@@ -10,7 +10,7 @@ import path from "node:path";
 import { ID_RE } from "./lib/entry-files.mjs";
 import { evidenceSection } from "./lib/frontmatter.mjs";
 import { isRealDate } from "./lib/shared.mjs";
-import { previewEligibility } from "./lib/thumbs.mjs";
+import { isPrivateHost, previewEligibility, safeImageUrl } from "./lib/thumbs.mjs";
 import { parseStack, pickPath, StackError } from "./lib/stacks.mjs";
 
 export { evidenceSection };
@@ -649,11 +649,6 @@ export function checkCategoryReadmeRows(categoryName, readmeText, entries) {
  * escaping HTML does nothing about a scheme.
  */
 /** localhost, *.local / *.internal, and IP literals: never a catalog source. */
-function isPrivateHost(hostname) {
-  const h = hostname.toLowerCase().replace(/^\[|\]$/g, "");
-  if (h === "localhost" || /\.(localhost|local|internal|lan)$/.test(h)) return true;
-  return /^\d{1,3}(\.\d{1,3}){3}$/.test(h) || h.includes(":");
-}
 
 export function checkEntryUrl(rel, meta) {
   const errors = [];
@@ -788,7 +783,9 @@ export function checkCountTables(measured, docs) {
 export function checkPreviewField(rel, meta) {
   if (meta.preview === undefined || meta.preview === null || meta.preview === "") return [];
   const v = String(meta.preview);
-  if (v === "none" || /^https:\/\/\S+$/.test(v)) return [];
+  if (v === "none") return [];
+  if (/^https:\/\/\S+$/.test(v) && safeImageUrl(v) === new URL(v).href) return [];
+  if (/^https:\/\/\S+$/.test(v)) return [`${rel} preview must be an https:// image URL on a public host`];
   return [`${rel} preview must be "none" or an https:// image URL`];
 }
 
@@ -824,6 +821,9 @@ export function checkThumbManifest(manifest, entriesById, files) {
     // entry's live licence, and the next script run refreshes the record.
     const gate = previewEligibility(entry);
     if (!gate.ok) errors.push(`thumbnail for "${id}" must be removed: ${gate.reason} (run node site/thumbs.mjs)`);
+    else if (rec.source && entry.url && rec.source !== String(entry.url)) {
+      errors.push(`thumbnail for "${id}" was fetched from ${rec.source} but the entry url is now ${entry.url} (run node site/thumbs.mjs --only ${id})`);
+    }
   }
   return errors;
 }
 
@@ -793,6 +793,7 @@ accepts("preview field: absent", checkPreviewField("ok.md", {}));
 accepts("preview field: none", checkPreviewField("ok.md", { preview: "none" }));
 accepts("preview field: https url", checkPreviewField("ok.md", { preview: "https://a/b.png" }));
 rejects("preview field: http refused", checkPreviewField("bad.md", { preview: "http://a/b.png" }), 'bad.md preview must be "none" or an https:// image URL');
+rejects("preview field: loopback refused", checkPreviewField("bad.md", { preview: "https://127.0.0.1/a.png" }), "bad.md preview must be an https:// image URL on a public host");
 rejects("preview field: word refused", checkPreviewField("bad.md", { preview: "yes" }), 'bad.md preview must be "none" or an https:// image URL');
 
 /* V30: line endings ------------------------------------------------------ */
 
@@ -898,7 +898,7 @@ eq("new-entry sets added to today", newEntryText("added: 2026-07-19\nverified: 2
 }
 
 // Site refresh: thumbnail rules.
-import { filmstripPick, imageUrlFromHtml, needsFetch, previewCredit, previewEligibility, publisherKey, sharedImageIds, webpSize } from "./thumbs.mjs";
+import { afterFailure, filmstripPick, imageUrlFromHtml, isPrivateHost, needsFetch, previewCredit, previewEligibility, publisherKey, safeImageUrl, sharedImageIds, sniffImage, webpSize } from "./thumbs.mjs";
 eq("thumbs: CC0 active itch page is eligible", previewEligibility({ license: "CC0", status: "active", url: "https://kaylousberg.itch.io/block-bits" }).ok, true);
 eq("thumbs: custom licence refused", previewEligibility({ license: "custom", status: "active", url: "https://x.itch.io/a" }).reason, "licence custom is not in the preview allowlist");
 eq("thumbs: needs-review refused before licence", previewEligibility({ license: "custom", status: "needs-review", url: "https://x.itch.io/a" }).reason, "status is needs-review");
@@ -917,6 +917,24 @@ eq("thumbs: needsFetch fresh same licence", needsFetch({ fetched: "2026-09-01",
 eq("thumbs: needsFetch licence changed", needsFetch({ fetched: "2026-09-01", license: "CC0" }, { license: "CC-BY-4.0", today: "2026-10-23" }), true);
 eq("thumbs: needsFetch stale", needsFetch({ fetched: "2026-01-01", license: "CC0" }, { license: "CC0", today: "2026-10-23" }), true);
 eq("thumbs: needsFetch force", needsFetch({ fetched: "2026-10-20", license: "CC0" }, { license: "CC0", today: "2026-10-23", force: true }), true);
+const recA = { source: "https://a.example/", image: "https://a.example/og.png", fetched: "2026-10-20", license: "CC0" };
+eq("thumbs: needsFetch url moved", needsFetch(recA, { license: "CC0", today: "2026-10-23", url: "https://b.example/", preview: "" }), true);
+eq("thumbs: needsFetch unchanged entry", needsFetch(recA, { license: "CC0", today: "2026-10-23", url: "https://a.example/", preview: "" }), false);
+eq("thumbs: needsFetch pin added", needsFetch(recA, { license: "CC0", today: "2026-10-23", url: "https://a.example/", preview: "https://a.example/shot.png" }), true);
+eq("thumbs: needsFetch pin changed", needsFetch({ ...recA, pinned: true, image: "https://a.example/old.png" }, { license: "CC0", today: "2026-10-23", url: "https://a.example/", preview: "https://a.example/new.png" }), true);
+eq("thumbs: needsFetch pin removed", needsFetch({ ...recA, pinned: true }, { license: "CC0", today: "2026-10-23", url: "https://a.example/", preview: "" }), true);
+eq("thumbs: afterFailure counts", afterFailure(recA, { today: "2026-10-23" }).failures, 1);
+eq("thumbs: afterFailure drops at the limit", afterFailure({ ...recA, failures: 2 }, { today: "2026-10-23" }), null);
+eq("thumbs: afterFailure drops an ancient image", afterFailure({ ...recA, fetched: "2025-01-01" }, { today: "2026-10-23" }), null);
+eq("thumbs: private host localhost", isPrivateHost("localhost"), true);
+eq("thumbs: private host ip literal", isPrivateHost("127.0.0.1"), true);
+eq("thumbs: public host", isPrivateHost("img.itch.zone"), false);
+eq("thumbs: http image upgraded", safeImageUrl("http://a.example/x.png"), "https://a.example/x.png");
+eq("thumbs: loopback image refused", safeImageUrl("https://127.0.0.1/x.png"), null);
+eq("thumbs: file scheme refused", safeImageUrl("file:///etc/passwd"), null);
+eq("thumbs: og:image on loopback refused", imageUrlFromHtml('<meta property="og:image" content="http://localhost/a.png">', "https://a.example/"), null);
+eq("thumbs: sniff png", sniffImage(Uint8Array.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 0])), "png");
+eq("thumbs: sniff html refused", sniffImage(new TextEncoder().encode("<!doctype html><html>")), null);
 {
   const hex = (s) => Buffer.from(s.replaceAll(" ", ""), "hex");
   const vp8x = hex("52494646 24000000 57454250 56503858 0a000000 10000000 7f0200 8f0100");
 
@@ -53,6 +53,40 @@ export function isAttributionLicence(license) {
   return /^CC-BY/.test(String(license));
 }
 
+/**
+ * True for hosts a fetch from CI must never reach: localhost, local-only
+ * suffixes and IP literals (a public catalog source is named by DNS).
+ */
+export function isPrivateHost(hostname) {
+  const h = String(hostname).toLowerCase().replace(/^\[|\]$/g, "");
+  if (h === "" || h === "localhost" || /\.(localhost|local|internal|lan)$/.test(h)) return true;
+  return /^\d{1,3}(\.\d{1,3}){3}$/.test(h) || h.includes(":");
+}
+
+/** An https URL on a public host, or null. http is upgraded to https; anything else is refused. */
+export function safeImageUrl(raw) {
+  let u;
+  try {
+    u = new URL(String(raw));
+  } catch {
+    return null;
+  }
+  if (u.protocol === "http:") u.protocol = "https:";
+  if (u.protocol !== "https:" || u.username || u.password || isPrivateHost(u.hostname)) return null;
+  return u.href;
+}
+
+/** The image format from its first bytes (png, jpeg, gif, webp), or null. Checked before a converter sees the file. */
+export function sniffImage(bytes) {
+  const b = bytes;
+  if (!b || b.length < 12) return null;
+  if (b[0] === 0x89 && b[1] === 0x50 && b[2] === 0x4e && b[3] === 0x47) return "png";
+  if (b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff) return "jpeg";
+  if (b[0] === 0x47 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x38) return "gif";
+  if (b[0] === 0x52 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x46 && b[8] === 0x57 && b[9] === 0x45 && b[10] === 0x42 && b[11] === 0x50) return "webp";
+  return null;
+}
+
 function hostOf(url) {
   try {
     return new URL(String(url)).hostname.toLowerCase();
@@ -115,7 +149,7 @@ export function imageUrlFromHtml(html, pageUrl) {
   if (!raw) return null;
   try {
     const abs = new URL(decodeEntities(raw).trim(), pageUrl);
-    return /^https?:$/.test(abs.protocol) ? abs.href : null;
+    return /^https?:$/.test(abs.protocol) ? safeImageUrl(abs.href) : null;
   } catch {
     return null;
   }
@@ -136,16 +170,45 @@ export function sharedImageIds(records) {
 
 const DAY = 86400000;
 
-/** Whether a stored record is missing, forced, under a different licence, or older than maxAgeDays. */
-export function needsFetch(record, { license, today, force = false, maxAgeDays = 180 }) {
+/**
+ * Whether a stored record is missing, forced, under a different licence,
+ * older than maxAgeDays, or no longer describes the entry: its `url` moved,
+ * a `preview:` pin was added, removed or changed. Pass `url` and
+ * `preview` to get the last three checks.
+ */
+export function needsFetch(record, { license, today, force = false, maxAgeDays = 180, url, preview }) {
   if (!record || force) return true;
   if (record.license !== license) return true;
+  if (url !== undefined && record.source !== url) return true;
+  if (preview !== undefined) {
+    const pinned = /^https:\/\//.test(preview || "");
+    if (Boolean(record.pinned) !== pinned) return true;
+    if (pinned && record.image !== preview) return true;
+  }
   const fetched = Date.parse(`${record.fetched}T00:00:00Z`);
   const now = Date.parse(`${today}T00:00:00Z`);
   if (Number.isNaN(fetched) || Number.isNaN(now)) return true;
   return now - fetched > maxAgeDays * DAY;
 }
 
+/** Consecutive failed refreshes after which a stored image is dropped. */
+export const MAX_FAILURES = 3;
+
+/**
+ * After a failed refresh: the record to keep (with its failure count raised),
+ * or null when it should be dropped because the source has failed
+ * MAX_FAILURES times in a row or the image is older than twice maxAgeDays.
+ */
+export function afterFailure(record, { today, maxAgeDays = 180 }) {
+  if (!record) return null;
+  const failures = (Number(record.failures) || 0) + 1;
+  const fetched = Date.parse(`${record.fetched}T00:00:00Z`);
+  const now = Date.parse(`${today}T00:00:00Z`);
+  const ancient = Number.isNaN(fetched) || Number.isNaN(now) || now - fetched > 2 * maxAgeDays * DAY;
+  if (failures >= MAX_FAILURES || ancient) return null;
+  return { ...record, failures };
+}
+
 /** Width and height of a WebP file from its header (VP8, VP8L or VP8X), or null. */
 export function webpSize(buf) {
   if (!buf || buf.length < 25) return null;
 
@@ -19,7 +19,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { listEntryFiles, idMatchesFile } from "./lib/entry-files.mjs";
 import { parseFrontmatter } from "./lib/frontmatter.mjs";
-import { imageUrlFromHtml, needsFetch, previewEligibility, sharedImageIds, webpSize } from "./lib/thumbs.mjs";
+import { afterFailure, imageUrlFromHtml, needsFetch, previewEligibility, safeImageUrl, sharedImageIds, sniffImage, webpSize } from "./lib/thumbs.mjs";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.resolve(__dirname, "..");
@@ -30,6 +30,8 @@ const USER_AGENT = "Mozilla/5.0 (compatible; FreeGameDevAssets-thumbs; +https://
 const MAX_IMAGE_BYTES = 15 * 1024 * 1024;
 const TIMEOUT_MS = 20000;
 const CONCURRENCY = 4;
+// A converter that hangs on a hostile file is killed rather than stalling the run.
+const CONVERT_TIMEOUT_MS = 30000;
 
 function parseArgs(argv) {
   const opts = { force: false, only: null, limit: Infinity, dryRun: false, report: null };
@@ -91,20 +93,37 @@ function convert(converter, input, output) {
     execFileSync(
       "ffmpeg",
       ["-y", "-loglevel", "error", "-i", input, "-frames:v", "1", "-vf", "scale='min(640,iw)':-2", "-c:v", "libwebp", "-quality", "78", output],
-      { stdio: ["ignore", "ignore", "pipe"] }
+      { stdio: ["ignore", "ignore", "pipe"], timeout: CONVERT_TIMEOUT_MS, killSignal: "SIGKILL", maxBuffer: 1024 * 1024 }
     );
   } else {
-    execFileSync("magick", [`${input}[0]`, "-resize", "640x>", "-quality", "78", output], { stdio: ["ignore", "ignore", "pipe"] });
+    execFileSync("magick", [`${input}[0]`, "-resize", "640x>", "-quality", "78", output], { stdio: ["ignore", "ignore", "pipe"], timeout: CONVERT_TIMEOUT_MS, killSignal: "SIGKILL", maxBuffer: 1024 * 1024 });
   }
 }
 
 async function fetchBytes(url, { maxBytes = MAX_IMAGE_BYTES } = {}) {
-  const res = await fetch(url, { headers: { "user-agent": USER_AGENT, accept: "*/*" }, signal: AbortSignal.timeout(TIMEOUT_MS), redirect: "follow" });
+  const safe = safeImageUrl(url);
+  if (!safe) throw new Error(`image URL refused (needs a public https host): ${url}`);
+  const res = await fetch(safe, { headers: { "user-agent": USER_AGENT, accept: "image/*" }, signal: AbortSignal.timeout(TIMEOUT_MS), redirect: "follow" });
   if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  if (res.url && !safeImageUrl(res.url)) throw new Error(`image redirected to a refused URL: ${res.url}`);
   const declared = Number(res.headers.get("content-length") || 0);
   if (declared > maxBytes) throw new Error(`image is ${declared} bytes, over the ${maxBytes} limit`);
-  const buf = Buffer.from(await res.arrayBuffer());
-  if (buf.length > maxBytes) throw new Error(`image is ${buf.length} bytes, over the ${maxBytes} limit`);
+  // Stream with a cap: content-length is optional and may lie.
+  const chunks = [];
+  let total = 0;
+  const reader = res.body.getReader();
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.length;
+    if (total > maxBytes) {
+      await reader.cancel();
+      throw new Error(`image is over the ${maxBytes} byte limit`);
+    }
+    chunks.push(value);
+  }
+  const buf = Buffer.concat(chunks);
+  if (!sniffImage(buf)) throw new Error("response is not a PNG, JPEG, GIF or WebP image");
   return buf;
 }
 
@@ -203,7 +222,7 @@ async function main() {
     }
     const rec = thumbs[entry.id];
     const fileExists = fs.existsSync(path.join(THUMBS_DIR, `${entry.id}.webp`));
-    if (!needsFetch(rec, { license: entry.license, today, force: opts.force }) && fileExists) {
+    if (!needsFetch(rec, { license: entry.license, today, force: opts.force, url: entry.url, preview: entry.preview || "" }) && fileExists) {
       summary.kept += 1;
       continue;
     }
@@ -225,6 +244,15 @@ async function main() {
         process.stdout.write(`  + ${entry.id} ${record.width}x${record.height} ${bytes.length} B\n`);
       } catch (err) {
         summary.failed.push({ id: entry.id, reason: err.message });
+        // A source that keeps failing does not keep its old image forever.
+        if (thumbs[entry.id]) {
+          const kept = afterFailure(thumbs[entry.id], { today });
+          if (kept) thumbs[entry.id] = kept;
+          else {
+            summary.removed.push({ id: entry.id, reason: `refresh failed repeatedly or image too old (${err.message})`, hash: thumbs[entry.id].hash });
+            delete thumbs[entry.id];
+          }
+        }
         process.stdout.write(`  ! ${entry.id}: ${err.message}\n`);
       }
     },