diff --git a/.agents/skills/privacy-mode-clearnet/SKILL.md b/.agents/skills/privacy-mode-clearnet/SKILL.md
index e717fef7..b060cb37 100644
--- a/.agents/skills/privacy-mode-clearnet/SKILL.md
+++ b/.agents/skills/privacy-mode-clearnet/SKILL.md
@@ -22,6 +22,10 @@ description: Privacy mode blocks backend outbound HTTP/HTTPS and tightens CSP. I
 
 Call `ensure_outbound_http_allowed` at the start of every backend path that would open a clearnet socket. Map `OutboundHttpBlockedError` to HTTP 403 or a structured `{ok: false}` the UI already handles. Do not swallow it and retry.
 
+New `httpx` / `urllib` / `aiohttp.ClientSession` code under `meshchatx/src/backend/` must call `ensure_outbound_http_allowed` or `http_url_guard` (or `MeshChat._require_outbound_http`). Do not rewrite existing translator, map tile, firmware, community-directory, or repository fetches into one mega-guard. The RNS `HTTPInterface` is mesh transport, not app clearnet.
+
+`tests/backend/test_outbound_http_allowlist.py` fails if a new backend file opens a clearnet client without being listed in `KNOWN_CLEARNET_FETCH_FILES`. Add the file to that set only after the privacy-mode or URL guard is wired.
+
 Config key: `privacy_mode_enabled` in `config_manager.py`. Settings copy lives under `app.privacy_mode_*` locale keys.
 
 ## What privacy mode is not
@@ -35,4 +39,8 @@ Optional clearnet helpers (docs fetch, community interface lists) stay behind th
 
 ## Tests
 
-When you add a clearnet call, add a test that enables privacy mode and asserts the call is blocked (`OutboundHttpBlockedError` or the HTTP status the route already uses). Search existing tests for `privacy_mode` and match that pattern.
+When you add a clearnet call, add a test that enables privacy mode and asserts the call is blocked (`OutboundHttpBlockedError` or the HTTP status the route already uses). Search existing tests for `privacy_mode` and match that pattern. Also run:
+
+```bash
+uv run pytest tests/backend/test_outbound_http_allowlist.py -q --tb=short
+```
diff --git a/.agents/skills/test-oracles/SKILL.md b/.agents/skills/test-oracles/SKILL.md
index 0dcf53a7..246541b2 100644
--- a/.agents/skills/test-oracles/SKILL.md
+++ b/.agents/skills/test-oracles/SKILL.md
@@ -51,11 +51,14 @@ Do not ship tests that only do:
 - Room keys: `tests/backend/test_rrc_room_keys.py`
 - EECT shared asserts: `tests/backend/eect/asserts.py`
 - URL origin allowlists: `tests/electron/mainHelpers.test.js`, `android/app/src/test/java/com/meshchatx/RemoteBackendUrlTest.java`
+- XSS sanitizers: `tests/frontend/sanitizerXssOracle.test.js` (shared payload list against Markdown, Nomad, Micron, KML)
+- Mesh size caps: `tests/backend/test_announce_manager_extended.py`, `tests/backend/test_nomadnet_downloader.py`, `tests/backend/test_map_geo_validator.py`, `tests/backend/test_rrc_security.py`
 
 ## Commands
 
 ```bash
 uv run pytest tests/backend/test_rrc_oracle_bugs.py tests/backend/test_rrc_protocol_fuzz.py -q --tb=short
+pnpm exec vitest run tests/frontend/sanitizerXssOracle.test.js
 task test:eect
 ```
 
diff --git a/meshchatx.rsm b/meshchatx.rsm
index 5d7a2a5c..71d6264e 100644
Binary files a/meshchatx.rsm and b/meshchatx.rsm differ