diff --git a/lexicons/wiki.lichen.membership.json b/lexicons/wiki.lichen.membership.json
index d23a416..194fbc2 100644
--- a/lexicons/wiki.lichen.membership.json
+++ b/lexicons/wiki.lichen.membership.json
@@ -12,6 +12,7 @@
 				"properties": {
 					"memberDid": {
 						"type": "string",
+						"format": "did",
 						"maxLength": 2048,
 						"description": "DID of the member being granted access."
 					},
diff --git a/src/firehose/handlers.ts b/src/firehose/handlers.ts
index f421dd6..709ec6a 100644
--- a/src/firehose/handlers.ts
+++ b/src/firehose/handlers.ts
@@ -1,7 +1,9 @@
+import { isDid } from "@atcute/lexicons/syntax";
 import { canEdit, getAccessLevel } from "../lib/access.ts";
 import { COLLECTIONS, normalizeRole } from "../lib/collections.ts";
 import { isValidLanguageTag } from "../lib/languages.ts";
 import { LIMITS } from "../lib/limits.ts";
+import { isSafeSlug, normalizeSlug } from "../lib/slug.ts";
 import { registerContributor } from "../registry/index.ts";
 import {
 	applyRevisionFromFirehose,
@@ -75,20 +77,17 @@ interface CommunityBookmarkRecord {
 	createdAt: string;
 }
 
-// Other PDSes don't enforce our lexicon maxima; oversized records are logged and skipped, never thrown.
+// Other PDSes enforce neither our lexicon maxima nor our field shapes; records
+// that violate either are logged and skipped, never thrown.
 function logDrop(atUri: string, reason: string): void {
 	console.warn(`[firehose] dropping record ${atUri}: ${reason}`);
 }
 
-function wikiExceedsLimits(atUri: string, r: WikiRecord): boolean {
+function wikiIsInvalid(atUri: string, r: WikiRecord): boolean {
 	if (r.name.length > LIMITS.wiki.name) {
 		logDrop(atUri, "wiki.name exceeds limit");
 		return true;
 	}
-	if (r.visibility.length > LIMITS.wiki.visibility) {
-		logDrop(atUri, "wiki.visibility exceeds limit");
-		return true;
-	}
 	if (r.language !== undefined && !isValidLanguageTag(r.language)) {
 		// Covers both over-length and malformed/HTML-bearing tags. A valid tag is
 		// already capped at LIMITS.wiki.language inside isValidLanguageTag.
@@ -105,9 +104,13 @@ function wikiExceedsLimits(atUri: string, r: WikiRecord): boolean {
 	return false;
 }
 
-function noteExceedsLimits(atUri: string, r: NoteRecord): boolean {
-	if (r.slug.length > LIMITS.note.slug) {
-		logDrop(atUri, "note.slug exceeds limit");
+function noteIsInvalid(atUri: string, r: NoteRecord): boolean {
+	// The slug is interpolated into URLs, so it has to be URL- and attribute-safe.
+	// isSafeSlug, not isValidSlug: another client may legitimately write a
+	// Japanese slug, and rejecting it would drop real content for a reason that
+	// has nothing to do with safety.
+	if (!isSafeSlug(normalizeSlug(r.slug))) {
+		logDrop(atUri, "note.slug is not a safe slug");
 		return true;
 	}
 	if (r.title.length > LIMITS.note.title) {
@@ -117,7 +120,7 @@ function noteExceedsLimits(atUri: string, r: NoteRecord): boolean {
 	return false;
 }
 
-function revisionExceedsLimits(atUri: string, r: RevisionRecord): boolean {
+function revisionIsInvalid(atUri: string, r: RevisionRecord): boolean {
 	if (r.diff.length > LIMITS.revision.diff) {
 		logDrop(atUri, "revision.diff exceeds limit");
 		return true;
@@ -137,9 +140,11 @@ function revisionExceedsLimits(atUri: string, r: RevisionRecord): boolean {
 	return false;
 }
 
-function membershipExceedsLimits(atUri: string, r: MembershipRecord): boolean {
-	if (r.memberDid.length > LIMITS.membership.memberDid) {
-		logDrop(atUri, "membership.memberDid exceeds limit");
+function membershipIsInvalid(atUri: string, r: MembershipRecord): boolean {
+	// memberDid reaches profileUrl() and the member directory's hrefs; only a real
+	// DID belongs there. isDid also bounds the length.
+	if (!isDid(r.memberDid)) {
+		logDrop(atUri, "membership.memberDid is not a DID");
 		return true;
 	}
 	if (r.role.length > LIMITS.membership.role) {
@@ -225,19 +230,19 @@ export function handleCommitEvent(evt: FirehoseCommit): void {
 
 	switch (evt.collection) {
 		case COLLECTIONS.wiki:
-			if (isWikiRecord(r) && !wikiExceedsLimits(atUri, r))
+			if (isWikiRecord(r) && !wikiIsInvalid(atUri, r))
 				handleWiki(evt.did, evt.rkey, atUri, r);
 			break;
 		case COLLECTIONS.note:
-			if (isNoteRecord(r) && !noteExceedsLimits(atUri, r))
+			if (isNoteRecord(r) && !noteIsInvalid(atUri, r))
 				handleNote(evt.did, atUri, r);
 			break;
 		case COLLECTIONS.noteRevision:
-			if (isRevisionRecord(r) && !revisionExceedsLimits(atUri, r))
+			if (isRevisionRecord(r) && !revisionIsInvalid(atUri, r))
 				handleRevision(evt.did, atUri, r);
 			break;
 		case COLLECTIONS.membership:
-			if (isMembershipRecord(r) && !membershipExceedsLimits(atUri, r))
+			if (isMembershipRecord(r) && !membershipIsInvalid(atUri, r))
 				handleMembership(evt.did, atUri, r);
 			break;
 		case COLLECTIONS.memberRequest:
@@ -307,10 +312,12 @@ function handleNote(did: string, atUri: string, record: NoteRecord): void {
 	if (!wiki) return;
 	if (!canDidEditWiki(wiki, did)) return;
 
+	// Store the NFC form: the same slug written in NFD is a different SQLite key,
+	// so an un-normalized write becomes a note that exists but never resolves.
 	upsertNote(
 		wiki.at_uri,
 		wiki.slug,
-		record.slug,
+		normalizeSlug(record.slug),
 		record.title,
 		did,
 		atUri,
diff --git a/src/lib/backfill/crawler.ts b/src/lib/backfill/crawler.ts
index f46e23d..772a473 100644
--- a/src/lib/backfill/crawler.ts
+++ b/src/lib/backfill/crawler.ts
@@ -1,5 +1,5 @@
 import { type Client, ClientResponseError, ok } from "@atcute/client";
-import type { Did, Nsid } from "@atcute/lexicons/syntax";
+import { type Did, isRecordKey, type Nsid } from "@atcute/lexicons/syntax";
 import {
 	type FirehoseCommit,
 	handleCommitEvent,
@@ -100,8 +100,12 @@ async function listPage(
 	}
 }
 
-function rkeyOf(uri: string): string {
-	return uri.split("/").pop() ?? "";
+// The uri is whatever the remote PDS returned, so the rkey needs the same
+// validation jetstream applies to live commits — otherwise backfill is a second,
+// unchecked door into handleCommitEvent.
+function rkeyOf(uri: string): string | null {
+	const rkey = uri.split("/").pop() ?? "";
+	return isRecordKey(rkey) ? rkey : null;
 }
 
 // Feed one listRecords row into the firehose handler and classify the *outcome*
@@ -124,6 +128,12 @@ function dispatchRow(
 		return;
 	}
 
+	const rkey = rkeyOf(row.uri);
+	if (rkey === null) {
+		countSkip(report, did, collection, "invalid-rkey");
+		return;
+	}
+
 	if (collection === COLLECTIONS.noteRevision) {
 		const noteRef = (row.value as { noteRef?: unknown }).noteRef;
 		const noteExists = options.noteExists ?? defaultNoteExists;
@@ -138,7 +148,7 @@ function dispatchRow(
 	dispatch({
 		did,
 		collection,
-		rkey: rkeyOf(row.uri),
+		rkey,
 		operation: "create",
 		record: row.value,
 	});
@@ -199,19 +209,19 @@ interface Stage {
 	reverse: boolean;
 }
 
-// Cross-collection ordering matters: revisions reference notes, notes/memberships
-// reference wikis. Crawl every DID through each stage before advancing.
+// Cross-collection ordering matters, for two reasons. References: revisions point
+// at notes, notes/memberships point at wikis. Authorization: handleNote and
+// handleRevision both call canDidEditWiki, which reads memberships — so
+// memberships must land before notes or every non-owner's content is dropped.
+// Crawl every DID through each stage before advancing.
 const STAGES: Stage[] = [
 	{ collections: [COLLECTIONS.wiki], reverse: false },
+	{ collections: [COLLECTIONS.membership], reverse: false },
 	{ collections: [COLLECTIONS.note], reverse: false },
 	// reverse: true → ascending TID (oldest first) so the diff chain applies in order.
 	{ collections: [COLLECTIONS.noteRevision], reverse: true },
 	{
-		collections: [
-			COLLECTIONS.membership,
-			COLLECTIONS.memberRequest,
-			COLLECTIONS.bookmark,
-		],
+		collections: [COLLECTIONS.memberRequest, COLLECTIONS.bookmark],
 		reverse: false,
 	},
 ];
diff --git a/src/lib/headings.ts b/src/lib/headings.ts
index ee692e6..069307a 100644
--- a/src/lib/headings.ts
+++ b/src/lib/headings.ts
@@ -1,4 +1,4 @@
-import { slugify } from "./slug.ts";
+import { toSlug } from "./slug.ts";
 
 interface Heading {
 	text: string;
@@ -8,7 +8,7 @@ interface Heading {
 
 // Disambiguates repeated slugs with -1, -2, …; `seen` counts uses per base slug.
 export function makeAnchor(text: string, seen: Map<string, number>): string {
-	const base = slugify(text);
+	const base = toSlug(text);
 	if (!base) return base;
 	const n = seen.get(base) ?? 0;
 	seen.set(base, n + 1);
diff --git a/src/lib/import-export/zip-parse.ts b/src/lib/import-export/zip-parse.ts
index 3397dbf..985343e 100644
--- a/src/lib/import-export/zip-parse.ts
+++ b/src/lib/import-export/zip-parse.ts
@@ -4,7 +4,7 @@ import { ImportError } from "../errors.ts";
 import { IMAGE_EXTENSIONS, MIME_BY_EXT } from "../image-types.ts";
 import { LIMITS } from "../limits.ts";
 import { normalizeLF } from "../normalize.ts";
-import { isValidSlug, slugify } from "../slug.ts";
+import { isSafeSlug, toSlug } from "../slug.ts";
 import { extractLocalImageRefs } from "./markdown-transform.ts";
 import type { ImportedImage, ImportedNote, ImportResult } from "./types.ts";
 
@@ -110,10 +110,10 @@ export function parseImportZip(buffer: ArrayBuffer): ImportResult {
 		if (isHomeName(name) && !usedSlugs.has("home")) {
 			slug = "home";
 		} else {
-			slug = slugify(title);
+			slug = toSlug(title);
 		}
 
-		if (!slug || !isValidSlug(slug)) {
+		if (!slug || !isSafeSlug(slug)) {
 			warnings.push(`Skipped "${name}": could not generate a valid slug.`);
 			continue;
 		}
diff --git a/src/lib/limits.ts b/src/lib/limits.ts
index 4000e20..52b9cf2 100644
--- a/src/lib/limits.ts
+++ b/src/lib/limits.ts
@@ -1,4 +1,6 @@
-// Mirrors lexicon maxLength/maxSize (lexicons/wiki.lichen.*.json) — keep in sync.
+// Mirrors lexicon maxLength/maxSize (lexicons/wiki.lichen.*.json); the mirror is
+// enforced by tests/lib/limits-lexicon.test.ts. Some entries are only referenced
+// there, because ingest applies a stricter predicate than the lexicon declares.
 export const LIMITS = {
 	wiki: {
 		name: 256,
diff --git a/src/lib/markdown/wikilink-plugin.ts b/src/lib/markdown/wikilink-plugin.ts
index 7fdf647..371853b 100644
--- a/src/lib/markdown/wikilink-plugin.ts
+++ b/src/lib/markdown/wikilink-plugin.ts
@@ -1,7 +1,7 @@
 import type MarkdownIt from "markdown-it";
 import type StateInline from "markdown-it/lib/rules_inline/state_inline.mjs";
 import { escapeHtml } from "../html.ts";
-import { slugify } from "../slug.ts";
+import { toSlug } from "../slug.ts";
 import { noteUrl, wikiUrl } from "../urls.ts";
 
 export interface WikilinkEnv {
@@ -114,9 +114,11 @@ export function wikilinkPlugin(mdi: MarkdownIt): void {
 			);
 			if (!target) return false;
 
-			const anchor = target.section ? `#${slugify(target.section)}` : "";
-			const noteSlug = target.noteSlug ? slugify(target.noteSlug) : "";
-			const wikiSlug = target.wikiSlug ? slugify(target.wikiSlug) : "";
+			// Must match what note-validation mints, or [[日本語のノート]] resolves to
+			// a slug no note has.
+			const anchor = target.section ? `#${toSlug(target.section)}` : "";
+			const noteSlug = target.noteSlug ? toSlug(target.noteSlug) : "";
+			const wikiSlug = target.wikiSlug ? toSlug(target.wikiSlug) : "";
 			let href: string;
 			if (!wikiSlug && !noteSlug && target.section) {
 				// [[#section]] — anchor only
diff --git a/src/lib/note-validation.ts b/src/lib/note-validation.ts
index 0e399e8..366e41c 100644
--- a/src/lib/note-validation.ts
+++ b/src/lib/note-validation.ts
@@ -2,7 +2,7 @@ import { getNoteBySlug } from "../server/db/queries/index.ts";
 import type { Messages } from "./i18n/index.ts";
 import { fmt } from "./i18n/index.ts";
 import { LIMITS } from "./limits.ts";
-import { isValidSlug, slugify } from "./slug.ts";
+import { isSafeSlug, toSlug } from "./slug.ts";
 
 export function validateNewNote(
 	wikiAtUri: string,
@@ -15,8 +15,8 @@ export function validateNewNote(
 			error: fmt(msg.error.titleTooLong, { max: String(LIMITS.note.title) }),
 		};
 	}
-	const noteSlug = slugify(title);
-	if (!isValidSlug(noteSlug))
+	const noteSlug = toSlug(title);
+	if (!isSafeSlug(noteSlug))
 		return { error: fmt(msg.error.invalidSlug, { title }) };
 	const existing = getNoteBySlug(wikiAtUri, noteSlug);
 	if (existing) return { error: fmt(msg.error.slugExists, { slug: noteSlug }) };
diff --git a/src/lib/response.ts b/src/lib/response.ts
index bf5a4a1..8dff926 100644
--- a/src/lib/response.ts
+++ b/src/lib/response.ts
@@ -3,6 +3,16 @@ interface HtmlResponseOptions {
 	edgeCacheSeconds?: number;
 }
 
+/**
+ * RFC 6266 attachment header. Note slugs may be Japanese, and a raw non-ASCII
+ * byte in a header makes Response throw — so send an ASCII-only `filename` for
+ * old clients plus the real name in `filename*`.
+ */
+export function attachmentDisposition(filename: string): string {
+	const ascii = filename.replace(/[^\x20-\x7E]/g, "_").replace(/["\\]/g, "_");
+	return `attachment; filename="${ascii}"; filename*=UTF-8''${encodeURIComponent(filename)}`;
+}
+
 // Strict CSP: no inline scripts; inline styles allowed for the layout's per-theme <style> block.
 const CSP_DIRECTIVES = [
 	"default-src 'self'",
diff --git a/src/lib/slug.ts b/src/lib/slug.ts
index 220c83d..fdde9af 100644
--- a/src/lib/slug.ts
+++ b/src/lib/slug.ts
@@ -1,7 +1,70 @@
+import slugifyAscii from "@sindresorhus/slugify";
+
 export { default as slugify } from "@sindresorhus/slugify";
 
 const SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const SLUG_MAX = 128;
+
+// Letters, numbers and combining marks in any script, plus "-" and "_". Excludes
+// everything that gives a slug meaning in a URL or an HTML attribute: "/", "%",
+// quotes, angle brackets, whitespace and control characters.
+const UNSAFE_CHARS = /[^\p{L}\p{N}\p{M}_-]/u;
 
+/** The canonical form we mint: lowercase ASCII words joined by hyphens. */
 export function isValidSlug(slug: string): boolean {
-	return SLUG_RE.test(slug) && slug.length >= 1 && slug.length <= 128;
+	return SLUG_RE.test(slug) && slug.length >= 1 && slug.length <= SLUG_MAX;
+}
+
+/**
+ * What we are willing to serve. Wider than isValidSlug — a slug written by
+ * another client may legitimately be Japanese — but still URL- and
+ * attribute-safe. Every isValidSlug slug satisfies this, so widening to it
+ * cannot invalidate a slug that already exists.
+ */
+export function isSafeSlug(slug: string): boolean {
+	return (
+		slug.length >= 1 && slug.length <= SLUG_MAX && !UNSAFE_CHARS.test(slug)
+	);
+}
+
+/**
+ * NFC only — no case folding. "が" as one code point and as か + combining
+ * dakuten look identical but are different SQLite primary keys, so both the
+ * stored slug and any slug we look up have to agree on a form. Case is left
+ * alone because the record on the PDS is canonical: we must not serve a slug
+ * that differs from the one its author wrote.
+ */
+export function normalizeSlug(slug: string): string {
+	return slug.normalize("NFC");
+}
+
+// slugify silently drops characters it cannot transliterate, so a mixed title
+// like "ノート#1" would come back as "1". Checking per character tells us whether
+// transliteration would lose script rather than just punctuation.
+function transliteratesCleanly(text: string): boolean {
+	for (const ch of text) {
+		if (!/[\p{L}\p{N}]/u.test(ch)) continue;
+		if (!slugifyAscii(ch)) return false;
+	}
+	return true;
+}
+
+/**
+ * Title → slug. Uses ASCII transliteration whenever it preserves the text, so
+ * behaviour is unchanged for Latin, Cyrillic, Greek and Arabic; falls back to a
+ * Unicode slug for scripts slugify would drop. ASCII is lowercased; other
+ * scripts are left alone (most have no case, and Unicode lowercasing is
+ * locale-dependent).
+ */
+export function toSlug(text: string): string {
+	const normalized = normalizeSlug(text);
+	if (transliteratesCleanly(normalized)) return slugifyAscii(normalized);
+
+	return normalized
+		.replace(/[A-Z]/g, (c) => c.toLowerCase())
+		.replace(/\s+/gu, "-")
+		.replace(new RegExp(UNSAFE_CHARS.source, "gu"), "")
+		.replace(/-{2,}/g, "-")
+		.replace(/^-+|-+$/g, "")
+		.slice(0, SLUG_MAX);
 }
diff --git a/src/lib/urls.ts b/src/lib/urls.ts
index e262a15..500ed57 100644
--- a/src/lib/urls.ts
+++ b/src/lib/urls.ts
@@ -4,8 +4,21 @@ export function resolvePublicUrl(request: Request): string {
 	return getAtprotoEnv()?.publicUrl ?? new URL(request.url).origin;
 }
 
+// Callers interpolate these results straight into href="…", and slugs/handles can
+// come from remote records, so anything outside the RFC 3986 unreserved set is
+// percent-encoded here rather than at ~25 call sites. ":" is kept: it is a legal
+// path character and /@did:plc:… must stay readable.
+function seg(segment: string): string {
+	return segment.replace(/[^A-Za-z0-9\-._~:]+/gu, (run) =>
+		encodeURIComponent(run).replace(
+			/[!'()*]/g,
+			(c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`,
+		),
+	);
+}
+
 export function wikiUrl(handle: string, wikiSlug: string): string {
-	return `/@${handle}/${wikiSlug}`;
+	return `/@${seg(handle)}/${seg(wikiSlug)}`;
 }
 
 export function noteUrl(
@@ -13,7 +26,7 @@ export function noteUrl(
 	wikiSlug: string,
 	noteSlug: string,
 ): string {
-	return `/@${handle}/${wikiSlug}/${noteSlug}`;
+	return `/@${seg(handle)}/${seg(wikiSlug)}/${seg(noteSlug)}`;
 }
 
 export function editNoteUrl(
@@ -21,31 +34,31 @@ export function editNoteUrl(
 	wikiSlug: string,
 	noteSlug: string,
 ): string {
-	return `/@${handle}/${wikiSlug}/${noteSlug}/edit`;
+	return `${noteUrl(handle, wikiSlug, noteSlug)}/edit`;
 }
 
 export function newNoteUrl(handle: string, wikiSlug: string): string {
-	return `/@${handle}/${wikiSlug}/new`;
+	return `${wikiUrl(handle, wikiSlug)}/new`;
 }
 
 export function settingsUrl(handle: string, wikiSlug: string): string {
-	return `/@${handle}/${wikiSlug}/-/settings`;
+	return `${wikiUrl(handle, wikiSlug)}/-/settings`;
 }
 
 export function membersUrl(handle: string, wikiSlug: string): string {
-	return `/@${handle}/${wikiSlug}/-/members`;
+	return `${wikiUrl(handle, wikiSlug)}/-/members`;
 }
 
 export function sidebarEditUrl(handle: string, wikiSlug: string): string {
-	return `/@${handle}/${wikiSlug}/-/sidebar/edit`;
+	return `${wikiUrl(handle, wikiSlug)}/-/sidebar/edit`;
 }
 
 export function profileUrl(didOrHandle: string): string {
-	return `/@${didOrHandle}`;
+	return `/@${seg(didOrHandle)}`;
 }
 
 export function exportUrl(handle: string, wikiSlug: string): string {
-	return `/@${handle}/${wikiSlug}/-/export`;
+	return `${wikiUrl(handle, wikiSlug)}/-/export`;
 }
 
 export function exportNoteUrl(
@@ -53,7 +66,7 @@ export function exportNoteUrl(
 	wikiSlug: string,
 	noteSlug: string,
 ): string {
-	return `/@${handle}/${wikiSlug}/${noteSlug}/-/export`;
+	return `${noteUrl(handle, wikiSlug, noteSlug)}/-/export`;
 }
 
 export function historyNoteUrl(
@@ -61,7 +74,7 @@ export function historyNoteUrl(
 	wikiSlug: string,
 	noteSlug: string,
 ): string {
-	return `/@${handle}/${wikiSlug}/${noteSlug}/-/history`;
+	return `${noteUrl(handle, wikiSlug, noteSlug)}/-/history`;
 }
 
 /**
@@ -73,7 +86,7 @@ export function collabWsPath(
 	wikiSlug: string,
 	noteSlug: string,
 ): string {
-	return `/collab/${handle}/${wikiSlug}/${noteSlug}`;
+	return `/collab/${seg(handle)}/${seg(wikiSlug)}/${seg(noteSlug)}`;
 }
 
 export function redirect(url: string): Response {
diff --git a/src/server/routes/note.ts b/src/server/routes/note.ts
index 959360b..9a54770 100644
--- a/src/server/routes/note.ts
+++ b/src/server/routes/note.ts
@@ -11,7 +11,7 @@ import {
 	editNoteAction,
 	parseNoteFormFields,
 } from "../../lib/orchestrators/note.ts";
-import { htmlResponse } from "../../lib/response.ts";
+import { attachmentDisposition, htmlResponse } from "../../lib/response.ts";
 import {
 	collabWsPath,
 	editNoteUrl,
@@ -147,7 +147,7 @@ export const noteRoutes = new Elysia()
 			return new Response(content, {
 				headers: {
 					"Content-Type": "text/markdown; charset=utf-8",
-					"Content-Disposition": `attachment; filename="${noteSlug}.md"`,
+					"Content-Disposition": attachmentDisposition(`${noteSlug}.md`),
 				},
 			});
 		},
diff --git a/src/server/routes/params.ts b/src/server/routes/params.ts
index 9559cef..cada7bf 100644
--- a/src/server/routes/params.ts
+++ b/src/server/routes/params.ts
@@ -1,4 +1,10 @@
 // Elysia can't infer `handle` from `/@:handle/…` (the `@` confuses it); these casts recover the runtime values.
+//
+// They also NFC-normalize the slugs. Stored slugs are NFC (see normalizeSlug), but
+// a URL can carry either form — macOS pastes NFD in particular — and SQLite
+// compares bytes, so an un-normalized param 404s a note that exists.
+
+import { normalizeSlug } from "../../lib/slug.ts";
 
 export interface HandleWikiParams {
 	handle: string;
@@ -14,19 +20,26 @@ export interface HandleWikiMemberParams extends HandleWikiParams {
 }
 
 export function hp(params: { wikiSlug: string }): HandleWikiParams {
-	return params as unknown as HandleWikiParams;
+	const p = params as unknown as HandleWikiParams;
+	return { ...p, wikiSlug: normalizeSlug(p.wikiSlug) };
 }
 
 export function hwnp(params: {
 	wikiSlug: string;
 	noteSlug: string;
 }): HandleWikiNoteParams {
-	return params as unknown as HandleWikiNoteParams;
+	const p = params as unknown as HandleWikiNoteParams;
+	return {
+		...p,
+		wikiSlug: normalizeSlug(p.wikiSlug),
+		noteSlug: normalizeSlug(p.noteSlug),
+	};
 }
 
 export function hwmp(params: {
 	wikiSlug: string;
 	memberDid: string;
 }): HandleWikiMemberParams {
-	return params as unknown as HandleWikiMemberParams;
+	const p = params as unknown as HandleWikiMemberParams;
+	return { ...p, wikiSlug: normalizeSlug(p.wikiSlug) };
 }
diff --git a/src/server/routes/wiki.ts b/src/server/routes/wiki.ts
index aa50545..7d3bae6 100644
--- a/src/server/routes/wiki.ts
+++ b/src/server/routes/wiki.ts
@@ -24,7 +24,7 @@ import {
 	setWikiThemeAction,
 } from "../../lib/orchestrators/wiki.ts";
 import { resolveProfiles } from "../../lib/profile.ts";
-import { htmlResponse } from "../../lib/response.ts";
+import { attachmentDisposition, htmlResponse } from "../../lib/response.ts";
 import {
 	redirect,
 	resolvePublicUrl,
@@ -348,7 +348,7 @@ export const wikiRoutes = new Elysia()
 		return new Response(zipBytes, {
 			headers: {
 				"Content-Type": "application/zip",
-				"Content-Disposition": `attachment; filename="${ctx.wiki.slug}.zip"`,
+				"Content-Disposition": attachmentDisposition(`${ctx.wiki.slug}.zip`),
 			},
 		});
 	})
diff --git a/tests/firehose/hostile-records.test.ts b/tests/firehose/hostile-records.test.ts
new file mode 100644
index 0000000..09e69e2
--- /dev/null
+++ b/tests/firehose/hostile-records.test.ts
@@ -0,0 +1,107 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { handleCommitEvent } from "../../src/firehose/handlers.ts";
+import { COLLECTIONS } from "../../src/lib/collections.ts";
+import {
+	getNoteBySlug,
+	listMembers,
+	upsertWiki,
+} from "../../src/server/db/queries/index.ts";
+import { cleanupWikiAndDependents } from "../helpers/cleanup.ts";
+
+// Records our own orchestrators could never produce. Every field a remote PDS
+// controls is fair game; the app path validates shape, so the firehose must too.
+const OWNER = "did:plc:hostileowner00000000000";
+const SLUG = "hostile-wiki";
+const WIKI_URI = `at://${OWNER}/${COLLECTIONS.wiki}/${SLUG}`;
+const ISO = "2026-01-01T00:00:00.000Z";
+
+function noteCommit(rkey: string, slug: string) {
+	return {
+		did: OWNER,
+		collection: COLLECTIONS.note,
+		rkey,
+		operation: "create" as const,
+		record: { slug, title: "Hostile", wikiRef: WIKI_URI, createdAt: ISO },
+	};
+}
+
+function membershipCommit(rkey: string, memberDid: string) {
+	return {
+		did: OWNER,
+		collection: COLLECTIONS.membership,
+		rkey,
+		operation: "create" as const,
+		record: {
+			memberDid,
+			wikiRef: WIKI_URI,
+			role: "contributor",
+			createdAt: ISO,
+		},
+	};
+}
+
+beforeAll(() => {
+	upsertWiki(SLUG, OWNER, "Hostile Wiki", "public", WIKI_URI, ISO);
+});
+
+afterAll(() => {
+	cleanupWikiAndDependents(SLUG);
+});
+
+describe("note.slug shape", () => {
+	test("drops a slug carrying an attribute break", () => {
+		const slug = `x" onmouseover="alert(1)`;
+		handleCommitEvent(noteCommit("3hostileaaaaa", slug));
+		expect(getNoteBySlug(WIKI_URI, slug)).toBeNull();
+	});
+
+	test.each([
+		["path separator", "a/b"],
+		["whitespace", "a b"],
+		["percent sign", "a%2fb"],
+		["angle brackets", "<script>"],
+		["over 128 chars", "a".repeat(129)],
+		["empty", ""],
+	])("drops %s", (_label, slug) => {
+		handleCommitEvent(noteCommit("3hostilebbbbb", slug));
+		expect(getNoteBySlug(WIKI_URI, slug)).toBeNull();
+	});
+
+	// The predicate is about URL and attribute safety, not about matching the
+	// canonical form we mint. Dropping these would discard real content written by
+	// another client for a reason unrelated to safety.
+	test.each([
+		["ascii", "perfectly-fine-1", "3hostilec1111"],
+		["japanese", "日本語のノート", "3hostilec2222"],
+		["korean", "한국어", "3hostilec3333"],
+		["mixed script", "日本語wiki2024", "3hostilec4444"],
+		["uppercase ascii", "NotLower", "3hostilec5555"],
+		["leading dash", "-lead", "3hostilec6666"],
+	])("ingests %s", (_label, slug, rkey) => {
+		handleCommitEvent(noteCommit(rkey, slug));
+		expect(getNoteBySlug(WIKI_URI, slug)).not.toBeNull();
+	});
+
+	test("stores the NFC form so an NFD lookup still resolves", () => {
+		const nfd = "が".normalize("NFD");
+		handleCommitEvent(noteCommit("3hostilefffff", nfd));
+		expect(getNoteBySlug(WIKI_URI, nfd)).toBeNull();
+		expect(getNoteBySlug(WIKI_URI, "が".normalize("NFC"))).not.toBeNull();
+	});
+});
+
+describe("membership.memberDid shape", () => {
+	test("drops a memberDid that is not a DID", () => {
+		handleCommitEvent(
+			membershipCommit("3hostileddddd", `did:plc:x" onmouseover="y`),
+		);
+		const dids = listMembers(WIKI_URI).map((m) => m.did);
+		expect(dids.some((d) => d.includes('"'))).toBe(false);
+	});
+
+	test("still ingests a real DID", () => {
+		const member = "did:plc:hostilemember0000000000";
+		handleCommitEvent(membershipCommit("3hostileeeeee", member));
+		expect(listMembers(WIKI_URI).map((m) => m.did)).toContain(member);
+	});
+});
diff --git a/tests/integration/backfill.test.ts b/tests/integration/backfill.test.ts
index cefe32b..53a53d4 100644
--- a/tests/integration/backfill.test.ts
+++ b/tests/integration/backfill.test.ts
@@ -260,3 +260,89 @@ describe("backfill parent-missing handling", () => {
 		expect(counts?.reasons["parent-missing"]).toBe(1);
 	});
 });
+
+// The stage order has to satisfy authorization, not just references: handleNote
+// calls canDidEditWiki, which reads memberships. Owners get admin without a
+// membership row, so an owner-only fixture passes even when the order is wrong —
+// this one is deliberately multi-author.
+describe("backfill preserves contributor content", () => {
+	const OWNER = "did:plc:backfillowner0000000000000";
+	const CONTRIB = "did:plc:backfillcontrib000000000000";
+	const CO_SLUG = "collab-wiki";
+	const CO_WIKI_URI = `at://${OWNER}/${COLLECTIONS.wiki}/${CO_SLUG}`;
+	const CONTRIB_NOTE_URI = `at://${CONTRIB}/${COLLECTIONS.note}/contribnote`;
+
+	afterAll(() => {
+		cleanupWikiAndDependents(CO_SLUG);
+	});
+
+	// listRecords shim keyed by (repo, collection) — the contributor's note lives
+	// in their own repo, the membership granting them access lives in the owner's.
+	function twoRepoFetch(): typeof fetch {
+		const byRepo: Record<string, Record<string, Row[]>> = {
+			[OWNER]: {
+				[COLLECTIONS.wiki]: [
+					{
+						uri: CO_WIKI_URI,
+						cid: "c",
+						value: {
+							$type: COLLECTIONS.wiki,
+							name: "Collab Wiki",
+							visibility: "public",
+							createdAt: ISO,
+						},
+					},
+				],
+				[COLLECTIONS.membership]: [
+					{
+						uri: `at://${OWNER}/${COLLECTIONS.membership}/grant`,
+						cid: "c",
+						value: {
+							$type: COLLECTIONS.membership,
+							memberDid: CONTRIB,
+							wikiRef: CO_WIKI_URI,
+							role: "contributor",
+							createdAt: ISO,
+						},
+					},
+				],
+			},
+			[CONTRIB]: {
+				[COLLECTIONS.note]: [
+					{
+						uri: CONTRIB_NOTE_URI,
+						cid: "c",
+						value: {
+							$type: COLLECTIONS.note,
+							slug: "contrib-note",
+							title: "Contributor Note",
+							wikiRef: CO_WIKI_URI,
+							createdAt: ISO,
+						},
+					},
+				],
+			},
+		};
+		const impl = async (url: string | URL): Promise<Response> => {
+			const params = new URL(String(url)).searchParams;
+			const repo = params.get("repo") ?? "";
+			const collection = params.get("collection") ?? "";
+			return jsonResponse({ records: byRepo[repo]?.[collection] ?? [] });
+		};
+		return impl as unknown as typeof fetch;
+	}
+
+	test("a non-owner's note survives a cold-start crawl", async () => {
+		await runBackfill([OWNER, CONTRIB], {
+			throttleMs: 0,
+			sleep: async () => {},
+			resolveClient: async () => ({
+				client: makePdsClient("http://pds.fake", twoRepoFetch()),
+				endpoint: "http://pds.fake",
+			}),
+		});
+
+		expect(getWikiByAtUri(CO_WIKI_URI)).not.toBeNull();
+		expect(getNoteByAtUri(CONTRIB_NOTE_URI)).not.toBeNull();
+	});
+});
diff --git a/tests/integration/unicode-slugs.test.ts b/tests/integration/unicode-slugs.test.ts
new file mode 100644
index 0000000..cee5ab4
--- /dev/null
+++ b/tests/integration/unicode-slugs.test.ts
@@ -0,0 +1,125 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { handleCommitEvent } from "../../src/firehose/handlers.ts";
+import { COLLECTIONS } from "../../src/lib/collections.ts";
+import { renderMarkdown } from "../../src/lib/markdown.ts";
+import { toSlug } from "../../src/lib/slug.ts";
+import {
+	createNote,
+	getNoteBySlug,
+	upsertWiki,
+} from "../../src/server/db/queries/index.ts";
+import { cleanupWikiAndDependents } from "../helpers/cleanup.ts";
+import { fetch } from "./http-helpers.ts";
+
+// Wiki slugs are rkeys, so they stay ASCII; note slugs live in the record body
+// and may be Japanese. This covers the whole path for the latter.
+const DID = "did:plc:unicodewiki000000000000";
+const WIKI_SLUG = "nihongo-wiki";
+const WIKI_URI = `at://${DID}/${COLLECTIONS.wiki}/${WIKI_SLUG}`;
+const ISO = "2026-01-01T00:00:00.000Z";
+const TITLE = "日本語のノート";
+const SLUG = "日本語のノート";
+
+beforeAll(() => {
+	upsertWiki(WIKI_SLUG, DID, "日本語ウィキ", "public", WIKI_URI, ISO);
+});
+
+afterAll(() => {
+	cleanupWikiAndDependents(WIKI_SLUG);
+});
+
+describe("japanese note slugs", () => {
+	test("a japanese title mints a japanese slug", () => {
+		expect(toSlug(TITLE)).toBe(SLUG);
+	});
+
+	test("the note is reachable over HTTP at its percent-encoded slug", async () => {
+		createNote(
+			`at://${DID}/${COLLECTIONS.note}/3jpaaaaaaaaaa`,
+			`at://${DID}/${COLLECTIONS.noteRevision}/3jpbbbbbbbbbb`,
+			WIKI_URI,
+			WIKI_SLUG,
+			SLUG,
+			TITLE,
+			DID,
+			"# こんにちは\n\n本文",
+		);
+
+		const res = await fetch(
+			"GET",
+			`/@${DID}/${WIKI_SLUG}/${encodeURIComponent(SLUG)}`,
+		);
+		expect(res.status).toBe(200);
+		expect(await res.text()).toContain("こんにちは");
+	});
+
+	// Dakuten decomposes; plain kana and kanji do not, so the slug used here has to
+	// be one whose NFD form actually differs, or the test proves nothing.
+	test("an NFD request path resolves to the NFC-stored note", async () => {
+		const nfcSlug = "がぞう";
+		expect(nfcSlug.normalize("NFD")).not.toBe(nfcSlug);
+
+		createNote(
+			`at://${DID}/${COLLECTIONS.note}/3jpddddddddddd`,
+			`at://${DID}/${COLLECTIONS.noteRevision}/3jpeeeeeeeeeee`,
+			WIKI_URI,
+			WIKI_SLUG,
+			nfcSlug,
+			"画像",
+			DID,
+			"# 画像",
+		);
+
+		const res = await fetch(
+			"GET",
+			`/@${DID}/${WIKI_SLUG}/${encodeURIComponent(nfcSlug.normalize("NFD"))}`,
+		);
+		expect(res.status).toBe(200);
+	});
+
+	test("a wikilink to the japanese title resolves to the note", () => {
+		const { html } = renderMarkdown(`[[${TITLE}]]`, WIKI_SLUG, DID);
+		// Rendered href is percent-encoded; the note must be the target.
+		expect(html).toContain(encodeURIComponent(SLUG));
+		expect(html).not.toContain('href=""');
+	});
+
+	test("a japanese heading gets a usable anchor", () => {
+		const { html } = renderMarkdown("## 見出し");
+		expect(html).toContain("見出し");
+		expect(html).not.toContain('id=""');
+	});
+
+	// A raw non-ASCII byte in a header makes Response throw, so this 500s rather
+	// than degrading if the disposition is built by interpolation.
+	test("exporting a japanese-slugged note does not throw", async () => {
+		const res = await fetch(
+			"GET",
+			`/@${DID}/${WIKI_SLUG}/${encodeURIComponent(SLUG)}/-/export`,
+		);
+		expect(res.status).toBe(200);
+		const disposition = res.headers.get("content-disposition") ?? "";
+		expect(disposition).toContain("filename*=UTF-8''");
+		expect(disposition).toContain(encodeURIComponent(SLUG));
+	});
+
+	test("the firehose ingests a japanese slug from another client", () => {
+		const otherSlug = "参考文献";
+		handleCommitEvent({
+			did: DID,
+			collection: COLLECTIONS.note,
+			rkey: "3jpccccccccccc",
+			operation: "create",
+			record: {
+				slug: otherSlug,
+				title: "参考文献",
+				wikiRef: WIKI_URI,
+				createdAt: ISO,
+			},
+		});
+
+		// A bare note record carries no revision, so this asserts ingestion, not
+		// rendering — the note page needs a current_note row to return 200.
+		expect(getNoteBySlug(WIKI_URI, otherSlug)).not.toBeNull();
+	});
+});
diff --git a/tests/lib/limits-lexicon.test.ts b/tests/lib/limits-lexicon.test.ts
new file mode 100644
index 0000000..adec74f
--- /dev/null
+++ b/tests/lib/limits-lexicon.test.ts
@@ -0,0 +1,65 @@
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { LIMITS } from "../../src/lib/limits.ts";
+
+// LIMITS mirrors the published lexicons. Ingest enforces stricter predicates than
+// some of these (note.slug -> isValidSlug, membership.memberDid -> isDid), which
+// leaves those entries with no other reference in the codebase — so this test is
+// what keeps them alive and what catches drift in either direction.
+const LEXICON_DIR = join(import.meta.dir, "../../lexicons");
+
+function lexiconProperty(
+	nsid: string,
+	path: string[],
+): Record<string, unknown> {
+	const raw = readFileSync(join(LEXICON_DIR, `${nsid}.json`), "utf8");
+	const doc = JSON.parse(raw) as Record<string, unknown>;
+	let node = (
+		(doc["defs"] as Record<string, Record<string, unknown>>)["main"] as Record<
+			string,
+			Record<string, unknown>
+		>
+	)["record"] as Record<string, unknown>;
+
+	for (const key of path) {
+		const props = node["properties"] as
+			| Record<string, Record<string, unknown>>
+			| undefined;
+		const next = props?.[key] ?? (node["items"] as Record<string, unknown>);
+		if (!next)
+			throw new Error(`no such lexicon path: ${nsid} ${path.join(".")}`);
+		node = next as Record<string, unknown>;
+	}
+	return node;
+}
+
+const MAX_LENGTH_CASES: [string, string[], number][] = [
+	["wiki.lichen.wiki", ["name"], LIMITS.wiki.name],
+	["wiki.lichen.wiki", ["visibility"], LIMITS.wiki.visibility],
+	["wiki.lichen.wiki", ["language"], LIMITS.wiki.language],
+	["wiki.lichen.wiki", ["description"], LIMITS.wiki.description],
+	["wiki.lichen.note", ["slug"], LIMITS.note.slug],
+	["wiki.lichen.note", ["title"], LIMITS.note.title],
+	["wiki.lichen.noteRevision", ["diff"], LIMITS.revision.diff],
+	["wiki.lichen.noteRevision", ["diffFormat"], LIMITS.revision.diffFormat],
+	["wiki.lichen.noteRevision", ["message"], LIMITS.revision.message],
+	["wiki.lichen.membership", ["memberDid"], LIMITS.membership.memberDid],
+	["wiki.lichen.membership", ["role"], LIMITS.membership.role],
+];
+
+describe("LIMITS mirrors the published lexicons", () => {
+	test.each(
+		MAX_LENGTH_CASES,
+	)("%s.%s maxLength matches LIMITS", (nsid, path, expected) => {
+		expect(lexiconProperty(nsid, path)["maxLength"]).toBe(expected);
+	});
+
+	test("revision blob maxSize matches the image ceiling", () => {
+		const blob = lexiconProperty("wiki.lichen.noteRevision", [
+			"blobs",
+			"items",
+		]);
+		expect(blob["maxSize"]).toBe(LIMITS.image.bytes);
+	});
+});
diff --git a/tests/lib/urls.test.ts b/tests/lib/urls.test.ts
index 88a305b..f84ef19 100644
--- a/tests/lib/urls.test.ts
+++ b/tests/lib/urls.test.ts
@@ -29,3 +29,33 @@ describe("URL helpers", () => {
 		expect(res.headers.get("Location")).toBe("/@alice/cooking");
 	});
 });
+
+// Results are interpolated straight into href="…", and slugs can originate from
+// remote records, so the helpers must not be able to emit attribute-breaking text.
+describe("URL segment encoding", () => {
+	test("percent-encodes characters that would break out of an attribute", () => {
+		const url = noteUrl("alice", "cooking", `x" onmouseover="alert(1)`);
+		expect(url).not.toContain('"');
+		expect(url).toBe("/@alice/cooking/x%22%20onmouseover%3D%22alert%281%29");
+	});
+
+	test("encodes quotes, angle brackets and slashes in a slug", () => {
+		expect(wikiUrl("alice", "a/b")).toBe("/@alice/a%2Fb");
+		expect(wikiUrl("alice", "<script>")).toBe("/@alice/%3Cscript%3E");
+		expect(wikiUrl("alice", "it's")).toBe("/@alice/it%27s");
+	});
+
+	test("leaves DIDs and handles readable", () => {
+		expect(wikiUrl("did:plc:abc123", "cooking")).toBe(
+			"/@did:plc:abc123/cooking",
+		);
+		expect(wikiUrl("alice.bsky.social", "cooking")).toBe(
+			"/@alice.bsky.social/cooking",
+		);
+	});
+
+	test("keeps multi-byte characters intact rather than splitting surrogates", () => {
+		expect(() => wikiUrl("alice", "🌱")).not.toThrow();
+		expect(wikiUrl("alice", "🌱")).toBe("/@alice/%F0%9F%8C%B1");
+	});
+});