diff --git a/CLAUDE.md b/CLAUDE.md
index 37f7186..6bbcbaa 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -121,6 +121,7 @@ This is a combined RMS (Resource Management System) backend + marketing site for
 - **tRPC caller constraint:** When calling procedures from server components, always verify the Zod input schema's runtime constraints (min, max, regex, enum). TypeScript only checks the base type (`number`, `string`), not Zod refinements. Open the router file and read the `.input()` block before writing the call.
 - **Audit logging:** mutations use `withAudit` middleware — do not bypass
 - **Public pages:** require 4 additions: proxy.ts PUBLIC_PATHS, [slug]/page.tsx RESERVED, sitemap.ts, footer link in site-footer.tsx
+- **Middleware is default-deny:** any page or endpoint a logged-out client must reach — auth flows, webhooks, cron — needs a `PUBLIC_PATHS` entry, or it silently redirects to `/login`. Verify with a logged-out `curl -I`.
 - **All public pages:** use `export const dynamic = "force-dynamic"` and fetch company name with try/catch fallback
 - **Settings:** stored in DB as key/value (Setting model), fetched via `db.setting.findUnique`
 - **CMS blocks:** JSON array of { type, content, level, src, alt, ctaText, ctaHref } objects
@@ -168,8 +169,11 @@ This is a combined RMS (Resource Management System) backend + marketing site for
 - **Admin password:** seed now generates a random 24-char password on first run, writes to `.first-admin-credentials` (0600). No more hardcoded `changeme123`. Founder rotated production password manually — confirm by reading the file or by attempting login with the old default (should fail)
 - **No CSRF on public API routes:** `/api/tickets/reply` and `/api/files/upload` use POST but no CSRF token — relies on SameSite cookies which is sufficient for browser clients but not for API-style access
 - **Rate limiting is in-memory:** `server/rate-limit.ts` uses a Map — resets on server restart, doesn't work across multiple instances. Acceptable for single-instance VPS deployment.
-- **No email queue retry backoff:** `app/api/cron/process-emails/route.ts` retries failed emails up to 3 times with no delay between attempts — should add exponential backoff if email failures become common
 - **Portal token is permanent:** Client portal tokens (cuid) never expire and can't be rotated without DB manual intervention — add rotation mechanism before handling sensitive client data
+- **Cron jobs have never run:** `proxy.ts` redirects `/api/cron/*` to `/login` before the handlers' `CRON_SECRET` check, `CRON_SECRET` is never set (not in `.env.example` or `deploy.sh`), and no scheduler is installed. So appointment reminders and overdue-invoice flagging (`/api/cron/overdue` is the only code that sets `OVERDUE`) never happen. `EmailQueue` has no producer, so `process-emails` has nothing to do. Fix: generate `CRON_SECRET` in `deploy.sh`, let `/api/cron` through `proxy.ts` but `deny` it in nginx (a systemd timer calls `127.0.0.1:3000` directly), and compare the secret with `timingSafeEqual`.
+- **Booking slots for visitors east of America/New_York:** `scheduling.availableSlots` receives the browser's local-midnight instant, takes the weekday from the UTC server's `getDay()`, and places the window on that instant's ET date. Visitors east of UTC see the previous day's slots; visitors between ET and UTC (Atlantic Canada, Puerto Rico/USVI in winter, Brazil, UK in winter) are offered slots that `book` then rejects. Every US state is unaffected. Fix: send the picked day as a `YYYY-MM-DD` string.
+- **Uploads aren't backed up:** `db-backup.yml` dumps Postgres only. The `uploads_data` volume (writable only since the Dockerfile `chown` fix) has no backup, so restoring a dump leaves `File` rows pointing at missing files.
+- **Root-level CMS pages sit behind login:** `proxy.ts` only exempts listed prefixes, so a published `CmsPage` served by `app/[slug]` redirects anonymous visitors to `/login`. Latent — no CMS pages are published.
 - **Prod DB password is the public dev default:** `docker-compose.yml` hardcodes `simplerms_dev` for dev *and* prod, and this repo is public. Mitigated by loopback-only port binding plus the cloud security group (only 22/80/443 reachable). Rotate it (move `DATABASE_URL` into the server's `.env.local`) if this box outlives the Holt migration.
 - **nodemailer forced via `overrides`:** `"nodemailer": "$nodemailer"` forces the whole tree to our direct nodemailer (now 10). next-auth's `@auth/core` declares an **optional** `nodemailer@^7` peer used only by its Email provider, which we don't use (Credentials-only in `server/auth/index.ts`) — runtime-safe, no `--legacy-peer-deps`. Side effect: `npm audit fix` and `npm update` crash on the `$` reference — raise the override floors in `package.json` by hand instead.
 
diff --git a/Dockerfile b/Dockerfile
index 33881df..8f52e02 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -28,6 +28,11 @@ COPY --from=builder /app/.next/standalone ./
 COPY --from=builder /app/.next/static ./.next/static
 COPY --from=builder /app/public ./public
 
+# Code stays root-owned (read-only to the app); only the dirs it writes are
+# node's. An empty named volume takes this dir's owner whenever a container
+# is created with it.
+RUN mkdir -p uploads .next/cache && chown node:node uploads .next/cache
+
 # Run as non-root for defense in depth.
 USER node
 EXPOSE 3000
diff --git a/__tests__/content-disposition.test.ts b/__tests__/content-disposition.test.ts
new file mode 100644
index 0000000..992160a
--- /dev/null
+++ b/__tests__/content-disposition.test.ts
@@ -0,0 +1,36 @@
+// __tests__/content-disposition.test.ts
+import { describe, it, expect } from "vitest";
+import { contentDisposition } from "@/lib/content-disposition";
+
+// The real failure: undici rejects any header value that isn't a ByteString.
+const isByteString = (v: string) => [...v].every((c) => c.charCodeAt(0) <= 0xff);
+
+describe("contentDisposition", () => {
+  it("passes plain ASCII names through", () => {
+    expect(contentDisposition("inline", "report.pdf")).toBe(
+      `inline; filename="report.pdf"; filename*=UTF-8''report.pdf`
+    );
+  });
+
+  it("encodes a macOS screenshot name (U+202F before AM)", () => {
+    const name = "Screenshot 2026-09-30 at 10.52.11\u202fAM.png";
+    const header = contentDisposition("inline", name);
+    expect(isByteString(header)).toBe(true);
+    expect(header).toContain(`filename="Screenshot 2026-09-30 at 10.52.11_AM.png"`);
+    expect(header).toContain("filename*=UTF-8''Screenshot%202026-09-30%20at%2010.52.11%E2%80%AFAM.png");
+    expect(() => new Response("x", { headers: { "Content-Disposition": header } })).not.toThrow();
+  });
+
+  it("encodes CJK and emoji names", () => {
+    const header = contentDisposition("attachment", "請求書 🧾.pdf");
+    expect(isByteString(header)).toBe(true);
+    expect(decodeURIComponent(header.split("UTF-8''")[1])).toBe("請求書 🧾.pdf");
+  });
+
+  it("cannot be broken out of by quotes, backslashes, CR/LF, or RFC 5987 delimiters", () => {
+    const header = contentDisposition("inline", `a"b\\c\r\nSet-Cookie: x=1'(*).txt`);
+    expect(header).not.toMatch(/[\r\n]/);
+    expect(header).toContain(`filename="a_b_c__Set-Cookie: x=1'(*).txt"`);
+    expect(header.split("UTF-8''")[1]).not.toMatch(/['()*"\\]/);
+  });
+});
diff --git a/__tests__/safe-redirect.test.ts b/__tests__/safe-redirect.test.ts
new file mode 100644
index 0000000..422278d
--- /dev/null
+++ b/__tests__/safe-redirect.test.ts
@@ -0,0 +1,42 @@
+// __tests__/safe-redirect.test.ts
+import { describe, it, expect } from "vitest";
+import { safeRedirectPath } from "@/lib/safe-redirect";
+
+const ORIGIN = "https://akritos.com";
+
+describe("safeRedirectPath", () => {
+  it("keeps same-origin paths, including query and hash", () => {
+    expect(safeRedirectPath("/dashboard/invoices?status=open#top", ORIGIN)).toBe(
+      "/dashboard/invoices?status=open#top"
+    );
+  });
+
+  it("reduces a same-origin absolute URL to its path", () => {
+    expect(safeRedirectPath("https://akritos.com/dashboard/settings", ORIGIN)).toBe("/dashboard/settings");
+  });
+
+  it.each([
+    ["protocol-relative", "//evil.example"],
+    ["backslash host", "/\\evil.example"],
+    ["double backslash", "/\\\\evil.example"],
+    ["mixed slashes", "\\/evil.example"],
+    ["tab-split slashes", "/\t/evil.example"],
+    ["newline-split slashes", "/\n/evil.example"],
+    ["absolute foreign URL", "https://evil.example/dashboard"],
+    ["lookalike host", "https://akritos.com.evil.example/"],
+    ["other scheme on our host", "http://akritos.com/dashboard"],
+    ["javascript URL", "javascript:alert(1)"],
+    ["data URL", "data:text/html,<script>alert(1)</script>"],
+  ])("rejects %s", (_label, raw) => {
+    expect(safeRedirectPath(raw, ORIGIN)).toBe("/dashboard");
+  });
+
+  it("falls back when missing or empty", () => {
+    expect(safeRedirectPath(null, ORIGIN)).toBe("/dashboard");
+    expect(safeRedirectPath("", ORIGIN)).toBe("/dashboard");
+  });
+
+  it("uses the caller's fallback", () => {
+    expect(safeRedirectPath("//evil.example", ORIGIN, "/")).toBe("/");
+  });
+});
diff --git a/app/api/files/[id]/route.ts b/app/api/files/[id]/route.ts
index b09e093..277e4dc 100644
--- a/app/api/files/[id]/route.ts
+++ b/app/api/files/[id]/route.ts
@@ -3,6 +3,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { auth } from "@/server/auth";
 import { db } from "@/server/db";
 import { getFile } from "@/server/storage/local";
+import { contentDisposition } from "@/lib/content-disposition";
 
 export async function GET(
   _request: NextRequest,
@@ -16,21 +17,24 @@ export async function GET(
   const file = await db.file.findUnique({ where: { id } });
   if (!file) return NextResponse.json({ error: "Not found" }, { status: 404 });
 
+  let buffer: Buffer;
   try {
-    const buffer = await getFile(file.storagePath);
-    // Strip quotes/CR/LF from the client-supplied name so it can't break the
-    // header, and send nosniff so a browser won't MIME-sniff a spoofed
-    // Content-Type into something executable (the upload MIME is client-set).
-    const safeName = file.originalName.replace(/[\r\n"\\]/g, "_");
-    return new NextResponse(new Uint8Array(buffer), {
-      headers: {
-        "Content-Type": file.mimeType,
-        "Content-Disposition": `inline; filename="${safeName}"`,
-        "Content-Length": String(file.sizeBytes),
-        "X-Content-Type-Options": "nosniff",
-      },
-    });
-  } catch {
-    return NextResponse.json({ error: "File not found on disk" }, { status: 404 });
+    buffer = await getFile(file.storagePath);
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code === "ENOENT") {
+      return NextResponse.json({ error: "File not found on disk" }, { status: 404 });
+    }
+    throw err;
   }
+
+  return new NextResponse(new Uint8Array(buffer), {
+    headers: {
+      "Content-Type": file.mimeType,
+      "Content-Disposition": contentDisposition("inline", file.originalName),
+      "Content-Length": String(file.sizeBytes),
+      // The upload MIME type is client-set; nosniff stops a browser from
+      // sniffing a spoofed type into something executable.
+      "X-Content-Type-Options": "nosniff",
+    },
+  });
 }
diff --git a/app/api/files/upload/route.ts b/app/api/files/upload/route.ts
index e578a76..6be46e8 100644
--- a/app/api/files/upload/route.ts
+++ b/app/api/files/upload/route.ts
@@ -3,6 +3,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { auth } from "@/server/auth";
 import { db } from "@/server/db";
 import { saveFile } from "@/server/storage/local";
+import { rateLimit } from "@/server/rate-limit";
 
 const MAX_SIZE = 10 * 1024 * 1024; // 10 MB
 
@@ -21,6 +22,13 @@ const ALLOWED_TYPES = new Set([
 export async function POST(request: NextRequest) {
   const session = await auth();
   if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  // Matches staffProcedure: READONLY accounts can't mutate anything.
+  if (session.user.role === "READONLY") return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+
+  // Checked before the body is parsed; bounds how fast one account can fill
+  // the disk that Postgres shares.
+  const { allowed } = rateLimit(`upload:${session.user.id}`, 30, 60 * 60 * 1000);
+  if (!allowed) return NextResponse.json({ error: "Too many uploads. Try again later." }, { status: 429 });
 
   const formData = await request.formData();
   const file = formData.get("file") as File | null;
diff --git a/app/blog/[slug]/opengraph-image.tsx b/app/blog/[slug]/opengraph-image.tsx
index d67c83d..960d630 100644
--- a/app/blog/[slug]/opengraph-image.tsx
+++ b/app/blog/[slug]/opengraph-image.tsx
@@ -7,9 +7,10 @@ export const alt = "Akritos blog post";
 export const size = { width: 1200, height: 630 };
 export const contentType = "image/png";
 
-export default async function OG({ params }: { params: { slug: string } }) {
+export default async function OG({ params }: { params: Promise<{ slug: string }> }) {
+  const { slug } = await params;
   const post = await db.cmsPost.findUnique({
-    where: { slug: params.slug, status: "PUBLISHED" },
+    where: { slug, status: "PUBLISHED" },
     select: { title: true, excerpt: true },
   });
 
diff --git a/app/blog/page.tsx b/app/blog/page.tsx
index 6739a42..b73aa13 100644
--- a/app/blog/page.tsx
+++ b/app/blog/page.tsx
@@ -9,7 +9,11 @@ import { db } from "@/server/db";
 import { formatDate } from "@/lib/utils";
 import { ArrowRight } from "lucide-react";
 
-export const metadata = { title: "Blog", description: "Insights and updates from our team." };
+export const metadata = {
+  title: "Blog",
+  description: "Insights and updates from our team.",
+  alternates: { canonical: "https://akritos.com/blog" },
+};
 
 async function getData() {
   const [setting, posts] = await Promise.all([
diff --git a/app/layout.tsx b/app/layout.tsx
index 62089f9..3ff5ac2 100644
--- a/app/layout.tsx
+++ b/app/layout.tsx
@@ -3,6 +3,7 @@ import type { Metadata } from "next";
 import { Geist } from "next/font/google";
 import { TRPCProvider } from "@/lib/trpc/provider";
 import { Analytics } from "@/components/site/analytics";
+import { PublicOnly } from "@/components/site/public-only";
 import { db } from "@/server/db";
 import "./globals.css";
 
@@ -62,7 +63,9 @@ export default function RootLayout({
       <body className="h-full bg-background font-sans text-foreground">
         <TRPCProvider>{children}</TRPCProvider>
         {/* Analytics is provider-agnostic and noop when settings are unset */}
-        <Analytics />
+        <PublicOnly>
+          <Analytics />
+        </PublicOnly>
       </body>
     </html>
   );
diff --git a/app/pricing/page.tsx b/app/pricing/page.tsx
index 2f7240f..f51e019 100644
--- a/app/pricing/page.tsx
+++ b/app/pricing/page.tsx
@@ -10,7 +10,7 @@ import { db } from "@/server/db";
 import { ArrowRight, Check, X } from "lucide-react";
 
 export const metadata: Metadata = {
-  title: "Pricing — Akritos",
+  title: "Pricing",
   description:
     "Published rates for senior IT partnership. Free 1-hour consultation. Project work from $1,500 flat. Partnership retainers from $750/month. Advisory at $250/hr. Vendor costs pass through at cost — zero markup.",
   alternates: { canonical: "https://akritos.com/pricing" },
diff --git a/components/auth/login-form.tsx b/components/auth/login-form.tsx
index 3ed851e..3833662 100644
--- a/components/auth/login-form.tsx
+++ b/components/auth/login-form.tsx
@@ -8,19 +8,11 @@ import Link from "next/link";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
+import { safeRedirectPath } from "@/lib/safe-redirect";
 
 export function LoginForm() {
   const router = useRouter();
   const searchParams = useSearchParams();
-  // Only allow same-origin relative paths — a full/protocol-relative URL here
-  // would be an open redirect (a user who just authenticated on the real page
-  // gets bounced to an attacker's site). `//evil.com` is protocol-relative, so
-  // reject anything that doesn't start with a single "/".
-  const rawCallback = searchParams.get("callbackUrl");
-  const callbackUrl =
-    rawCallback && rawCallback.startsWith("/") && !rawCallback.startsWith("//")
-      ? rawCallback
-      : "/dashboard";
 
   const [email, setEmail] = useState("");
   const [password, setPassword] = useState("");
@@ -45,7 +37,9 @@ export function LoginForm() {
       return;
     }
 
-    router.push(callbackUrl);
+    // A just-authenticated user bounced off-site is a phishing setup, so the
+    // callback must resolve to this origin.
+    router.push(safeRedirectPath(searchParams.get("callbackUrl"), window.location.origin));
     router.refresh();
   }
 
diff --git a/components/auth/reset-password-form.tsx b/components/auth/reset-password-form.tsx
index eefe62b..7fc3977 100644
--- a/components/auth/reset-password-form.tsx
+++ b/components/auth/reset-password-form.tsx
@@ -1,7 +1,7 @@
 // components/auth/reset-password-form.tsx
 "use client";
 
-import { useState } from "react";
+import { useEffect, useState } from "react";
 import { useSearchParams } from "next/navigation";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
@@ -11,7 +11,15 @@ import Link from "next/link";
 
 export function ResetPasswordForm() {
   const searchParams = useSearchParams();
-  const token = searchParams.get("token") ?? "";
+  // Captured once: the effect below strips it from the URL, and Next syncs
+  // replaceState into useSearchParams.
+  const [token] = useState(() => searchParams.get("token") ?? "");
+
+  // The token is a password-reset credential; keep it out of browser history
+  // and the Referer of every later request from this page.
+  useEffect(() => {
+    if (token) window.history.replaceState(null, "", window.location.pathname);
+  }, [token]);
 
   const [password, setPassword] = useState("");
   const [confirm, setConfirm] = useState("");
diff --git a/components/site/public-only.tsx b/components/site/public-only.tsx
new file mode 100644
index 0000000..bccc200
--- /dev/null
+++ b/components/site/public-only.tsx
@@ -0,0 +1,22 @@
+// components/site/public-only.tsx
+"use client";
+
+import { usePathname } from "next/navigation";
+
+// Signed-in and token-bearing routes. Analytics reports the full page URL, so
+// rendering it here would ship reset, portal, and ticket-tracking tokens to a
+// third party.
+const PRIVATE_PREFIXES = [
+  "/dashboard",
+  "/portal",
+  "/login",
+  "/forgot-password",
+  "/reset-password",
+  "/support/track",
+];
+
+export function PublicOnly({ children }: { children: React.ReactNode }) {
+  const pathname = usePathname();
+  const isPrivate = PRIVATE_PREFIXES.some((p) => pathname === p || pathname.startsWith(`${p}/`));
+  return isPrivate ? null : children;
+}
diff --git a/deploy.sh b/deploy.sh
index a6cf81c..d852f8f 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -5,6 +5,26 @@ set -e
 COMPOSE="docker compose -f docker-compose.yml -f docker-compose.prod.yml"
 REPO_DIR="/opt/simplerms"
 
+# Without the newline guard, a key appended to a file that lacks a trailing
+# newline fuses onto the previous line and corrupts that value.
+append_env() {
+  if [ -s .env.local ] && [ -n "$(tail -c1 .env.local)" ]; then echo >> .env.local; fi
+  echo "$1" >> .env.local
+}
+
+# Replaces every KEY= line with a single KEY=value line.
+set_env() {
+  sed -i "/^$1=/d" .env.local
+  append_env "$1=$2"
+}
+
+# Absent, empty, or still the .env.example placeholder. A bare presence check
+# keeps the placeholder AUTH_SECRET — public in this repo — so anyone could
+# forge a session.
+env_missing() {
+  ! grep -qE "^$1=[\"']?[^\"'[:space:]]" .env.local || grep -qE "^$1=.*replace-with" .env.local
+}
+
 echo "==> Changing to repo directory"
 cd "$REPO_DIR"
 
@@ -14,21 +34,40 @@ if [ ! -f .env.local ]; then
   echo "    Created .env.local from .env.example"
 fi
 
-if ! grep -q "^AUTH_SECRET=" .env.local 2>/dev/null; then
-  echo "AUTH_SECRET=$(openssl rand -base64 32)" >> .env.local
+if env_missing AUTH_SECRET; then
+  set_env AUTH_SECRET "$(openssl rand -base64 32)"
   echo "    Generated AUTH_SECRET"
 fi
 
-if ! grep -q "^APP_ENCRYPTION_KEY=" .env.local 2>/dev/null || grep -q "replace-with" .env.local 2>/dev/null; then
-  sed -i "s|APP_ENCRYPTION_KEY=.*|APP_ENCRYPTION_KEY=$(openssl rand -hex 32)|" .env.local
+if env_missing APP_ENCRYPTION_KEY; then
+  set_env APP_ENCRYPTION_KEY "$(openssl rand -hex 32)"
   echo "    Generated APP_ENCRYPTION_KEY"
 fi
 
-if ! grep -q "^AUTH_TRUST_HOST=" .env.local 2>/dev/null; then
-  echo "AUTH_TRUST_HOST=true" >> .env.local
+if ! grep -q "^AUTH_TRUST_HOST=" .env.local; then
+  append_env "AUTH_TRUST_HOST=true"
   echo "    Set AUTH_TRUST_HOST=true (required behind reverse proxy)"
 fi
 
+# Without AUTH_URL, Auth.js builds redirect URLs from the container hostname,
+# so sign-out lands on https://<container-id>:3000. Re-synced every deploy to
+# follow NEXT_PUBLIC_APP_URL, and reduced to an origin because Auth.js treats
+# any path in it as its basePath.
+APP_ORIGIN=$(grep -E '^NEXT_PUBLIC_APP_URL=' .env.local | tail -1 | cut -d= -f2- \
+  | sed 's/[[:space:]]#.*$//' | tr -d "\"' \r" \
+  | sed -nE 's#^(https?://[A-Za-z0-9.-]+(:[0-9]+)?)([/?#].*)?$#\1#p')
+case "$APP_ORIGIN" in
+  "" | *://localhost | *://localhost:* | *://127.0.0.1 | *://127.0.0.1:*)
+    echo "    WARNING: NEXT_PUBLIC_APP_URL is unset, invalid, or local — AUTH_URL not set"
+    ;;
+  *)
+    if ! grep -qxF "AUTH_URL=$APP_ORIGIN" .env.local; then
+      set_env AUTH_URL "$APP_ORIGIN"
+      echo "    Set AUTH_URL=$APP_ORIGIN"
+    fi
+    ;;
+esac
+
 echo "==> Ensuring swap space (prevents OOM during build)"
 if [ ! -f /swapfile ]; then
   sudo fallocate -l 2G /swapfile
diff --git a/docker-compose.yml b/docker-compose.yml
index f24fa23..f9b7ddf 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -25,8 +25,10 @@ services:
       context: .
       dockerfile: Dockerfile
     restart: unless-stopped
+    # Loopback only: nginx proxies to 127.0.0.1:3000, and a directly reachable
+    # app would let clients forge the X-Real-IP that rate limiting trusts.
     ports:
-      - "3000:3000"
+      - "127.0.0.1:3000:3000"
     env_file:
       - .env.local
     environment:
diff --git a/docs/DECISIONS.md b/docs/DECISIONS.md
index 754a5de..1751934 100644
--- a/docs/DECISIONS.md
+++ b/docs/DECISIONS.md
@@ -200,3 +200,13 @@ The AI framework is the cleaner reference implementation of the pattern.
 **Why:** The 9.x line has no fix for a high addressparser ReDoS (GHSA-v53p-9fqp-m79j, fixed in 10.0.6); the major-version pin is how nodemailer fell a full major behind a security fix. `shadcn` is a component CLI plus one build-time CSS import (`@import "shadcn/tailwind.css"`); the Docker builder stage installs dev deps and production ships only `.next/standalone`, so nothing from it runs on the server. Listing it as a runtime dep pulled its MCP SDK tree (hono, express, ip-address) into the production audit for code we never deploy.
 
 **Alternatives:** keep nodemailer 9 and allowlist the ReDoS (rejected — a fix exists); keep `shadcn` in `dependencies` and chase its transitive advisories with more overrides (rejected — misclassifies build tooling as runtime).
+
+---
+
+### 2026-09-30: Disable the Next.js image optimizer
+
+**Decision:** `images: { unoptimized: true }` in `next.config.ts`; the unused `images.unsplash.com` remote pattern is gone.
+
+**Why:** No live page renders an optimized image (a post-deploy sweep found zero `/_next/image` references across all 29 sitemap URLs). The optimizer was the component behind GHSA-2xp9-vwfh-vxw4 (unauthenticated RCE), decodes attacker-influenced image formats through sharp/libheif, and — with its cache dir unwritable — re-processed every request, a free CPU-amplification endpoint. With `unoptimized`, Next answers `/_next/image` with a 404 before touching the pipeline, and `next/image` renders a plain `<img>`.
+
+**Alternatives:** keep it and only fix the cache permissions (rejected — keeps unused, historically exploitable surface). Revisit if the blog starts using large cover images.
diff --git a/docs/LESSONS.md b/docs/LESSONS.md
index b0ed2af..0e30b6a 100644
--- a/docs/LESSONS.md
+++ b/docs/LESSONS.md
@@ -256,6 +256,26 @@ Read at session start (loaded by `/boot`). Add to it whenever:
 
 ---
 
+## 2026-09-30 — `USER node` without `chown` left uploads and the image cache unwritable
+
+**What happened:** The production stage copied everything as root, then switched to `USER node`. The `uploads_data` volume's mount point was created root-owned, so file uploads could never succeed, and the image optimizer's cache couldn't be written, so it re-processed every request. Both failed silently for months — nothing exercised them after deploy.
+
+**Lesson:** Before `USER`, create and `chown` every directory the runtime user writes (and nothing else — code stays root-owned). An empty named volume takes the image directory's owner on its next mount, so the fix also repairs an existing, never-written volume. Verify with `docker exec <app> touch <dir>/x` as the runtime user.
+
+**Where it applies:** `Dockerfile` production stage; any new writable path or volume.
+
+---
+
+## 2026-09-30 — `tsc` passed while a metadata image route 500'd
+
+**What happened:** `app/blog/[slug]/opengraph-image.tsx` typed `params` as `{ slug: string }` and read it synchronously. In Next 16 `params` is a Promise, so the slug was `undefined`, Prisma threw, and every blog post's social-preview image returned 500. Type-check and build were clean: Next doesn't check metadata-route props the way it checks `page.tsx`.
+
+**Lesson:** In Next 16, always `await params` — in metadata routes (`opengraph-image`, `twitter-image`, `icon`) too. After any Next upgrade, fetch each metadata route with a real request; a clean build proves nothing about them.
+
+**Where it applies:** `app/**/opengraph-image.tsx` and other file-convention metadata routes.
+
+---
+
 ## How to add to this file
 
 When you finish a task and a real lesson emerged, add an entry. Keep it terse. The point is to avoid repeating the mistake — not to write an essay. If the lesson is big enough to drive an architectural change, it goes in `docs/DECISIONS.md` instead. If it's about how the codebase works, update `CLAUDE.md`. If it's about how *we* work — it lives here.
diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md
index 656effa..f756d06 100644
--- a/docs/ROADMAP.md
+++ b/docs/ROADMAP.md
@@ -56,10 +56,10 @@ These make the system usable day-to-day without workarounds.
 - ✅ Appointment list with cancel links
 - ✅ Portal tRPC router with rate-limited token validation
 
-### 2.2 Appointment Reminders ✅
+### 2.2 Appointment Reminders
 - **File:** `docs/features/scheduling.md`
-- ✅ Email reminder 24h before appointment
-- ✅ Cron API route at /api/cron/reminders (CRON_SECRET protected)
+- ✅ Email reminder 24h before appointment (route logic)
+- Cron API route at /api/cron/reminders exists but has never been scheduled — see CLAUDE.md Known Issues
 - ✅ Uses reminderSentAt field to prevent duplicates
 
 ---
@@ -68,11 +68,12 @@ These make the system usable day-to-day without workarounds.
 
 These become important as client count grows.
 
-### 3.1 Background Job Processor ✅
+### 3.1 Background Job Processor
 - **File:** `docs/features/background-jobs.md`
-- ✅ Process EmailQueue table (cron route at /api/cron/process-emails)
-- ✅ Appointment reminders (cron route at /api/cron/reminders)
-- ✅ Overdue invoice flagging (cron route at /api/cron/overdue)
+- Routes exist but have never been scheduled — see CLAUDE.md Known Issues
+- Process EmailQueue table (/api/cron/process-emails) — nothing writes to EmailQueue yet
+- Appointment reminders (/api/cron/reminders)
+- Overdue invoice flagging (/api/cron/overdue)
 - Simple cron-based, no Redis/Bull dependency
 
 ### 3.2 Invoice Recurring/Templates
@@ -140,7 +141,7 @@ These become important as client count grows.
 | File Uploads | Working | Local storage, upload/download routes, drag-and-drop UI |
 | PDF Generation | Working | API route, react-pdf template |
 | Settings UI | Working | Company, SMTP, invoice defaults |
-| Background Jobs | Working | Email queue processor + reminders + overdue flagging |
+| Background Jobs | Not scheduled | Routes exist; never run in production (see CLAUDE.md Known Issues) |
 | Client Portal | Working | Token-based, invoices/tickets/appointments |
 | Public Pages | Working | Homepage, about, services, pricing, contact, careers, nonprofits, apple-business, ai-risk, ownership, privacy, terms, blog, book, support |
 | Lead Magnets | Working | Vendor Independence Checklist (PDF) + AI Prompt Framework (PDF). `Lead` model, `leads` tRPC router, token-gated downloads, admin view at /dashboard/cms/leads |
diff --git a/docs/features/background-jobs.md b/docs/features/background-jobs.md
index 2eb643c..79207b7 100644
--- a/docs/features/background-jobs.md
+++ b/docs/features/background-jobs.md
@@ -4,7 +4,8 @@
 
 - EmailQueue model exists (PENDING/SENT/FAILED, attempts, scheduledAt)
 - Appointment.reminderSentAt field exists
-- No job processor, no cron, no queue consumer
+- Cron routes exist (`/api/cron/process-emails`, `/api/cron/reminders`, `/api/cron/overdue`) but have never run in production: `proxy.ts` redirects them to `/login`, `CRON_SECRET` is unset, and no scheduler is installed
+- Nothing writes to `EmailQueue`, so the queue processor has no input
 
 ## Approach
 
diff --git a/docs/features/scheduling.md b/docs/features/scheduling.md
index 631f763..6c5c3ba 100644
--- a/docs/features/scheduling.md
+++ b/docs/features/scheduling.md
@@ -109,6 +109,6 @@ In scheduling dashboard:
 
 ## Timezone Handling
 
-The availability system stores times in the staff member's local timezone and converts to UTC for slot calculation. This is the most complex part of the scheduling system. The conversion logic is in the router and handles DST correctly.
+The availability system stores times in the staff member's local timezone and converts to UTC for slot calculation. This is the most complex part of the scheduling system. The conversion logic is in the router and handles DST correctly for US visitors; `availableSlots` derives the day from the browser's local-midnight instant, so visitors east of America/New_York get the wrong day's slots (see CLAUDE.md Known Issues).
 
 Key: all appointments store startsAt/endsAt in UTC. Display converts to the viewer's timezone.
diff --git a/lib/content-disposition.ts b/lib/content-disposition.ts
new file mode 100644
index 0000000..5b2d239
--- /dev/null
+++ b/lib/content-disposition.ts
@@ -0,0 +1,13 @@
+// lib/content-disposition.ts
+
+// Header values must be ByteStrings, so a raw non-ASCII name (every macOS
+// screenshot name contains U+202F) makes `new Response()` throw. RFC 6266:
+// `filename` gets an ASCII fallback, `filename*` carries the real name.
+export function contentDisposition(type: "inline" | "attachment", name: string): string {
+  const fallback = name.replace(/[^\x20-\x7E]|["\\]/g, "_");
+  const encoded = encodeURIComponent(name).replace(
+    /['()*]/g,
+    (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`,
+  );
+  return `${type}; filename="${fallback}"; filename*=UTF-8''${encoded}`;
+}
diff --git a/lib/safe-redirect.ts b/lib/safe-redirect.ts
new file mode 100644
index 0000000..9a4a00a
--- /dev/null
+++ b/lib/safe-redirect.ts
@@ -0,0 +1,15 @@
+// lib/safe-redirect.ts
+
+// Resolving against the real origin and comparing origins catches every
+// off-site form a prefix check misses: "//host", "/\host" (browsers read "\"
+// as "/"), tab/newline-split slashes, and absolute or javascript: URLs.
+export function safeRedirectPath(raw: string | null, origin: string, fallback = "/dashboard"): string {
+  if (!raw) return fallback;
+  try {
+    const url = new URL(raw, origin);
+    if (url.origin !== origin) return fallback;
+    return `${url.pathname}${url.search}${url.hash}`;
+  } catch {
+    return fallback;
+  }
+}
diff --git a/next.config.ts b/next.config.ts
index 4c7e71b..b0cf32b 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -26,12 +26,11 @@ const ANALYTICS_IMG = [
 
 const nextConfig: NextConfig = {
   output: "standalone",
+  poweredByHeader: false,
 
-  images: {
-    remotePatterns: [
-      { protocol: "https", hostname: "images.unsplash.com" },
-    ],
-  },
+  // Disables /_next/image entirely: no page needs resizing, and the optimizer
+  // is the component behind GHSA-2xp9-vwfh-vxw4 (unauthenticated RCE).
+  images: { unoptimized: true },
 
   headers: async () => [
     {
diff --git a/proxy.ts b/proxy.ts
index 90ff97a..c54c457 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -5,6 +5,10 @@ import type { NextRequest } from "next/server";
 
 const PUBLIC_PATHS = [
   "/login",
+  // Only logged-out users need these; the mutations behind them are already
+  // public and rate-limited via /api/trpc.
+  "/forgot-password",
+  "/reset-password",
   "/book",
   "/support",
   "/pricing",
@@ -36,10 +40,11 @@ const PUBLIC_PATHS = [
 export default auth((req: NextRequest & { auth: unknown }) => {
   const { pathname } = req.nextUrl;
 
+  // Whole-segment match: a bare prefix check would silently make a future
+  // "/bookkeeping" public because "/book" is listed.
   const isPublic =
-    PUBLIC_PATHS.some((p) => pathname.startsWith(p)) ||
-    pathname.startsWith("/(site)") ||
-    pathname === "/";
+    pathname === "/" ||
+    PUBLIC_PATHS.some((p) => pathname === p || pathname.startsWith(`${p}/`));
 
   if (isPublic) return NextResponse.next();
 
diff --git a/server/trpc/routers/users.ts b/server/trpc/routers/users.ts
index 6c1a205..896993f 100644
--- a/server/trpc/routers/users.ts
+++ b/server/trpc/routers/users.ts
@@ -209,6 +209,9 @@ export const usersRouter = createTRPCRouter({
   resetPassword: publicProcedure
     .input(z.object({ token: z.string().min(1), newPassword: z.string().min(8).max(128) }))
     .mutation(async ({ ctx, input }) => {
+      const { allowed } = rateLimit(`pw-reset-confirm:${getClientIp(ctx.headers)}`, 10, 900000);
+      if (!allowed) throw new TRPCError({ code: "TOO_MANY_REQUESTS", message: "Too many requests. Please try again later." });
+
       const record = await ctx.db.verificationToken.findUnique({ where: { token: input.token } });
       if (!record || record.expires < new Date()) {
         throw new TRPCError({ code: "BAD_REQUEST", message: "Invalid or expired reset link. Please request a new one." });