diff --git a/src/lib/markdown.ts b/src/lib/markdown.ts
--- a/src/lib/markdown.ts
+++ b/src/lib/markdown.ts
@@ -1,5 +1,6 @@
 import MarkdownIt from "markdown-it";
 import type StateInline from "markdown-it/lib/rules_inline/state_inline.mjs";
+import { escapeHtml } from "./html.ts";
 import { type VizPluginEnv, vizPlugin } from "./viz/plugin.ts";
 
 export interface RenderResult {
@@ -42,7 +43,7 @@ const wikiSlug = env.wikiSlug;
 			const href = wikiSlug ? `/wiki/${wikiSlug}/${slug.trim()}` : slug.trim();
 
 			const token = state.push("html_inline", "", 0);
-			token.content = `<a href="${href}" class="wikilink">${label.trim()}</a>`;
+			token.content = `<a href="${escapeHtml(href)}" class="wikilink">${escapeHtml(label.trim())}</a>`;
 		}
 
 		state.pos = closeIdx + 2;
diff --git a/tests/atproto/routes.test.ts b/tests/atproto/routes.test.ts
--- a/tests/atproto/routes.test.ts
+++ b/tests/atproto/routes.test.ts
@@ -16,3 +16,40 @@ expect(setCookie).toContain("did=");
 		expect(setCookie).toContain("Max-Age=0");
 	});
 });
+
+describe("client-metadata.json", () => {
+	test("returns 503 when OAuth is not configured", async () => {
+		const res = await app.handle(
+			new Request("http://localhost/client-metadata.json"),
+		);
+		// In test env, OAuth is not configured
+		expect(res.status).toBe(503);
+	});
+});
+
+describe("jwks.json", () => {
+	test("returns 503 when OAuth is not configured", async () => {
+		const res = await app.handle(new Request("http://localhost/jwks.json"));
+		expect(res.status).toBe(503);
+	});
+});
+
+describe("login", () => {
+	test("GET /login returns HTML", async () => {
+		const res = await app.handle(new Request("http://localhost/login"));
+		expect(res.status).toBe(200);
+		expect(res.headers.get("Content-Type")).toContain("text/html");
+	});
+
+	test("POST /login without OAuth configured returns 503", async () => {
+		const formData = new FormData();
+		formData.set("handle", "alice.test");
+		const res = await app.handle(
+			new Request("http://localhost/login", {
+				method: "POST",
+				body: formData,
+			}),
+		);
+		expect(res.status).toBe(503);
+	});
+});
diff --git a/tests/lib/access-context.test.ts b/tests/lib/access-context.test.ts
new file mode 100644
--- /dev/null
+++ b/tests/lib/access-context.test.ts
@@ -0,0 +1,121 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { DEV_DID } from "../../src/atproto/session.ts";
+import {
+	resolveWikiContext,
+	resolveWikiContextSoft,
+} from "../../src/lib/access.ts";
+import { ForbiddenError, NotFoundError } from "../../src/lib/errors.ts";
+import {
+	upsertMembership,
+	upsertWiki,
+} from "../../src/server/db/queries/index.ts";
+import { cleanupWikiAndDependents } from "../helpers/cleanup.ts";
+
+const PUBLIC_SLUG = "ctx-public-wiki";
+const PRIVATE_SLUG = "ctx-private-wiki";
+const OTHER_DID = "did:plc:ctx-other";
+
+beforeAll(() => {
+	upsertWiki(
+		PUBLIC_SLUG,
+		DEV_DID,
+		"Ctx Public",
+		"public",
+		`at://${DEV_DID}/wiki.lichen.wiki/${PUBLIC_SLUG}`,
+		new Date().toISOString(),
+	);
+	upsertWiki(
+		PRIVATE_SLUG,
+		OTHER_DID,
+		"Ctx Private",
+		"private",
+		`at://${OTHER_DID}/wiki.lichen.wiki/${PRIVATE_SLUG}`,
+		new Date().toISOString(),
+	);
+});
+
+afterAll(() => {
+	cleanupWikiAndDependents(PUBLIC_SLUG);
+	cleanupWikiAndDependents(PRIVATE_SLUG);
+});
+
+function fakeRequest(): Request {
+	return new Request("http://localhost/test");
+}
+
+describe("resolveWikiContext", () => {
+	test("throws NotFoundError for nonexistent wiki", async () => {
+		expect(
+			resolveWikiContext(fakeRequest(), "nonexistent-slug-xyz", "read"),
+		).rejects.toBeInstanceOf(NotFoundError);
+	});
+
+	test("returns context for public wiki with read access", async () => {
+		const ctx = await resolveWikiContext(fakeRequest(), PUBLIC_SLUG, "read");
+		expect(ctx.wiki.slug).toBe(PUBLIC_SLUG);
+		expect(ctx.access).toBe("admin"); // DEV_DID is owner
+	});
+
+	test("throws ForbiddenError for private wiki when user has no membership", async () => {
+		// DEV_DID is not the owner and has no membership on private wiki
+		expect(
+			resolveWikiContext(fakeRequest(), PRIVATE_SLUG, "read"),
+		).rejects.toBeInstanceOf(ForbiddenError);
+	});
+
+	test("throws ForbiddenError when requiring edit on read-only access", async () => {
+		// Add DEV_DID as viewer on private wiki
+		upsertMembership(
+			PRIVATE_SLUG,
+			DEV_DID,
+			"viewer",
+			`at://${DEV_DID}/wiki.lichen.membership/ctx-viewer`,
+			new Date().toISOString(),
+		);
+
+		expect(
+			resolveWikiContext(fakeRequest(), PRIVATE_SLUG, "edit"),
+		).rejects.toBeInstanceOf(ForbiddenError);
+
+		// Cleanup viewer membership
+		const { getDb } = await import("../../src/server/db/index.ts");
+		getDb().run("DELETE FROM memberships WHERE wiki_slug = ? AND did = ?", [
+			PRIVATE_SLUG,
+			DEV_DID,
+		]);
+	});
+
+	test("throws ForbiddenError when requiring admin on edit access", async () => {
+		upsertMembership(
+			PRIVATE_SLUG,
+			DEV_DID,
+			"contributor",
+			`at://${DEV_DID}/wiki.lichen.membership/ctx-contrib`,
+			new Date().toISOString(),
+		);
+
+		expect(
+			resolveWikiContext(fakeRequest(), PRIVATE_SLUG, "admin"),
+		).rejects.toBeInstanceOf(ForbiddenError);
+
+		const { getDb } = await import("../../src/server/db/index.ts");
+		getDb().run("DELETE FROM memberships WHERE wiki_slug = ? AND did = ?", [
+			PRIVATE_SLUG,
+			DEV_DID,
+		]);
+	});
+});
+
+describe("resolveWikiContextSoft", () => {
+	test("throws NotFoundError for nonexistent wiki", async () => {
+		expect(
+			resolveWikiContextSoft(fakeRequest(), "nonexistent-slug-xyz"),
+		).rejects.toBeInstanceOf(NotFoundError);
+	});
+
+	test("returns context with none access for private wiki (does not throw)", async () => {
+		const ctx = await resolveWikiContextSoft(fakeRequest(), PRIVATE_SLUG);
+		expect(ctx.wiki.slug).toBe(PRIVATE_SLUG);
+		expect(ctx.access).toBe("none");
+	});
+});
diff --git a/tests/lib/blob.test.ts b/tests/lib/blob.test.ts
--- a/tests/lib/blob.test.ts
+++ b/tests/lib/blob.test.ts
@@ -59,6 +59,22 @@ const content = "![img](/blob/did:plc:abc/bafyrei123ABCdef456)";
 		const refs = extractBlobRefs(content);
 		expect(refs).toEqual([{ did: "did:plc:abc", cid: "bafyrei123ABCdef456" }]);
 	});
+
+	test("ignores malformed blob URLs (missing did prefix)", () => {
+		const content = "![img](/blob/notadid/bafyreiabc)";
+		expect(extractBlobRefs(content)).toEqual([]);
+	});
+
+	test("ignores blob URL without CID", () => {
+		const content = "![img](/blob/did:plc:abc/)";
+		expect(extractBlobRefs(content)).toEqual([]);
+	});
+
+	test("does not extract from non-image markdown links", () => {
+		// Regular links (not images) should not match
+		const content = "[click here](/blob/did:plc:abc/bafyreiabc)";
+		expect(extractBlobRefs(content)).toEqual([]);
+	});
 });
 
 describe("parseBlobMetadata", () => {
diff --git a/tests/lib/constants.test.ts b/tests/lib/constants.test.ts
new file mode 100644
--- /dev/null
+++ b/tests/lib/constants.test.ts
@@ -0,0 +1,22 @@
+import { describe, expect, test } from "bun:test";
+import { normalizeRole } from "../../src/lib/constants.ts";
+
+describe("normalizeRole", () => {
+	test("passes through valid roles", () => {
+		expect(normalizeRole("admin")).toBe("admin");
+		expect(normalizeRole("viewer")).toBe("viewer");
+	});
+
+	test("defaults contributor for valid contributor input", () => {
+		expect(normalizeRole("contributor")).toBe("contributor");
+	});
+
+	test("defaults to contributor for invalid or missing input", () => {
+		expect(normalizeRole(null)).toBe("contributor");
+		expect(normalizeRole(undefined)).toBe("contributor");
+		expect(normalizeRole("")).toBe("contributor");
+		expect(normalizeRole("superadmin")).toBe("contributor");
+		expect(normalizeRole("ADMIN")).toBe("contributor");
+		expect(normalizeRole("<script>")).toBe("contributor");
+	});
+});
diff --git a/tests/lib/errors.test.ts b/tests/lib/errors.test.ts
deleted file mode 100644
--- a/tests/lib/errors.test.ts
+++ /dev/null
@@ -1,57 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import {
-	AppError,
-	ForbiddenError,
-	formatError,
-	NotFoundError,
-	PdsWriteError,
-	ValidationError,
-} from "../../src/lib/errors.ts";
-
-describe("formatError", () => {
-	test("extracts message from Error", () => {
-		expect(formatError(new Error("boom"))).toBe("boom");
-	});
-
-	test("converts non-Error to string", () => {
-		expect(formatError("oops")).toBe("oops");
-		expect(formatError(42)).toBe("42");
-	});
-});
-
-describe("error classes", () => {
-	test("NotFoundError defaults to 404", () => {
-		const err = new NotFoundError();
-		expect(err).toBeInstanceOf(AppError);
-		expect(err).toBeInstanceOf(Error);
-		expect(err.statusCode).toBe(404);
-		expect(err.message).toBe("Not found");
-	});
-
-	test("NotFoundError accepts custom message", () => {
-		const err = new NotFoundError("Wiki not found");
-		expect(err.statusCode).toBe(404);
-		expect(err.message).toBe("Wiki not found");
-	});
-
-	test("ForbiddenError defaults to 403", () => {
-		const err = new ForbiddenError();
-		expect(err).toBeInstanceOf(AppError);
-		expect(err.statusCode).toBe(403);
-		expect(err.message).toBe("Forbidden");
-	});
-
-	test("PdsWriteError is 502", () => {
-		const err = new PdsWriteError("PDS unreachable");
-		expect(err).toBeInstanceOf(AppError);
-		expect(err.statusCode).toBe(502);
-		expect(err.message).toBe("PDS unreachable");
-	});
-
-	test("ValidationError is 400", () => {
-		const err = new ValidationError("Title required");
-		expect(err).toBeInstanceOf(AppError);
-		expect(err.statusCode).toBe(400);
-		expect(err.message).toBe("Title required");
-	});
-});
diff --git a/tests/lib/image-validation.test.ts b/tests/lib/image-validation.test.ts
new file mode 100644
--- /dev/null
+++ b/tests/lib/image-validation.test.ts
@@ -0,0 +1,32 @@
+import { describe, expect, test } from "bun:test";
+import {
+	ALLOWED_MIME_TYPES,
+	ImageValidationError,
+	MAX_IMAGE_SIZE,
+} from "../../src/lib/image.ts";
+
+// These tests validate the image constraints WITHOUT calling processImage
+// (which requires sharp). They verify the exported constants and error class.
+
+describe("image validation constants", () => {
+	test("only allows jpg, png, gif, webp", () => {
+		expect(ALLOWED_MIME_TYPES).toContain("image/jpeg");
+		expect(ALLOWED_MIME_TYPES).toContain("image/png");
+		expect(ALLOWED_MIME_TYPES).toContain("image/gif");
+		expect(ALLOWED_MIME_TYPES).toContain("image/webp");
+		expect(ALLOWED_MIME_TYPES).toHaveLength(4);
+		// Dangerous types must not be present
+		expect(ALLOWED_MIME_TYPES).not.toContain("image/svg+xml");
+		expect(ALLOWED_MIME_TYPES).not.toContain("application/pdf");
+	});
+
+	test("max image size is 10MB", () => {
+		expect(MAX_IMAGE_SIZE).toBe(10 * 1024 * 1024);
+	});
+
+	test("ImageValidationError is an Error", () => {
+		const err = new ImageValidationError("test");
+		expect(err).toBeInstanceOf(Error);
+		expect(err.name).toBe("ImageValidationError");
+	});
+});
diff --git a/tests/lib/markdown.test.ts b/tests/lib/markdown.test.ts
--- a/tests/lib/markdown.test.ts
+++ b/tests/lib/markdown.test.ts
@@ -2,10 +2,15 @@ import { describe, expect, test } from "bun:test";
 import { extractWikilinks, renderMarkdown } from "../../src/lib/markdown.ts";
 
 describe("renderMarkdown", () => {
-	test("does not render raw HTML", () => {
+	test("does not render raw HTML (XSS prevention)", () => {
 		const { html } = renderMarkdown('<script>alert("xss")</script>');
 		expect(html).not.toContain("<script>");
 	});
+
+	test("renders empty string without error", () => {
+		const { html } = renderMarkdown("");
+		expect(html).toBe("");
+	});
 });
 
 describe("wikilinks", () => {
@@ -14,7 +19,6 @@
 	test("renders [[slug]] as a link with wiki prefix", () => {
 		const { html } = renderMarkdown("see [[my-page]]", WIKI);
 		expect(html).toContain('href="/wiki/test-wiki/my-page"');
-		expect(html).toContain("my-page");
 		expect(html).toContain('class="wikilink"');
 	});
 
@@ -30,7 +34,7 @@ expect(html).toContain('href="/wiki/test-wiki/page-a"');
 		expect(html).toContain('href="/wiki/test-wiki/page-b"');
 	});
 
-	test("handles wikilink with pipe in label", () => {
+	test("handles pipe in label (preserves extra pipes)", () => {
 		const { html } = renderMarkdown("[[slug|label with | pipe]]", WIKI);
 		expect(html).toContain('href="/wiki/test-wiki/slug"');
 		expect(html).toContain("label with | pipe");
@@ -48,68 +52,61 @@ expect(html).toContain('href="/wiki/test-wiki/my-page"');
 		expect(html).toContain("My Page");
 	});
 
-	test("works alongside normal markdown", () => {
-		const { html } = renderMarkdown("**bold** and [[link]]", WIKI);
-		expect(html).toContain("<strong>bold</strong>");
-		expect(html).toContain('class="wikilink"');
-	});
-
 	test("falls back to bare slug when no wikiSlug provided", () => {
 		const { html } = renderMarkdown("see [[my-page]]");
 		expect(html).toContain('href="my-page"');
 	});
+
+	test("XSS in wikilink slug: quote breakout in href is escaped", () => {
+		const { html } = renderMarkdown('[[" onclick="alert(1)]]', WIKI);
+		// Quotes are escaped so the attacker can't break out of the href attribute
+		expect(html).not.toContain(' onclick="alert');
+		expect(html).toContain("&quot;");
+		expect(html).toContain("wikilink");
+	});
+
+	test("XSS in wikilink label: HTML tags are escaped", () => {
+		const { html } = renderMarkdown(
+			"[[safe-slug|<img src=x onerror=alert(1)>]]",
+			WIKI,
+		);
+		expect(html).toContain('href="/wiki/test-wiki/safe-slug"');
+		expect(html).not.toContain("<img");
+		expect(html).toContain("&lt;img");
+	});
 });
 
 describe("extractWikilinks", () => {
 	test("returns empty array for content with no wikilinks", () => {
 		expect(extractWikilinks("no links here")).toEqual([]);
-	});
-
-	test("returns empty array for empty string", () => {
 		expect(extractWikilinks("")).toEqual([]);
 	});
 
-	test("extracts a single [[slug]]", () => {
+	test("extracts slugs from [[slug]] and [[slug|label]]", () => {
 		expect(extractWikilinks("see [[my-page]]")).toEqual(["my-page"]);
-	});
-
-	test("extracts slug from [[slug|label]]", () => {
 		expect(extractWikilinks("see [[my-page|My Page]]")).toEqual(["my-page"]);
 	});
 
-	test("extracts multiple wikilinks", () => {
-		const result = extractWikilinks("[[page-a]] and [[page-b]]");
-		expect(result).toEqual(["page-a", "page-b"]);
-	});
-
-	test("deduplicates repeated slugs", () => {
-		const result = extractWikilinks("[[foo]] then [[foo]] again");
-		expect(result).toEqual(["foo"]);
+	test("extracts multiple wikilinks and deduplicates", () => {
+		expect(extractWikilinks("[[page-a]] and [[page-b]]")).toEqual([
+			"page-a",
+			"page-b",
+		]);
+		expect(extractWikilinks("[[foo]] then [[foo]] again")).toEqual(["foo"]);
 	});
 
 	test("trims whitespace from slugs", () => {
 		expect(extractWikilinks("[[ spaced ]]")).toEqual(["spaced"]);
-	});
-
-	test("trims whitespace from piped slugs", () => {
 		expect(extractWikilinks("[[ spaced | Label ]]")).toEqual(["spaced"]);
 	});
 
-	test("ignores unclosed brackets", () => {
+	test("ignores unclosed brackets and empty slugs", () => {
 		expect(extractWikilinks("[[unclosed")).toEqual([]);
+		expect(extractWikilinks("[[]]")).toEqual([]);
 	});
 
 	test("handles wikilinks across multiple lines", () => {
 		const result = extractWikilinks("line1 [[a]]\nline2 [[b]]");
 		expect(result).toEqual(["a", "b"]);
-	});
-
-	test("handles pipe in label (takes first part as slug)", () => {
-		const result = extractWikilinks("[[slug|label with | pipe]]");
-		expect(result).toEqual(["slug"]);
-	});
-
-	test("skips empty slug between brackets", () => {
-		expect(extractWikilinks("[[]]")).toEqual([]);
 	});
 });
diff --git a/tests/lib/note-validation.test.ts b/tests/lib/note-validation.test.ts
new file mode 100644
--- /dev/null
+++ b/tests/lib/note-validation.test.ts
@@ -0,0 +1,63 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { DEV_DID } from "../../src/atproto/session.ts";
+import { t } from "../../src/lib/i18n/index.ts";
+import { validateNewNote } from "../../src/lib/note-validation.ts";
+import { createNote, upsertWiki } from "../../src/server/db/queries/index.ts";
+import { cleanupWikiAndDependents } from "../helpers/cleanup.ts";
+
+const msg = t("en");
+const WIKI_SLUG = "nv-test-wiki";
+
+beforeAll(() => {
+	upsertWiki(
+		WIKI_SLUG,
+		DEV_DID,
+		"NV Test",
+		"public",
+		`at://${DEV_DID}/wiki.lichen.wiki/${WIKI_SLUG}`,
+		new Date().toISOString(),
+	);
+	createNote(
+		`at://${DEV_DID}/wiki.lichen.note/nv-existing`,
+		`at://${DEV_DID}/wiki.lichen.noteRevision/nv-existing-rev`,
+		WIKI_SLUG,
+		"existing-note",
+		"Existing Note",
+		DEV_DID,
+		"content",
+	);
+});
+
+afterAll(() => {
+	cleanupWikiAndDependents(WIKI_SLUG);
+});
+
+describe("validateNewNote", () => {
+	test("returns slug for valid title", () => {
+		const result = validateNewNote(WIKI_SLUG, "My New Page", msg);
+		expect(result).toEqual({ noteSlug: "my-new-page" });
+	});
+
+	test("rejects empty title", () => {
+		const result = validateNewNote(WIKI_SLUG, "", msg);
+		expect("error" in result).toBe(true);
+	});
+
+	test("rejects whitespace-only title", () => {
+		const result = validateNewNote(WIKI_SLUG, "   ", msg);
+		expect("error" in result).toBe(true);
+	});
+
+	test("rejects title that produces existing slug", () => {
+		const result = validateNewNote(WIKI_SLUG, "Existing Note", msg);
+		expect("error" in result).toBe(true);
+		if ("error" in result) {
+			expect(result.error).toContain("existing-note");
+		}
+	});
+
+	test("rejects title that produces invalid slug (special chars only)", () => {
+		const result = validateNewNote(WIKI_SLUG, "!!!???", msg);
+		expect("error" in result).toBe(true);
+	});
+});
diff --git a/tests/lib/slug.test.ts b/tests/lib/slug.test.ts
--- a/tests/lib/slug.test.ts
+++ b/tests/lib/slug.test.ts
@@ -2,44 +2,24 @@ import { describe, expect, test } from "bun:test";
 import { isValidSlug } from "../../src/lib/slug.ts";
 
 describe("isValidSlug", () => {
-	test("accepts simple slugs", () => {
+	test("accepts valid slugs", () => {
 		expect(isValidSlug("hello")).toBe(true);
 		expect(isValidSlug("hello-world")).toBe(true);
+		expect(isValidSlug("page1")).toBe(true);
 		expect(isValidSlug("a")).toBe(true);
 	});
 
-	test("accepts slugs with numbers", () => {
-		expect(isValidSlug("page1")).toBe(true);
-		expect(isValidSlug("123")).toBe(true);
-		expect(isValidSlug("v2-release")).toBe(true);
-	});
-
-	test("rejects uppercase", () => {
+	test("rejects invalid slugs", () => {
+		expect(isValidSlug("")).toBe(false);
 		expect(isValidSlug("Hello")).toBe(false);
-	});
-
-	test("rejects spaces", () => {
 		expect(isValidSlug("hello world")).toBe(false);
-	});
-
-	test("rejects underscores", () => {
 		expect(isValidSlug("hello_world")).toBe(false);
-	});
-
-	test("rejects leading or trailing hyphens", () => {
 		expect(isValidSlug("-hello")).toBe(false);
 		expect(isValidSlug("hello-")).toBe(false);
-	});
-
-	test("rejects consecutive hyphens", () => {
 		expect(isValidSlug("hello--world")).toBe(false);
 	});
 
-	test("rejects empty string", () => {
-		expect(isValidSlug("")).toBe(false);
-	});
-
-	test("rejects slugs over 128 characters", () => {
+	test("enforces 128 character max length", () => {
 		expect(isValidSlug("a".repeat(128))).toBe(true);
 		expect(isValidSlug("a".repeat(129))).toBe(false);
 	});
diff --git a/tests/lib/urls.test.ts b/tests/lib/urls.test.ts
--- a/tests/lib/urls.test.ts
+++ b/tests/lib/urls.test.ts
@@ -9,23 +9,11 @@ wikiUrl,
 } from "../../src/lib/urls.ts";
 
 describe("URL helpers", () => {
-	test("wikiUrl", () => {
+	test("builds correct paths for all route types", () => {
 		expect(wikiUrl("cooking")).toBe("/wiki/cooking");
-	});
-
-	test("noteUrl", () => {
 		expect(noteUrl("cooking", "pasta")).toBe("/wiki/cooking/pasta");
-	});
-
-	test("editNoteUrl", () => {
 		expect(editNoteUrl("cooking", "pasta")).toBe("/wiki/cooking/pasta/edit");
-	});
-
-	test("newNoteUrl", () => {
 		expect(newNoteUrl("cooking")).toBe("/wiki/cooking/new");
-	});
-
-	test("membersUrl", () => {
 		expect(membersUrl("cooking")).toBe("/wiki/cooking/-/members");
 	});
 
diff --git a/tests/server/db/queries/cursor.test.ts b/tests/server/db/queries/cursor.test.ts
new file mode 100644
--- /dev/null
+++ b/tests/server/db/queries/cursor.test.ts
@@ -0,0 +1,30 @@
+import { afterAll, describe, expect, test } from "bun:test";
+import { getDb } from "../../../../src/server/db/index.ts";
+import {
+	getCursor,
+	setCursor,
+} from "../../../../src/server/db/queries/cursor.ts";
+
+afterAll(() => {
+	// Clean up cursor row
+	getDb().run("DELETE FROM firehose_cursor WHERE id = 1");
+});
+
+describe("firehose cursor", () => {
+	test("getCursor returns null when no cursor is set", () => {
+		getDb().run("DELETE FROM firehose_cursor WHERE id = 1");
+		expect(getCursor()).toBeNull();
+	});
+
+	test("setCursor stores and getCursor retrieves the value", () => {
+		setCursor(12345);
+		expect(getCursor()).toBe(12345);
+	});
+
+	test("setCursor upserts (overwrites previous value)", () => {
+		setCursor(100);
+		expect(getCursor()).toBe(100);
+		setCursor(200);
+		expect(getCursor()).toBe(200);
+	});
+});
diff --git a/tests/server/routes/routes.test.ts b/tests/server/routes/routes.test.ts
new file mode 100644
--- /dev/null
+++ b/tests/server/routes/routes.test.ts
@@ -0,0 +1,295 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { Elysia } from "elysia";
+import { DEV_DID } from "../../../src/atproto/session.ts";
+import { AppError } from "../../../src/lib/errors.ts";
+import {
+	createNote,
+	upsertMembership,
+	upsertWiki,
+} from "../../../src/server/db/queries/index.ts";
+import { blobRoutes } from "../../../src/server/routes/blob.ts";
+import { homeRoute } from "../../../src/server/routes/home.ts";
+import { membershipRoutes } from "../../../src/server/routes/membership.ts";
+import { noteRoutes } from "../../../src/server/routes/note.ts";
+import { searchRoutes } from "../../../src/server/routes/search.ts";
+import { wikiRoutes } from "../../../src/server/routes/wiki.ts";
+import { cleanupWikiAndDependents } from "../../helpers/cleanup.ts";
+
+// Build a test app with the same error handler as production
+const app = new Elysia()
+	.onError(({ error }) => {
+		if (error instanceof AppError) {
+			return new Response(error.message, { status: error.statusCode });
+		}
+		return new Response("Internal server error", { status: 500 });
+	})
+	.use(blobRoutes)
+	.use(homeRoute)
+	.use(searchRoutes)
+	.use(membershipRoutes)
+	.use(noteRoutes)
+	.use(wikiRoutes);
+
+const WIKI_SLUG = "rt-test-wiki";
+const WIKI_AT_URI = `at://${DEV_DID}/wiki.lichen.wiki/${WIKI_SLUG}`;
+const PRIVATE_WIKI_SLUG = "rt-test-private";
+const PRIVATE_WIKI_AT_URI = `at://did:plc:other/wiki.lichen.wiki/${PRIVATE_WIKI_SLUG}`;
+const OTHER_DID = "did:plc:other";
+
+beforeAll(() => {
+	// Seed a public wiki owned by DEV_DID
+	upsertWiki(
+		WIKI_SLUG,
+		DEV_DID,
+		"Route Test Wiki",
+		"public",
+		WIKI_AT_URI,
+		new Date().toISOString(),
+	);
+	upsertMembership(
+		WIKI_SLUG,
+		DEV_DID,
+		"admin",
+		`at://${DEV_DID}/wiki.lichen.membership/rt1`,
+		new Date().toISOString(),
+	);
+	createNote(
+		`at://${DEV_DID}/wiki.lichen.note/rt-home`,
+		`at://${DEV_DID}/wiki.lichen.noteRevision/rt-home-rev`,
+		WIKI_SLUG,
+		"home",
+		"Home",
+		DEV_DID,
+		"# Welcome",
+	);
+	createNote(
+		`at://${DEV_DID}/wiki.lichen.note/rt-test-note`,
+		`at://${DEV_DID}/wiki.lichen.noteRevision/rt-test-rev`,
+		WIKI_SLUG,
+		"test-note",
+		"Test Note",
+		DEV_DID,
+		"Some content",
+	);
+
+	// Seed a private wiki owned by another DID (DEV_DID has no membership)
+	upsertWiki(
+		PRIVATE_WIKI_SLUG,
+		OTHER_DID,
+		"Private Wiki",
+		"private",
+		PRIVATE_WIKI_AT_URI,
+		new Date().toISOString(),
+	);
+});
+
+afterAll(() => {
+	cleanupWikiAndDependents(WIKI_SLUG);
+	cleanupWikiAndDependents(PRIVATE_WIKI_SLUG);
+});
+
+// --- Wiki routes ---
+
+describe("wiki routes", () => {
+	test("GET /wiki/:slug returns 200 for public wiki", async () => {
+		const res = await app.handle(
+			new Request(`http://localhost/wiki/${WIKI_SLUG}`),
+		);
+		expect(res.status).toBe(200);
+		expect(res.headers.get("Content-Type")).toContain("text/html");
+	});
+
+	test("GET /wiki/:slug returns 403 for private wiki (non-member)", async () => {
+		const res = await app.handle(
+			new Request(`http://localhost/wiki/${PRIVATE_WIKI_SLUG}`),
+		);
+		expect(res.status).toBe(403);
+	});
+
+	test("GET /wiki/nonexistent returns 404", async () => {
+		const res = await app.handle(
+			new Request("http://localhost/wiki/does-not-exist-xyz"),
+		);
+		expect(res.status).toBe(404);
+	});
+
+	test("GET /wiki/:slug/-/settings returns 200 for admin", async () => {
+		const res = await app.handle(
+			new Request(`http://localhost/wiki/${WIKI_SLUG}/-/settings`),
+		);
+		expect(res.status).toBe(200);
+	});
+
+	test("GET /wiki/:slug/-/settings returns 403 for non-admin", async () => {
+		const res = await app.handle(
+			new Request(`http://localhost/wiki/${PRIVATE_WIKI_SLUG}/-/settings`),
+		);
+		expect(res.status).toBe(403);
+	});
+
+	test("POST /wiki/:slug/-/delete rejects wrong confirmation name", async () => {
+		const formData = new FormData();
+		formData.set("confirm", "wrong name");
+		const res = await app.handle(
+			new Request(`http://localhost/wiki/${WIKI_SLUG}/-/delete`, {
+				method: "POST",
+				body: formData,
+			}),
+		);
+		expect(res.status).toBe(400);
+	});
+
+	test("GET /wiki/new returns 200", async () => {
+		const res = await app.handle(new Request("http://localhost/wiki/new"));
+		expect(res.status).toBe(200);
+	});
+});
+
+// --- Note routes ---
+
+describe("note routes", () => {
+	test("GET /wiki/:slug/:noteSlug returns 200 for existing note", async () => {
+		const res = await app.handle(
+			new Request(`http://localhost/wiki/${WIKI_SLUG}/test-note`),
+		);
+		expect(res.status).toBe(200);
+		expect(res.headers.get("Content-Type")).toContain("text/html");
+	});
+
+	test("GET /wiki/:slug/:noteSlug returns 404 for nonexistent note", async () => {
+		const res = await app.handle(
+			new Request(`http://localhost/wiki/${WIKI_SLUG}/nonexistent-note-xyz`),
+		);
+		expect(res.status).toBe(404);
+	});
+
+	test("GET /wiki/:slug/:noteSlug/edit returns 200 for editable note", async () => {
+		const res = await app.handle(
+			new Request(`http://localhost/wiki/${WIKI_SLUG}/test-note/edit`),
+		);
+		expect(res.status).toBe(200);
+	});
+
+	test("GET edit on private wiki returns 403 for non-member", async () => {
+		const res = await app.handle(
+			new Request(`http://localhost/wiki/${PRIVATE_WIKI_SLUG}/some-note/edit`),
+		);
+		expect(res.status).toBe(403);
+	});
+
+	test("GET new note on private wiki returns 403 for non-member", async () => {
+		const res = await app.handle(
+			new Request(`http://localhost/wiki/${PRIVATE_WIKI_SLUG}/new`),
+		);
+		expect(res.status).toBe(403);
+	});
+
+	test("POST /wiki/:slug/new creates a note and redirects", async () => {
+		const formData = new FormData();
+		formData.set("title", "Route Created Note");
+		formData.set("content", "Test content from route test");
+		const res = await app.handle(
+			new Request(`http://localhost/wiki/${WIKI_SLUG}/new`, {
+				method: "POST",
+				body: formData,
+			}),
+		);
+		expect(res.status).toBe(302);
+		expect(res.headers.get("Location")).toContain(`/wiki/${WIKI_SLUG}/`);
+	});
+
+	test("POST /wiki/:slug/new with empty title returns validation error", async () => {
+		const formData = new FormData();
+		formData.set("title", "   ");
+		formData.set("content", "content");
+		const res = await app.handle(
+			new Request(`http://localhost/wiki/${WIKI_SLUG}/new`, {
+				method: "POST",
+				body: formData,
+			}),
+		);
+		// ValidationError is caught by the route and re-rendered as the form page
+		expect(res.status).toBe(200);
+		const body = await res.text();
+		expect(body).toContain("required");
+	});
+});
+
+// --- Search routes ---
+
+describe("search routes", () => {
+	test("GET /search with empty query returns empty", async () => {
+		const res = await app.handle(new Request("http://localhost/search?q="));
+		expect(res.status).toBe(200);
+		const body = await res.text();
+		expect(body).toBe("");
+	});
+
+	test("GET /search returns results for matching wikis", async () => {
+		const res = await app.handle(
+			new Request("http://localhost/search?q=Route+Test"),
+		);
+		expect(res.status).toBe(200);
+		const body = await res.text();
+		expect(body).toContain("Route Test Wiki");
+	});
+
+	test("GET /search within wiki returns note results", async () => {
+		const res = await app.handle(
+			new Request(`http://localhost/search?q=Test&wiki=${WIKI_SLUG}`),
+		);
+		expect(res.status).toBe(200);
+	});
+
+	test("GET /search within private wiki returns empty for non-member", async () => {
+		const res = await app.handle(
+			new Request(
+				`http://localhost/search?q=anything&wiki=${PRIVATE_WIKI_SLUG}`,
+			),
+		);
+		expect(res.status).toBe(200);
+		const body = await res.text();
+		expect(body).toBe("");
+	});
+});
+
+// --- Blob routes ---
+
+describe("blob routes", () => {
+	test("POST /api/upload-image without file returns 400", async () => {
+		const formData = new FormData();
+		const res = await app.handle(
+			new Request("http://localhost/api/upload-image", {
+				method: "POST",
+				body: formData,
+			}),
+		);
+		expect(res.status).toBe(400);
+		const json = (await res.json()) as { error: string };
+		expect(json.error).toContain("No file");
+	});
+
+	test("GET /blob/local/ rejects path traversal", async () => {
+		const res = await app.handle(
+			new Request("http://localhost/blob/local/..%2F..%2Fetc%2Fpasswd"),
+		);
+		expect(res.status).toBe(400);
+	});
+
+	test("GET /blob/local/ rejects filename with double dots", async () => {
+		const res = await app.handle(
+			new Request("http://localhost/blob/local/..secret.jpg"),
+		);
+		expect(res.status).toBe(400);
+	});
+});
+
+// --- Home route ---
+
+describe("home route", () => {
+	test("GET / returns 200 with HTML", async () => {
+		const res = await app.handle(new Request("http://localhost/"));
+		expect(res.status).toBe(200);
+		expect(res.headers.get("Content-Type")).toContain("text/html");
+	});
+});