diff --git a/.github/workflows/open-link.yml b/.github/workflows/open-link.yml
new file mode 100644
index 00000000..f909367f
--- /dev/null
+++ b/.github/workflows/open-link.yml
@@ -0,0 +1,45 @@
+name: /open link validation
+
+# The /open page and freenet-core's freenet:// handler must accept exactly the
+# same links. Both are tested against one vector file, which lives in
+# freenet-core (crates/core/tests/data/share-link-vectors.json); this repo
+# keeps a copy. This workflow runs the page's own JS over the copy and fails
+# if the copy has drifted from freenet-core main.
+
+on:
+  pull_request:
+    paths:
+      - 'hugo-site/themes/freenet/layouts/shortcodes/open-link.html'
+      - 'hugo-site/tests/**'
+      - '.github/workflows/open-link.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'hugo-site/themes/freenet/layouts/shortcodes/open-link.html'
+      - 'hugo-site/tests/**'
+      - '.github/workflows/open-link.yml'
+  schedule:
+    # Catch a rule change on the freenet-core side, which no change here
+    # would trigger.
+    - cron: '41 6 * * *'
+  workflow_dispatch:
+
+jobs:
+  vectors:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - name: Page JS against the shared vectors
+        run: node hugo-site/tests/open-link-vectors.test.mjs
+      - name: Vector copy matches freenet-core main
+        run: |
+          curl -fsSL https://raw.githubusercontent.com/freenet/freenet-core/main/crates/core/tests/data/share-link-vectors.json \
+            -o /tmp/upstream-vectors.json
+          if ! diff -u /tmp/upstream-vectors.json hugo-site/tests/share-link-vectors.json; then
+            echo "::error::hugo-site/tests/share-link-vectors.json differs from freenet-core main. Copy it over, and update open-link.html if the rules changed."
+            exit 1
+          fi
diff --git a/hugo-site/content/build/manual/share-links.md b/hugo-site/content/build/manual/share-links.md
index 91c42e7f..d9da9ace 100644
--- a/hugo-site/content/build/manual/share-links.md
+++ b/hugo-site/content/build/manual/share-links.md
@@ -51,11 +51,12 @@ https://freenet.org/open#6FzSeAUKcqJrveKyU8RJgGKc5jRB1Z2juvxXtwTA4Em9/#store=Ab3
   who already has Freenet installed and running.
 - **Use in your browser** -- the same target on `try.freenet.org`, a peer we host, for anyone who
   wants to look without installing anything.
-- **Open in Freenet** -- `freenet://<contract-id>/<path>...`. Works once a visitor's Freenet install
-  has registered the `freenet://` link type. That handler is not shipped yet
-  ([freenet-core#5726](https://github.com/freenet/freenet-core/issues/5726) tracks it), so this
-  button is styled and ordered as a secondary option for now -- swap it back to primary and first
-  once installers register the scheme.
+- **Open in Freenet** -- `freenet:<contract-id>/<path>...`, which the visitor's own Freenet opens
+  on their local peer. The handler ([freenet-core#5726](https://github.com/freenet/freenet-core/issues/5726))
+  ships in the first release after 0.2.139, so until peers have updated this button is styled and
+  ordered as a secondary option. The link has no `//`: in `freenet://<contract-id>` the
+  case-sensitive contract id would be the URL's host, which some desktops lowercase before the
+  handler sees it. (The handler accepts both forms.)
 - **Get Freenet** -- the [install guide](/quickstart/).
 
 An invalid or truncated fragment shows a "this link looks broken" message instead of guessing at
diff --git a/hugo-site/static/uninstall.sh b/hugo-site/static/uninstall.sh
index b523b6bf..434070c4 100755
--- a/hugo-site/static/uninstall.sh
+++ b/hugo-site/static/uninstall.sh
@@ -200,14 +200,87 @@ if [ "$OS" = "linux" ]; then
        (or: sudo systemctl disable --now freenet && sudo rm /etc/systemd/system/freenet.service)"
     fi
 elif [ "$OS" = "macos" ]; then
-    PLIST="${HOME}/Library/LaunchAgents/org.freenet.node.plist"
-    if [ -f "$PLIST" ]; then
-        info "Unloading launchd agent..."
-        launchctl unload "$PLIST" >/dev/null 2>&1 || true
-        rm -f "$PLIST"
-        info "Removed ${PLIST}"
-        removed_service="launchd"
+    # Legacy install.sh / `freenet service install` plist (pre-DMG):
+    LEGACY_PLIST="${HOME}/Library/LaunchAgents/org.freenet.node.plist"
+    # DMG-installed Freenet.app's Launch-at-Login plist:
+    DMG_PLIST="${HOME}/Library/LaunchAgents/org.freenet.Freenet.plist"
+    UID_VALUE="$(id -u 2>/dev/null || echo 501)"
+    for PLIST in "$LEGACY_PLIST" "$DMG_PLIST"; do
+        if [ -f "$PLIST" ]; then
+            info "Unloading launchd agent at $PLIST"
+            # Try modern bootout first (macOS 11+), fall back to legacy
+            # unload for older systems. Either may fail non-fatally if
+            # the agent was never actually loaded in this session.
+            launchctl bootout "gui/${UID_VALUE}" "$PLIST" >/dev/null 2>&1 || \
+                launchctl unload "$PLIST" >/dev/null 2>&1 || true
+            rm -f "$PLIST"
+            info "Removed ${PLIST}"
+            removed_service="launchd"
+        fi
+    done
+fi
+
+# --- Step 1b: remove the freenet:// link handler (Linux) -------------------
+#
+# `freenet service install` registers a desktop entry for freenet:// links
+# (crates/core/src/bin/commands/url_handler.rs). Remove it only if it carries
+# Freenet's marker line, and remove only Freenet's own association line from
+# mimeapps.list, leaving every other entry in that file untouched.
+
+removed_handler="0"
+if [ "$OS" = "linux" ]; then
+    # Relative XDG_* values are invalid per the spec and ignored, as the Rust
+    # side ignores them.
+    case "${XDG_DATA_HOME:-}" in /*) data_home="$XDG_DATA_HOME" ;; *) data_home="${HOME}/.local/share" ;; esac
+    case "${XDG_CONFIG_HOME:-}" in /*) config_home="$XDG_CONFIG_HOME" ;; *) config_home="${HOME}/.config" ;; esac
+    APPS_DIR="${data_home}/applications"
+    DESKTOP_ENTRY="${APPS_DIR}/freenet-url-handler.desktop"
+    handler_is_ours="1"
+    if [ -f "$DESKTOP_ENTRY" ]; then
+        if grep -qx 'X-Freenet-Managed=true' "$DESKTOP_ENTRY"; then
+            rm -f "$DESKTOP_ENTRY"
+            info "Removed ${DESKTOP_ENTRY}"
+            removed_handler="1"
+            if has_cmd update-desktop-database; then
+                update-desktop-database -q "$APPS_DIR" >/dev/null 2>&1 || true
+            fi
+        else
+            # Someone else's file at our path: it, and the association
+            # naming it, are not ours to remove.
+            handler_is_ours="0"
+        fi
     fi
+    # Surrounding whitespace and a CR are tolerated, as in the Rust copy.
+    HANDLER_LINE='^[[:space:]]*x-scheme-handler/freenet=freenet-url-handler\.desktop;\{0,1\}[[:space:]]*$'
+    # The current XDG location, and the one older xdg-utils wrote to.
+    for MIMEAPPS in "${config_home}/mimeapps.list" "${APPS_DIR}/mimeapps.list"; do
+        if [ "$handler_is_ours" = "1" ] && [ -f "$MIMEAPPS" ] && grep -q "$HANDLER_LINE" "$MIMEAPPS"; then
+            # Rewrite the real file (following a dotfile-manager symlink)
+            # through a temp file in ITS directory, then rename it into place:
+            # atomic, so a failure never leaves a truncated list, and the
+            # symlink itself is untouched.
+            target="$(readlink -f "$MIMEAPPS" 2>/dev/null || echo "$MIMEAPPS")"
+            if ! tmp_list="$(mktemp "${target}.freenet-XXXXXX" 2>/dev/null)"; then
+                warn "Could not create a temp file; left the freenet:// line in ${MIMEAPPS}"
+                continue
+            fi
+            # grep -v exits 1 when it prints nothing (the file held only our
+            # line); that is still success. Exit 2 is a read error: keep the
+            # user's file.
+            grep_status=0
+            grep -v "$HANDLER_LINE" "$MIMEAPPS" > "$tmp_list" || grep_status=$?
+            # Keep the file's mode (best effort: busybox chmod has no
+            # --reference, and then the list simply becomes 0600).
+            chmod --reference="$target" "$tmp_list" 2>/dev/null || true
+            if [ "$grep_status" -le 1 ] && mv -f "$tmp_list" "$target"; then
+                info "Removed the freenet:// association from ${MIMEAPPS}"
+                removed_handler="1"
+            else
+                warn "Could not rewrite ${MIMEAPPS}; left it unchanged"
+            fi
+            rm -f "$tmp_list"
+        fi
+    done
 fi
 
 # --- Step 2: remove binaries from every known install location ------------
@@ -294,7 +367,7 @@ fi
 
 # --- Summary --------------------------------------------------------------
 
-if [ -z "$removed_service" ] && [ "$removed_binaries" = "0" ]; then
+if [ -z "$removed_service" ] && [ "$removed_binaries" = "0" ] && [ "$removed_handler" = "0" ]; then
     info "Nothing to uninstall - Freenet does not appear to be installed for this user."
 else
     success "Freenet uninstalled."
diff --git a/hugo-site/tests/open-link-vectors.test.mjs b/hugo-site/tests/open-link-vectors.test.mjs
new file mode 100644
index 00000000..781f943b
--- /dev/null
+++ b/hugo-site/tests/open-link-vectors.test.mjs
@@ -0,0 +1,78 @@
+// Runs the /open page's own validation code against the share-link vectors
+// that freenet-core's freenet:// handler is also tested against
+// (crates/core/tests/data/share-link-vectors.json there; a copy here, kept
+// identical by the drift check in .github/workflows/open-link.yml). A rule
+// changed on one side only fails a test.
+//
+// Usage: node hugo-site/tests/open-link-vectors.test.mjs
+
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import vm from "node:vm";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const shortcode = readFileSync(
+  join(here, "../themes/freenet/layouts/shortcodes/open-link.html"),
+  "utf8",
+);
+const match = shortcode.match(/<script>([\s\S]*?)<\/script>/);
+if (!match) throw new Error("no <script> block in open-link.html");
+
+// Run the page script with a stub DOM, then drive processFragment() the way
+// the browser does: set location.hash, fire DOMContentLoaded, read the state
+// and the button hrefs it produced.
+function runPage(hash) {
+  const elements = {};
+  const el = (id) =>
+    (elements[id] ??= { id, style: {}, textContent: "", href: "#" });
+  const listeners = {};
+  const document = {
+    getElementById: el,
+    addEventListener: (ev, fn) => (listeners[ev] = fn),
+  };
+  const window = {
+    location: { hash },
+    addEventListener: () => {},
+  };
+  vm.runInNewContext(match[1], { document, window });
+  listeners.DOMContentLoaded();
+  const shown = ["open-link-missing", "open-link-invalid", "open-link-valid"].find(
+    (id) => el(id).style.display === "",
+  );
+  return { shown, el };
+}
+
+const { vectors } = JSON.parse(
+  readFileSync(join(here, "share-link-vectors.json"), "utf8"),
+);
+let failures = 0;
+for (const v of vectors) {
+  const { shown, el } = runPage("#" + v.raw);
+  const valid = shown === "open-link-valid";
+  let problem = null;
+  if (valid !== v.valid) {
+    problem = `expected valid=${v.valid}, page showed ${shown}`;
+  } else if (valid) {
+    const local = el("open-link-local").href;
+    const tryIt = el("open-link-try").href;
+    const scheme = el("open-link-scheme").href;
+    const want = "http://127.0.0.1:7509" + v.local_path;
+    const wantTry = "https://try.freenet.org" + v.local_path;
+    const rest = v.local_path.slice("/v1/contract/web/".length);
+    if (local !== want) problem = `local button ${local} != ${want}`;
+    else if (tryIt !== wantTry) problem = `try button ${tryIt} != ${wantTry}`;
+    else if (scheme !== "freenet:" + rest)
+      problem = `scheme button ${scheme} != freenet:${rest}`;
+  }
+  if (problem) {
+    failures++;
+    console.error(`FAIL ${JSON.stringify(v.raw.slice(0, 80))} (${v.note}): ${problem}`);
+  }
+}
+console.log(`${vectors.length} vectors, ${failures} failures`);
+if (vectors.length < 40) {
+  console.error("vector file looks truncated");
+  process.exit(1);
+}
+process.exit(failures ? 1 : 0);
diff --git a/hugo-site/tests/share-link-vectors.json b/hugo-site/tests/share-link-vectors.json
new file mode 100644
index 00000000..809e48db
--- /dev/null
+++ b/hugo-site/tests/share-link-vectors.json
@@ -0,0 +1,310 @@
+{
+  "description": "Share-link validation vectors. Shared contract between freenet.org/open (freenet/web, open-link.html) and the freenet:// handler (freenet-core, crates/core/src/bin/commands/open_link.rs). 'raw' is the part after 'https://freenet.org/open#' or after 'freenet://'. A valid vector's 'local_path' is appended to 'http://127.0.0.1:<port>' by the handler and to the local/try.freenet.org origins by the page. Change a rule on one side only together with this file and the other side.",
+  "vectors": [
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv",
+      "valid": true,
+      "local_path": "/v1/contract/web/raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv",
+      "note": "bare contract id"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/",
+      "valid": true,
+      "local_path": "/v1/contract/web/raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/",
+      "note": "trailing slash"
+    },
+    {
+      "raw": "1thX6LZfHDZZKUs92febYZhYRcXddmzfzF2NvTkPNE/",
+      "valid": true,
+      "local_path": "/v1/contract/web/1thX6LZfHDZZKUs92febYZhYRcXddmzfzF2NvTkPNE/",
+      "note": "id with a leading zero byte (leading '1')"
+    },
+    {
+      "raw": "JEKNVnkbo3jma5nREBBJCDoXFVeKkD56V3xKrvRmWxFG/",
+      "valid": true,
+      "local_path": "/v1/contract/web/JEKNVnkbo3jma5nREBBJCDoXFVeKkD56V3xKrvRmWxFG/",
+      "note": "id of all 0xff bytes (44 chars)"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/?invitation=abc123&x=y",
+      "valid": true,
+      "local_path": "/v1/contract/web/raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/?invitation=abc123&x=y",
+      "note": "query string passes through"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/#store=ABCDEFGHJKLMNPQR",
+      "valid": true,
+      "local_path": "/v1/contract/web/raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/#store=ABCDEFGHJKLMNPQR",
+      "note": "app fragment passes through"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/path/to/page.html?q=1#frag",
+      "valid": true,
+      "local_path": "/v1/contract/web/raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/path/to/page.html?q=1#frag",
+      "note": "path, query and fragment"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv?q=1",
+      "valid": true,
+      "local_path": "/v1/contract/web/raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv?q=1",
+      "note": "query without a path"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv#frag",
+      "valid": true,
+      "local_path": "/v1/contract/web/raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv#frag",
+      "note": "fragment without a path"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/a/b#x/../y",
+      "valid": true,
+      "local_path": "/v1/contract/web/raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/a/b#x/../y",
+      "note": "dot segments after '#' are not path segments"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/a?b=../c",
+      "valid": true,
+      "local_path": "/v1/contract/web/raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/a?b=../c",
+      "note": "dot segments after '?' are not path segments"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/%20space",
+      "valid": true,
+      "local_path": "/v1/contract/web/raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/%20space",
+      "note": "well-formed percent escape"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/a%2Fb",
+      "valid": true,
+      "local_path": "/v1/contract/web/raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/a%2Fb",
+      "note": "encoded slash is not a segment separator"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/{x}|^",
+      "valid": true,
+      "local_path": "/v1/contract/web/raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/{x}|^",
+      "note": "WHATWG leaves {}|^ unencoded in a fragment"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/...",
+      "valid": true,
+      "local_path": "/v1/contract/web/raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/...",
+      "note": "three dots is not a dot segment"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/.hidden",
+      "valid": true,
+      "local_path": "/v1/contract/web/raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/.hidden",
+      "note": "leading-dot name is not a dot segment"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/a..b/c.",
+      "valid": true,
+      "local_path": "/v1/contract/web/raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/a..b/c.",
+      "note": "dots inside a segment are fine"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/~user/-_.:@!$&'()*+,;=[]",
+      "valid": true,
+      "local_path": "/v1/contract/web/raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/~user/-_.:@!$&'()*+,;=[]",
+      "note": "every allowed punctuation character"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/%25",
+      "valid": true,
+      "local_path": "/v1/contract/web/raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/%25",
+      "note": "an escaped percent sign"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "valid": true,
+      "local_path": "/v1/contract/web/raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "note": "rest of exactly 2000 characters"
+    },
+    {
+      "raw": "",
+      "valid": false,
+      "note": "empty"
+    },
+    {
+      "raw": "/raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv",
+      "valid": false,
+      "note": "empty contract id"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RL0",
+      "valid": false,
+      "note": "'0' is not base58"
+    },
+    {
+      "raw": "laAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv",
+      "valid": false,
+      "note": "'l' is not base58"
+    },
+    {
+      "raw": "tVojvhToWjQ8Xvo4UPx2Xz9eRy7auyYMmZBjc2XfN/",
+      "valid": false,
+      "note": "decodes to 31 bytes"
+    },
+    {
+      "raw": "JJEfe6DcPM2ziB2vfUWDV6aHVerXRGkv3TcyvJUNGHZz/",
+      "valid": false,
+      "note": "decodes to 33 bytes"
+    },
+    {
+      "raw": "11111111111111111111111111111111/",
+      "valid": false,
+      "note": "all '1's (the /open page's decoder yields 33 bytes)"
+    },
+    {
+      "raw": "1111111111111111111111111111111/",
+      "valid": false,
+      "note": "31 '1's does not round-trip"
+    },
+    {
+      "raw": "1raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/",
+      "valid": false,
+      "note": "extra leading '1' does not decode to 32 bytes"
+    },
+    {
+      "raw": "22222222222222222222222222222222222222222222222222222222222222222",
+      "valid": false,
+      "note": "id longer than 64 characters"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv//evil.example/",
+      "valid": false,
+      "note": "rest starting with '//' could become an authority"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/../other",
+      "valid": false,
+      "note": "literal .. segment"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/a/..",
+      "valid": false,
+      "note": "trailing .. segment"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/./x",
+      "valid": false,
+      "note": "literal . segment"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/%2e%2e/JEKNVnkbo3jma5nREBBJCDoXFVeKkD56V3xKrvRmWxFG/",
+      "valid": false,
+      "note": "percent-encoded .. segment (would open a different contract)"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/%2E%2E/x",
+      "valid": false,
+      "note": "upper-case percent-encoded .. segment"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/.%2e/x",
+      "valid": false,
+      "note": "mixed .%2e segment"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/%2e./x",
+      "valid": false,
+      "note": "mixed %2e. segment"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/%2e/x",
+      "valid": false,
+      "note": "percent-encoded . segment"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/a/%2E%2e",
+      "valid": false,
+      "note": "trailing mixed-case encoded .. segment"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/a b",
+      "valid": false,
+      "note": "space"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/a\"b",
+      "valid": false,
+      "note": "double quote"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/a\\b",
+      "valid": false,
+      "note": "backslash"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/a`b",
+      "valid": false,
+      "note": "backtick"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/a<b>",
+      "valid": false,
+      "note": "angle brackets"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/a\nb",
+      "valid": false,
+      "note": "newline"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/a\tb",
+      "valid": false,
+      "note": "tab"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/\u00e9",
+      "valid": false,
+      "note": "non-ASCII"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/%0a",
+      "valid": false,
+      "note": "escape encoding a control character"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/%1F",
+      "valid": false,
+      "note": "escape encoding a control character (upper-case hex)"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/%7f",
+      "valid": false,
+      "note": "escape encoding DEL"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/%zz",
+      "valid": false,
+      "note": "malformed escape"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/%4",
+      "valid": false,
+      "note": "truncated escape"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/%",
+      "valid": false,
+      "note": "bare percent sign"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/\" --flag \"x",
+      "valid": false,
+      "note": "argument-injection attempt"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv --flag",
+      "valid": false,
+      "note": "argument-injection attempt without quotes"
+    },
+    {
+      "raw": "raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "valid": false,
+      "note": "rest of 2001 characters"
+    }
+  ]
+}
diff --git a/hugo-site/themes/freenet/layouts/shortcodes/open-link.html b/hugo-site/themes/freenet/layouts/shortcodes/open-link.html
index bdb6e6a9..335e7956 100644
--- a/hugo-site/themes/freenet/layouts/shortcodes/open-link.html
+++ b/hugo-site/themes/freenet/layouts/shortcodes/open-link.html
@@ -89,11 +89,11 @@ <h2>Open this link</h2>
 
     <div class="open-link-buttons">
       <!-- "Open on this computer" is the primary (highlighted, first) button
-           because installers don't register the freenet:// scheme yet
-           (freenet-core#5726 tracks that work) -- until they do, "Open in
-           Freenet" below does nothing for almost every visitor. Swap the
-           `is-primary` class and the button order back to lead with "Open in
-           Freenet" once installers register the scheme. -->
+           until the freenet: link handler (freenet-core#5726, merged in
+           freenet-core#5753) has shipped in a release and peers have
+           auto-updated to it -- until then, "Open in Freenet" below does
+           nothing for most visitors. Swap the `is-primary` class and the
+           button order back to lead with "Open in Freenet" after that. -->
       <div class="open-link-option">
         <a
           id="open-link-local"
@@ -116,8 +116,8 @@ <h2>Open this link</h2>
       <div class="open-link-option">
         <a id="open-link-scheme" class="button" href="#">Open in Freenet</a>
         <p class="open-link-note">
-          Only works once your Freenet install registers freenet:// links (coming soon). Try the
-          options above instead.
+          Needs a Freenet release newer than 0.2.139 (it registers freenet: links). If nothing
+          happens, try the options above instead.
         </p>
       </div>
       <div class="open-link-option">
@@ -229,7 +229,7 @@ <h2>Open this link</h2>
     // Everything after the id is opaque to this page: an app's own path,
     // query and nested fragment, copied verbatim from its local link. It is
     // never parsed apart here, only checked so it cannot make a browser (or
-    // a future native freenet:// handler) treat it as something other than
+    // the freenet:// handler, which applies the same rules) treat it as something other than
     // a sub-path of the fixed prefix each destination button hard-codes.
     // `{}|^` are added to the RFC 3986 unreserved/reserved set because they
     // are NOT in the WHATWG fragment percent-encode set, so a browser leaves
@@ -266,8 +266,8 @@ <h2>Open this link</h2>
 
       // Every '%' must start a well-formed two-hex-digit escape and must not
       // encode a control character. A browser leaves an already-encoded
-      // fragment alone, so this mostly guards a *future* native handler that
-      // may decode the path itself.
+      // fragment alone, so this mostly keeps the page's rules identical to the
+      // freenet:// handler's, which enforces the same check.
       for (var i = 0; i < rest.length; i++) {
         if (rest.charAt(i) === "%") {
           var hex = rest.substr(i + 1, 2);
@@ -335,7 +335,10 @@ <h2>Open this link</h2>
       // The scheme and host are always this fixed literal, never derived
       // from the fragment, so nothing in `rest` can turn these into a
       // link to somewhere else.
-      document.getElementById("open-link-scheme").href = "freenet://" + contractId + parts.rest;
+      // The authority-less form: in "freenet://<id>" the case-sensitive id is
+      // the URL host, which some desktops lowercase (Qt/KDE) before the
+      // handler sees it. The freenet-core handler accepts both forms.
+      document.getElementById("open-link-scheme").href = "freenet:" + contractId + parts.rest;
       document.getElementById("open-link-local").href =
         "http://127.0.0.1:7509/v1/contract/web/" + contractId + parts.rest;
       document.getElementById("open-link-try").href =