@@ -147,6 +147,10 @@ const ADMITTED_METHODS: [&str; 2] = ["GET", "POST"];
 /// source, from already-decided inputs.
 pub fn draft(inputs: &EmitInputs) -> Result<DraftArtifacts> {
     let method = request_method(&inputs.operation.method)?;
+    if !inputs.request_mappings.is_empty() {
+        validate_mapped_request_path(inputs)
+            .context("generated request path is outside the Evidence fixed-request contract")?;
+    }
 
     let mut get_paths = Vec::with_capacity(inputs.selection.len());
     for pointer in &inputs.selection {
@@ -321,6 +325,108 @@ fn request_path(inputs: &EmitInputs) -> String {
     format!("{prefix}{}", inputs.operation.path)
 }
 
+/// Mirror the pure FixedRequest path rules without linking the runtime into
+/// authoring. The runtime-admission parity test covers the complete rendered
+/// path, including its server prefix, bounds, escapes and binding names.
+fn validate_mapped_request_path(inputs: &EmitInputs) -> Result<()> {
+    let path = request_path(inputs);
+    if !(2..=2048).contains(&path.len()) || !path.starts_with('/') || !path.is_ascii() {
+        bail!("request paths must be absolute ASCII paths between 2 and 2048 bytes");
+    }
+    let bindings = inputs
+        .request_mappings
+        .iter()
+        .filter_map(|mapping| {
+            if let RequestTarget::Path(name) = &mapping.target {
+                Some(name.as_str())
+            } else {
+                None
+            }
+        })
+        .collect::<BTreeSet<_>>();
+    let mut placeholders = BTreeSet::new();
+    let mut normalized = String::with_capacity(path.len());
+    for segment in path.split('/').skip(1) {
+        if segment.is_empty() || matches!(segment, "." | "..") {
+            bail!("request paths must not contain empty or dot segments");
+        }
+        normalized.push('/');
+        if segment.contains(['{', '}']) {
+            let name = segment
+                .strip_prefix('{')
+                .and_then(|value| value.strip_suffix('}'))
+                .ok_or_else(|| {
+                    anyhow::anyhow!("a path placeholder must occupy one complete segment")
+                })?;
+            LocalId::new(name).with_context(|| {
+                format!(
+                    "path parameter `{name}` must be a Registry Stack LocalId for a path binding"
+                )
+            })?;
+            if !placeholders.insert(name) {
+                bail!("path placeholders must be unique: `{name}` is repeated");
+            }
+            if !bindings.contains(name) {
+                bail!("required request input `path:{name}` has no --map-selector assignment");
+            }
+            normalized.push('x');
+        } else {
+            normalized.push_str(segment);
+        }
+    }
+    if placeholders != bindings {
+        bail!("path bindings must exactly match the generated path placeholders");
+    }
+    let bytes = normalized.as_bytes();
+    let mut index = 0;
+    while index < bytes.len() {
+        let byte = bytes[index];
+        if byte == b'%' {
+            if index + 2 >= bytes.len()
+                || !bytes[index + 1].is_ascii_hexdigit()
+                || !bytes[index + 2].is_ascii_hexdigit()
+                || bytes[index + 1].is_ascii_lowercase()
+                || bytes[index + 2].is_ascii_lowercase()
+            {
+                bail!("request path contains a non-canonical escape");
+            }
+            let decoded = u8::from_str_radix(&normalized[index + 1..index + 3], 16)?;
+            if decoded.is_ascii_alphanumeric()
+                || matches!(decoded, b'-' | b'.' | b'_' | b'~' | b'/' | b'\\')
+            {
+                bail!("request path contains an ambiguous escape");
+            }
+            index += 3;
+        } else if byte.is_ascii_alphanumeric()
+            || matches!(
+                byte,
+                b'/' | b'.'
+                    | b'_'
+                    | b'~'
+                    | b'!'
+                    | b'$'
+                    | b'&'
+                    | b'\''
+                    | b'('
+                    | b')'
+                    | b'*'
+                    | b'+'
+                    | b','
+                    | b';'
+                    | b'='
+                    | b':'
+                    | b'@'
+                    | b'-'
+            )
+        {
+            index += 1;
+        } else {
+            bail!("request path contains a prohibited character");
+        }
+    }
+    Ok(())
+}
+
 /// Write every named Function asset under `<project>/`, creating parent
 /// directories as needed. Refuses to overwrite any existing file: if any
 /// target already exists, nothing is written and the error lists every
 
@@ -1026,28 +1026,6 @@ fn validate_required_inputs(
     body: Option<&types::OperationRequestBody>,
     mappings: &[RequestMapping],
 ) -> Result<()> {
-    let mut placeholders = BTreeSet::new();
-    for segment in operation.path.split('/') {
-        if !segment.contains(['{', '}']) {
-            continue;
-        }
-        let name = segment
-            .strip_prefix('{')
-            .and_then(|segment| segment.strip_suffix('}'))
-            .ok_or_else(|| anyhow!("a path placeholder must occupy one complete segment"))?;
-        registry_platform_yaml::LocalId::new(name).with_context(|| {
-            format!("path parameter `{name}` must be a Registry Stack LocalId for a path binding")
-        })?;
-        if !placeholders.insert(name) {
-            bail!("path placeholders must be unique: `{name}` is repeated");
-        }
-        if !mappings
-            .iter()
-            .any(|mapping| mapping.target == RequestTarget::Path(name.to_owned()))
-        {
-            bail!("required request input `path:{name}` has no --map-selector assignment");
-        }
-    }
     for parameter in parameters.iter().filter(|parameter| parameter.required) {
         let target = match parameter.location {
             ParameterLocation::Path => RequestTarget::Path(parameter.name.clone()),
 
@@ -259,7 +259,11 @@ fn unsupported_path_placeholders_are_refused_without_mutation() {
             &[format!(
                 "subject.subject-reference-v1.reference=path:{name}"
             )],
-            "must be a Registry Stack LocalId",
+            if name.is_ascii() {
+                "must be a Registry Stack LocalId"
+            } else {
+                "absolute ASCII paths"
+            },
             &format!("unsupported path placeholder {name}"),
         );
     }
@@ -290,6 +294,71 @@ fn unsupported_path_placeholders_are_refused_without_mutation() {
     }
 }
 
+#[test]
+fn invalid_rendered_request_paths_are_refused_without_mutation() {
+    for path in [
+        "/records/{record_id}/".to_owned(),
+        "//records/{record_id}".to_owned(),
+        "/records//{record_id}".to_owned(),
+        "/records/./{record_id}".to_owned(),
+        "/records/../{record_id}".to_owned(),
+        "/récords/{record_id}".to_owned(),
+        "/records?fixed=1/{record_id}".to_owned(),
+        "/records#fragment/{record_id}".to_owned(),
+        "/records\\other/{record_id}".to_owned(),
+        "/records/%2e/{record_id}".to_owned(),
+        "/records/%2F/{record_id}".to_owned(),
+        "/records/%41/{record_id}".to_owned(),
+        "/records/%GG/{record_id}".to_owned(),
+        format!("/{}/{{record_id}}", "a".repeat(2048)),
+    ] {
+        let document = request_openapi(
+            "GET",
+            &path,
+            vec![parameter("record_id", "path", true, "string")],
+            None,
+        );
+        let workspace = tempfile::tempdir().expect("tempdir");
+        let project = scaffold(workspace.path(), &document);
+        assert_mapping_failure_is_atomic(
+            &project,
+            &["subject.subject-reference-v1.reference=path:record_id".to_owned()],
+            "generated request path",
+            &path,
+        );
+    }
+}
+
+#[test]
+fn invalid_rendered_server_prefixes_are_refused_without_mutation() {
+    for prefix in [
+        "/api//v1".to_owned(),
+        "/api/./v1".to_owned(),
+        "/api/../v1".to_owned(),
+        "/api/%2F".to_owned(),
+        "/api/%2e".to_owned(),
+        format!("/{}", "a".repeat(2040)),
+    ] {
+        let mut document: Value = serde_norway::from_str(MAPPED_GET_OPENAPI).expect("OpenAPI");
+        document["servers"] =
+            serde_json::json!([{"url":format!("https://records.example.invalid{prefix}")}]);
+        let workspace = tempfile::tempdir().expect("tempdir");
+        let project = scaffold(
+            workspace.path(),
+            &serde_norway::to_string(&document).expect("OpenAPI YAML"),
+        );
+        assert_mapping_failure_is_atomic(
+            &project,
+            &[
+                "subject.subject-reference-v1.reference=path:record_id".to_owned(),
+                "subject.subject-reference-v1.reference=query:reference".to_owned(),
+            ],
+            "generated request path",
+            &prefix,
+        );
+    }
+}
+
 #[test]
 fn invalid_selector_mappings_refuse_before_mutating_the_project() {
     struct Case {
 
@@ -190,6 +190,94 @@ fn explicit_path_and_query_mappings_generate_an_ordinary_source_request() {
     assert!(!prepare.contains("TODO(evidencectl)"), "{prepare}");
 }
 
+#[test]
+fn mapped_rendered_path_guard_agrees_with_runtime_admission() {
+    use registry_evidence::config::EvidenceConfig;
+    let maximum = format!("/{}", "a".repeat(2047));
+    let overlong = format!("/{}", "a".repeat(2048));
+    let cases = [
+        ("/v1/records", ""),
+        ("/v1/records/{record_id}", "/api"),
+        ("/v1/exact:record/{record_id}", ""),
+        ("/v1/value%20with%20space/{record_id}", ""),
+        (maximum.as_str(), ""),
+        (overlong.as_str(), ""),
+        ("/v1/records/{record_id}/", ""),
+        ("/v1//records/{record_id}", ""),
+        ("/v1/./records/{record_id}", ""),
+        ("/v1/../records/{record_id}", ""),
+        ("/v1/récords/{record_id}", ""),
+        ("/v1/records/{record_id}?fixed=1", ""),
+        ("/v1/records/{record_id}#fragment", ""),
+        ("/v1/records\\other/{record_id}", ""),
+        ("/v1/%2e/{record_id}", ""),
+        ("/v1/%2F/{record_id}", ""),
+        ("/v1/%41/{record_id}", ""),
+        ("/v1/%GG/{record_id}", ""),
+        ("/v1/records/{record_id}", "/api//v2"),
+        ("/v1/records/{record_id}", "/api/%2F"),
+    ];
+    for (case, (path, prefix)) in cases.into_iter().enumerate() {
+        let mut inputs = base_inputs();
+        inputs.operation.path = path.to_owned();
+        inputs.base_url_suggestion =
+            emit::split_server_url(&format!("https://api.example.invalid{prefix}"));
+        let selector = SelectorReference {
+            role: "subject".to_owned(),
+            profile: "person-demographics-v1".to_owned(),
+            field: "given_name".to_owned(),
+            scalar_type: SelectorScalarType::String,
+            maximum_bytes: 200,
+        };
+        inputs.request_mappings = vec![RequestMapping {
+            selector: selector.clone(),
+            target: RequestTarget::Query("reference".to_owned()),
+        }];
+        let mut bindings = serde_json::Map::new();
+        if path.contains("{record_id}") {
+            inputs.request_mappings.push(RequestMapping {
+                selector,
+                target: RequestTarget::Path("record_id".to_owned()),
+            });
+            bindings.insert("record_id".to_owned(), json!({"type":"selector", "role":"subject", "profile":"person-demographics-v1", "field":"given_name"}));
+        }
+        let rendered = format!("{prefix}{path}");
+        let mut bundle: serde_json::Value = serde_norway::from_str(include_str!(
+            "../../../products/evidence/fixtures/acceptance/adult-status/evidence.yaml"
+        ))
+        .expect("runtime acceptance bundle");
+        let request = &mut bundle["sources"]["source-a"]["request"];
+        request["path"] = json!(rendered);
+        if !bindings.is_empty() {
+            request["pathBindings"] = json!(bindings);
+        }
+        let runtime =
+            EvidenceConfig::parse_yaml(&serde_json::to_vec(&bundle).expect("runtime bundle"));
+        let draft = emit::draft(&inputs);
+        assert_eq!(
+            draft.is_ok(),
+            runtime.is_ok(),
+            "path case {case} ({} bytes): draft {:?}, runtime {:?}",
+            rendered.len(),
+            draft.as_ref().err(),
+            runtime.as_ref().err()
+        );
+        if let Ok(draft) = draft {
+            let source: serde_json::Value =
+                serde_json::from_str(&draft.authoring_source).expect("Source JSON");
+            assert_eq!(source["request"]["path"], rendered);
+        }
+    }
+}
+
+#[test]
+fn unmapped_incomplete_path_drafts_remain_available() {
+    let mut inputs = base_inputs();
+    inputs.operation.path = "/v1/records/{RecordId}/".to_owned();
+    let draft = emit::draft(&inputs).expect("unmapped authoring draft");
+    assert!(file_contents(&draft, "functions/search-a-prepare.rhai").contains("TODO(evidencectl)"));
+}
+
 #[test]
 fn explicit_post_body_mappings_generate_a_closed_json_object() {
     let mut inputs = base_inputs();
 
@@ -169,6 +169,9 @@ inputs are inspected only when you map them. Parameter and request-body
 references must resolve locally so their requiredness is known.
 Every path placeholder must occupy a unique complete segment, have a mapping,
 and use a Registry Stack local identifier (`[a-z][a-z0-9_-]{0,63}`).
+The complete request path, including the server path prefix, must fit the
+runtime's 2–2048-byte absolute ASCII path contract, with no empty or dot segments,
+query, fragment, backslash, or noncanonical or ambiguous percent escapes.
 
 Scalar types must agree, and the selector's admitted domain must fit the
 supported string-length or integer-range constraints. Integer formats `int32`