diff --git a/AUDIT.md b/AUDIT.md
index 6a13fb0..8c64764 100644
--- a/AUDIT.md
+++ b/AUDIT.md
@@ -11,19 +11,20 @@ Status key:
 - 🚫 not verified yet (needs hardware or CI, not a known code gap);
 - — planned, not started.
 
-*Last updated: Milestone 41, site isolation (2026-10-22).*
+*Last updated: first CI runs and the libFuzzer fixes they found (2026-10-23).*
 
 ## Headline numbers
 
 | Check | Value | How to reproduce |
 |---|---|---|
-| Tests | **1,209 passed, 0 failed** (1,195 before M41; the gap pass's tests had not been counted here) | `cargo test --workspace --release` |
-| Fuzz suite | 25 targets; M41 added six `ipc_decode` seeds (`21`–`26`: storage requests and answers served by the browser, an unknown operation, a value claiming 2 GiB); since M40b `parse_document` also moves the tree into a `Document` and checks every interned name reads back (seed `14_invented_names.html`); the newest target is M40's `webidl_parse` (the binding declarations, malformed and deeply nested input), and `js_script/07_generated_bindings` calls prototype members on the wrong `this`, tears accessors off and forges node ids; earlier seeds cover the M38b renderer protocol (`ipc_decode`) and the M39 tree mutation API (`js_script/06_tree_mutations`); `layout_document` also checks M39b's pruned hit testing against visiting every box. Replay, structural stress and deterministic mutation all clean. | `cargo test --manifest-path fuzz/Cargo.toml --no-default-features` |
+| Tests | **1,213 passed, 0 failed** (1,209 at M41; four regression tests for the libFuzzer findings since) | `cargo test --workspace --release` |
+| Fuzz suite | 25 targets; M41 added six `ipc_decode` seeds (`21`–`26`: storage requests and answers served by the browser, an unknown operation, a value claiming 2 GiB); since M40b `parse_document` also moves the tree into a `Document` and checks every interned name reads back (seed `14_invented_names.html`); the newest target is M40's `webidl_parse` (the binding declarations, malformed and deeply nested input), and `js_script/07_generated_bindings` calls prototype members on the wrong `this`, tears accessors off and forges node ids; earlier seeds cover the M38b renderer protocol (`ipc_decode`) and the M39 tree mutation API (`js_script/06_tree_mutations`); `layout_document` also checks M39b's pruned hit testing against visiting every box. Replay, structural stress and deterministic mutation all clean. The first libFuzzer runs (CI `fuzz-smoke`, 2026-10-22) found five bugs, all fixed with regression tests and seeds: a PNG header declaring billions of pixels allocated its ~51 GB output buffer (`png`'s limits don't cover it; the shared pixel cap now applies); a `ttcf` header claiming 2^32−1 fonts tripped a `ttf-parser` debug-assert (refused before parsing); CSS nesting under an unclosed `(` multiplied selector text (5 KB → ~800 MB; selectors with unclosed brackets are now invalid, only valid ones are nested further, and nested selector text is capped at 64 KiB); a `zune-jpeg` 0.4 debug-assert on a truncated bitstream (upgraded to 0.5); and `js_script` reported Boa's lazy GC as a leak (the target now collects after each input, as a page thread does). | `cargo test --manifest-path fuzz/Cargo.toml --no-default-features` |
 | AddressSanitizer | 0 reports: `js`, `engine` and display-list suites, 3 runs (the CI `sanitizer` job's command); M34 re-ran them with `gpu_backend` (the GPU tests on hardware included), 2 runs; M35 with `text` too; M36 with `browser_core`, `capability` and `storage`, 1 run; M37 with `network`, `filter` and `privacy`, 1 run; M38a re-ran the CI command on Boa 0.22, 3 runs; M38b, 3 runs; M39 with `dom` added, 3 runs; M39b with `layout`, `rendering`, `text`, `style` and `dom`, 3 runs; M39c the same, 3 runs; M40 with `script` (now in the CI job) and `dom`, 4 runs; M40b with `names`, `dom`, `html_parser`, `css_parser` and `style`, 3 runs; M41 with `storage` and `capability` (site isolation, browser-served storage, a fake compromised renderer), 3 runs. | `.github/workflows/ci.yml`, job `sanitizer` (nightly) |
 | Clippy | 28 warnings (a ratchet; it may not grow — 43 until M40 removed the hand-written bindings; M40b and M41 added none) | `scripts/clippy-ratchet.sh` |
 | `unsafe` | None. `forbid(unsafe_code)` in every crate, and the exceptions list is empty. | `scripts/check-forbid-unsafe.sh` |
 | Guardrails | All pass | `check-dependency-direction.sh`, `check-host-boundary.sh`, `check-panic-strategy.sh`, `check-gc-handles.sh`, `check-core-capabilities.sh`, `check-capabilities.sh` (M36), `check-dom-encapsulation.sh` (M39), `check-advisory-exceptions.sh`, `check-psl-freshness.sh` |
-| `cargo audit` | 2 documented exceptions, both unmaintained-crate notices: `paste` (build-time, via wgpu's `metal`) and `ttf-parser` (the font parser, ADR 009). The two Boa 0.17 advisories are gone with Boa 0.22 (M38a). | `deny.toml`, `scripts/check-advisory-exceptions.sh` |
+| `cargo audit` | 3 documented exceptions, all unmaintained-crate notices: `paste` (build-time, via wgpu's `metal`), `ttf-parser` (the font parser, ADR 009) and `rustybuzz` (the shaper, which sits on `ttf-parser`; RUSTSEC-2026-0206, accepted 2026-10-22 on the same grounds). The two Boa 0.17 advisories are gone with Boa 0.22 (M38a); the rustls/webpki advisories of October 2026 are patched (rustls 0.23.46, rustls-webpki 0.103.16). | `deny.toml`, `scripts/check-advisory-exceptions.sh` |
+| CI | Every job of `ci.yml` passes on PR #1 (merged 2026-10-23 as `a7983ad`), `fuzz-smoke` included — reported from the GitHub Actions UI; not checked from this machine (no `gh`). The nightly `fuzz-nightly.yml` has not passed yet: its only run so far (03:17 UTC, 2026-10-23) was before the merge, so it ran the initial commit's `fuzz-smoke.sh`, which lacked the host-triple `--target` pin, and every target failed to build for static musl under ASan. | `.github/workflows/` |
 | Renderer sandbox | Active on this machine (Linux 7.2): Landlock closes the filesystem; seccomp refuses sockets, exec and ptrace. Seen in `/proc` of a running renderer: seccomp filter, `NoNewPrivs`, no sockets, empty environment. | `browser-renderer --sandbox-self-test`; `crates/renderer/tests/real_processes.rs` |
 | Real-site corpus | Last replayed at M40b (its recordings are local-only and were not on the machine M41 was built on; it replays in thread mode, which M41 did not change): 56 of 56 pages render, with 0 crashes and 0 timeouts. All are deterministic and match their goldens (re-blessed in M34 after a per-pixel comparison: 43 identical, 13 differing in 1–595 pixels, each explained). | `cargo run -p conformance --release -- run` (the corpus is local-only, not in the repository) |
 
@@ -39,7 +40,7 @@ each violation's detail and the work item that fixes it.
 | GPU-first | 🟢 | Everything on screen is drawn by the GPU, through `wgpu` and a display list with clip, transform and group markers (ADR 017); the CPU rasterizer is only for `conformance` PNGs and tests. Clips and transforms per instance on the GPU, opacity groups as offscreen layers, a kept back buffer redrawn by damage, image atlas pages with LRU eviction, batching across non-overlapping items. Transform animations and container scrolls are compositor updates; after an incremental layout the page's display list is updated in part (M39b), and patched in place when the changed element keeps its size (M39c, ADR 022). The GPU path is checked against the CPU rasterizer on hardware (`gpu_matches_raster.rs`). |
 | Thread-safe | 🟢 | One OS thread per page (in its own process by default, ADR 016) owns its non-thread-safe state (`Rc`/`RefCell` only in `engine` and `js`). There's a GPU thread and a thread-safe mailbox, checked at compile time. Global state is limited to atomics, read-only tables built once, and the bounded fetch pool's queue (one lock). `rayon` runs style (per-worker result shards), intrinsic sizing (sharded) and image decoding, including a page's network images — which decode off the page thread (M34). |
 | Capability-based | 🟢 | Script reaches the network and storage only through capability handles the profile grants each page (ADR 010, M36): no grant, no `fetch`/XHR/`localStorage` — a capability error, checked in thread and process mode. Grants are scoped (storage to the document's own storage key) and revocable (`PageCommand::Revoke`, in-flight requests included). APIs not built have capability types that cannot be constructed. Minting only in Browser Core and the renderer, and no global mutable state in the bindings (`js` and, since M40, `script`) — `check-capabilities.sh`. Only `network` opens connections, in the browser process; file access (`FileAccess`, denied to pages), cookie and profile files, and host-granted fonts are the filesystem's only users; no core crate reads the environment or starts processes (`check-core-capabilities.sh`). Since M41 the browser process enforces the grants too (ADR 025): without the network grant it makes only the document loader's requests, whatever the renderer labels them, and of a cross-origin response gives a renderer only what the request's stated purpose can use; `localStorage` is served by it, through the page's own grant. |
-| Zero-trust | 🟡 | Every page runs in its own sandboxed renderer process (ADR 016), which holds documents of one site: a navigation that lands on another site moves the page to another renderer (ADR 025, M41); the browser decodes what it sends with a bounded, fuzzed codec and makes its network requests and storage operations only for origins of that site it actually loaded. Parsers are bounded and fuzzed, page commands are validated, and redirects to non-web schemes are refused. GPU resources are bounded: a capped glyph atlas that compacts, every texture checked against device limits, an image-texture budget kept by LRU eviction (M34), and a GPU error handler instead of a panic (P1–P3, fixed and verified on hardware; `milestones/principles-audit-fixes.md`). **Gap:** no CI or libFuzzer run has been observed (a GitHub remote exists; its Actions history was not checked, and there is no `g++` locally). |
+| Zero-trust | 🟡 | Every page runs in its own sandboxed renderer process (ADR 016), which holds documents of one site: a navigation that lands on another site moves the page to another renderer (ADR 025, M41); the browser decodes what it sends with a bounded, fuzzed codec and makes its network requests and storage operations only for origins of that site it actually loaded. Parsers are bounded and fuzzed, page commands are validated, and redirects to non-web schemes are refused. GPU resources are bounded: a capped glyph atlas that compacts, every texture checked against device limits, an image-texture budget kept by LRU eviction (M34), and a GPU error handler instead of a panic (P1–P3, fixed and verified on hardware; `milestones/principles-audit-fixes.md`). CI's libFuzzer smoke run passes (60 s per target, 2026-10-22, after fixing the five bugs it found). **Gap:** no long (nightly) libFuzzer run has passed yet. |
 | Privacy-first | 🟢 | Every row of the §6 boundary has a named policy and a test (table in `milestones/milestone-37-privacy-layer.md`): routes that fail closed with a fixed precedence (ADR 011); DNS over HTTPS with no default vendor (ADR 012); third-party cookies blocked and storage keyed by (top-level site, origin) (ADR 019); a filter engine on every hop in the browser process; a fingerprint policy for `Date`, rAF and fonts, through Boa's host hooks (P5); frozen headers; no `navigator`, `screen` or `performance`; no phone-home. |
 | Vendor-independent | 🟢 | No Blink, Gecko or WebKit; `cargo deny` bans encode it, and no service is hard-coded: no default DoH resolver, no bundled third-party filter list. TLS trusts the bundled Mozilla roots plus any CA the user adds (P8, ADR 018). |
 | Secondary: power budget, minimal-dependency | 🟡 | A runaway page in a renderer process is ended within 10 s (ADR 013, M38a); pages on threads are bounded only by Boa's loop and recursion limits: the runtime interface has an interrupt (M40, ADR 023 §6), but Boa 0.22 offers none. Pages are woken by finished work, never polled; hidden pages do no animation work (a hidden renderer measured at 0 CPU ticks in 2 s); an animating page that can't keep up lowers its frame rate and input is not delayed (ADR 020, M38b). Off-screen `background-color` transitions are skipped (gap pass); other off-screen animations are not; a covered or minimised window hides its active tab (gap pass). `engine`'s exact `rayon` pin is relaxed (P11), but `style` and `images` still pin `rayon = "=1.10.0"`. |
@@ -73,7 +74,7 @@ each violation's detail and the work item that fixes it.
 | 23 | Rich input & editing | 🟡 | Selection, drag-and-drop, context menus and the file picker are in the backlog. |
 | 24 | Accessibility tree | 🟡 | The OS screen-reader bridge is in the backlog. |
 | — | Hardening pass | 🟢 | Items not fixed there were taken up by M34–M38 (as 38a and 38b). |
-| 25 | Guardrails & CI | 🟡 | CI workflows and libFuzzer jobs are written; no run observed: the repository has a GitHub remote (`origin`), but its Actions history was not checked 🚫. |
+| 25 | Guardrails & CI | 🟡 | Every PR job passes on GitHub Actions (PR #1, 2026-10-23), `fuzz-smoke` included; its first runs found five bugs, all fixed. **Gap:** the nightly fuzz job has not passed yet — its one run predated the `--target` fix 🚫. |
 | 26 | Shared network context | 🟢 | |
 | 27 | Observability | 🟢 | Live-window `--trace` and the `gpu_render` span exercised on hardware in M34 (per-frame spans, including `compositor_update`). |
 | 28 | Origin & site model | 🟢 | |
@@ -115,7 +116,7 @@ each violation's detail and the work item that fixes it.
 | Video (`<video>`, codecs, A/V sync): never scoped; `<video>` is only sized as a replaced element (`layout::intrinsic`, `style::cascade`). Flagged in the 2026-09-02 audit | Needs its own scoping pass (`ROADMAP.md`, "Video") |
 | Every other item any milestone (1–33, Phases A–F, the hardening pass) deferred: events, navigation, frames, network, forms, a11y, animation, performance | Backlog (`ROADMAP.md` §4), each tagged with the milestone that deferred it |
 | Hardware checks: human input on the threaded window | 🚫 Needs a person at the desktop (GPU drawing, paint order and the live `--trace` window were exercised in M34) |
-| A first CI run, libFuzzer runs | 🚫 A GitHub remote exists now (`origin`, holding the initial commit); whether its workflows ran is unchecked (no `gh` here). libFuzzer locally needs `g++` |
+| A passing nightly libFuzzer run (10 min per target) | 🚫 Its one run (2026-10-23 03:17 UTC) built the initial commit, without the `--target` pin, and failed for every target; the next scheduled run, or a manual `workflow_dispatch`, builds `main`. libFuzzer locally needs `g++` |
 
 The engine is a well-tested core with enumerated, bounded gaps. It is not a
 finished browser.
diff --git a/ROADMAP.md b/ROADMAP.md
index 578f97b..34178e8 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -978,7 +978,7 @@ In `docs/adr/`. Each is written before the code it constrains.
 | Risk | Mitigation |
 |---|---|
 | Boa cannot be interrupted (0.22 included), so a script budget can't be enforced in-thread. The audit exceptions expire on 2026-12-31. | M38a: the browser kills a renderer that stops finishing ticks (ADR 013); the Boa upgrade is done first in M38a. Thread mode keeps only Boa's loop and recursion limits. |
-| `ttf-parser`, the parser for untrusted fonts since M35, is listed as unmaintained (RUSTSEC-2026-0192), and `rustybuzz` depends on it. | Accepted with reasons in `deny.toml` and ADR 009: fuzz targets, hostile-font tests, and web-font bytes validated before parsing. If a parser bug turns up that upstream doesn't fix, replace the parser and shaper together, evaluated against the same fuzz corpus. |
+| `ttf-parser`, the parser for untrusted fonts since M35, is listed as unmaintained (RUSTSEC-2026-0192), and so is `rustybuzz`, which depends on it (RUSTSEC-2026-0206). | Both accepted with reasons in `deny.toml` and ADR 009: fuzz targets, hostile-font tests, and web-font bytes validated before parsing. If a parser bug turns up that upstream doesn't fix, replace the parser and shaper together, evaluated against the same fuzz corpus. |
 | Incremental restyle or layout gets stale-state bugs. | The full-versus-incremental oracles are merge gates. Every new feature extends them. |
 | New dependencies break the memory-safety or vendor stance. | The dependency ADR gate, a pure-Rust preference, and replaceability behind traits. |
 | Scope creep toward "complete" web compatibility. | The curated API surface: a new Web API needs a written permission, fingerprint and capability policy first. |
diff --git a/crates/css_parser/src/lib.rs b/crates/css_parser/src/lib.rs
index da0de2f..e028e45 100644
--- a/crates/css_parser/src/lib.rs
+++ b/crates/css_parser/src/lib.rs
@@ -705,12 +705,12 @@ fn read_block(chars: &mut std::iter::Peekable<std::str::Chars>) -> (String, bool
 /// multiplies): past it the nested rule is dropped.
 const MAX_NESTED_SELECTORS: usize = 256;
 
-/// Most text one nested rule's selector list may expand to. The count
-/// above is not enough: a selector with an unclosed `(` hides the commas
-/// after it from `split_top_level`, so `P c1, P c2, …` counts as ONE parent
-/// at the next level while its text still multiplies by every level's child
-/// count — and each `&` in a child is another copy of the parent (found by
-/// the `parse_stylesheet` fuzz target: 5 KB of CSS expanded to ~800 MB).
+/// Most text one nested rule's selector list may expand to. Each `&` in a
+/// child is another copy of the parent, so the count above does not bound
+/// the text. (The `parse_stylesheet` fuzz target found 5 KB of CSS that
+/// expanded to ~800 MB: an unclosed `(` in a parent hid the commas after
+/// it from the count. Invalid selectors are no longer passed down, so that
+/// input is stopped at its first level; this cap bounds what is left.)
 const MAX_NESTED_SELECTOR_BYTES: usize = 64 * 1024;
 
 /// One style rule: its own declarations, then its nested rules (CSS
@@ -796,12 +796,15 @@ fn split_nested_rules(body: &str) -> (String, Vec<(String, String)>) {
 
 /// The selector list of a nested rule, written out in full against its
 /// parent's (`None` when there is nothing to match or it would expand
-/// past [`MAX_NESTED_SELECTORS`] or [`MAX_NESTED_SELECTOR_BYTES`]).
+/// past [`MAX_NESTED_SELECTORS`] or [`MAX_NESTED_SELECTOR_BYTES`]). Only
+/// combinations that parse are kept: one that does not matches nothing,
+/// nor does anything nested under it, and its text must not reach the next
+/// level, where an unclosed `(` in it would hide the commas that follow.
 fn nest_selectors(parent: &str, nested: &str) -> Option<String> {
     let parents = split_top_level(parent, ',');
     let children = split_top_level(nested, ',');
     if parents.len().saturating_mul(children.len()) > MAX_NESTED_SELECTORS {
-        diagnostics::guard(diagnostics::Guard::CssAtRuleNestingDepth, "nested selector list too large; rule dropped");
+        diagnostics::guard(diagnostics::Guard::CssNestedSelectorsTooLarge, "nested selector list too large; rule dropped");
         return None;
     }
     let mut combined = Vec::new();
@@ -813,10 +816,13 @@ fn nest_selectors(parent: &str, nested: &str) -> Option<String> {
             let copies = child.matches('&').count().max(1);
             bytes = bytes.saturating_add(child.len() + 2).saturating_add(copies.saturating_mul(parent.len() + 1));
             if bytes > MAX_NESTED_SELECTOR_BYTES {
-                diagnostics::guard(diagnostics::Guard::CssAtRuleNestingDepth, "nested selector text too large; rule dropped");
+                diagnostics::guard(diagnostics::Guard::CssNestedSelectorsTooLarge, "nested selector text too large; rule dropped");
                 return None;
             }
-            combined.push(if child.contains('&') { child.replace('&', parent) } else { format!("{parent} {child}") });
+            let selector = if child.contains('&') { child.replace('&', parent) } else { format!("{parent} {child}") };
+            if parse_selector(&selector).is_some() {
+                combined.push(selector);
+            }
         }
     }
     (!combined.is_empty()).then(|| combined.join(", "))
@@ -928,6 +934,24 @@ fn parse_selector_list(text: &str) -> Vec<Selector> {
     split_top_level(text, ',').iter().filter_map(|chunk| parse_selector(chunk.trim())).collect()
 }
 
+/// Whether every `(` and `[` outside a string is closed, in order.
+fn brackets_balanced(text: &str) -> bool {
+    let mut open = Vec::new();
+    let mut quote: Option<char> = None;
+    for c in text.chars() {
+        match (quote, c) {
+            (Some(q), _) if c == q => quote = None,
+            (Some(_), _) => {}
+            (None, '"' | '\'') => quote = Some(c),
+            (None, '(') => open.push(')'),
+            (None, '[') => open.push(']'),
+            (None, ')' | ']') if open.pop() != Some(c) => return false,
+            _ => {}
+        }
+    }
+    quote.is_none() && open.is_empty()
+}
+
 /// The most compounds one selector may have. Real selectors have a
 /// handful; the cap bounds what one hostile selector can cost the cascade
 /// (matching is linear in compounds × ancestors, see
@@ -936,7 +960,13 @@ fn parse_selector_list(text: &str) -> Vec<Selector> {
 pub const MAX_SELECTOR_COMPOUNDS: usize = 64;
 
 /// Parses one full selector (a combinator-joined chain of compounds).
+/// One with an unclosed `(` or `[` is invalid: in CSS syntax the bracket
+/// would run on past the rule's `{` (found by the `parse_stylesheet` fuzz
+/// target, where accepting it let nested rules multiply its text).
 fn parse_selector(text: &str) -> Option<Selector> {
+    if !brackets_balanced(text) {
+        return None;
+    }
     let tokens = tokenize_selector(text);
     if tokens.is_empty() {
         return None;
@@ -1707,23 +1737,43 @@ mod tests {
     }
 
     /// Regression (fuzz target `parse_stylesheet`): a parent with an
-    /// unclosed `(` hides the commas of its expansion, so every level
-    /// counted as one parent and passed the selector-count cap while the
-    /// text grew 100x per level. The text cap stops it at the second level.
+    /// unclosed `(` hid the commas of its expansion, so every level counted
+    /// as one parent and passed the selector-count cap while the text grew
+    /// 100x per level (5 KB -> ~800 MB). An invalid selector matches
+    /// nothing, so it is not passed down: nothing is built past the first
+    /// level, and no cap is needed to stop it.
     #[test]
     fn nesting_under_an_unclosed_paren_cannot_multiply_selector_text() {
         use diagnostics::{collector::capture, Guard};
         let list = (0..100).map(|i| format!(".c{i}")).collect::<Vec<_>>().join(",");
         let css = format!("a:not( {{ {list} {{ {list} {{ {list} {{ {list} {{ x: 1 }} }} }} }} }}");
-        let start = std::time::Instant::now();
-        let (_, c) = capture(|| parse_stylesheet(&css));
-        assert!(c.saw_guard(Guard::CssAtRuleNestingDepth), "{:?}", c.events);
-        assert!(start.elapsed() < std::time::Duration::from_secs(1), "{:?}", start.elapsed());
+        let (sheet, c) = capture(|| parse_stylesheet(&css));
+        assert!(sheet.rules.is_empty(), "{sheet:?}");
+        assert!(c.events.is_empty(), "stopped by validity, not by a cap: {:?}", c.events);
+
+        // Unclosed brackets make a selector invalid at the top level too;
+        // brackets inside a string do not count.
+        assert!(parse_stylesheet("a:not(.x { color: red }").rules.is_empty());
+        assert!(parse_stylesheet("[data-x] .y] { color: red }").rules.is_empty());
+        assert_eq!(parse_stylesheet("[title=\"a(b]\"] { color: red }").rules.len(), 1);
+
+        // A valid sibling of an invalid selector still nests; the invalid
+        // half is dropped at each level.
+        let sheet = parse_stylesheet(".a, b:not() { .x { .y { z: 1 } } }");
+        let nested: Vec<usize> = sheet.rules.iter().map(|r| r.selectors.len()).collect();
+        assert_eq!(nested, vec![1, 1, 1], "{sheet:?}");
+
+        // The same lists under a valid parent: the count cap drops the
+        // second level (100 x 100 > MAX_NESTED_SELECTORS).
+        let css = format!(".p {{ {list} {{ {list} {{ x: 1 }} }} }}");
+        let (sheet, c) = capture(|| parse_stylesheet(&css));
+        assert!(c.saw_guard(Guard::CssNestedSelectorsTooLarge), "{:?}", c.events);
+        assert_eq!(sheet.rules.len(), 2, "`.p` and its first level survive; the second is dropped");
 
         // `&` copies the parent: many of them in one child are sized first.
         let amps = format!(".{} {{ {} {{ x: 1 }} }}", "a".repeat(1000), "&".repeat(1000));
         let (sheet, c) = capture(|| parse_stylesheet(&amps));
-        assert!(c.saw_guard(Guard::CssAtRuleNestingDepth));
+        assert!(c.saw_guard(Guard::CssNestedSelectorsTooLarge));
         assert_eq!(sheet.rules.len(), 1, "the parent rule survives; the nested one is dropped");
     }
 
diff --git a/crates/diagnostics/src/lib.rs b/crates/diagnostics/src/lib.rs
index 8fbe0a0..d5ac2e6 100644
--- a/crates/diagnostics/src/lib.rs
+++ b/crates/diagnostics/src/lib.rs
@@ -155,10 +155,14 @@ pub enum Guard {
     /// cannot use (not an image for an image request, not readable by the
     /// document's script for a script request; ADR 025 §5).
     RendererResponseWithheld,
+    /// `css_parser`: a nested rule's selector list, written out against its
+    /// parent's, would pass `MAX_NESTED_SELECTORS` or
+    /// `MAX_NESTED_SELECTOR_BYTES`; the nested rule was dropped.
+    CssNestedSelectorsTooLarge,
 }
 
 impl Guard {
-    pub const ALL: [Guard; 40] = [
+    pub const ALL: [Guard; 41] = [
         Guard::HtmlNestingDepth,
         Guard::CssNotNestingDepth,
         Guard::CssAtRuleNestingDepth,
@@ -199,6 +203,7 @@ impl Guard {
         Guard::PageUnresponsive,
         Guard::FrameBudgetExceeded,
         Guard::RendererResponseWithheld,
+        Guard::CssNestedSelectorsTooLarge,
     ];
 
     /// Stable snake_case identifier — the `guard` field on the event and
@@ -246,6 +251,7 @@ impl Guard {
             Guard::PageUnresponsive => "page_unresponsive",
             Guard::FrameBudgetExceeded => "frame_budget_exceeded",
             Guard::RendererResponseWithheld => "renderer_response_withheld",
+            Guard::CssNestedSelectorsTooLarge => "css_nested_selectors_too_large",
         }
     }
 }
diff --git a/milestones/milestone-25-guardrails-and-ci-hardening.md b/milestones/milestone-25-guardrails-and-ci-hardening.md
index 28253f4..402f649 100644
--- a/milestones/milestone-25-guardrails-and-ci-hardening.md
+++ b/milestones/milestone-25-guardrails-and-ci-hardening.md
@@ -1,6 +1,6 @@
 # Milestone 25 — Guardrails & CI hardening
 
-> **Status:** Done, with gaps. **Still open:** the libFuzzer jobs and CI workflows are written; no run observed: the repository has a GitHub remote (`origin`), but its Actions history was not checked, and libFuzzer needs `g++`, absent locally. ~~Two `cargo audit` exceptions for Boa 0.17 expire 2026-12-31~~ — removed by the Boa 0.22 upgrade (M38a).
+> **Status:** Done, with gaps. **Still open:** a passing nightly fuzz run (its first run, 2026-10-23, built the initial commit, before the `--target` fix). ~~No CI run observed~~ — every PR job passes on GitHub Actions (PR #1, 2026-10-23), `fuzz-smoke` included; see "First CI runs" below. ~~Two `cargo audit` exceptions for Boa 0.17 expire 2026-12-31~~ — removed by the Boa 0.22 upgrade (M38a).
 > Overall status: `AUDIT.md` · the plan: `ROADMAP.md`.
 
 **Goal:** make the discipline that already existed non-optional, cover the
@@ -115,9 +115,52 @@ The point of fuzzing is to find things; it did, before it was ever run in CI.
    animated WebP with a huge canvas. The cap is now a small function
    (`check_decode_dimensions`) tested directly (see M27).
 
+## First CI runs (2026-10-22/23)
+
+The workflows first ran on PR #1 (Milestone 41). Getting `fuzz-smoke` to
+build and run took two script fixes, and its first real run found five bugs:
+
+1. `cargo-fuzz` defaults `--target` to the triple it was built for; the
+   prebuilt binary from `taiki-e/install-action` is static musl, and ASan
+   cannot link against static libc. `fuzz-smoke.sh` now passes the nightly
+   toolchain's host triple.
+2. That fix dropped the space after `--`, so libFuzzer's first flag reached
+   `cargo-fuzz` as `---max_total_time=…`; restored.
+3. `decode_auto`: a well-formed PNG whose IHDR declares 3 × 4,294,443,012
+   pixels made `decode_png` allocate a ~51 GB output buffer. `png`'s
+   `Limits` bound only its own allocations; the shared pixel cap
+   (`check_decode_dimensions`) now runs first.
+4. `font_parse`: a `ttcf` header claiming 2^32−1 fonts tripped
+   `ttf-parser`'s length debug-assert. Collections whose offset table does
+   not fit in the file are refused before parsing, and in the directory scan.
+5. `js_script`: Boa collects lazily, so libFuzzer's leak check reported
+   what the script left reachable. The target now calls
+   `js::collect_garbage()` after each input, as a page thread does.
+6. `parse_stylesheet`: a parent selector with an unclosed `(` hid its
+   commas from the nested-selector count, so every level passed
+   `MAX_NESTED_SELECTORS` while multiplying its text (5 KB of CSS → ~800 MB,
+   12 s under ASan). Nested selector text is now capped at 64 KiB, sized
+   before it is built (reported as `Guard::CssNestedSelectorsTooLarge`, as
+   the selector-count cap now is). A follow-up fixed the cause: a selector
+   with an unclosed `(` or `[` is invalid (in CSS syntax the bracket would
+   run past the rule's `{`), and a nested rule passes down only the
+   combined selectors that parse, so that input builds nothing past its
+   first level.
+7. `decode_auto`: `zune-jpeg` 0.4 debug-asserts when entropy data runs out
+   mid-symbol (it saturates in release). 0.5 removed the assertion as a
+   known false positive; upgraded, with the same 16384 × 16384 limits.
+
+Each bug has a regression test in its crate and its input as a seed. The
+same PR patched the rustls/webpki advisories and accepted RUSTSEC-2026-0206
+(`rustybuzz` unmaintained) alongside the `ttf-parser` exception.
+
+The nightly job's first run (03:17 UTC, 2026-10-23) ran before PR #1 was
+merged, so it built the initial commit's script, without fix 1, and every
+target failed with `sanitizer is incompatible with statically linked libc`.
+It has not yet run against `main`.
+
 ## Known gaps
-- `fuzz-smoke`/`fuzz-nightly`/`supply-chain` workflows are unexecuted; their
-  commands were run individually here except libFuzzer itself.
+- `fuzz-nightly` has not passed yet (see above).
 - No OSS-Fuzz. Fuzz targets for fonts, `@font-face`, `Content-Type`/header
   parsing and the JS→DOM binding surface are M32's scope.
 - `cargo deny` reports duplicate-version warnings (`windows-sys`, `syn`,