__proto__` as an own key, and assigning it would swap the object's prototype.
+ */
 export function mergeFields(current: Values | undefined, patch: Values): Values {
   const next: Values = { ...(current ?? {}) };
   for (const [key, value] of Object.entries(patch)) {
+    if (isReservedKey(key)) throw new ToolError("invalid", `fields: "${key}" is a reserved key`);
     if (value === null) delete next[key];
     else next[key] = value;
   }
diff --git a/packages/mcp-server/test/chrome-tools.test.ts b/packages/mcp-server/test/chrome-tools.test.ts
index 9ba9b85e..30b4cd34 100644
--- a/packages/mcp-server/test/chrome-tools.test.ts
+++ b/packages/mcp-server/test/chrome-tools.test.ts
@@ -80,6 +80,11 @@ describe("chrome tools (RFC-0025)", () => {
     await expect(
       run("set_chrome", { siteId, rev: saved.rev, header: { layout: "zigzag" } }),
     ).rejects.toThrow();
+    // JSON input can carry `__proto__` as an own key: refused, not merged into the part's prototype
+    await expect(
+      run("set_chrome", { siteId, rev: saved.rev, header: JSON.parse('{"__proto__":{"x":1}}') }),
+    ).rejects.toThrow('"__proto__" is a reserved key');
+    expect(({} as Record<string, unknown>).x).toBeUndefined();
 
     const merged = (
       await run("set_chrome", { siteId, rev: saved.rev, header: { width: "wide" }, footer: null })
diff --git a/packages/mcp-server/test/fields.test.ts b/packages/mcp-server/test/fields.test.ts
index 35692436..1e81236a 100644
--- a/packages/mcp-server/test/fields.test.ts
+++ b/packages/mcp-server/test/fields.test.ts
@@ -421,3 +421,15 @@ describe("typed custom fields over MCP (RFC-0041 §8)", () => {
     expect(entries.every((e) => "capacity" in (e.fields ?? {}))).toBe(true);
   });
 });
+
+describe("mergeFields", () => {
+  it("refuses reserved keys instead of swapping the object's prototype", async () => {
+    const { mergeFields } = await import("../src/entry-fields.ts");
+    expect(mergeFields({ a: 1 }, { b: 2, a: null })).toEqual({ b: 2 });
+    for (const key of ["__proto__", "constructor", "prototype"])
+      expect(() => mergeFields({}, JSON.parse(`{"${key}":{"x":1}}`))).toThrow(
+        `fields: "${key}" is a reserved key`,
+      );
+    expect(({} as Record<string, unknown>).x).toBeUndefined();
+  });
+});
diff --git a/packages/ui/src/blocks/editor/paste.ts b/packages/ui/src/blocks/editor/paste.ts
index 4c3ec56c..8ee0744e 100644
--- a/packages/ui/src/blocks/editor/paste.ts
+++ b/packages/ui/src/blocks/editor/paste.ts
@@ -31,6 +31,37 @@ export function pasteMarkdown(
 export function looksLikeMarkdown(text: string): boolean {
   return (
     /^(#{1,6}\s|[-*+]\s|\d+[.)]\s|>\s?|```|~~~|\|.*\|\s*$|- \[[ xX]\]\s)/m.test(text) ||
-    /\*\*[^*\n]+\*\*|__[^_\n]+__|\[[^\]\n]+\]\([^)\s]+\)|`[^`\n]+`|~~[^~\n]+~~/.test(text)
+    /\*\*[^*\n]+\*\*|__[^_\n]+__|`[^`\n]+`|~~[^~\n]+~~/.test(text) ||
+    hasInlineLink(text)
   );
 }
+
+const isSpace = (c: string) => /\s/.test(c);
+
+/**
+ * Whether `text` has a `[label](target)` on one line: what `/\[[^\]\n]+\]\([^)\s]+\)/` tested, in
+ * one pass. That regex rescanned from every `[` (and every `](`) to the end of a long line
+ * (CodeQL js/polynomial-redos, alert 32). Each `](` is checked once: a `[` after the previous `]`
+ * or line break with something before the `]`, then a target without spaces up to a `)`. A scan
+ * over a target is shared by every `](` inside it, since they all stop where it stopped.
+ */
+export function hasInlineLink(text: string): boolean {
+  let stop = -1;
+  for (let at = text.indexOf("](", 0); at !== -1; at = text.indexOf("](", at + 1)) {
+    // The label: back to the previous `]` or line break; a `[` at least one character before.
+    let label = false;
+    for (let k = at - 1; k >= 0 && text[k] !== "]" && text[k] !== "\n"; k--)
+      if (text[k] === "[" && k < at - 1) {
+        label = true;
+        break;
+      }
+    // The target: up to the first `)` or whitespace.
+    const from = at + 2;
+    if (stop < from) {
+      stop = from;
+      while (stop < text.length && text[stop] !== ")" && !isSpace(text[stop] as string)) stop++;
+    }
+    if (label && text[stop] === ")" && stop > from) return true;
+  }
+  return false;
+}
diff --git a/packages/ui/test/paste-redos.test.tsx b/packages/ui/test/paste-redos.test.tsx
new file mode 100644
index 00000000..bddd7da9
--- /dev/null
+++ b/packages/ui/test/paste-redos.test.tsx
@@ -0,0 +1,54 @@
+/** Alert 32: `looksLikeMarkdown`'s link check answers as its regex did, in linear time. */
+import { describe, expect, it } from "vitest";
+import { hasInlineLink, looksLikeMarkdown } from "../src/blocks/editor/paste.ts";
+
+const oldLink = (text: string) => /\[[^\]\n]+\]\([^)\s]+\)/.test(text);
+const oldLooks = (text: string) =>
+  /^(#{1,6}\s|[-*+]\s|\d+[.)]\s|>\s?|```|~~~|\|.*\|\s*$|- \[[ xX]\]\s)/m.test(text) ||
+  /\*\*[^*\n]+\*\*|__[^_\n]+__|\[[^\]\n]+\]\([^)\s]+\)|`[^`\n]+`|~~[^~\n]+~~/.test(text);
+
+describe("hasInlineLink (alert 32)", () => {
+  it("answers as the regex did", () => {
+    for (const t of [
+      "see [docs](https://x.test) here",
+      "[a](b)",
+      "[](b)",
+      "[a]()",
+      "[a] (b)",
+      "[a](b c)",
+      "[a\nb](c)",
+      "[a](b\n)",
+      "[x [y](z)",
+      "[a](b(c)d)",
+      "](x) [",
+      "plain text",
+      "",
+    ])
+      expect(hasInlineLink(t), JSON.stringify(t)).toBe(oldLink(t));
+    // random strings over the characters that matter
+    let s = 32;
+    const next = () => {
+      s = (s * 1103515245 + 12345) & 0x7fffffff;
+      return s;
+    };
+    for (let n = 0; n < 20_000; n++) {
+      let t = "";
+      for (let i = next() % 14; i > 0; i--)
+        t += ["[", "]", "(", ")", " ", "\n", "a", "!"][next() % 8];
+      expect(hasInlineLink(t), JSON.stringify(t)).toBe(oldLink(t));
+      expect(looksLikeMarkdown(t), JSON.stringify(t)).toBe(oldLooks(t));
+    }
+  });
+
+  it("is linear on long runs of [ and [!](", () => {
+    for (const t of [
+      "[".repeat(100_000),
+      `[\\](${"[!](".repeat(25_000)}`,
+      `[a](${"](x".repeat(33_000)}`,
+    ]) {
+      const start = performance.now();
+      expect(looksLikeMarkdown(t)).toBe(false);
+      expect(performance.now() - start).toBeLessThan(1500);
+    }
+  });
+});
diff --git a/scripts/size-baseline.json b/scripts/size-baseline.json
index eeb1ec9f..c6c2009e 100644
--- a/scripts/size-baseline.json
+++ b/scripts/size-baseline.json
@@ -22,7 +22,7 @@
     "packages/core-ts/src/menu.ts": 928,
     "packages/core-ts/src/releases.ts": 996,
     "packages/core-ts/src/store.ts": 1212,
-    "packages/core-ts/src/surface-interop.ts": 1233,
+    "packages/core-ts/src/surface-interop.ts": 1192,
     "packages/core-ts/src/taxonomy.ts": 1718,
     "packages/mcp-server/src/menu-tools.ts": 1058,
     "packages/mcp-server/src/schedule-tools.ts": 1553,