diff --git a/app/src/main/java/com/itsaky/androidide/localWebServer/WebServer.kt b/app/src/main/java/com/itsaky/androidide/localWebServer/WebServer.kt
index a978a8f286..714219e460 100644
--- a/app/src/main/java/com/itsaky/androidide/localWebServer/WebServer.kt
+++ b/app/src/main/java/com/itsaky/androidide/localWebServer/WebServer.kt
@@ -10,6 +10,7 @@ import com.google.gson.Gson
 import com.google.gson.GsonBuilder
 import com.google.gson.ToNumberPolicy
 import com.google.gson.reflect.TypeToken
+import com.itsaky.androidide.utils.ContentTypeHeaders
 import com.itsaky.androidide.utils.DatabaseVersionResolver
 import io.pebbletemplates.pebble.PebbleEngine
 import io.pebbletemplates.pebble.loader.StringLoader
@@ -480,6 +481,10 @@ class WebServer(
 	}
 
 	private fun handleClient(clientSocket: Socket) {
+		// Whether the client has already been told 200. Read by the error path, which must not put a
+		// second status line on a response that has already started (see the assignment below).
+		var responseStarted = false
+
 		if (debugEnabled) log.debug("In handleClient(), socket is {}.", clientSocket)
 
 		val input = clientSocket.getInputStream()
@@ -625,6 +630,8 @@ class WebServer(
 				while (nextChunk.size == contentChunkSize) {
 					val path2 = "$path-$fragmentNumber"
 					val cursor2 = database.rawQuery(query2, arrayOf(path2))
+					// Whether the client has already been told 200; see the assignment below.
+					var responseStarted = false
 					try {
 						if (cursor2.moveToFirst()) {
 							nextChunk = cursor2.getBlob(0)
@@ -657,8 +664,19 @@ class WebServer(
 				dbContent = instantiatePebbleTemplate(templateId, dbContent, path, dbMimeType, compression)
 			}
 
+			// Built before the status line goes out: everything after the first println is on the
+			// wire (the writer autoflushes), so a throw past that point cannot be answered with a
+			// fresh error response. dbMimeType is a platform type from Cursor.getString, so a NULL
+			// ContentTypes.value throws here rather than there.
+			val contentTypeHeader = ContentTypeHeaders.headerValue(dbMimeType)
+
 			writer.println("HTTP/1.1 200 OK")
-			writer.println("Content-Type: $dbMimeType")
+			// From here on the client has been told 200. A failure while writing the body -- a
+			// dropped connection is the common one -- must not append a second status line to that
+			// response; sendError writes nothing at all when told the output has started, which is
+			// the only honest thing left to do with a half-sent reply.
+			responseStarted = true
+			writer.println("Content-Type: $contentTypeHeader")
 			writer.println("Content-Length: ${dbContent.size}")
 			writer.println("Connection: close")
 			writer.println()
@@ -666,8 +684,15 @@ class WebServer(
 			output.write(dbContent)
 			output.flush()
 		} catch (e: Exception) {
-			log.error("Error processing request: {}", e.message)
-			sendError(writer, output, httpInternalServerError, "Internal Server Error", e.message ?: "")
+			log.error("Error processing request: {}", e.message, e)
+			sendError(
+				writer,
+				output,
+				httpInternalServerError,
+				"Internal Server Error",
+				e.message ?: "",
+				outputStarted = responseStarted,
+			)
 		} finally {
 			cursor.close()
 		}
diff --git a/app/src/test/java/com/itsaky/androidide/localWebServer/WebServerTest.kt b/app/src/test/java/com/itsaky/androidide/localWebServer/WebServerTest.kt
index e68b2e05e4..3bbb403556 100644
--- a/app/src/test/java/com/itsaky/androidide/localWebServer/WebServerTest.kt
+++ b/app/src/test/java/com/itsaky/androidide/localWebServer/WebServerTest.kt
@@ -10,6 +10,7 @@ import io.mockk.mockkStatic
 import io.mockk.unmockkAll
 import io.mockk.verify
 import org.junit.After
+import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
 import org.junit.Before
@@ -377,6 +378,68 @@ class WebServerTest {
 		}
 	}
 
+	// ADFA-5241: the helper decides the charset, but only a real response proves the header that
+	// reaches a client. Two thirds of the database's text rows are non-ASCII with no BOM, so an
+	// undeclared encoding renders them as mojibake in any client that does not assume UTF-8.
+	@Test
+	fun `a text response declares utf-8 and a binary one does not`() {
+		assertContentTypeHeader(storedMimeType = "text/html", expected = "text/html; charset=utf-8")
+		assertContentTypeHeader(storedMimeType = "image/png", expected = "image/png")
+	}
+
+	private fun assertContentTypeHeader(
+		storedMimeType: String,
+		expected: String,
+	) {
+		val port = freePort()
+		val db = mockk<SQLiteDatabase>(relaxed = true)
+		every { SQLiteDatabase.openDatabase(any(), isNull(), any()) } returns db
+		// Deliberately no version stub: this row is compression = "none", so nothing decodes and no
+		// dictionary is consulted. Declaring one would couple the assertion to a lazy-load path it
+		// does not exercise.
+		every {
+			db.rawQuery(match { it.contains("FROM   Content") }, any())
+		} returns
+			mockk<Cursor>(relaxed = true) {
+				every { count } returns 1
+				every { moveToFirst() } returns true
+				every { getBlob(0) } returns "payload".toByteArray()
+				every { getString(1) } returns storedMimeType
+				every { getString(2) } returns "none"
+				every { getInt(3) } returns 0
+			}
+
+		val server = WebServer(testConfig(port))
+		val serverThread = Thread { server.start() }.apply { isDaemon = true }
+		serverThread.start()
+		try {
+			awaitPortBound(port)
+			val response = sendRawGetRequest(port, "/some/path")
+			val header =
+				response.lineSequence().firstOrNull { it.startsWith("Content-Type:", ignoreCase = true) }
+					?: error("No Content-Type in the response:\n$response")
+			assertEquals("Content-Type: $expected", header.trim())
+		} finally {
+			server.stop()
+			serverThread.join(2_000)
+		}
+	}
+
+	// Same as sendRawGetRequestAndAwaitClose, but hands back what the server actually wrote.
+	private fun sendRawGetRequest(
+		port: Int,
+		path: String,
+	): String =
+		Socket().use { socket ->
+			socket.connect(InetSocketAddress("localhost", port), 2_000)
+			socket.soTimeout = 2_000
+			socket.getOutputStream().apply {
+				write("GET $path HTTP/1.1\r\n\r\n".toByteArray(Charsets.ISO_8859_1))
+				flush()
+			}
+			socket.getInputStream().readBytes().toString(Charsets.ISO_8859_1)
+		}
+
 	// Blocks until the server closes the connection (every response sends "Connection: close"),
 	// so by the time this returns the server has fully finished processing this one request --
 	// making repeated calls a reliable way to serialize several full request/response cycles.
diff --git a/common/src/main/java/com/itsaky/androidide/utils/ContentTypeHeaders.kt b/common/src/main/java/com/itsaky/androidide/utils/ContentTypeHeaders.kt
new file mode 100644
index 0000000000..298ebe4761
--- /dev/null
+++ b/common/src/main/java/com/itsaky/androidide/utils/ContentTypeHeaders.kt
@@ -0,0 +1,259 @@
+package com.itsaky.androidide.utils
+
+/**
+ * Turns a stored `ContentTypes.value` into the `Content-Type` a client should be sent.
+ *
+ * `documentation.db` stores bare MIME types -- no `ContentTypes.value` carries a charset -- so a
+ * text response says nothing about its encoding, and a client that does not assume UTF-8 falls back
+ * to a legacy single-byte encoding. 17,903 of the 29,139 text rows in the 21-Aug database --
+ * 61.4%, a full census rather than a sample -- contain non-ASCII bytes with no BOM, so they render
+ * as mojibake wherever that guess goes wrong (ADFA-5241): a page's U+21B3 arrow arriving as the
+ * three Latin-1 characters its UTF-8 bytes decode to. (The rate is per-generation; an older export
+ * measures far lower, so quote the database when quoting the number.)
+ *
+ * This is deliberately *not* fixed by storing the parameter in the database. `ContentTypes.value`
+ * doubles as a lookup key matched exactly by the plugin installer
+ * (`ExtensionToContentTypeResolver`), by `docdb-studio`'s anchor extraction, and by three scripts in
+ * `OfflineDocumentationTools`; two of those would fail silently rather than loudly.
+ *
+ * Kept in `common` so both documentation transports answer the same way -- the socket server here
+ * and ADFA-5176's `shouldInterceptRequest` interceptor, which otherwise carries its own rule.
+ */
+object ContentTypeHeaders {
+	private const val UTF_8 = "utf-8"
+	private const val TEXT_PLAIN = "text/plain"
+
+	// What a value carrying a control character becomes: renders nothing, injects nothing.
+	private const val OCTET_STREAM = "application/octet-stream"
+
+	// Textual types outside text/* and the +xml family. application/x-typescript has no rows in the
+	// current database but costs nothing to keep; application/javascript does have rows, and is what
+	// ExtensionToContentTypeResolver maps ".mjs" to, so omitting it served real files undeclared.
+	private val TEXTUAL_APPLICATION_TYPES =
+		setOf(
+			"application/javascript",
+			"application/ecmascript",
+			"application/x-typescript",
+			"application/x-sh",
+		)
+
+	/**
+	 * The charset to send with [mimeType], or null when there is none to send: the type is binary, or
+	 * the format fixes its own encoding.
+	 *
+	 * `application/json` is deliberately absent: RFC 8259 defines no charset parameter for it and
+	 * fixes the encoding as UTF-8, so declaring one is meaningless rather than helpful. XML-based
+	 * types are included even though a document may carry its own declaration, because a
+	 * transport-level charset takes precedence and SVG in particular usually omits it.
+	 */
+	internal fun charsetFor(mimeType: String): String? = typeAndCharset(mimeType).second
+
+	/**
+	 * The media type and the charset to send with it, which is what
+	 * `WebResourceResponse(type, encoding, stream)` wants and what [headerValue] builds its header
+	 * from. One decision, so the two documentation transports cannot disagree.
+	 *
+	 * The type is normalized, not passed through: the database stores a bare `text` and a
+	 * `text/text`, neither of which is a media type (`type "/" subtype` is required), and a client
+	 * that cannot parse the type discards the charset with it -- which would have made this whole
+	 * change a no-op on exactly those rows. A value carrying a control character is refused outright;
+	 * see [safeType].
+	 *
+	 * An unusable `charset=` counts as declaring nothing, so the default applies. [headerValue]
+	 * rebuilds the header rather than appending to the stored string, so that substitution reaches
+	 * both transports instead of only this one.
+	 */
+	internal fun typeAndCharset(mimeType: String): Pair<String, String?> {
+		// Refusal has to be asked, not inferred. This used to read the answer out of safeType's return
+		// value -- OCTET_STREAM with no charset -- and a control character inside the charset parameter
+		// defeated it: safeType refused the type, declaredCharset re-parsed the *original* string and
+		// found a charset, so "refused" was never true and the CRLF went into the header verbatim.
+		// text/html; charset=x<CR><LF><CR><LF><script>... split the response in two, which is the one
+		// thing this class exists to prevent.
+		if (isUntrustworthy(mimeType)) {
+			return OCTET_STREAM to null
+		}
+		val type = safeType(mimeType)
+		return type to (declaredCharset(mimeType) ?: defaultCharsetFor(type))
+	}
+
+	/**
+	 * Whether the stored value cannot be trusted into a header at all.
+	 *
+	 * A control character anywhere in it -- type, parameter name, or parameter value -- means the
+	 * whole string is refused rather than repaired. `ContentTypes.value` comes from a database a
+	 * debug build swaps in from shared storage, and `WebServer` writes the result with `println`.
+	 */
+	private fun isUntrustworthy(mimeType: String): Boolean = mimeType.any { it.isISOControl() }
+
+	/**
+	 * [mimeType]'s media type, normalized and safe to put in a header.
+	 *
+	 * A control character makes the whole value untrustworthy: `ContentTypes.value` comes from a
+	 * database that a debug build will swap in from shared storage (`WebServer`'s
+	 * `debugDatabasePath`), and a stored `text/html\r\n\r\n...` would otherwise be written
+	 * straight into the response by `println`, splitting it into two. Such a value is not repaired,
+	 * it is refused: `application/octet-stream` renders nothing and injects nothing.
+	 */
+	private fun safeType(mimeType: String): String {
+		// The *whole* stored value, not just the segment before the first ';'. A control character in
+		// a parameter -- text/html; note=x<CR><LF>X-Injected: y -- would otherwise pass this check and
+		// then be written into the header by the parameter loop in headerValue, which is the same
+		// response splitting, one segment further along.
+		if (mimeType.any { it.isISOControl() }) {
+			return OCTET_STREAM
+		}
+		val type = mimeType.substringBefore(';').trim()
+		if (type.isEmpty()) {
+			return OCTET_STREAM
+		}
+		// "text" and "text/text" are the database's own spellings for plain text, and neither parses
+		// as a media type.
+		return if (type.equals("text", ignoreCase = true) || type.equals("text/text", ignoreCase = true)) {
+			TEXT_PLAIN
+		} else {
+			type
+		}
+	}
+
+	private fun defaultCharsetFor(safeType: String): String? {
+		val type = safeType.lowercase()
+		return when {
+			// Matched at the boundary: "textual/example" is not a text type, and startsWith("text")
+			// would say it is.
+			type.startsWith("text/") -> UTF_8
+
+			type.endsWith("+xml") || type == "application/xml" -> UTF_8
+
+			// Textual application/* types share no syntactic marker, hence a list. application/json
+			// is deliberately absent (see the class KDoc). Anything textual that turns up later and
+			// is not here serves undeclared -- the bug this class exists to prevent -- so add it
+			// rather than assuming the list is complete.
+			type in TEXTUAL_APPLICATION_TYPES -> UTF_8
+
+			else -> null
+		}
+	}
+
+	/**
+	 * The charset [mimeType] already declares, or null when it declares none that is usable.
+	 *
+	 * Parsed rather than substring-matched: "charset=" occurs inside other parameters' values
+	 * (`note="charset=utf-8"`), and splitting naively on ';' still finds it when the value itself
+	 * contains a semicolon (`note="x; charset=utf-8"`). A parameter with no value (`; charset`) or
+	 * an empty one (`; charset=`) declares nothing and must not suppress the default -- treating it
+	 * as a declaration is how a response ends up with no encoding at all.
+	 *
+	 * The first *usable* one, not simply the first. While this class appended to the stored string,
+	 * reading the first mattered -- that is the one a recipient keeps when a name repeats, so
+	 * honouring a later one would have meant acting on a parameter the client ignores. [headerValue]
+	 * rebuilds the header now and emits exactly one charset, so that no longer applies, and reading
+	 * past an unusable parameter is what keeps `charset=; charset=iso-8859-1` from being served as
+	 * utf-8 -- which would garble a page that says plainly what it is.
+	 */
+	private fun declaredCharset(mimeType: String): String? =
+		parameters(mimeType)
+			.firstOrNull { (name, value) -> name.equals("charset", ignoreCase = true) && !value.isNullOrEmpty() }
+			?.second
+
+	/**
+	 * [mimeType]'s `name=value` parameters, with semicolons inside quoted values left alone. A null
+	 * value means the parameter carried no `=` at all, which recipients drop entirely -- see
+	 * [carriesCharsetParameter].
+	 */
+	private fun parameters(mimeType: String): List<Pair<String, String?>> {
+		val found = mutableListOf<Pair<String, String?>>()
+		val token = StringBuilder()
+		var quoted = false
+
+		// RFC 9110 quoted-pair: inside a quoted string a backslash escapes the next character, so
+		// \" does not end the value. Without this, text/html; note="a\"; charset=iso-8859-1 parses
+		// as two parameters and the charset inside note reads as a declaration.
+		var escaped = false
+
+		fun take() {
+			val text = token.toString().trim()
+			token.setLength(0)
+			if (text.isEmpty()) return
+			val name = text.substringBefore('=').trim()
+			val value = if (text.contains('=')) text.substringAfter('=').trim().trim('"') else null
+			found += name to value
+		}
+
+		var index = mimeType.indexOf(';')
+		if (index < 0) return found
+		while (++index < mimeType.length) {
+			val character = mimeType[index]
+			when {
+				escaped -> {
+					escaped = false
+					token.append(character)
+				}
+
+				quoted && character == '\\' -> {
+					escaped = true
+					token.append(character)
+				}
+
+				character == '"' -> {
+					quoted = !quoted
+					token.append(character)
+				}
+
+				character == ';' && !quoted -> {
+					take()
+				}
+
+				else -> {
+					token.append(character)
+				}
+			}
+		}
+		take()
+		return found
+	}
+
+	/**
+	 * The `Content-Type` header value for a row stored as [mimeType].
+	 *
+	 * Rebuilt from the parsed parts rather than appended to. Appending produced a header no stricter
+	 * than what the database happened to hold: a bare `text` stayed unparseable, an unusable
+	 * `charset=` stayed and contradicted the one added after it, and a valueless `charset` was left
+	 * beside its replacement. Rebuilding emits one normalized type, the other parameters as they
+	 * were, and exactly one charset -- the same one [typeAndCharset] hands the other transport.
+	 */
+	fun headerValue(mimeType: String): String {
+		// Nothing from a refused value is re-emitted: its parameters are exactly where the control
+		// characters would have been. Asked directly rather than deduced from the pair below, which
+		// also stops a legitimately stored `application/octet-stream; name=file.bin` from being read
+		// as a refusal and losing its parameters.
+		if (isUntrustworthy(mimeType)) {
+			return OCTET_STREAM
+		}
+		val (type, charset) = typeAndCharset(mimeType)
+		return buildString {
+			append(type)
+			for ((name, value) in parameters(mimeType)) {
+				if (name.equals("charset", ignoreCase = true)) continue
+				append("; ").append(name)
+				if (value != null) append('=').append(quoteIfNeeded(value))
+			}
+			// quoteIfNeeded, like every other parameter value: `parameters` strips the quotes from a
+			// stored charset="utf-8; x=y" and returned `utf-8; x=y`, which appended raw became a
+			// charset plus a smuggled second parameter.
+			if (charset != null) append("; charset=").append(quoteIfNeeded(charset))
+		}
+	}
+
+	/**
+	 * Re-quotes a parameter value that needed quoting in the first place. [parameters] strips the
+	 * quotes it parsed, so a value containing a space or a separator has to get them back or the
+	 * rebuilt header means something different from the stored one.
+	 */
+	private fun quoteIfNeeded(value: String): String =
+		if (value.isNotEmpty() && value.none { it.isWhitespace() || it in "\"(),/:;<=>?@[\\]{}" }) {
+			value
+		} else {
+			"\"" + value.replace("\\", "\\\\").replace("\"", "\\\"") + "\""
+		}
+}
diff --git a/common/src/test/java/com/itsaky/androidide/utils/ContentTypeHeadersTest.kt b/common/src/test/java/com/itsaky/androidide/utils/ContentTypeHeadersTest.kt
new file mode 100644
index 0000000000..284fa41258
--- /dev/null
+++ b/common/src/test/java/com/itsaky/androidide/utils/ContentTypeHeadersTest.kt
@@ -0,0 +1,180 @@
+package com.itsaky.androidide.utils
+
+import com.google.common.truth.Truth.assertThat
+import org.junit.Test
+
+/**
+ * ADFA-5241: text served without a charset renders as mojibake wherever the client's guess goes
+ * wrong. These cover what is actually sent, which is not always what was stored -- the header is
+ * rebuilt from the parsed parts so a malformed stored value cannot produce a malformed response.
+ */
+class ContentTypeHeadersTest {
+	@Test
+	fun `text types get utf-8`() {
+		for (type in listOf("text/html", "text/css", "text/javascript", "text/markdown")) {
+			assertThat(ContentTypeHeaders.headerValue(type)).isEqualTo("$type; charset=utf-8")
+		}
+	}
+
+	// The database stores a bare "text" (one row, x.html) and a "text/text" (ten licence files).
+	// Neither is a media type -- type "/" subtype is required -- and a client that cannot parse the
+	// type discards the charset with it, which would have made this change a no-op on exactly the
+	// rows it was written for.
+	@Test
+	fun `the database's non-media-type spellings become text-plain`() {
+		assertThat(ContentTypeHeaders.headerValue("text")).isEqualTo("text/plain; charset=utf-8")
+		assertThat(ContentTypeHeaders.headerValue("text/text")).isEqualTo("text/plain; charset=utf-8")
+		assertThat(ContentTypeHeaders.typeAndCharset("text")).isEqualTo("text/plain" to "utf-8")
+	}
+
+	// ContentTypes.value comes from a database a debug build will swap in from shared storage, and
+	// the header is written with println(). A stored CR/LF would split the response in two.
+	@Test
+	fun `a type carrying a control character is refused, not repaired`() {
+		val injected = "text/html\r\nContent-Length: 0\r\n\r\nHTTP/1.1 200 OK"
+
+		assertThat(ContentTypeHeaders.headerValue(injected)).isEqualTo("application/octet-stream")
+		assertThat(ContentTypeHeaders.headerValue("text/html\u0000")).isEqualTo("application/octet-stream")
+		assertThat(ContentTypeHeaders.headerValue("")).isEqualTo("application/octet-stream")
+	}
+
+	// The type segment being clean is not enough: a parameter is just as much a part of the header
+	// line, so a CR/LF there splits the response exactly the same way.
+	@Test
+	fun `a control character in a parameter is refused too`() {
+		val injected = "text/html; note=x\r\nX-Injected: y"
+
+		assertThat(ContentTypeHeaders.headerValue(injected)).isEqualTo("application/octet-stream")
+		assertThat(ContentTypeHeaders.typeAndCharset(injected)).isEqualTo("application/octet-stream" to null)
+	}
+
+	@Test
+	fun `binary types are left alone`() {
+		for (type in listOf("image/png", "image/gif", "application/pdf", "font/woff2", "video/mp4")) {
+			assertThat(ContentTypeHeaders.charsetFor(type)).isNull()
+			assertThat(ContentTypeHeaders.headerValue(type)).isEqualTo(type)
+		}
+	}
+
+	// RFC 8259 defines no charset parameter for JSON and fixes the encoding as UTF-8, so declaring
+	// one says nothing.
+	@Test
+	fun `json is left alone`() {
+		assertThat(ContentTypeHeaders.charsetFor("application/json")).isNull()
+		assertThat(ContentTypeHeaders.headerValue("application/json")).isEqualTo("application/json")
+	}
+
+	@Test
+	fun `xml-based types get utf-8, since svg rarely declares its own`() {
+		assertThat(ContentTypeHeaders.headerValue("image/svg+xml")).isEqualTo("image/svg+xml; charset=utf-8")
+		assertThat(ContentTypeHeaders.headerValue("application/xml")).isEqualTo("application/xml; charset=utf-8")
+	}
+
+	@Test
+	fun `an existing charset is kept, never doubled`() {
+		assertThat(ContentTypeHeaders.headerValue("text/html; charset=iso-8859-1"))
+			.isEqualTo("text/html; charset=iso-8859-1")
+		assertThat(ContentTypeHeaders.headerValue("text/html; CHARSET=UTF-8")).isEqualTo("text/html; charset=UTF-8")
+	}
+
+	// An unusable charset is replaced rather than contradicted. Appending left the empty one in
+	// place, where a first-wins recipient keeps it and ignores what follows -- so the response still
+	// had no usable encoding, which is the bug this class exists to remove.
+	@Test
+	fun `an unusable charset is replaced`() {
+		assertThat(ContentTypeHeaders.headerValue("text/html; charset=")).isEqualTo("text/html; charset=utf-8")
+		assertThat(ContentTypeHeaders.headerValue("text/html; charset")).isEqualTo("text/html; charset=utf-8")
+		assertThat(ContentTypeHeaders.headerValue("text/html; charset=; charset=iso-8859-1"))
+			.isEqualTo("text/html; charset=iso-8859-1")
+	}
+
+	// Both transports take the same decision from the same call, so a WebView and the socket server
+	// cannot declare different encodings for one stored value.
+	@Test
+	fun `both transports agree on every form of unusable charset`() {
+		for (stored in listOf("text/html; charset=", "text/html; charset", "text", "text/html")) {
+			val (type, charset) = ContentTypeHeaders.typeAndCharset(stored)
+			assertThat(ContentTypeHeaders.headerValue(stored)).isEqualTo("$type; charset=$charset")
+		}
+	}
+
+	// Substring-matching "charset=" would find it inside another parameter's value and suppress the
+	// declaration this response actually needs. The quotes have to survive the rebuild.
+	@Test
+	fun `charset inside another parameter's value does not count as a declaration`() {
+		assertThat(ContentTypeHeaders.headerValue("""text/html; note="charset=utf-8""""))
+			.isEqualTo("""text/html; note="charset=utf-8"; charset=utf-8""")
+		assertThat(ContentTypeHeaders.headerValue("""text/html; note="x; charset=utf-8""""))
+			.isEqualTo("""text/html; note="x; charset=utf-8"; charset=utf-8""")
+	}
+
+	// RFC 9110 quoted-pair: an escaped quote does not end the value, so the charset inside note is
+	// not a declaration either.
+	@Test
+	fun `an escaped quote does not end a quoted parameter value`() {
+		assertThat(ContentTypeHeaders.typeAndCharset("""text/html; note="a\"; charset=iso-8859-1""""))
+			.isEqualTo("text/html" to "utf-8")
+	}
+
+	@Test
+	fun `a type that merely begins with text is not a text type`() {
+		assertThat(ContentTypeHeaders.charsetFor("textual/example")).isNull()
+		assertThat(ContentTypeHeaders.headerValue("textual/example")).isEqualTo("textual/example")
+	}
+
+	@Test
+	fun `casing and stray whitespace on the type are tolerated`() {
+		assertThat(ContentTypeHeaders.headerValue("TEXT/HTML")).isEqualTo("TEXT/HTML; charset=utf-8")
+		assertThat(ContentTypeHeaders.headerValue("text/html ")).isEqualTo("text/html; charset=utf-8")
+		assertThat(ContentTypeHeaders.headerValue("text/html;boundary=x")).isEqualTo("text/html; boundary=x; charset=utf-8")
+	}
+
+	@Test
+	fun `typeAndCharset splits the type from the charset it should declare`() {
+		assertThat(ContentTypeHeaders.typeAndCharset("text/html")).isEqualTo("text/html" to "utf-8")
+		assertThat(ContentTypeHeaders.typeAndCharset("image/png")).isEqualTo("image/png" to null)
+		assertThat(ContentTypeHeaders.typeAndCharset("text/html; charset=iso-8859-1"))
+			.isEqualTo("text/html" to "iso-8859-1")
+	}
+
+	// The hole the previous revision left: safeType refused the type, but the charset parameter was
+	// re-parsed from the original string, so a CRLF inside it reached the header anyway. WebServer
+	// writes this with println, so that is a split response with an attacker-chosen body.
+	@Test
+	fun `a control character in the charset parameter refuses the whole value`() {
+		val split = "text/html; charset=x\r\n\r\n<script>alert(1)</script>"
+
+		val header = ContentTypeHeaders.headerValue(split)
+
+		assertThat(header).isEqualTo("application/octet-stream")
+		assertThat(header).doesNotContain("\r")
+		assertThat(header).doesNotContain("\n")
+		assertThat(ContentTypeHeaders.typeAndCharset(split).second).isNull()
+	}
+
+	@Test
+	fun `a control character in a parameter name refuses the whole value`() {
+		val header = ContentTypeHeaders.headerValue("text/html; x\r\nX-Injected: y=1")
+
+		assertThat(header).isEqualTo("application/octet-stream")
+	}
+
+	// parameters() strips the quotes, so appending the value raw turned one charset into a charset
+	// plus a second parameter the client would honour.
+	@Test
+	fun `a quoted charset cannot smuggle a second parameter`() {
+		val header = ContentTypeHeaders.headerValue("""text/html; charset="utf-8; x=y"""")
+
+		// Quoted, so the recipient reads one charset whose value happens to contain a semicolon --
+		// not a charset plus a second parameter. Appended raw it was the latter.
+		assertThat(header).isEqualTo("""text/html; charset="utf-8; x=y"""")
+	}
+
+	// Refusal used to be read off the returned string, so a genuine octet-stream looked refused.
+	@Test
+	fun `a stored octet-stream keeps its own parameters`() {
+		val header = ContentTypeHeaders.headerValue("application/octet-stream; name=file.bin")
+
+		assertThat(header).contains("name=file.bin")
+	}
+}