diff --git a/keel/freeze.py b/keel/freeze.py
index 2de8268..a6722fb 100644
--- a/keel/freeze.py
+++ b/keel/freeze.py
@@ -1,6 +1,6 @@
 """What a frozen bundle has to be told, because PyInstaller cannot work it out (#438).
 
-Four things break when keel is frozen, and three of them break SILENTLY. That is what makes this
+Five things break when keel is frozen, and four of them break SILENTLY. That is what makes this
 module worth having rather than a handful of flags in a build script: every one of these was found
 by building a bundle and running it, and every one of them produced a binary that started
 cleanly and was wrong.
@@ -23,6 +23,15 @@
 **4. The config templates are package DATA.** `init-config` reads them through
 `importlib.resources`; without them a first run cannot write a config at all.
 
+**5. The web UI's static assets are package DATA too (#535).** `keel/web/staticfiles.py` finds
+them with `Path(__file__).parent / "static"` rather than `importlib.resources` -- a plain
+filesystem lookup relative to the module's OWN frozen location, which resolves correctly only if
+PyInstaller actually copied `keel/web/static/` alongside the frozen `staticfiles.py`. Without
+this, `keel serve` binds and every rendered page loads (they carry no static reference), so the
+bundle looks healthy right up until #536's client -- or anyone hitting `/static/*` today -- gets
+a 404 with no terminal to diagnose it from, on the exact double-click path #535 exists to make
+work.
+
 Everything here is computed from the build environment rather than hardcoded. A hardcoded list is
 the same failure one release later: adding a fifth adapter and forgetting to add it here would
 produce exactly the silent `0 adapter(s)` bundle that (2) describes.
@@ -35,6 +44,15 @@
 #: The package holding `config.yaml` / `config.live.yaml`, read via `importlib.resources`.
 TEMPLATE_PACKAGE = "keel.templates"
 
+#: The package holding the web UI's static assets (#535), read via a plain filesystem path
+#: (`keel/web/staticfiles.py`'s `STATIC_ROOT`), not `importlib.resources` -- so unlike
+#: `TEMPLATE_PACKAGE` this name never needs to reach `hidden_imports()`: nothing anywhere calls
+#: `importlib.import_module` or `importlib.resources.files` on it by string. It still has to
+#: reach `collect_data` below, because that is the step that copies the directory into the
+#: bundle at all; naming it here is what stops that copy from being forgotten the way the
+#: config templates already were once (see the module docstring's point 5).
+STATIC_PACKAGE = "keel.web.static"
+
 
 def _module_of(distribution: str) -> str:
     """`keel-broker-fake` -> `keel_broker_fake`. The import package for a keel distribution is
@@ -98,5 +116,5 @@ def freeze_inputs() -> dict[str, tuple[str, ...]]:
     return {
         "hiddenimports": hidden_imports(),
         "copy_metadata": metadata_distributions(),
-        "collect_data": (TEMPLATE_PACKAGE,),
+        "collect_data": (TEMPLATE_PACKAGE, STATIC_PACKAGE),
     }
diff --git a/keel/web/server.py b/keel/web/server.py
index 582254b..1e306d5 100644
--- a/keel/web/server.py
+++ b/keel/web/server.py
@@ -45,7 +45,7 @@
 from typing import Any
 from urllib.parse import parse_qs, quote, urlsplit
 
-from keel.web import render
+from keel.web import render, staticfiles
 from keel.web.security import (
     SESSION_COOKIE,
     HostPolicy,
@@ -309,10 +309,16 @@ def page_glossary(_cfg: ServeConfig, _query: dict[str, list[str]]) -> tuple[str,
 }
 
 
-#: The write surface, in full. A path here maps to one `keel.commands.setup.Action`; there is no
-#: other way into this handler, and no other verb.
+#: The write surface, in full, today. A path here maps to one `keel.commands.setup.Action`; there
+#: is no other way into this handler, and no other verb.
 SETUP_ACTION_PREFIX = "/setup/"
 
+#: Reserved for #533/#534's JSON API and #536's fetch()-based client -- nothing is mapped under
+#: it yet, so a POST here is a 404 like any other unmapped path. Named now because #535's third
+#: CSRF layer (`X-Keel-Client`, checked in `_client_header_ok`) is scoped to it specifically: see
+#: that method's docstring for why it must NOT also gate `SETUP_ACTION_PREFIX`.
+API_PREFIX = "/api/"
+
 
 def run_setup_action(cfg: ServeConfig, key: str, form: dict[str, str]) -> Any:
     """Perform one declared setup action. Returns its `ActionResult`, or `None` for a key that is
@@ -365,6 +371,87 @@ def _close(repo: Any) -> None:
 )
 
 
+#: The header set for `/static/*` (#535), separate from `_SECURITY_HEADERS` above because the
+#: two routes need different values for the SAME header, not merely an additional one.
+#: `_SECURITY_HEADERS`'s `default-src 'none'` is correct for the rendered pages -- they ship no
+#: script, no style file, no image, nothing to permit -- but #536's client is exactly the thing
+#: `'none'` forbids: its own JS, its own CSS, its own icons, all same-origin. `'self'` is the
+#: tightest policy that still allows that, and `connect-src 'self'` on top of it is the specific
+#: guarantee the design spec asks for: the interface is provably incapable of sending positions,
+#: equity or trade history anywhere but this local process, checkable in the response headers
+#: rather than merely promised.
+#:
+#: `X-Frame-Options`, `Referrer-Policy` and `X-Content-Type-Options` are unconditional -- all
+#: three are meaningful (and harmless) on any content type, exactly as they are for the rendered
+#: pages above. CSP is NOT: RFC-wise it is a response header with no defined meaning outside a
+#: browsing context, so it is applied only where the content type IS one -- `text/html`, and
+#: `image/svg+xml` (see `_CSP_CONTENT_TYPES` and `_static_headers` below) -- matching the design
+#: spec's "CSP belongs on `text/html` responses only; it is invalid and discouraged on other
+#: content types."
+_STATIC_BASE_HEADERS: tuple[tuple[str, str], ...] = (
+    ("X-Content-Type-Options", "nosniff"),
+    ("X-Frame-Options", "DENY"),
+    ("Referrer-Policy", "no-referrer"),
+    # `_serve_static` writes its own headers rather than going through `_send` (below), which is
+    # what let this go missing initially: `_send` puts `Cache-Control: no-store` on every
+    # rendered page, and that omission here meant a browser was free to heuristically cache a
+    # static asset with NO explicit directive at all. Harmless for today's one placeholder file,
+    # but #536 ships a real client next, and a stale shell surviving an engine upgrade in the
+    # HTTP cache is exactly the failure the design spec's service-worker cache key (keyed to
+    # `/api/config`'s build version) exists to prevent one layer up -- this is the layer below
+    # it. `no-store` for now is the conservative match to the rendered pages; a `CacheFirst`
+    # strategy with content-hashed filenames is #536's to add once there is a build version to
+    # key it to.
+    ("Cache-Control", "no-store, max-age=0"),
+)
+
+#: `default-src 'self'; connect-src 'self'` alone was the shape reviewed in and it was
+#: incomplete: `form-action`, `base-uri` and `frame-ancestors` do NOT fall back to `default-src`
+#: under CSP3 -- each is independently permissive (`form-action` defaults to "anywhere",
+#: `base-uri` to "anywhere", `frame-ancestors` to "anywhere") unless named explicitly. Without
+#: them, `connect-src 'self'` still stops `fetch`/`XHR`/`EventSource` leaving the origin, but a
+#: `<form method=post action="https://evil.example">` is not a connection and would have sailed
+#: through, an injected `<base href="https://evil.example/">` could retarget every relative URL
+#: on the page, and the page could still be framed by a hostile origin -- the exact DNS-rebinding
+#: half `_SECURITY_HEADERS` above already closes for the rendered pages
+#: (`frame-ancestors 'none'` there is called "the other half of the DNS-rebinding defence"; this
+#: is the same half, for the route that will host all of #536's JavaScript).
+_STATIC_CSP = (
+    "default-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'none'; "
+    "frame-ancestors 'none'"
+)
+
+#: The content types CSP applies to. `text/html` for the obvious reason; `image/svg+xml` because
+#: SVG is ACTIVE content -- a same-origin `.svg` opened directly (not `<img>`-embedded, which
+#: does not execute it) runs any inline `<script>` it contains in keel's own origin, with no
+#: policy at all unless CSP explicitly covers this content type too.
+_CSP_CONTENT_TYPES: tuple[str, ...] = ("text/html", "image/svg+xml")
+
+# `Strict-Transport-Security` is deliberately absent from both header sets above, on every
+# response this server ever sends -- recorded here so nobody adds it back reading only the
+# acceptance checklist. `keel serve` binds loopback HTTP by design
+# (`docs/superpowers/specs/2026-08-23-web-ui-rewrite-design.md`'s secure-context argument:
+# `http://127.0.0.1` is a secure context by specification, so the service worker, manifest and
+# browser install all work with no TLS decision required). HSTS exists to upgrade a site that
+# COULD be intercepted on the way to a plaintext connection; there is no "on the way" here, and
+# pinning `max-age` on loopback would only ever matter if this process later bound a
+# non-loopback address (an operator's own choice, already warned about loudly in `serve()`
+# below) -- at which point a stale HSTS pin from an earlier loopback run would be actively
+# wrong: forcing HTTPS at an address that was never issued a certificate.
+
+
+def _static_headers(content_type: str) -> tuple[tuple[str, str], ...]:
+    """`_STATIC_BASE_HEADERS` plus CSP, but ONLY when `content_type` is one of
+    `_CSP_CONTENT_TYPES` -- see the comments on `_STATIC_BASE_HEADERS` and `_CSP_CONTENT_TYPES`
+    for why the other static content types get no CSP at all, not a looser one."""
+    if any(content_type.startswith(kind) for kind in _CSP_CONTENT_TYPES):
+        return (
+            ("Content-Security-Policy", _STATIC_CSP),
+            *_STATIC_BASE_HEADERS,
+        )
+    return _STATIC_BASE_HEADERS
+
+
 class KeelHandler(BaseHTTPRequestHandler):
     """GET and HEAD. No other verb is implemented, so no other verb reaches keel."""
 
@@ -443,6 +530,88 @@ def _admitted(self) -> bool:
             return False
         return True
 
+    def _sec_fetch_site_ok(self) -> bool:
+        """Checked on EVERY `POST`, `/setup/*` included -- unlike `_api_client_header_ok` below,
+        a plain HTML `<form method=post>` DOES carry `Sec-Fetch-Site`: it is Fetch Metadata, set
+        by the browser on every request the page itself initiates, forms included, and page
+        JavaScript can neither set nor override it.
+
+        That asymmetry is exactly why a WRONG value is refused while a MISSING one is not: a
+        wrong value (`cross-site`, `same-site`) is the browser itself reporting that this request
+        did not originate on this page, which nothing here could otherwise learn. A missing value
+        proves nothing -- the header is a comparatively recent Fetch Metadata addition (Safari
+        shipped it later than Chrome/Firefox) -- so refusing its absence would turn a
+        defence-in-depth layer into an availability bug for exactly the users who most need every
+        OTHER layer (host validation, the session cookie, the CSRF token) to hold."""
+        sec_fetch_site = self.headers.get("Sec-Fetch-Site")
+        if sec_fetch_site is not None and sec_fetch_site != "same-origin":
+            self._refuse(
+                403,
+                "Refused",
+                "This request's Sec-Fetch-Site header says it did not originate on this page.",
+            )
+            return False
+        return True
+
+    def _api_client_header_ok(self) -> bool:
+        """The third CSRF layer (#535), and scoped to `API_PREFIX` ONLY -- never to
+        `SETUP_ACTION_PREFIX`. This was gated at the top of `do_POST`, over every write, in an
+        earlier version of this change, and that was a defect, not a stricter check: the shipped
+        UI's entire write surface IS a plain HTML `<form method=post action="/setup/...">`
+        (`render.py`'s `_action_form`), and `_SECURITY_HEADERS` ships no `script-src` at all --
+        there is no code path by which that form can set a custom request header. Gating
+        `/setup/*` on it would have refused every legitimate submission the shipped client can
+        make, with no fallback: the desktop bundle has no terminal.
+        `test_a_browser_form_post_succeeds_without_the_api_client_header` pins that this route
+        stays reachable from exactly what ships.
+
+        `X-Keel-Client: 1` is a real defence where it CAN apply: a custom header forces a CORS
+        preflight a hostile origin cannot satisfy, closing the one gap `SameSite=Strict` and the
+        HMAC CSRF token both assume shut -- a plain form POST, which is never preflighted, in any
+        browser. But "a custom header" and "a `fetch()` client" are the same requirement, and
+        `/setup/*` has no `fetch()` client today. `API_PREFIX` is reserved for #533/#534's JSON
+        API, which #536's client speaks over `fetch()` -- that is where this check belongs, and
+        widening it onto `/setup/*` is #536's call to make, once (and only once) the forms it
+        replaces are gone."""
+        if self.headers.get("X-Keel-Client") != "1":
+            self._refuse(
+                403,
+                "Refused",
+                "This request is missing the header keel's own API client always sends.",
+            )
+            return False
+        return True
+
+    def _serve_static(self, url_path: str) -> None:
+        """One file under `staticfiles.STATIC_PREFIX` (#535), or the same 404 an unmapped
+        `ROUTES` path gets -- containment and the Content-Type table are `staticfiles`'s job
+        (`tests/web/test_staticfiles.py` pins the resolver in isolation); this method's only
+        responsibility is refusing anything it returns `None` for, uniformly, so a missing
+        static file and a missing page look identical to a client probing the server."""
+        resolved = staticfiles.resolve_static_asset(staticfiles.STATIC_ROOT, url_path)
+        content_type = staticfiles.content_type_for(resolved) if resolved is not None else None
+        if resolved is None or content_type is None:
+            self._refuse(404, "No such page", f"Nothing is served at {url_path}.")
+            return
+
+        try:
+            # A second filesystem race between `resolve_static_asset`'s existence check and this
+            # read (the file removed, a permission change) must be a clean 500 like any other
+            # broken page (`test_a_broken_page_does_not_take_the_server_down`'s guarantee),
+            # never an uncaught exception that leaves the connection hanging.
+            payload = resolved.read_bytes()
+        except OSError as exc:
+            self._refuse(500, "That file could not be read", f"{type(exc).__name__}: {exc}")
+            return
+        self.send_response(200)
+        self.send_header("Content-Type", content_type)
+        self.send_header("Content-Length", str(len(payload)))
+        for name, value in _static_headers(content_type):
+            self.send_header(name, value)
+        self.end_headers()
+        if self.command != "HEAD":
+            self.wfile.write(payload)
+
     # -- the request --
     def do_HEAD(self) -> None:  # noqa: N802 - stdlib's naming, not ours
         self.do_GET()
@@ -450,15 +619,31 @@ def do_HEAD(self) -> None:  # noqa: N802 - stdlib's naming, not ours
     def do_POST(self) -> None:  # noqa: N802 - stdlib's naming, not ours
         """The ENTIRE write surface (#437). Read `keel/web/__init__.py` before extending it.
 
-        Four refusals before anything is performed, and then a lookup in a closed set. There is
-        no dynamic dispatch here, no getattr on a user-supplied name, and no path that reaches
-        keel other than `keel.commands.setup.ACTIONS` -- which contains three idempotent,
-        non-destructive, `MECHANICAL` steps and cannot contain anything else without failing a
-        test."""
+        Admission, then `Sec-Fetch-Site` (both apply to every POST), then a PATH-SCOPED branch:
+        `API_PREFIX` additionally requires `X-Keel-Client` before falling through to the 404 no
+        route there answers yet; `SETUP_ACTION_PREFIX` does not, and reads its own CSRF token
+        instead (see `_api_client_header_ok`'s docstring for why the two paths differ -- it is
+        not an oversight, it is the fix for one). Either way there is no dynamic dispatch here,
+        no getattr on a user-supplied name, and no path that reaches keel other than
+        `keel.commands.setup.ACTIONS` -- which contains three idempotent, non-destructive,
+        `MECHANICAL` steps and cannot contain anything else without failing a test."""
         parsed = urlsplit(self.path)
         if not self._admitted():
             return
 
+        if not self._sec_fetch_site_ok():
+            return
+
+        if parsed.path.startswith(API_PREFIX):
+            if not self._api_client_header_ok():
+                return
+            # No JSON API write surface exists yet (#533/#534 land the reads; a write is
+            # further out still) -- this is a 404 like any other unmapped path, not a stub
+            # success. Checked here, ahead of that surface existing, so its first action does
+            # not have to remember to add the gate.
+            self._refuse(404, "No such action", f"Nothing accepts a POST at {parsed.path}.")
+            return
+
         if not parsed.path.startswith(SETUP_ACTION_PREFIX):
             # Not "method not allowed" -- there is no write surface at this path at all, and
             # saying so is both true and less informative to someone probing.
@@ -548,6 +733,15 @@ def do_GET(self) -> None:  # noqa: N802 - stdlib's naming, not ours
         if not self._admitted():
             return
 
+        if parsed.path.startswith(staticfiles.STATIC_PREFIX):
+            # Same admission as every rendered page (never weakened): a static asset is not
+            # exempted from the loopback-plus-session model just because it holds no secrets
+            # today. #536's client is what actually reads these, and it authenticates the same
+            # way any other fetch from this origin does -- the session cookie already on the
+            # request.
+            self._serve_static(parsed.path)
+            return
+
         handler = ROUTES.get(parsed.path)
         if handler is None:
             self._refuse(404, "No such page", f"Nothing is served at {parsed.path}.")
diff --git a/keel/web/static/index.html b/keel/web/static/index.html
new file mode 100644
index 0000000..7d621df
--- /dev/null
+++ b/keel/web/static/index.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>keel</title>
+</head>
+<body>
+<!--
+  Placeholder for #536's client, which does not exist yet. This file exists so that #535's
+  static-serving capability -- directory containment, Content-Type-by-extension, the header set
+  -- is exercised end to end by a real request rather than only by unit tests against a
+  synthetic root. Nothing here is wired up as a page a user is meant to reach: the rendered
+  routes in `keel/web/server.py`'s `ROUTES` table still own navigation until #536 lands.
+-->
+<p>keel's static asset serving is live. The client that uses it (#536) is not built yet.</p>
+</body>
+</html>
diff --git a/keel/web/staticfiles.py b/keel/web/staticfiles.py
new file mode 100644
index 0000000..5fc86c4
--- /dev/null
+++ b/keel/web/staticfiles.py
@@ -0,0 +1,99 @@
+"""Static asset serving for `keel serve` (#535).
+
+The client that consumes this -- plain ES modules, a stylesheet, icons -- is #536 and does not
+exist yet. What ships here is the serving capability itself, on the same origin as the existing
+rendered routes (§"Static assets and the API share ONE origin" in the design spec), plus one
+placeholder asset so the path is exercised end to end rather than merely reachable in theory.
+
+**Why a hand-written resolver and not `http.server.SimpleHTTPRequestHandler`.** The stdlib
+handler roots itself at the process's current working directory, which is wherever `keel serve`
+happened to be launched from -- not a fixed location inside the package. Wiring it up safely
+would mean overriding `translate_path` anyway, at which point there is nothing left to reuse.
+
+**The traversal defence is `resolve()` then `relative_to()`, not string matching.** A check for
+the literal substring `".."` is a losing game against encoding (`%2e%2e`), redundant separators,
+and symlinks, and it also has a sharper failure mode that is easy to miss entirely: `Path`'s `/`
+operator DISCARDS the left side when the right side is absolute --
+`Path("/srv/static") / "/etc/passwd"` is `Path("/etc/passwd")`, not an error and not a joined
+path. A resolver that only rejected strings containing `".."` would serve `/etc/passwd` to a
+request for `/static//etc/passwd` and never notice. Resolving the candidate against the
+filesystem and then asking whether it is still `relative_to` the static root catches both
+failure modes with one check, because it asks the only question that matters: where does this
+path ACTUALLY point, not what does its spelling suggest.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from urllib.parse import unquote
+
+#: Where the shipped assets live, inside the installed package. A wheel build ships this
+#: directory because `pyproject.toml`'s `artifacts` glob (`keel/web/static/**`) says to; without
+#: that glob the directory exists in a checkout and nowhere else, which is the exact bug #535
+#: exists to close (see the comment beside that glob).
+STATIC_ROOT = Path(__file__).resolve().parent / "static"
+
+#: The URL prefix static requests are served under. Kept off `/` and the rest of `server.py`'s
+#: `ROUTES` table on purpose: the rendered pages still own the root paths today, and #536's
+#: client does not exist yet, so nothing here can collide with current routing. When the client
+#: lands, its entry point is served from under this prefix like everything else it ships.
+STATIC_PREFIX = "/static/"
+
+#: Content-Type by extension, spelled out rather than left to `mimetypes.guess_type`. The stdlib
+#: table is OS-dependent -- some platforms still answer a `.js` file with `text/plain` -- and a
+#: wrong type paired with `X-Content-Type-Options: nosniff` (added below) is a script the
+#: browser refuses to RUN rather than one it sniffs its way around the mistake for. So the type
+#: has to be correct, not merely present, and an extension absent from this table is refused
+#: (404) rather than guessed: a "correct" 404 is safer than a wrong Content-Type served with
+#: confidence.
+_CONTENT_TYPES: dict[str, str] = {
+    ".html": "text/html; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".mjs": "text/javascript; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    ".webmanifest": "application/manifest+json",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".ico": "image/x-icon",
+    ".txt": "text/plain; charset=utf-8",
+}
+
+
+def content_type_for(path: Path) -> str | None:
+    """The Content-Type for a static file, by its extension. `None` for an extension this server
+    does not know how to label -- the caller's job is to refuse, not to guess."""
+    return _CONTENT_TYPES.get(path.suffix.lower())
+
+
+def resolve_static_asset(root: Path, url_path: str) -> Path | None:
+    """A file inside `root` for a request path under `STATIC_PREFIX`, or `None`.
+
+    `None` covers three cases the caller must treat identically -- as a 404, never as a 500 or
+    as "serve something close enough": the path does not start with the static prefix, the
+    computed target does not exist or is not a plain file, or the target would land outside
+    `root` once symlinks and `..` segments are resolved. Decoded ONCE (`unquote`), matching
+    `http.server`'s own behaviour and the browser's: a doubly-encoded `%252e%252e` decodes here
+    to the literal, inert string `%2e%2e`, not to `..`.
+    """
+    if not url_path.startswith(STATIC_PREFIX):
+        return None
+    rel = unquote(url_path[len(STATIC_PREFIX) :])
+    if not rel or "\x00" in rel:
+        # A null byte truncates a C string in some filesystem APIs beneath Python's own; refused
+        # here rather than let `resolve()` raise it as an uncaught `ValueError` a layer up.
+        return None
+
+    root_resolved = root.resolve()
+    try:
+        # See the module docstring: `root / rel` alone is not a safe join when `rel` can be
+        # absolute. `resolve()` then `relative_to()` is what actually enforces containment,
+        # regardless of how `rel` got here.
+        candidate = (root / rel).resolve()
+        candidate.relative_to(root_resolved)
+    except ValueError:
+        return None
+
+    if not candidate.is_file():
+        return None
+    return candidate
diff --git a/pyproject.toml b/pyproject.toml
index 5e00242..5246fee 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -44,8 +44,22 @@ module-root = ""
 # `keel_trader/` from the distribution name.
 module-name = "keel"
 # Ship the default config template inside the wheel so `keel init-config` can write it out on a
-# fresh install (the wheel otherwise contains only .py files).
-artifacts = ["keel/templates/*.yaml"]
+# fresh install, and (#535) the web UI's static assets so `keel serve` has something to serve
+# from an installed wheel rather than a checkout.
+#
+# ⚠️ Measured against the pinned uv_build (`uv_build>=0.10.4,<0.13.0`, resolving to 0.11.31 as
+# of #535): this key has NO observable effect. `artifacts` does not appear in uv_build's
+# documented `[tool.uv.build-backend]` schema (`module-root`, `module-name`, `namespace`, `data`,
+# `source-include`, `source-exclude`, `wheel-exclude`, `default-excludes`), and removing this
+# line entirely, or replacing its value with garbage, still ships both the templates and
+# `keel/web/static/**` in a rebuilt wheel with no warning either way -- uv_build's actual default
+# is "the whole module tree except `default-excludes`" (`__pycache__`, `*.pyc`, `*.pyo`), not
+# "importable source only". `tests/test_packaging.py::test_static_assets_survive_being_built_
+# into_a_wheel` therefore checks the built wheel directly rather than trusting this line, and
+# would catch it if a future uv_build (or a `wheel-exclude` added here later) narrowed that
+# default. Left in place as a statement of intent and because it is the field this project's
+# prior art used for the same purpose -- but it is not, today, load-bearing.
+artifacts = ["keel/templates/*.yaml", "keel/web/static/**"]
 
 [tool.uv.workspace]
 members = ["packages/*"]
@@ -216,3 +230,12 @@ exclude_also = [
     "raise NotImplementedError",
     "@overload",
 ]
+
+# `ci.yml` and `release.yml` both run a plain `pytest -q` with no `-m` filter, so registering a
+# marker here changes nothing about what CI runs -- it exists to give a contributor working
+# offline, or iterating quickly, an opt OUT (`pytest -q -m "not slow"`) for the one test that
+# shells out to a real `uv build` (tests/test_packaging.py) rather than exercising pure Python.
+[tool.pytest.ini_options]
+markers = [
+    "slow: shells out to a real subprocess (e.g. `uv build`) instead of pure Python; still runs in CI, skip locally with -m 'not slow'",
+]
diff --git a/tests/commands/test_console_thinness.py b/tests/commands/test_console_thinness.py
index 2133aaf..7433f0c 100644
--- a/tests/commands/test_console_thinness.py
+++ b/tests/commands/test_console_thinness.py
@@ -76,18 +76,22 @@ def _console_module_paths() -> list[str]:
     return sorted(set(paths))
 
 
-#: Rule 5's one entry-scoped exception, in the same shape as every other allowance here:
+#: Rule 5's entry-scoped exceptions, in the same shape as every other allowance here:
 #: (module stem, imported module).
 #:
 #: Rule 5 bans `urllib` by ROOT, which is the right coarseness for a rule about network egress --
 #: `urllib.request.urlopen` is the thing it exists to stop. But `urllib.parse` performs no I/O at
 #: all: it is string manipulation, and it is how `keel/web/server.py` splits a request path from
-#: its query string. The alternative was hand-rolling percent-decoding on attacker-influenced
-#: input, which is a strictly worse trade than one named, scoped allowance.
+#: its query string, and (#535) how `keel/web/staticfiles.py` decodes one static-asset path
+#: segment before checking it stays inside the static root. The alternative in both cases was
+#: hand-rolling percent-decoding on attacker-influenced input, which is a strictly worse trade
+#: than one named, scoped allowance.
 #:
-#: Scoped to the module and the exact import, so it cannot widen: `urllib.request` in the same
-#: file still fails, and `urllib.parse` anywhere else still fails.
-RULE5_IMPORT_ALLOWLIST: frozenset[tuple[str, str]] = frozenset({("server", "urllib.parse")})
+#: Scoped to the module and the exact import, so it cannot widen: `urllib.request` in either file
+#: still fails, and `urllib.parse` anywhere else still fails.
+RULE5_IMPORT_ALLOWLIST: frozenset[tuple[str, str]] = frozenset(
+    {("server", "urllib.parse"), ("staticfiles", "urllib.parse")}
+)
 
 
 #: The compute trees -- where sizing/backtest/gate/screening/reporting math lives. The
diff --git a/tests/test_freeze.py b/tests/test_freeze.py
index 91ee881..77172f0 100644
--- a/tests/test_freeze.py
+++ b/tests/test_freeze.py
@@ -21,6 +21,7 @@
 
 from keel.freeze import (
     EXCLUDED_MODULES,
+    STATIC_PACKAGE,
     TEMPLATE_PACKAGE,
     broker_modules,
     freeze_inputs,
@@ -80,6 +81,18 @@ def test_the_config_templates_are_collected() -> None:
     assert TEMPLATE_PACKAGE in inputs["hiddenimports"]
 
 
+def test_the_web_ui_static_assets_are_collected() -> None:
+    """(#535) `keel/web/staticfiles.py` finds its assets with `Path(__file__).parent / "static"`
+    -- a filesystem lookup relative to the frozen module's OWN location -- so `/static/*` (and
+    every request #536's client makes for its own shell) 404s in the desktop bundle unless
+    PyInstaller actually copies `keel/web/static/` in. Not asserted against `hiddenimports`,
+    unlike the templates above: nothing calls `importlib.import_module` or
+    `importlib.resources.files` on `STATIC_PACKAGE` by string, so there is nothing for PyInstaller
+    to fail to statically discover -- only `collect_data`, the copy step, applies here."""
+    inputs = freeze_inputs()
+    assert STATIC_PACKAGE in inputs["collect_data"]
+
+
 def test_the_inputs_are_computed_and_not_hardcoded() -> None:
     """The failure this module exists to prevent is a list that goes stale. If `freeze.py` ever
     grows a literal adapter name, this is where that shows up."""
diff --git a/tests/test_packaging.py b/tests/test_packaging.py
index 463908e..077d78b 100644
--- a/tests/test_packaging.py
+++ b/tests/test_packaging.py
@@ -75,6 +75,77 @@ def test_the_dev_only_fake_venue_is_not_a_runtime_dependency_of_anything():
         assert "keel-broker-fake" not in deps, f"{name} must not depend on keel-broker-fake"
 
 
+# -- what actually survives packaging, not what the source tree merely holds --------------------
+
+
+@pytest.mark.slow
+def test_static_assets_survive_being_built_into_a_wheel(tmp_path: Path) -> None:
+    """Whether `keel/web/static/` ships is a fact about the BUILT wheel, never about the source
+    tree, and only inspecting a real build can state it (#535).
+
+    Asserting the source tree holds these files (a bare `Path.exists`) would prove nothing: they
+    are on disk in every checkout regardless of what the packaging step does with them.
+    `pyproject.toml`'s `artifacts` glob states the intent to ship them, but -- measured directly,
+    see the comment beside that glob -- it turns out to have no effect on the currently pinned
+    `uv_build`, which already ships the whole module tree by default. That measurement is exactly
+    why this test builds a REAL wheel with the project's own build backend (`uv build`, the same
+    command `release.yml` runs) and inspects the zip it actually produces, rather than trusting
+    either the glob or the source tree: it is a regression guard against uv_build narrowing that
+    default, or a future `wheel-exclude` catching these files, not a check on the glob's syntax.
+
+    `slow`: it shells out to a real `uv build`. Still runs in CI (`ci.yml`/`release.yml` pass no
+    `-m` filter); `pytest -q -m "not slow"` skips it locally.
+    """
+    import subprocess
+    import zipfile
+
+    out_dir = tmp_path / "dist"
+    subprocess.run(
+        [
+            "uv",
+            "build",
+            "--wheel",
+            "--package",
+            "keel-trader",
+            "--out-dir",
+            str(out_dir),
+            "--no-build-logs",
+        ],
+        cwd=_ROOT,
+        check=True,
+        capture_output=True,
+        text=True,
+        timeout=120,
+    )
+    wheels = sorted(out_dir.glob("keel_trader-*.whl"))
+    assert wheels, f"`uv build` produced no wheel in {out_dir}"
+
+    with zipfile.ZipFile(wheels[0]) as archive:
+        shipped = set(archive.namelist())
+
+    static_dir = _ROOT / "keel" / "web" / "static"
+    on_disk = sorted(
+        p.relative_to(_ROOT).as_posix()
+        for p in static_dir.rglob("*")
+        # Filesystem cruft a contributor's OS or editor drops in unasked for (macOS's
+        # `.DS_Store` foremost -- `.gitignore` already excludes it, and so, empirically, does
+        # uv_build) is not a static asset, and comparing it against the wheel would fail this
+        # test for a reason that has nothing to do with packaging. Any dotfile is excluded on
+        # the same reasoning: nothing under `keel/web/static/` is meant to be one.
+        if p.is_file() and not any(part.startswith(".") for part in p.relative_to(static_dir).parts)
+    )
+    assert on_disk, (
+        f"no files under {static_dir} on disk -- this test would prove nothing about packaging"
+    )
+    for source in on_disk:
+        assert source in shipped, (
+            f"{source} exists in the source tree but is absent from the built wheel "
+            f"({wheels[0].name}) -- keel/web/static is no longer surviving packaging, whatever "
+            "the reason (uv_build's default module-tree inclusion narrowed, a wheel-exclude "
+            "pattern now catches it, or the file moved outside the module root)"
+        )
+
+
 #: The flag that identifies a strict override. `strict = true` cannot be used in a per-module
 #: section -- mypy applies it GLOBALLY whatever `module` the section names -- so the strict
 #: packages spell the bundle out flag by flag instead, and this is the one that best marks the
diff --git a/tests/web/test_server.py b/tests/web/test_server.py
index 1aae28a..d531515 100644
--- a/tests/web/test_server.py
+++ b/tests/web/test_server.py
@@ -81,11 +81,30 @@ def _request(
     cookie: str | None = None,
     host: str | None = None,
     form: dict[str, str] | None = None,
+    client_header: str | None = "1",
+    sec_fetch_site: str | None = None,
+    origin: str | None = None,
 ) -> tuple[int, dict[str, str], str]:
+    """`client_header` defaults to `"1"` and is only sent on `POST`: it is only CHECKED on
+    `API_PREFIX` (`/api/*`), so a default of `"1"` on every POST test in this module is
+    harmless everywhere else -- ignored by `/setup/*` -- and is what a real `fetch()` client
+    would send anyway (per the design spec's `api.js`). Tests of the layer itself pass
+    `client_header=None` (omitted entirely) or an explicit wrong value against an `/api/*` path.
+
+    `sec_fetch_site` and `origin` are both unset by default; pass them to reproduce what a real
+    browser sends for a same-origin form submission -- see
+    `test_a_browser_form_post_succeeds_without_the_api_client_header`, which is the test this
+    parameter pair exists for."""
     conn = http.client.HTTPConnection(cfg.host, cfg.port, timeout=10)
     headers = {"Host": host if host is not None else f"{cfg.host}:{cfg.port}"}
     if cookie:
         headers["Cookie"] = cookie
+    if method == "POST" and client_header is not None:
+        headers["X-Keel-Client"] = client_header
+    if sec_fetch_site is not None:
+        headers["Sec-Fetch-Site"] = sec_fetch_site
+    if origin is not None:
+        headers["Origin"] = origin
     body = None
     if form is not None:
         body = urlencode(form)
@@ -401,6 +420,163 @@ def test_the_csrf_token_is_not_the_session_token(
     assert csrf_token(running.token) in body
 
 
+# -- Sec-Fetch-Site (#535), checked on every POST -- /setup/* included --------------------------
+#
+# Unlike X-Keel-Client (below), a real browser form POST DOES carry Sec-Fetch-Site: it is Fetch
+# Metadata, set by the browser itself on every request the page initiates -- forms included --
+# and page JavaScript can neither set nor override it. That makes it load-bearing on /setup/*,
+# the write surface the shipped, script-free UI actually uses, unlike a custom header (see the
+# section after the next one), which that UI has no way to attach at all.
+
+
+def test_a_write_missing_sec_fetch_site_is_accepted(
+    empty_machine: web_server.ServeConfig,
+) -> None:
+    """Older browsers never send `Sec-Fetch-Site` at all; its absence must not be a refusal, or
+    every one of them would be locked out of the one write surface that exists."""
+    status, _headers, _body = _request(
+        empty_machine,
+        "/setup/config",
+        method="POST",
+        cookie=_session(empty_machine),
+        form={"csrf": _csrf(empty_machine)},
+        sec_fetch_site=None,
+    )
+    assert status == 303
+
+
+def test_a_write_with_sec_fetch_site_same_origin_is_accepted(
+    empty_machine: web_server.ServeConfig,
+) -> None:
+    status, _headers, _body = _request(
+        empty_machine,
+        "/setup/config",
+        method="POST",
+        cookie=_session(empty_machine),
+        form={"csrf": _csrf(empty_machine)},
+        sec_fetch_site="same-origin",
+    )
+    assert status == 303
+
+
+@pytest.mark.parametrize("value", ["cross-site", "same-site", "none"])
+def test_a_write_with_a_wrong_sec_fetch_site_is_refused(
+    empty_machine: web_server.ServeConfig, value: str
+) -> None:
+    """Page JavaScript cannot forge this header -- the browser sets it. A value present and
+    wrong is therefore real evidence of a cross-origin request, unlike a missing one."""
+    status, _headers, _body = _request(
+        empty_machine,
+        "/setup/config",
+        method="POST",
+        cookie=_session(empty_machine),
+        form={"csrf": _csrf(empty_machine)},
+        sec_fetch_site=value,
+    )
+    assert status == 403, value
+    assert not Path(empty_machine.config_path).exists()
+
+
+# -- the browser form the shipped UI actually submits --------------------------------------------
+
+
+def test_a_browser_form_post_succeeds_without_the_api_client_header(
+    empty_machine: web_server.ServeConfig,
+) -> None:
+    """THE regression this file exists to catch, and the reason X-Keel-Client below is scoped to
+    `/api/*` rather than every POST. `render.py`'s `_action_form` emits `<form method="post"
+    action="/setup/{key}">`, and `_SECURITY_HEADERS` ships `default-src 'none'` with no
+    `script-src` at all -- there is no code path by which that form can attach a custom request
+    header. An earlier version of #535 checked `X-Keel-Client` over EVERY POST, which made this
+    request -- exactly what a real browser sends for the shipped UI's only write action -- a
+    403. Every setup action (create config, create database, seed rules, capture credentials)
+    would have been unreachable, with no terminal to fall back to on the desktop bundle.
+
+    This sends what a real browser sends for that form: the session cookie, the CSRF token
+    (`render.py` embeds it as a hidden input), `Origin` (browsers attach it to POST even for a
+    same-origin submission), and `Sec-Fetch-Site: same-origin` (Fetch Metadata, forged by
+    nothing real). Deliberately NOT `X-Keel-Client` -- the point being pinned is that nothing
+    in the shipped client ever sends it."""
+    status, headers, _body = _request(
+        empty_machine,
+        "/setup/config",
+        method="POST",
+        cookie=_session(empty_machine),
+        form={"csrf": _csrf(empty_machine)},
+        client_header=None,
+        sec_fetch_site="same-origin",
+        origin=f"http://{empty_machine.host}:{empty_machine.port}",
+    )
+    assert status == 303
+    assert headers["Location"] == "/setup?ran=config"
+
+    from keel.commands.setup import inspect
+
+    state = inspect(empty_machine.config_path, empty_machine.db_path)
+    item = next(s for s in state.states if s.step.key == "config")
+    assert item.done is True
+
+
+# -- the client header (#535's third CSRF layer), scoped to API_PREFIX only ---------------------
+#
+# A custom request header is only obtainable from a `fetch()` client -- an HTML
+# `<form method=post>` cannot set one, which the section above pins directly. The shipped UI's
+# write surface IS such a form, so this check does not apply to it; #536's client will speak
+# `fetch()` over `/api/*`, which is where the check actually runs. `SameSite=Strict` and the HMAC
+# CSRF token both assume a hostile cross-origin write is PREFLIGHTED -- true for `fetch()`, never
+# true for a form -- so a custom header closes that gap specifically where a `fetch()` client
+# exists to carry it. A hostile origin's script could still try to add the header itself, but
+# doing so makes the request cross-origin-with-a-custom-header, which is exactly the shape CORS
+# preflights, and this server answers no `Access-Control-Allow-*` to any origin (there is no CORS
+# configuration at all -- see server.py's module docstring), so a hostile preflight cannot
+# succeed either.
+
+
+def test_an_api_write_without_the_client_header_is_refused(
+    empty_machine: web_server.ServeConfig,
+) -> None:
+    status, _headers, _body = _request(
+        empty_machine,
+        "/api/whatever",
+        method="POST",
+        cookie=_session(empty_machine),
+        client_header=None,
+    )
+    assert status == 403
+
+
+@pytest.mark.parametrize("value", ["0", "true", "yes", "2", ""])
+def test_an_api_write_with_a_wrong_client_header_value_is_refused(
+    empty_machine: web_server.ServeConfig, value: str
+) -> None:
+    status, _headers, _body = _request(
+        empty_machine,
+        "/api/whatever",
+        method="POST",
+        cookie=_session(empty_machine),
+        client_header=value,
+    )
+    assert status == 403, value
+
+
+def test_an_api_write_with_the_client_header_reaches_the_404_not_the_403(
+    empty_machine: web_server.ServeConfig,
+) -> None:
+    """No `/api/*` write surface exists yet (#533/#534); this pins that a CORRECT header clears
+    the client-header gate and lands on the same "no such action" 404 every unmapped path gets --
+    proving the check is a gate on a real path, not a black hole that also swallows valid
+    requests once one exists."""
+    status, _headers, body = _request(
+        empty_machine,
+        "/api/whatever",
+        method="POST",
+        cookie=_session(empty_machine),
+        client_header="1",
+    )
+    assert status == 404
+    assert "No such action" in body
+
+
 # -- the actions themselves, over the wire ------------------------------------------------------
 
 
@@ -624,6 +800,165 @@ def test_head_returns_the_headers_without_a_body(running: web_server.ServeConfig
     assert int(headers["Content-Length"]) > 0
 
 
+# -- static assets (#535) -------------------------------------------------------------------
+#
+# `keel/web/static/index.html` is the one placeholder asset the package ships (#536's real
+# client does not exist yet). These drive it over the real wire -- a real bound server, a real
+# `Path` on disk -- for the same reason `tests/web/test_staticfiles.py`'s module docstring
+# gives: the properties worth pinning are properties of the served bytes, not of a resolver
+# called directly.
+
+
+def test_a_shipped_static_asset_is_served(running: web_server.ServeConfig) -> None:
+    status, headers, body = _request(running, "/static/index.html", cookie=_session(running))
+    assert status == 200
+    assert headers["Content-Type"] == "text/html; charset=utf-8"
+    assert "keel" in body.lower()
+
+
+def test_static_assets_are_behind_the_same_admission_as_every_other_page(
+    running: web_server.ServeConfig,
+) -> None:
+    """Never weakened: a static file is not exempted from the loopback-plus-session model just
+    because it holds no secrets today. The same guard that protects `/rules` protects this."""
+    status, _headers, _body = _request(running, "/static/index.html")  # no cookie
+    assert status == 403
+
+
+def test_a_missing_static_asset_is_a_404(running: web_server.ServeConfig) -> None:
+    status, _headers, _body = _request(
+        running, "/static/does-not-exist.html", cookie=_session(running)
+    )
+    assert status == 404
+
+
+@pytest.mark.parametrize(
+    "path",
+    [
+        "/static/../keel/web/security.py",
+        "/static/../../pyproject.toml",
+        "/static/%2e%2e/%2e%2e/pyproject.toml",
+        "/static//etc/passwd",
+        "/static/..%2f..%2fpyproject.toml",
+    ],
+)
+def test_directory_traversal_through_the_wire_is_refused(
+    running: web_server.ServeConfig, path: str
+) -> None:
+    """The unit-level payloads live in `tests/web/test_staticfiles.py`; these are the same shape
+    of attack sent as an actual HTTP request line, over a real socket, to prove nothing between
+    the wire and the resolver -- URL parsing, `http.server`'s own request handling -- reopens
+    what the resolver closes."""
+    status, _headers, body = _request(running, path, cookie=_session(running))
+    assert status == 404, (path, body[:200])
+
+
+def test_a_static_html_response_carries_the_new_header_set(
+    running: web_server.ServeConfig,
+) -> None:
+    """The full set from #535, on `text/html`. `form-action`, `base-uri` and `frame-ancestors`
+    do NOT inherit from `default-src` under CSP3 -- each defaults to "anywhere" unless named --
+    so all three are asserted individually, not just `default-src`/`connect-src`."""
+    status, headers, _body = _request(running, "/static/index.html", cookie=_session(running))
+    assert status == 200
+    csp = headers["Content-Security-Policy"]
+    assert "default-src 'self'" in csp
+    assert "connect-src 'self'" in csp
+    assert "form-action 'self'" in csp
+    assert "base-uri 'none'" in csp
+    assert "frame-ancestors 'none'" in csp
+    assert headers["X-Frame-Options"] == "DENY"
+    assert headers["X-Content-Type-Options"] == "nosniff"
+    assert headers["Referrer-Policy"] == "no-referrer"
+    assert "no-store" in headers["Cache-Control"]
+    assert "Strict-Transport-Security" not in headers
+
+
+def test_a_static_svg_response_also_carries_the_csp(
+    running: web_server.ServeConfig, monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """SVG is active content: a same-origin `.svg` opened directly (not `<img>`-embedded, which
+    does not execute it) runs any inline `<script>` it contains in keel's own origin. Without CSP
+    on this content type too, that script runs with no policy at all."""
+    from keel.web import staticfiles
+
+    (tmp_path / "icon.svg").write_text("<svg></svg>")
+    monkeypatch.setattr(staticfiles, "STATIC_ROOT", tmp_path)
+
+    status, headers, _body = _request(running, "/static/icon.svg", cookie=_session(running))
+    assert status == 200
+    assert headers["Content-Type"] == "image/svg+xml"
+    csp = headers["Content-Security-Policy"]
+    assert "default-src 'self'" in csp
+    assert "frame-ancestors 'none'" in csp
+
+
+def test_a_non_html_non_svg_static_asset_carries_no_csp(
+    running: web_server.ServeConfig, monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """Per the design spec: CSP is invalid and discouraged on anything but `text/html` (and, per
+    #535's review, `image/svg+xml` -- see the test above). A CSS or JS asset still gets
+    `nosniff`, `X-Frame-Options` and `Referrer-Policy` -- those are meaningful on any content
+    type -- but no `Content-Security-Policy` header at all."""
+    from keel.web import staticfiles
+
+    (tmp_path / "style.css").write_text("body { color: black; }")
+    monkeypatch.setattr(staticfiles, "STATIC_ROOT", tmp_path)
+
+    status, headers, _body = _request(running, "/static/style.css", cookie=_session(running))
+    assert status == 200
+    assert headers["Content-Type"] == "text/css; charset=utf-8"
+    assert "Content-Security-Policy" not in headers
+    assert headers["X-Frame-Options"] == "DENY"
+    assert headers["X-Content-Type-Options"] == "nosniff"
+    assert headers["Referrer-Policy"] == "no-referrer"
+    assert "no-store" in headers["Cache-Control"]
+    assert "Strict-Transport-Security" not in headers
+
+
+def test_an_unrecognised_static_extension_is_refused(
+    running: web_server.ServeConfig, monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """A file with no entry in the Content-Type table is refused rather than guessed at -- see
+    `staticfiles.content_type_for`'s docstring."""
+    from keel.web import staticfiles
+
+    (tmp_path / "payload.exe").write_bytes(b"MZ")
+    monkeypatch.setattr(staticfiles, "STATIC_ROOT", tmp_path)
+
+    status, _headers, _body = _request(
+        running, "/static/payload.exe", cookie=_session(running)
+    )
+    assert status == 404
+
+
+def test_a_static_file_removed_between_resolve_and_read_is_a_500_not_a_hang(
+    running: web_server.ServeConfig, monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """`resolve_static_asset` proves the file existed at check time; a `read_bytes()` failure
+    afterwards (deleted, permission change) must land as a clean page, matching the guarantee
+    `test_a_broken_page_does_not_take_the_server_down` already pins for rendered routes."""
+    from keel.web import staticfiles
+
+    target = tmp_path / "flaky.html"
+    target.write_text("<html></html>")
+    monkeypatch.setattr(staticfiles, "STATIC_ROOT", tmp_path)
+
+    real_resolve = staticfiles.resolve_static_asset
+
+    def _resolve_then_delete(root: Path, url_path: str) -> Path | None:
+        resolved = real_resolve(root, url_path)
+        if resolved is not None:
+            resolved.unlink()
+        return resolved
+
+    monkeypatch.setattr(staticfiles, "resolve_static_asset", _resolve_then_delete)
+
+    status, _headers, body = _request(running, "/static/flaky.html", cookie=_session(running))
+    assert status == 500
+    assert "OSError" in body or "FileNotFoundError" in body
+
+
 def test_the_activity_scope_comes_from_the_query_and_hostile_input_collapses_safely(
     running: web_server.ServeConfig,
 ) -> None:
diff --git a/tests/web/test_staticfiles.py b/tests/web/test_staticfiles.py
new file mode 100644
index 0000000..d761d54
--- /dev/null
+++ b/tests/web/test_staticfiles.py
@@ -0,0 +1,129 @@
+"""`keel/web/staticfiles.py` -- the resolver in isolation, against a synthetic root.
+
+The wire-level exercise of the same code lives in `tests/web/test_server.py`, against the one
+placeholder asset the package actually ships. These tests are the ones that can try payloads a
+real filesystem would not conveniently hold still for -- an escape through a directory that may
+not even exist on the test machine -- without needing one to.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from keel.web import staticfiles
+
+
+@pytest.fixture
+def root(tmp_path: Path) -> Path:
+    (tmp_path / "index.html").write_text("<html>hi</html>")
+    (tmp_path / "style.css").write_text("body {}")
+    (tmp_path / "app.js").write_text("console.log(1)")
+    (tmp_path / "icon.svg").write_text("<svg></svg>")
+    (tmp_path / "unknown.exe").write_bytes(b"MZ")
+    sub = tmp_path / "sub"
+    sub.mkdir()
+    (sub / "nested.html").write_text("<html>nested</html>")
+    # A sibling of the static root -- the thing every traversal payload below is reaching for.
+    (tmp_path.parent / "secret.txt").write_text("do not serve me")
+    return tmp_path
+
+
+def test_a_plain_file_resolves(root: Path) -> None:
+    resolved = staticfiles.resolve_static_asset(root, "/static/index.html")
+    assert resolved == root / "index.html"
+
+
+def test_a_nested_file_resolves(root: Path) -> None:
+    resolved = staticfiles.resolve_static_asset(root, "/static/sub/nested.html")
+    assert resolved == root / "sub" / "nested.html"
+
+
+def test_a_path_missing_the_prefix_does_not_resolve(root: Path) -> None:
+    assert staticfiles.resolve_static_asset(root, "/index.html") is None
+
+
+def test_a_missing_file_does_not_resolve(root: Path) -> None:
+    assert staticfiles.resolve_static_asset(root, "/static/nope.html") is None
+
+
+def test_a_directory_is_not_a_file(root: Path) -> None:
+    assert staticfiles.resolve_static_asset(root, "/static/sub") is None
+    assert staticfiles.resolve_static_asset(root, "/static/sub/") is None
+
+
+def test_the_bare_prefix_does_not_resolve(root: Path) -> None:
+    assert staticfiles.resolve_static_asset(root, "/static/") is None
+
+
+# -- the entire point of the module ------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "payload",
+    [
+        "/static/../secret.txt",
+        "/static/../../secret.txt",
+        "/static/sub/../../secret.txt",
+        "/static/%2e%2e/secret.txt",
+        "/static/%2e%2e%2f%2e%2e/secret.txt",
+        "/static//../secret.txt",
+        "/static/./../secret.txt",
+        # The specific footgun the module docstring names: `Path("/root") / "/etc/passwd"`
+        # discards the root entirely rather than raising. Both a raw absolute path and its
+        # percent-encoded spelling must be caught by the same containment check.
+        "/static//etc/passwd",
+        "/static/%2fetc%2fpasswd",
+    ],
+)
+def test_directory_traversal_payloads_never_escape_the_root(root: Path, payload: str) -> None:
+    assert staticfiles.resolve_static_asset(root, payload) is None
+
+
+def test_a_null_byte_is_refused_not_raised(root: Path) -> None:
+    assert staticfiles.resolve_static_asset(root, "/static/index.html\x00.png") is None
+
+
+def test_a_doubly_encoded_traversal_is_inert_not_decoded_twice(root: Path) -> None:
+    """`%252e%252e` decodes ONCE, here, to the literal string `%2e%2e` -- not to `..`. It must
+    therefore fail to resolve to any real file, exactly like any other nonsense path, rather
+    than be walked a second time into an escape."""
+    assert staticfiles.resolve_static_asset(root, "/static/%252e%252e/secret.txt") is None
+
+
+# -- content types ------------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    ("name", "expected"),
+    [
+        ("index.html", "text/html; charset=utf-8"),
+        ("style.css", "text/css; charset=utf-8"),
+        ("app.js", "text/javascript; charset=utf-8"),
+        ("worker.mjs", "text/javascript; charset=utf-8"),
+        ("manifest.webmanifest", "application/manifest+json"),
+        ("data.json", "application/json; charset=utf-8"),
+        ("icon.svg", "image/svg+xml"),
+        ("icon.png", "image/png"),
+        ("favicon.ico", "image/x-icon"),
+        ("notes.txt", "text/plain; charset=utf-8"),
+    ],
+)
+def test_known_extensions_map_to_the_right_content_type(name: str, expected: str) -> None:
+    assert staticfiles.content_type_for(Path(name)) == expected
+
+
+def test_an_unknown_extension_has_no_content_type() -> None:
+    """No entry, not a guess. `mimetypes.guess_type` would happily return something for `.exe`;
+    the caller must refuse instead of serving a file it cannot correctly label."""
+    assert staticfiles.content_type_for(Path("payload.exe")) is None
+
+
+def test_an_unknown_extension_does_not_resolve_even_though_the_file_exists(root: Path) -> None:
+    """`resolve_static_asset` only proves the path is safe; `server.py` is expected to also
+    check `content_type_for` before serving. This pins that the file existing is not, by
+    itself, enough -- the type table is where an unrecognised kind gets refused."""
+    resolved = staticfiles.resolve_static_asset(root, "/static/unknown.exe")
+    assert resolved == root / "unknown.exe"  # resolves fine -- the type check is a SEPARATE gate
+    assert staticfiles.content_type_for(resolved) is None