diff --git a/.env.example b/.env.example
index 3cbd6bb..909f42f 100644
--- a/.env.example
+++ b/.env.example
@@ -111,6 +111,12 @@ ORACLE_PAYMENT_ADDRESS=GD...
 # URL of the x402 facilitator (default: https://facilitator.stellar.org)
 X402_FACILITATOR_URL=https://facilitator.stellar.org
 
+# --- Bazaar catalog integrity ---
+# Catalog listings arrive from clients in the payment payload, so writes are
+# rate limited per payTo. A rejected listing never fails the payment.
+BAZAAR_CATALOG_WRITES_PER_MIN=10
+BAZAAR_CATALOG_WRITES_PER_DAY=200
+
 # --- Oracle Relay Example ---
 # Lens API base URL consumed by the relay example.
 ORACLE_RELAY_API_URL=http://localhost:3002
diff --git a/docs/x402/bazaar-catalog-integrity.md b/docs/x402/bazaar-catalog-integrity.md
new file mode 100644
index 0000000..7c3d4a2
--- /dev/null
+++ b/docs/x402/bazaar-catalog-integrity.md
@@ -0,0 +1,102 @@
+# Bazaar catalog integrity
+
+The Bazaar catalog is written from the payment payload. Clients echo the
+resource block into it, so the facilitator is a trust boundary: **anyone who
+can pay can attempt to write to the index.** This note describes what is
+enforced at that boundary, and what an attacker who is willing to pay can still
+attempt.
+
+## The two doors into the catalog
+
+| Path | Trust | Validation |
+|---|---|---|
+| `registerBazaarResource(input)` | Trusted — Lens listing its own endpoints | None; the caller is us |
+| `submitCatalogListing(input, authority)` | Untrusted — a listing carried by a client's payment | Everything below |
+
+`authority` is `{ payTo, network }` taken from the payment requirements the
+payer signed. It is the one fact about a listing that cannot be forged, and
+every ownership decision is anchored to it.
+
+## What is enforced
+
+**Seller identity.** Every `accepts[].payTo` must equal the payment's own
+`payTo`, and the listing's network must equal the payment's network. A listing
+can therefore only ever speak for the seller that paid to publish it.
+
+**First claim wins.** A resource identity — `(network, url, httpMethod)` for
+HTTP, `(network, url, toolName)` for MCP — belongs to the `payTo` that
+registered it first. Its owner can update it forever; anyone else is refused,
+which is what stops a payer from repointing another seller's entry at their own
+endpoint or pricing.
+
+**`routeTemplate`, decoded before it is checked.** The template is
+percent-decoded to a fixed point *first*, and the traversal checks run on the
+decoded form. `%2e%2e%2f` is `../`; a validator that inspects the raw string and
+decodes later waves it straight through, and one that decodes only once is
+defeated by `%252e%252e%252f`. A value still changing after four decode passes
+is dropped rather than decoded further. The decoded form is what gets stored, so
+the value served is the value that was validated. Beyond traversal, a template
+must be a path (no scheme, no `//`, no query or fragment, no backslash, no
+control characters), must use `:param` names matching
+`[A-Za-z_][A-Za-z0-9_]*` without repeats, and must structurally describe the
+path of `resource.url` — otherwise a listing could consolidate itself under
+another seller's route family.
+
+**Field limits.** Length, type and character-class limits on every stored
+field (see `CATALOG_LIMITS` in `src/bazaar/validation.ts`), a byte ceiling on
+`bazaar.info` and `bazaar.schema`, `https` only for `resource.url` and
+`iconUrl` with no embedded credentials, atomic-unit amounts, and a bounded
+`maxTimeoutSeconds`. An unbounded description is both a storage problem and a
+search-ranking problem.
+
+**Rate limiting per `payTo`.** `BAZAAR_CATALOG_WRITES_PER_MIN` (default 10) and
+`BAZAAR_CATALOG_WRITES_PER_DAY` (default 200). The attempt is counted before
+the decision, so a rejected write still costs its slot. If Redis is
+unreachable the limiter fails **closed** — at a trust boundary, "I cannot tell
+whether this payer is flooding" is not a reason to accept the write. The
+payment is unaffected either way.
+
+**Untrusted at read time too.** Control characters are stripped when a row is
+served, not only when it is written: rows predate this validation, and a value
+that is harmless inside JSON can still be harmful to whatever renders it.
+
+## Soft drop
+
+Invalid metadata never fails the payment. The payment is legitimate; only the
+listing is bad. `submitCatalogListing` returns
+`{ accepted, drops }` and never throws, and `toExtensionResponses(drops)`
+builds the `EXTENSION-RESPONSES` body so the seller is told which field was
+rejected and why:
+
+```json
+{
+  "bazaar": {
+    "catalog": {
+      "accepted": false,
+      "drops": [
+        {
+          "field": "extensions.bazaar.routeTemplate",
+          "code": "path_traversal",
+          "message": "routeTemplate contains a path traversal segment."
+        }
+      ]
+    }
+  }
+}
+```
+
+`code` is stable and machine-readable — an agent branches on it rather than
+parsing `message`. `message` never echoes the offending value back.
+
+## What an attacker who can pay can still attempt
+
+- **Squatting an unclaimed identity.** First claim wins, so a payer can
+  register a URL they do not operate, as long as nobody registered it first.
+  What they cannot do is claim someone else's `payTo`, so the listing is
+  attributable and revocable. Binding a listing to proof of control over its
+  domain would close this, and is not in this change.
+- **Paying for their slots.** Rate limits bound the flood per `payTo`; funding
+  many addresses buys proportionally more slots, at the cost of a payment per
+  write.
+- **Truthful but useless metadata.** Nothing here judges whether a description
+  is accurate. That is a ranking problem, and belongs to search (#129).
diff --git a/src/__tests__/bazaarIntegrity.test.ts b/src/__tests__/bazaarIntegrity.test.ts
new file mode 100644
index 0000000..89bb038
--- /dev/null
+++ b/src/__tests__/bazaarIntegrity.test.ts
@@ -0,0 +1,435 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const { mockFindFirst, mockUpsert, mockFindMany, mockCount, mockCheckRate } = vi.hoisted(() => ({
+  mockFindFirst: vi.fn(),
+  mockUpsert: vi.fn(),
+  mockFindMany: vi.fn(),
+  mockCount: vi.fn(),
+  mockCheckRate: vi.fn(),
+}))
+
+vi.mock('../db', () => ({
+  prisma: {
+    bazaarResource: {
+      findFirst: mockFindFirst,
+      upsert: mockUpsert,
+      findMany: mockFindMany,
+      count: mockCount,
+      deleteMany: vi.fn(),
+    },
+  },
+}))
+
+vi.mock('../bazaar/rateLimit', () => ({
+  checkCatalogWriteRate: mockCheckRate,
+}))
+
+import { submitCatalogListing, queryDiscoveryResources } from '../bazaar/catalog'
+import {
+  CATALOG_LIMITS,
+  fullyPercentDecode,
+  stripControlChars,
+  toExtensionResponses,
+  validateListing,
+  validateRouteTemplate,
+  type CatalogAuthority,
+} from '../bazaar/validation'
+import type { RegisterBazaarResourceInput } from '../bazaar/types'
+
+/** Obviously synthetic, but shaped like a real strkey so the address check passes. */
+const SELLER = 'G' + 'A'.repeat(55)
+const ATTACKER = 'G' + 'B'.repeat(55)
+
+const authority: CatalogAuthority = { payTo: SELLER, network: 'mainnet' }
+
+function listing(overrides: Partial<RegisterBazaarResourceInput> = {}): RegisterBazaarResourceInput {
+  return {
+    type: 'http',
+    network: 'mainnet',
+    resource: { url: 'https://lens.example/price/XLMUSDC' },
+    accepts: [
+      {
+        scheme: 'exact',
+        network: 'stellar:pubnet',
+        amount: '1000000',
+        asset: 'CCW67TSZV3SSS2HXMBQ5JFGCKJNXKZM7UQUWUZPUTHXSTZLEO7SJMI75',
+        payTo: SELLER,
+        maxTimeoutSeconds: 60,
+      },
+    ],
+    bazaar: {
+      info: { input: { type: 'http', method: 'GET' } },
+      schema: { type: 'object' },
+    },
+    ...overrides,
+  }
+}
+
+function codes(drops: { code: string }[]): string[] {
+  return drops.map(d => d.code)
+}
+
+beforeEach(() => {
+  mockFindFirst.mockReset().mockResolvedValue(null)
+  mockUpsert.mockReset().mockResolvedValue({})
+  mockFindMany.mockReset().mockResolvedValue([])
+  mockCount.mockReset().mockResolvedValue(0)
+  mockCheckRate.mockReset().mockResolvedValue({ allowed: true })
+})
+
+describe('fullyPercentDecode', () => {
+  it('decodes to a fixed point rather than once', () => {
+    expect(fullyPercentDecode('%252e%252e%252f')).toEqual({ ok: true, decoded: '../' })
+  })
+
+  it('leaves an already-decoded value alone', () => {
+    expect(fullyPercentDecode('/price/:pairId')).toEqual({ ok: true, decoded: '/price/:pairId' })
+  })
+
+  it('reports malformed encoding instead of throwing', () => {
+    expect(fullyPercentDecode('%zz')).toEqual({ ok: false, code: 'malformed_encoding' })
+  })
+
+  it('refuses a value still changing after the decode budget', () => {
+    let value = '../'
+    for (let i = 0; i < CATALOG_LIMITS.percentDecodePasses + 1; i++) {
+      value = value.replace(/%/g, '%25').replace(/\./g, '%2e').replace(/\//g, '%2f')
+    }
+    expect(fullyPercentDecode(value)).toEqual({ ok: false, code: 'excessive_encoding' })
+  })
+})
+
+describe('validateRouteTemplate', () => {
+  const url = 'https://lens.example/price/XLMUSDC'
+
+  it('accepts a canonical :param template that describes the resource path', () => {
+    const result = validateRouteTemplate('/price/:pairId', url)
+    expect(result).toEqual({ ok: true, value: '/price/:pairId' })
+  })
+
+  it('rejects %2e%2e%2f — percent-decoded BEFORE the traversal check', () => {
+    const result = validateRouteTemplate('/price/%2e%2e%2fadmin', url)
+    expect(result.ok).toBe(false)
+    if (!result.ok) expect(codes(result.drops)).toContain('path_traversal')
+  })
+
+  it('rejects a plain ../ traversal', () => {
+    const result = validateRouteTemplate('/price/../admin', url)
+    expect(result.ok).toBe(false)
+    if (!result.ok) expect(codes(result.drops)).toContain('path_traversal')
+  })
+
+  it('rejects double-encoded traversal', () => {
+    const result = validateRouteTemplate('/price/%252e%252e%252fadmin', url)
+    expect(result.ok).toBe(false)
+    if (!result.ok) expect(codes(result.drops)).toContain('path_traversal')
+  })
+
+  it('rejects a backslash separator', () => {
+    const result = validateRouteTemplate('/price\\..\\admin', url)
+    expect(result.ok).toBe(false)
+    if (!result.ok) expect(codes(result.drops)).toContain('backslash')
+  })
+
+  it('rejects an absolute URL and a protocol-relative one', () => {
+    expect(validateRouteTemplate('https://evil.example/price/:pairId', url).ok).toBe(false)
+    expect(validateRouteTemplate('//evil.example/price', url).ok).toBe(false)
+  })
+
+  it('rejects a query string or fragment', () => {
+    expect(validateRouteTemplate('/price/:pairId?admin=1', url).ok).toBe(false)
+    expect(validateRouteTemplate('/price/:pairId#x', url).ok).toBe(false)
+  })
+
+  it('rejects a NUL byte', () => {
+    const result = validateRouteTemplate('/price/%00', url)
+    expect(result.ok).toBe(false)
+    if (!result.ok) expect(codes(result.drops)).toContain('control_characters')
+  })
+
+  it('rejects a template that does not describe the resource path', () => {
+    const result = validateRouteTemplate('/admin/:id', url)
+    expect(result.ok).toBe(false)
+    if (!result.ok) expect(codes(result.drops)).toContain('template_url_mismatch')
+  })
+
+  it('rejects a malformed parameter name and a repeated one', () => {
+    expect(validateRouteTemplate('/price/:1bad', url).ok).toBe(false)
+    expect(validateRouteTemplate('/:pairId/:pairId', 'https://lens.example/a/b').ok).toBe(false)
+  })
+
+  it('rejects a template past the length limit', () => {
+    const long = '/' + 'a'.repeat(CATALOG_LIMITS.routeTemplate + 1)
+    const result = validateRouteTemplate(long, url)
+    expect(result.ok).toBe(false)
+    if (!result.ok) expect(codes(result.drops)).toContain('too_long')
+  })
+})
+
+describe('validateListing — seller identity', () => {
+  it('accepts a listing whose accepts[] matches the payment payTo', () => {
+    const result = validateListing(listing(), authority)
+    expect(result.ok).toBe(true)
+  })
+
+  it('refuses a listing that claims another seller payTo', () => {
+    const forged = listing({
+      accepts: [{ ...listing().accepts[0], payTo: ATTACKER }],
+    })
+    const result = validateListing(forged, authority)
+    expect(result.ok).toBe(false)
+    if (!result.ok) expect(codes(result.drops)).toContain('pay_to_mismatch')
+  })
+
+  it('refuses a listing registered against a different network than the payment', () => {
+    const result = validateListing(listing({ network: 'testnet' }), authority)
+    expect(result.ok).toBe(false)
+    if (!result.ok) expect(codes(result.drops)).toContain('network_mismatch')
+  })
+
+  it('refuses accepts[] whose CAIP-2 network contradicts the payment', () => {
+    const mismatched = listing({
+      accepts: [{ ...listing().accepts[0], network: 'stellar:testnet' }],
+    })
+    const result = validateListing(mismatched, authority)
+    expect(result.ok).toBe(false)
+    if (!result.ok) expect(codes(result.drops)).toContain('network_mismatch')
+  })
+
+  it('refuses a payTo that is not a Stellar address, even when it matches the payment', () => {
+    const result = validateListing(
+      listing({ accepts: [{ ...listing().accepts[0], payTo: 'not-an-address' }] }),
+      { payTo: 'not-an-address', network: 'mainnet' },
+    )
+    expect(result.ok).toBe(false)
+    if (!result.ok) expect(codes(result.drops)).toContain('invalid_address')
+  })
+})
+
+describe('validateListing — field limits', () => {
+  it('refuses a description past the limit', () => {
+    const result = validateListing(
+      listing({ resource: { url: 'https://lens.example/price/XLMUSDC', description: 'x'.repeat(CATALOG_LIMITS.description + 1) } }),
+      authority,
+    )
+    expect(result.ok).toBe(false)
+    if (!result.ok) expect(codes(result.drops)).toContain('too_long')
+  })
+
+  it('refuses more tags than the limit, and a tag with illegal characters', () => {
+    const tooMany = validateListing(
+      listing({
+        resource: {
+          url: 'https://lens.example/price/XLMUSDC',
+          tags: Array.from({ length: CATALOG_LIMITS.tags + 1 }, (_, i) => `tag${i}`),
+        },
+      }),
+      authority,
+    )
+    expect(tooMany.ok).toBe(false)
+
+    const illegal = validateListing(
+      listing({ resource: { url: 'https://lens.example/price/XLMUSDC', tags: ['<script>'] } }),
+      authority,
+    )
+    expect(illegal.ok).toBe(false)
+    if (!illegal.ok) expect(codes(illegal.drops)).toContain('invalid_characters')
+  })
+
+  it('refuses a non-https resource URL, and one with embedded credentials', () => {
+    const insecure = validateListing(listing({ resource: { url: 'http://lens.example/price/XLMUSDC' } }), authority)
+    expect(insecure.ok).toBe(false)
+    if (!insecure.ok) expect(codes(insecure.drops)).toContain('insecure_scheme')
+
+    const creds = validateListing(
+      listing({ resource: { url: 'https://user:pass@lens.example/price/XLMUSDC' } }),
+      authority,
+    )
+    expect(creds.ok).toBe(false)
+    if (!creds.ok) expect(codes(creds.drops)).toContain('embedded_credentials')
+  })
+
+  it('refuses a malformed mimeType', () => {
+    const result = validateListing(
+      listing({ resource: { url: 'https://lens.example/price/XLMUSDC', mimeType: 'not a mime type' } }),
+      authority,
+    )
+    expect(result.ok).toBe(false)
+  })
+
+  it('refuses bazaar.info larger than the byte ceiling', () => {
+    const result = validateListing(
+      listing({
+        bazaar: {
+          info: { input: { type: 'http', method: 'GET' }, output: { blob: 'x'.repeat(CATALOG_LIMITS.jsonBytes) } },
+          schema: { type: 'object' },
+        },
+      }),
+      authority,
+    )
+    expect(result.ok).toBe(false)
+    if (!result.ok) expect(codes(result.drops)).toContain('too_large')
+  })
+
+  it('refuses an accepts[] amount that is not atomic units', () => {
+    const result = validateListing(listing({ accepts: [{ ...listing().accepts[0], amount: '1.5' }] }), authority)
+    expect(result.ok).toBe(false)
+    if (!result.ok) expect(codes(result.drops)).toContain('invalid_amount')
+  })
+
+  it('strips control characters from text it keeps', () => {
+    const result = validateListing(
+      listing({ resource: { url: 'https://lens.example/price/XLMUSDC', serviceName: 'Lens\u0000 Oracle' } }),
+      authority,
+    )
+    expect(result.ok).toBe(true)
+    if (result.ok) expect(result.value.resource.serviceName).toBe('Lens Oracle')
+  })
+
+  it('stores the decoded routeTemplate, not the submitted encoding', () => {
+    const result = validateListing(
+      listing({
+        bazaar: {
+          info: { input: { type: 'http', method: 'GET' } },
+          schema: { type: 'object' },
+          routeTemplate: '/price/%3ApairId',
+        },
+      }),
+      authority,
+    )
+    expect(result.ok).toBe(true)
+    if (result.ok) expect(result.value.bazaar.routeTemplate).toBe('/price/:pairId')
+  })
+})
+
+describe('submitCatalogListing — soft drop', () => {
+  it('accepts a valid listing and writes it', async () => {
+    const result = await submitCatalogListing(listing(), authority)
+
+    expect(result).toEqual({ accepted: true, drops: [] })
+    expect(mockUpsert).toHaveBeenCalledTimes(1)
+  })
+
+  it('drops an invalid listing without throwing and without writing', async () => {
+    const forged = listing({ accepts: [{ ...listing().accepts[0], payTo: ATTACKER }] })
+
+    const result = await submitCatalogListing(forged, authority)
+
+    expect(result.accepted).toBe(false)
+    expect(codes(result.drops)).toContain('pay_to_mismatch')
+    expect(mockUpsert).not.toHaveBeenCalled()
+  })
+
+  it('refuses to overwrite an identity already owned by another payTo', async () => {
+    mockFindFirst.mockResolvedValue({ payTo: ATTACKER })
+
+    const result = await submitCatalogListing(listing(), authority)
+
+    expect(result.accepted).toBe(false)
+    expect(codes(result.drops)).toContain('identity_owned_by_another_seller')
+    expect(mockUpsert).not.toHaveBeenCalled()
+  })
+
+  it('lets a seller update their own listing', async () => {
+    mockFindFirst.mockResolvedValue({ payTo: SELLER })
+
+    const result = await submitCatalogListing(listing(), authority)
+
+    expect(result.accepted).toBe(true)
+    expect(mockUpsert).toHaveBeenCalledTimes(1)
+  })
+
+  it('drops the listing when the payTo is over its write rate limit', async () => {
+    mockCheckRate.mockResolvedValue({ allowed: false, scope: 'minute', retryAfterSeconds: 60 })
+
+    const result = await submitCatalogListing(listing(), authority)
+
+    expect(result.accepted).toBe(false)
+    expect(codes(result.drops)).toContain('rate_limited')
+    expect(mockUpsert).not.toHaveBeenCalled()
+  })
+
+  it('drops the listing rather than writing it when the limiter is unavailable', async () => {
+    mockCheckRate.mockResolvedValue({ allowed: false, scope: 'unavailable' })
+
+    const result = await submitCatalogListing(listing(), authority)
+
+    expect(result.accepted).toBe(false)
+    expect(codes(result.drops)).toContain('rate_limit_unavailable')
+    expect(mockUpsert).not.toHaveBeenCalled()
+  })
+
+  it('drops rather than throwing when the catalog write itself fails', async () => {
+    mockUpsert.mockRejectedValue(new Error('connection reset'))
+
+    const result = await submitCatalogListing(listing(), authority)
+
+    expect(result.accepted).toBe(false)
+    expect(codes(result.drops)).toContain('catalog_write_failed')
+  })
+
+  it('writes only the sanitized values', async () => {
+    await submitCatalogListing(
+      listing({
+        resource: { url: 'https://lens.example/price/XLMUSDC', serviceName: 'Lens\u0000 Oracle' },
+        bazaar: {
+          info: { input: { type: 'http', method: 'GET' } },
+          schema: { type: 'object' },
+          routeTemplate: '/price/%3ApairId',
+        },
+      }),
+      authority,
+    )
+
+    expect(mockUpsert).toHaveBeenCalledWith(
+      expect.objectContaining({
+        create: expect.objectContaining({ serviceName: 'Lens Oracle', routeTemplate: '/price/:pairId' }),
+      }),
+    )
+  })
+})
+
+describe('toExtensionResponses', () => {
+  it('reports acceptance when nothing was dropped', () => {
+    expect(toExtensionResponses([])).toEqual({ bazaar: { catalog: { accepted: true } } })
+  })
+
+  it('reports each drop with a field and a machine-readable code', () => {
+    const drops = [{ field: 'accepts[0].payTo', code: 'pay_to_mismatch', message: 'nope' }]
+
+    expect(toExtensionResponses(drops)).toEqual({
+      bazaar: { catalog: { accepted: false, drops } },
+    })
+  })
+})
+
+describe('read-time sanitisation', () => {
+  it('strips control characters from rows written before validation existed', async () => {
+    mockFindMany.mockResolvedValue([
+      {
+        url: 'https://lens.example/price',
+        description: 'legacyrow',
+        mimeType: null,
+        serviceName: null,
+        tags: ['ok\u0000tag'],
+        iconUrl: null,
+        accepts: [],
+        bazaarInfo: {},
+        bazaarSchema: {},
+        routeTemplate: '/price/:id',
+        extensionKeys: ['bazaar'],
+      },
+    ])
+    mockCount.mockResolvedValue(1)
+
+    const result = await queryDiscoveryResources({ limit: 50, offset: 0 })
+
+    expect(result.resources[0].resource.description).toBe('legacyrow')
+    expect(result.resources[0].resource.tags).toEqual(['oktag'])
+    expect(result.resources[0].extensions.bazaar.routeTemplate).toBe('/price/:id')
+  })
+
+  it('stripControlChars leaves ordinary text untouched', () => {
+    expect(stripControlChars('XLM/USDC spot price')).toBe('XLM/USDC spot price')
+  })
+})
diff --git a/src/__tests__/bazaarRateLimit.test.ts b/src/__tests__/bazaarRateLimit.test.ts
new file mode 100644
index 0000000..0ae4f69
--- /dev/null
+++ b/src/__tests__/bazaarRateLimit.test.ts
@@ -0,0 +1,99 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+
+const { mockExec } = vi.hoisted(() => ({ mockExec: vi.fn() }))
+
+function chain() {
+  const self: Record<string, unknown> = {}
+  self.incr = () => self
+  self.expire = () => self
+  self.exec = mockExec
+  return self
+}
+
+vi.mock('../redis', () => ({
+  redis: { multi: () => chain() },
+}))
+
+import { checkCatalogWriteRate, perDayLimit, perMinuteLimit } from '../bazaar/rateLimit'
+
+const PAY_TO = 'G' + 'A'.repeat(55)
+
+/** ioredis multi().exec() returns [error, value] pairs in command order. */
+function counts(minute: number, day: number) {
+  return [
+    [null, minute],
+    [null, 1],
+    [null, day],
+    [null, 1],
+  ]
+}
+
+beforeEach(() => {
+  mockExec.mockReset()
+})
+
+afterEach(() => {
+  delete process.env.BAZAAR_CATALOG_WRITES_PER_MIN
+  delete process.env.BAZAAR_CATALOG_WRITES_PER_DAY
+})
+
+describe('checkCatalogWriteRate', () => {
+  it('allows a write inside both windows', async () => {
+    mockExec.mockResolvedValue(counts(1, 1))
+
+    expect(await checkCatalogWriteRate(PAY_TO)).toEqual({ allowed: true })
+  })
+
+  it('rejects once the per-minute window is exceeded', async () => {
+    mockExec.mockResolvedValue(counts(perMinuteLimit() + 1, 1))
+
+    const decision = await checkCatalogWriteRate(PAY_TO)
+
+    expect(decision.allowed).toBe(false)
+    expect(decision.scope).toBe('minute')
+    expect(decision.retryAfterSeconds).toBe(60)
+  })
+
+  it('rejects once the per-day window is exceeded', async () => {
+    mockExec.mockResolvedValue(counts(1, perDayLimit() + 1))
+
+    const decision = await checkCatalogWriteRate(PAY_TO)
+
+    expect(decision.allowed).toBe(false)
+    expect(decision.scope).toBe('day')
+  })
+
+  it('counts the attempt even when it is rejected, so a flood still costs its slots', async () => {
+    mockExec.mockResolvedValue(counts(perMinuteLimit() + 5, 1))
+
+    await checkCatalogWriteRate(PAY_TO)
+
+    expect(mockExec).toHaveBeenCalledTimes(1)
+  })
+
+  it('fails closed when Redis is unreachable', async () => {
+    mockExec.mockRejectedValue(new Error('ECONNREFUSED'))
+
+    expect(await checkCatalogWriteRate(PAY_TO)).toEqual({ allowed: false, scope: 'unavailable' })
+  })
+
+  it('fails closed when the transaction returns no result', async () => {
+    mockExec.mockResolvedValue(null)
+
+    expect(await checkCatalogWriteRate(PAY_TO)).toEqual({ allowed: false, scope: 'unavailable' })
+  })
+
+  it('reads its limits from the environment', () => {
+    process.env.BAZAAR_CATALOG_WRITES_PER_MIN = '3'
+    process.env.BAZAAR_CATALOG_WRITES_PER_DAY = '30'
+
+    expect(perMinuteLimit()).toBe(3)
+    expect(perDayLimit()).toBe(30)
+  })
+
+  it('falls back to its defaults for a nonsense limit', () => {
+    process.env.BAZAAR_CATALOG_WRITES_PER_MIN = 'lots'
+
+    expect(perMinuteLimit()).toBe(10)
+  })
+})
diff --git a/src/bazaar/catalog.ts b/src/bazaar/catalog.ts
index 9e0a9a4..d3b9818 100644
--- a/src/bazaar/catalog.ts
+++ b/src/bazaar/catalog.ts
@@ -6,6 +6,15 @@ import type {
   DiscoveryResponse,
   RegisterBazaarResourceInput,
 } from './types'
+import { checkCatalogWriteRate } from './rateLimit'
+import {
+  stripControlChars,
+  validateListing,
+  type CatalogAuthority,
+  type CatalogDrop,
+} from './validation'
+
+export type { CatalogAuthority, CatalogDrop } from './validation'
 
 /** CAIP-2 network ids used by @x402/stellar and returned in `accepts[].network`. */
 const STELLAR_NETWORK_IDS: Record<NetworkName, string> = {
@@ -68,6 +77,101 @@ export async function registerBazaarResource(input: RegisterBazaarResourceInput)
   }
 }
 
+/** Outcome of an untrusted catalog write. Never an exception — see soft drop. */
+export interface CatalogWriteResult {
+  /** Whether the listing landed in the catalog. */
+  accepted: boolean
+  /** Why it did not, when it did not. Empty on acceptance. */
+  drops: CatalogDrop[]
+}
+
+/**
+ * Registers a listing that arrived from a client, in the payment payload.
+ *
+ * This is the untrusted door into the catalog and the one #131 is about.
+ * `registerBazaarResource` above stays the trusted path, for listings Lens
+ * publishes about its own endpoints; everything a payer sends comes through
+ * here instead.
+ *
+ * Soft drop is the contract: a bad listing never fails the payment, because
+ * the payment is legitimate — only the metadata is not. The caller settles the
+ * payment either way and reports `drops` back through `EXTENSION-RESPONSES`
+ * (see `toExtensionResponses`), so a seller whose listing was rejected finds
+ * out why instead of watching it silently never appear.
+ */
+export async function submitCatalogListing(
+  input: RegisterBazaarResourceInput,
+  authority: CatalogAuthority,
+): Promise<CatalogWriteResult> {
+  const rate = await checkCatalogWriteRate(authority.payTo)
+  if (!rate.allowed) {
+    return {
+      accepted: false,
+      drops: [
+        {
+          field: 'listing',
+          code: rate.scope === 'unavailable' ? 'rate_limit_unavailable' : 'rate_limited',
+          message:
+            rate.scope === 'unavailable'
+              ? 'Catalog writes are temporarily unavailable; the payment was unaffected.'
+              : `Too many catalog writes for this payTo. Retry in ${rate.retryAfterSeconds ?? 60}s.`,
+        },
+      ],
+    }
+  }
+
+  const validated = validateListing(input, authority)
+  if (!validated.ok) return { accepted: false, drops: validated.drops }
+
+  const owner = await identityOwner(validated.value)
+  if (owner !== null && owner !== authority.payTo) {
+    return {
+      accepted: false,
+      drops: [
+        {
+          field: 'resource.url',
+          code: 'identity_owned_by_another_seller',
+          message: 'This resource identity is already registered to a different payTo.',
+        },
+      ],
+    }
+  }
+
+  try {
+    await registerBazaarResource(validated.value)
+  } catch {
+    return {
+      accepted: false,
+      drops: [{ field: 'listing', code: 'catalog_write_failed', message: 'The catalog could not store this listing.' }],
+    }
+  }
+
+  return { accepted: true, drops: [] }
+}
+
+/**
+ * Returns the `payTo` that already owns a listing's identity tuple, or null if
+ * the identity is unclaimed.
+ *
+ * First claim wins. A seller can update their own listing forever; nobody else
+ * can overwrite it, which is what stops a payer from repointing another
+ * seller's entry at their own endpoint or pricing.
+ */
+async function identityOwner(input: RegisterBazaarResourceInput): Promise<string | null> {
+  const existing = await prisma.bazaarResource.findFirst({
+    where: {
+      network: input.network,
+      url: input.resource.url,
+      ...(input.type === 'mcp'
+        ? { mcpToolName: (input.bazaar.info.input as { toolName: string }).toolName }
+        : { httpMethod: (input.bazaar.info.input as { method: string }).method }),
+    },
+    select: { payTo: true },
+  })
+
+  return existing?.payTo ?? null
+}
+
 export async function removeBazaarResource(network: NetworkName, url: string, key?: string): Promise<void> {
   await prisma.bazaarResource.deleteMany({
     where: {
@@ -129,18 +233,21 @@ function toListing(row: {
     bazaar: {
       info: row.bazaarInfo as BazaarResourceListing['extensions']['bazaar']['info'],
       schema: row.bazaarSchema as Record<string, unknown>,
-      ...(row.routeTemplate ? { routeTemplate: row.routeTemplate } : {}),
+      ...(row.routeTemplate ? { routeTemplate: stripControlChars(row.routeTemplate) } : {}),
     },
   }
 
+  // Catalog content is untrusted at read time as well as at write time: rows
+  // written before #131's validation existed were never checked, and a value
+  // that is harmless inside JSON can still be harmful to whatever renders it.
   return {
     resource: {
-      url: row.url,
-      ...(row.description ? { description: row.description } : {}),
-      ...(row.mimeType ? { mimeType: row.mimeType } : {}),
-      ...(row.serviceName ? { serviceName: row.serviceName } : {}),
-      ...(row.tags.length > 0 ? { tags: row.tags } : {}),
-      ...(row.iconUrl ? { iconUrl: row.iconUrl } : {}),
+      url: stripControlChars(row.url),
+      ...(row.description ? { description: stripControlChars(row.description) } : {}),
+      ...(row.mimeType ? { mimeType: stripControlChars(row.mimeType) } : {}),
+      ...(row.serviceName ? { serviceName: stripControlChars(row.serviceName) } : {}),
+      ...(row.tags.length > 0 ? { tags: row.tags.map(stripControlChars) } : {}),
+      ...(row.iconUrl ? { iconUrl: stripControlChars(row.iconUrl) } : {}),
     },
     accepts: row.accepts as BazaarResourceListing['accepts'],
     extensions,
diff --git a/src/bazaar/rateLimit.ts b/src/bazaar/rateLimit.ts
new file mode 100644
index 0000000..6ac5f0b
--- /dev/null
+++ b/src/bazaar/rateLimit.ts
@@ -0,0 +1,94 @@
+import type Redis from 'ioredis'
+import { redis } from '../redis'
+
+/**
+ * Per-`payTo` rate limiting on catalog writes (#131).
+ *
+ * Anyone who can pay can attempt to write to the index, so the cost of a
+ * flood has to be more than the price of one request. Limits are per payment
+ * recipient rather than per IP: `payTo` is the identity the payment signs, and
+ * it is the identity a flood would be trying to build up.
+ */
+
+const WINDOW_SECONDS = 60
+
+function envLimit(name: string, fallback: number): number {
+  const raw = Number(process.env[name])
+  return Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : fallback
+}
+
+/** Writes allowed per `payTo` per minute. */
+export function perMinuteLimit(): number {
+  return envLimit('BAZAAR_CATALOG_WRITES_PER_MIN', 10)
+}
+
+/** Writes allowed per `payTo` per UTC day. */
+export function perDayLimit(): number {
+  return envLimit('BAZAAR_CATALOG_WRITES_PER_DAY', 200)
+}
+
+export interface RateLimitDecision {
+  allowed: boolean
+  /** Which window rejected the write, when one did. */
+  scope?: 'minute' | 'day' | 'unavailable'
+  retryAfterSeconds?: number
+}
+
+function minuteKey(payTo: string): string {
+  return `lens:bazaar:catalog-writes:min:${Math.floor(Date.now() / 1000 / WINDOW_SECONDS)}:${payTo}`
+}
+
+function dayKey(payTo: string): string {
+  const d = new Date()
+  const day = `${d.getUTCFullYear()}-${String(d.getUTCMonth() + 1).padStart(2, '0')}-${String(d.getUTCDate()).padStart(2, '0')}`
+  return `lens:bazaar:catalog-writes:day:${day}:${payTo}`
+}
+
+function secondsUntilEndOfDay(): number {
+  const now = new Date()
+  const end = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate() + 1))
+  return Math.max(1, Math.floor((end.getTime() - now.getTime()) / 1000))
+}
+
+/**
+ * Counts one catalog write against both windows and reports whether it is
+ * allowed.
+ *
+ * Counting happens before the decision, so a rejected write still costs the
+ * attacker its slot — otherwise a flood would only be slowed by the number of
+ * *successful* writes, which is the number an attacker controls least.
+ *
+ * Fails **closed**: if Redis is unreachable we cannot say a payer is under
+ * their limit, and the safe answer at a trust boundary is to drop the listing.
+ * The payment is unaffected either way — this only decides whether the listing
+ * lands, and the seller is told why.
+ */
+export async function checkCatalogWriteRate(payTo: string): Promise<RateLimitDecision> {
+  const db = redis as unknown as Redis
+
+  try {
+    const results = await db
+      .multi()
+      .incr(minuteKey(payTo))
+      .expire(minuteKey(payTo), WINDOW_SECONDS)
+      .incr(dayKey(payTo))
+      .expire(dayKey(payTo), secondsUntilEndOfDay())
+      .exec()
+
+    if (!results) return { allowed: false, scope: 'unavailable' }
+
+    const minuteCount = Number(results[0]?.[1] ?? 0)
+    const dayCount = Number(results[2]?.[1] ?? 0)
+
+    if (minuteCount > perMinuteLimit()) {
+      return { allowed: false, scope: 'minute', retryAfterSeconds: WINDOW_SECONDS }
+    }
+    if (dayCount > perDayLimit()) {
+      return { allowed: false, scope: 'day', retryAfterSeconds: secondsUntilEndOfDay() }
+    }
+
+    return { allowed: true }
+  } catch {
+    return { allowed: false, scope: 'unavailable' }
+  }
+}
diff --git a/src/bazaar/validation.ts b/src/bazaar/validation.ts
new file mode 100644
index 0000000..2b83e8f
--- /dev/null
+++ b/src/bazaar/validation.ts
@@ -0,0 +1,569 @@
+import type { NetworkName } from '../config'
+import type {
+  BazaarPaymentRequirement,
+  RegisterBazaarResourceInput,
+} from './types'
+
+/**
+ * Catalog integrity checks for the Bazaar (#131).
+ *
+ * The facilitator is a trust boundary: clients echo the resource block into
+ * the payment payload, so every field validated here arrives from whoever paid
+ * — including a hostile payer. Nothing in this module trusts its input, and
+ * nothing here throws: invalid metadata is *soft dropped* (the payment stands,
+ * the listing does not) and each drop is reported back so the seller learns
+ * why.
+ */
+
+/** CAIP-2 network ids, mirroring catalog.ts's mapping. */
+const CAIP2_BY_NETWORK: Record<NetworkName, string> = {
+  mainnet: 'stellar:pubnet',
+  testnet: 'stellar:testnet',
+}
+
+export const CATALOG_LIMITS = {
+  url: 2048,
+  description: 2048,
+  serviceName: 128,
+  tags: 10,
+  tag: 64,
+  iconUrl: 2048,
+  mimeType: 255,
+  mcpToolName: 128,
+  accepts: 10,
+  extensionKeys: 16,
+  extensionKey: 64,
+  routeTemplate: 512,
+  /** Serialized byte ceiling for each of `bazaar.info` and `bazaar.schema`. */
+  jsonBytes: 32 * 1024,
+  /** Decoding passes allowed before a value is treated as deliberately obfuscated. */
+  percentDecodePasses: 4,
+} as const
+
+/** A single reason a listing (or one of its fields) was dropped. */
+export interface CatalogDrop {
+  /** Dotted path of the offending field, e.g. "extensions.bazaar.routeTemplate". */
+  field: string
+  /** Stable machine-readable code — agents branch on this, not on `message`. */
+  code: string
+  /** Human-readable detail. Never echoes the offending value back verbatim. */
+  message: string
+}
+
+export type ValidationResult =
+  | { ok: true; value: RegisterBazaarResourceInput; drops: [] }
+  | { ok: false; drops: CatalogDrop[] }
+
+/** Identity proven by the payment itself, which a listing cannot argue with. */
+export interface CatalogAuthority {
+  /** `payTo` from the PaymentRequirements the payer signed. */
+  payTo: string
+  /** Network the payment settled on. */
+  network: NetworkName
+}
+
+const STELLAR_ADDRESS = /^[GC][A-Z2-7]{55}$/
+const MIME_TYPE = /^[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]{0,126}\/[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]{0,126}$/
+const TAG = /^[A-Za-z0-9][A-Za-z0-9 ._-]*$/
+const MCP_TOOL_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/
+const EXTENSION_KEY = /^[A-Za-z0-9][A-Za-z0-9._-]*$/
+const SCHEME = /^[a-z][a-z0-9_-]*$/
+const ROUTE_PARAM = /^:[A-Za-z_][A-Za-z0-9_]*$/
+const ROUTE_LITERAL = /^[A-Za-z0-9._~-]*$/
+const AMOUNT = /^[0-9]{1,40}$/
+
+/** C0, DEL and C1 control characters — never legitimate in catalog metadata. */
+const CONTROL_CHAR = /[\u0000-\u001F\u007F-\u009F]/u
+const CONTROL_CHARS_GLOBAL = /[\u0000-\u001F\u007F-\u009F]/gu
+
+function drop(field: string, code: string, message: string): CatalogDrop {
+  return { field, code, message }
+}
+
+/**
+ * Strips control characters (including NUL and the C1 range) from a string.
+ *
+ * Applied on write *and* on read: catalog rows predate this validation, and a
+ * value that is safe inside JSON can still break a consumer that renders it.
+ */
+export function stripControlChars(value: string): string {
+  return value.replace(CONTROL_CHARS_GLOBAL, '')
+}
+
+export type DecodeResult =
+  | { ok: true; decoded: string }
+  | { ok: false; code: 'malformed_encoding' | 'excessive_encoding' }
+
+/**
+ * Percent-decodes a value repeatedly until it stops changing.
+ *
+ * The RFP is explicit that decoding happens *before* traversal checks, not
+ * after: `%2e%2e%2f` is `../`, and a validator that inspects the raw string
+ * and decodes later waves it straight through. Decoding to a fixed point also
+ * defeats double encoding (`%252e%252e%252f`), which single-pass decoding
+ * would turn into `%2e%2e%2f` — a string that no longer contains `..` at the
+ * moment it is inspected, but does by the time anything resolves it.
+ *
+ * A value still changing after `percentDecodePasses` rounds is dropped rather
+ * than decoded further: nothing legitimate is encoded four times deep.
+ */
+export function fullyPercentDecode(value: string): DecodeResult {
+  let current = value
+
+  for (let pass = 0; pass < CATALOG_LIMITS.percentDecodePasses; pass++) {
+    let next: string
+    try {
+      next = decodeURIComponent(current)
+    } catch {
+      return { ok: false, code: 'malformed_encoding' }
+    }
+    if (next === current) return { ok: true, decoded: current }
+    current = next
+  }
+
+  return { ok: false, code: 'excessive_encoding' }
+}
+
+/**
+ * Validates a `routeTemplate` against a hostile author.
+ *
+ * Runs entirely on the fully decoded form, and the decoded form is what gets
+ * stored — so the value the catalog serves is the value that was validated,
+ * with no encoded second reading of it left over.
+ */
+export function validateRouteTemplate(
+  template: unknown,
+  resourceUrl?: string,
+  field = 'extensions.bazaar.routeTemplate',
+): { ok: true; value: string } | { ok: false; drops: CatalogDrop[] } {
+  if (typeof template !== 'string' || template.length === 0) {
+    return { ok: false, drops: [drop(field, 'invalid_type', 'routeTemplate must be a non-empty string.')] }
+  }
+  if (template.length > CATALOG_LIMITS.routeTemplate) {
+    return {
+      ok: false,
+      drops: [drop(field, 'too_long', `routeTemplate exceeds ${CATALOG_LIMITS.routeTemplate} characters.`)],
+    }
+  }
+
+  const decoded = fullyPercentDecode(template)
+  if (!decoded.ok) {
+    return {
+      ok: false,
+      drops: [
+        drop(
+          field,
+          decoded.code,
+          decoded.code === 'malformed_encoding'
+            ? 'routeTemplate is not valid percent-encoding.'
+            : 'routeTemplate is percent-encoded more deeply than the catalog will decode.',
+        ),
+      ],
+    }
+  }
+
+  const value = decoded.decoded
+
+  if (CONTROL_CHAR.test(value)) {
+    return { ok: false, drops: [drop(field, 'control_characters', 'routeTemplate contains control characters.')] }
+  }
+  if (value.includes('\\')) {
+    return { ok: false, drops: [drop(field, 'backslash', 'routeTemplate must use "/" as its only separator.')] }
+  }
+  if (value.includes('://') || value.startsWith('//')) {
+    return {
+      ok: false,
+      drops: [drop(field, 'not_a_path', 'routeTemplate must be a path, not an absolute or protocol-relative URL.')],
+    }
+  }
+  if (!value.startsWith('/')) {
+    return { ok: false, drops: [drop(field, 'not_absolute', 'routeTemplate must start with "/".')] }
+  }
+  if (value.includes('?') || value.includes('#')) {
+    return { ok: false, drops: [drop(field, 'not_a_path', 'routeTemplate must not carry a query string or fragment.')] }
+  }
+  if (value.includes('%')) {
+    return {
+      ok: false,
+      drops: [drop(field, 'residual_encoding', 'routeTemplate is stored decoded; a literal "%" is not accepted.')],
+    }
+  }
+
+  const segments = value.slice(1).split('/')
+  const params = new Set<string>()
+
+  for (const segment of segments) {
+    if (segment === '.' || segment === '..') {
+      return { ok: false, drops: [drop(field, 'path_traversal', 'routeTemplate contains a path traversal segment.')] }
+    }
+    if (segment.startsWith(':')) {
+      if (!ROUTE_PARAM.test(segment)) {
+        return {
+          ok: false,
+          drops: [drop(field, 'invalid_param', 'routeTemplate parameter names must match :[A-Za-z_][A-Za-z0-9_]*.')],
+        }
+      }
+      if (params.has(segment)) {
+        return { ok: false, drops: [drop(field, 'duplicate_param', 'routeTemplate repeats a parameter name.')] }
+      }
+      params.add(segment)
+      continue
+    }
+    if (!ROUTE_LITERAL.test(segment)) {
+      return {
+        ok: false,
+        drops: [drop(field, 'invalid_characters', 'routeTemplate contains characters not allowed in a path segment.')],
+      }
+    }
+  }
+
+  if (resourceUrl !== undefined && !routeTemplateMatchesUrl(value, resourceUrl)) {
+    return {
+      ok: false,
+      drops: [drop(field, 'template_url_mismatch', 'routeTemplate does not describe the path of resource.url.')],
+    }
+  }
+
+  return { ok: true, value }
+}
+
+/**
+ * Checks that a template actually describes the resource's own path: same
+ * segment count, literal segments equal, parameter segments non-empty.
+ *
+ * Without this a listing could advertise a template that consolidates it under
+ * another seller's route family, which is impersonation through a different
+ * door than a forged `payTo`.
+ */
+function routeTemplateMatchesUrl(template: string, resourceUrl: string): boolean {
+  let path: string
+  try {
+    path = new URL(resourceUrl).pathname
+  } catch {
+    return false
+  }
+
+  const decodedPath = fullyPercentDecode(path)
+  if (!decodedPath.ok) return false
+
+  const templateSegments = template.slice(1).split('/')
+  const pathSegments = decodedPath.decoded.replace(/^\//, '').split('/')
+  if (templateSegments.length !== pathSegments.length) return false
+
+  return templateSegments.every((segment, i) => {
+    if (segment.startsWith(':')) return pathSegments[i].length > 0
+    return segment === pathSegments[i]
+  })
+}
+
+function validateHttpsUrl(
+  raw: unknown,
+  field: string,
+  maxLength: number,
+): { ok: true; value: string } | { ok: false; drops: CatalogDrop[] } {
+  if (typeof raw !== 'string' || raw.length === 0) {
+    return { ok: false, drops: [drop(field, 'invalid_type', `${field} must be a non-empty string.`)] }
+  }
+  if (raw.length > maxLength) {
+    return { ok: false, drops: [drop(field, 'too_long', `${field} exceeds ${maxLength} characters.`)] }
+  }
+  if (CONTROL_CHAR.test(raw)) {
+    return { ok: false, drops: [drop(field, 'control_characters', `${field} contains control characters.`)] }
+  }
+
+  let url: URL
+  try {
+    url = new URL(raw)
+  } catch {
+    return { ok: false, drops: [drop(field, 'invalid_url', `${field} is not a valid absolute URL.`)] }
+  }
+
+  if (url.protocol !== 'https:') {
+    return { ok: false, drops: [drop(field, 'insecure_scheme', `${field} must use https.`)] }
+  }
+  if (url.username.length > 0 || url.password.length > 0) {
+    return { ok: false, drops: [drop(field, 'embedded_credentials', `${field} must not embed credentials.`)] }
+  }
+
+  return { ok: true, value: url.toString() }
+}
+
+function validateText(
+  raw: unknown,
+  field: string,
+  maxLength: number,
+  pattern?: RegExp,
+): { ok: true; value: string } | { ok: false; drops: CatalogDrop[] } {
+  if (typeof raw !== 'string') {
+    return { ok: false, drops: [drop(field, 'invalid_type', `${field} must be a string.`)] }
+  }
+
+  const value = stripControlChars(raw).trim()
+  if (value.length === 0) {
+    return { ok: false, drops: [drop(field, 'empty', `${field} must not be empty.`)] }
+  }
+  if (value.length > maxLength) {
+    return { ok: false, drops: [drop(field, 'too_long', `${field} exceeds ${maxLength} characters.`)] }
+  }
+  if (pattern && !pattern.test(value)) {
+    return { ok: false, drops: [drop(field, 'invalid_characters', `${field} contains characters that are not allowed.`)] }
+  }
+
+  return { ok: true, value }
+}
+
+function jsonByteLength(value: unknown): number {
+  return Buffer.byteLength(JSON.stringify(value ?? null), 'utf8')
+}
+
+function validateAccepts(
+  accepts: unknown,
+  authority: CatalogAuthority,
+  drops: CatalogDrop[],
+): BazaarPaymentRequirement[] | undefined {
+  if (!Array.isArray(accepts) || accepts.length === 0) {
+    drops.push(drop('accepts', 'empty', 'accepts[] must contain at least one payment requirement.'))
+    return undefined
+  }
+  if (accepts.length > CATALOG_LIMITS.accepts) {
+    drops.push(drop('accepts', 'too_many', `accepts[] must contain at most ${CATALOG_LIMITS.accepts} entries.`))
+    return undefined
+  }
+
+  const expectedCaip2 = CAIP2_BY_NETWORK[authority.network]
+  const validated: BazaarPaymentRequirement[] = []
+
+  accepts.forEach((entry, i) => {
+    const at = `accepts[${i}]`
+    if (typeof entry !== 'object' || entry === null) {
+      drops.push(drop(at, 'invalid_type', 'Each accepts[] entry must be an object.'))
+      return
+    }
+    const req = entry as Record<string, unknown>
+
+    // The anchor: a listing may only ever speak for the payTo that signed the
+    // payment carrying it. This is the check that makes impersonation fail.
+    if (req.payTo !== authority.payTo) {
+      drops.push(drop(`${at}.payTo`, 'pay_to_mismatch', "A listing may only claim the payment's own payTo."))
+      return
+    }
+    if (typeof req.payTo !== 'string' || !STELLAR_ADDRESS.test(req.payTo)) {
+      drops.push(drop(`${at}.payTo`, 'invalid_address', 'payTo must be a Stellar account or contract address.'))
+      return
+    }
+    if (req.network !== expectedCaip2) {
+      drops.push(
+        drop(`${at}.network`, 'network_mismatch', `Listing settles on ${expectedCaip2}; accepts[] says otherwise.`),
+      )
+      return
+    }
+
+    const scheme = validateText(req.scheme, `${at}.scheme`, 32, SCHEME)
+    if (!scheme.ok) {
+      drops.push(...scheme.drops)
+      return
+    }
+    if (typeof req.amount !== 'string' || !AMOUNT.test(req.amount)) {
+      drops.push(drop(`${at}.amount`, 'invalid_amount', 'amount must be a string of atomic units.'))
+      return
+    }
+    const asset = validateText(req.asset, `${at}.asset`, 128)
+    if (!asset.ok) {
+      drops.push(...asset.drops)
+      return
+    }
+    const timeout = req.maxTimeoutSeconds
+    if (typeof timeout !== 'number' || !Number.isInteger(timeout) || timeout <= 0 || timeout > 3600) {
+      drops.push(
+        drop(`${at}.maxTimeoutSeconds`, 'invalid_timeout', 'maxTimeoutSeconds must be an integer between 1 and 3600.'),
+      )
+      return
+    }
+    if (req.extra !== undefined && (typeof req.extra !== 'object' || req.extra === null || Array.isArray(req.extra))) {
+      drops.push(drop(`${at}.extra`, 'invalid_type', 'extra must be an object when present.'))
+      return
+    }
+
+    validated.push({
+      scheme: scheme.value,
+      network: expectedCaip2,
+      amount: req.amount,
+      asset: asset.value,
+      payTo: req.payTo,
+      maxTimeoutSeconds: timeout,
+      ...(req.extra ? { extra: req.extra as Record<string, unknown> } : {}),
+    })
+  })
+
+  return validated.length === accepts.length ? validated : undefined
+}
+
+/**
+ * Validates a client-supplied listing against the identity the payment proves.
+ *
+ * Returns the sanitized listing to store, or the reasons it was dropped. It
+ * never throws and never partially writes: a listing lands whole or not at
+ * all, so the catalog cannot end up holding half of a hostile submission.
+ */
+export function validateListing(
+  input: RegisterBazaarResourceInput,
+  authority: CatalogAuthority,
+): ValidationResult {
+  const drops: CatalogDrop[] = []
+
+  if (typeof input !== 'object' || input === null) {
+    return { ok: false, drops: [drop('listing', 'invalid_type', 'Listing must be an object.')] }
+  }
+
+  if (input.type !== 'http' && input.type !== 'mcp') {
+    drops.push(drop('type', 'invalid_type', 'type must be "http" or "mcp".'))
+  }
+  if (input.network !== authority.network) {
+    drops.push(drop('network', 'network_mismatch', "A listing may only be registered on the payment's own network."))
+  }
+
+  const resource = input.resource
+  if (typeof resource !== 'object' || resource === null) {
+    return { ok: false, drops: [...drops, drop('resource', 'invalid_type', 'resource must be an object.')] }
+  }
+
+  const url = validateHttpsUrl(resource.url, 'resource.url', CATALOG_LIMITS.url)
+  if (!url.ok) drops.push(...url.drops)
+
+  const sanitizedResource: RegisterBazaarResourceInput['resource'] = {
+    url: url.ok ? url.value : '',
+  }
+
+  if (resource.description !== undefined) {
+    const description = validateText(resource.description, 'resource.description', CATALOG_LIMITS.description)
+    if (description.ok) sanitizedResource.description = description.value
+    else drops.push(...description.drops)
+  }
+  if (resource.mimeType !== undefined) {
+    const mimeType = validateText(resource.mimeType, 'resource.mimeType', CATALOG_LIMITS.mimeType, MIME_TYPE)
+    if (mimeType.ok) sanitizedResource.mimeType = mimeType.value
+    else drops.push(...mimeType.drops)
+  }
+  if (resource.serviceName !== undefined) {
+    const serviceName = validateText(resource.serviceName, 'resource.serviceName', CATALOG_LIMITS.serviceName)
+    if (serviceName.ok) sanitizedResource.serviceName = serviceName.value
+    else drops.push(...serviceName.drops)
+  }
+  if (resource.iconUrl !== undefined) {
+    const iconUrl = validateHttpsUrl(resource.iconUrl, 'resource.iconUrl', CATALOG_LIMITS.iconUrl)
+    if (iconUrl.ok) sanitizedResource.iconUrl = iconUrl.value
+    else drops.push(...iconUrl.drops)
+  }
+  if (resource.tags !== undefined) {
+    if (!Array.isArray(resource.tags)) {
+      drops.push(drop('resource.tags', 'invalid_type', 'tags must be an array.'))
+    } else if (resource.tags.length > CATALOG_LIMITS.tags) {
+      drops.push(drop('resource.tags', 'too_many', `tags must contain at most ${CATALOG_LIMITS.tags} entries.`))
+    } else {
+      const tags: string[] = []
+      resource.tags.forEach((tag, i) => {
+        const validated = validateText(tag, `resource.tags[${i}]`, CATALOG_LIMITS.tag, TAG)
+        if (validated.ok) tags.push(validated.value)
+        else drops.push(...validated.drops)
+      })
+      if (tags.length > 0) sanitizedResource.tags = tags
+    }
+  }
+
+  const accepts = validateAccepts(input.accepts, authority, drops)
+
+  const bazaar = input.bazaar
+  if (typeof bazaar !== 'object' || bazaar === null) {
+    return {
+      ok: false,
+      drops: [...drops, drop('extensions.bazaar', 'invalid_type', 'bazaar declaration must be an object.')],
+    }
+  }
+
+  if (typeof bazaar.info !== 'object' || bazaar.info === null) {
+    drops.push(drop('extensions.bazaar.info', 'invalid_type', 'bazaar.info must be an object.'))
+  } else if (jsonByteLength(bazaar.info) > CATALOG_LIMITS.jsonBytes) {
+    drops.push(drop('extensions.bazaar.info', 'too_large', `bazaar.info exceeds ${CATALOG_LIMITS.jsonBytes} bytes.`))
+  }
+  if (typeof bazaar.schema !== 'object' || bazaar.schema === null) {
+    drops.push(drop('extensions.bazaar.schema', 'invalid_type', 'bazaar.schema must be an object.'))
+  } else if (jsonByteLength(bazaar.schema) > CATALOG_LIMITS.jsonBytes) {
+    drops.push(
+      drop('extensions.bazaar.schema', 'too_large', `bazaar.schema exceeds ${CATALOG_LIMITS.jsonBytes} bytes.`),
+    )
+  }
+
+  if (input.type === 'mcp') {
+    const toolName = (bazaar.info as { input?: { toolName?: unknown } })?.input?.toolName
+    const validated = validateText(
+      toolName,
+      'extensions.bazaar.info.input.toolName',
+      CATALOG_LIMITS.mcpToolName,
+      MCP_TOOL_NAME,
+    )
+    if (!validated.ok) drops.push(...validated.drops)
+  }
+
+  let routeTemplate: string | undefined
+  if (bazaar.routeTemplate !== undefined) {
+    const validated = validateRouteTemplate(bazaar.routeTemplate, url.ok ? url.value : undefined)
+    if (validated.ok) routeTemplate = validated.value
+    else drops.push(...validated.drops)
+  }
+
+  let extensionKeys: string[] | undefined
+  if (input.extensionKeys !== undefined) {
+    if (!Array.isArray(input.extensionKeys)) {
+      drops.push(drop('extensionKeys', 'invalid_type', 'extensionKeys must be an array.'))
+    } else if (input.extensionKeys.length > CATALOG_LIMITS.extensionKeys) {
+      drops.push(
+        drop('extensionKeys', 'too_many', `extensionKeys must contain at most ${CATALOG_LIMITS.extensionKeys} entries.`),
+      )
+    } else {
+      const keys: string[] = []
+      input.extensionKeys.forEach((key, i) => {
+        const validated = validateText(key, `extensionKeys[${i}]`, CATALOG_LIMITS.extensionKey, EXTENSION_KEY)
+        if (validated.ok) keys.push(validated.value)
+        else drops.push(...validated.drops)
+      })
+      extensionKeys = Array.from(new Set(['bazaar', ...keys]))
+    }
+  }
+
+  if (drops.length > 0 || !accepts) return { ok: false, drops }
+
+  return {
+    ok: true,
+    drops: [],
+    value: {
+      type: input.type,
+      network: authority.network,
+      resource: sanitizedResource,
+      accepts,
+      bazaar: {
+        info: bazaar.info,
+        schema: bazaar.schema,
+        ...(routeTemplate ? { routeTemplate } : {}),
+      },
+      ...(extensionKeys ? { extensionKeys } : {}),
+    },
+  }
+}
+
+/**
+ * Builds the `EXTENSION-RESPONSES` body reporting what happened to a listing.
+ *
+ * A soft drop is only half a mechanism if the seller cannot see it, so a
+ * dropped listing is reported on the same response as the successful payment
+ * (#130 attaches this to the header).
+ */
+export function toExtensionResponses(drops: CatalogDrop[]): Record<string, unknown> {
+  return {
+    bazaar: {
+      catalog: {
+        accepted: drops.length === 0,
+        ...(drops.length > 0 ? { drops } : {}),
+      },
+    },
+  }
+}