diff --git a/docs/development/adr/0018-search-engine-rendering-for-public-wikis.md b/docs/development/adr/0018-search-engine-rendering-for-public-wikis.md
index 3234c8aee..806cfa724 100644
--- a/docs/development/adr/0018-search-engine-rendering-for-public-wikis.md
+++ b/docs/development/adr/0018-search-engine-rendering-for-public-wikis.md
@@ -227,3 +227,41 @@ fixing that is a separate change.
     `pageRoutePath` in `urls.go`), like the SPA's own page read: `/<page>/` gets the page's
     meta with the canonical link to `/<page>`, and its Markdown. `/` and `//` stay the root;
     empty segments inside the path (`/a//b`) find no page and get noindex.
+- **2026-11 (#1292, rendered body for search engines):** details fixed while implementing it:
+  - A contributor behind `PublicOnly`, registered after the page meta contributor, puts
+    `<article><h1>title</h1>` + the page rendered by `internal/render`
+    ([ADR-0020](./0020-server-rendered-page-html-for-crawlers.md)) + `<nav><ul>` links to the
+    page's direct children into `#root`. Title and child titles are escaped, child links are
+    escaped wiki paths below the base path; wikilinks resolve by the rule stored links follow
+    (`links.ResolveWikiLinkTarget`, behind `pages.ResolveWikiLinkUseCase`), children come
+    from one locked tree read (`TreeService.ChildRoutes`). No breadcrumbs. The SPA mounts with `createRoot`, which
+    replaces the content, so the page is shown once (pinned by
+    `e2e/tests/seo-crawler-body.spec.ts`).
+  - Only for user agents containing (case-insensitive) `googlebot`, `google-inspectiontool`
+    (Search Console's URL Inspection and the Rich Results Test), `bingbot`, `duckduckbot`,
+    `yandex`, `baiduspider` or `applebot`; everyone else, unknown pages, the root, SPA routes
+    and `/p/:id` permalinks (their canonical link points at the page route) get the plain
+    shell. Anyone can send such a user agent; the body is the content the SPA shows anyway.
+  - Every shell of a public wiki carries `Vary: User-Agent` (through `ShellParts.Vary`, merged
+    with the Markdown responder's `Vary: Accept`) and `Cache-Control: no-cache`, crawler or
+    not, so caches never mix the variants. A private wiki's shell has neither.
+  - Renders are cached in memory per page version (key: base path, route path and content;
+    a hit is reused only while every wikilink in it still resolves the same way), at most
+    16 MB of HTML, least recently used dropped first. At most two renders run at once; a request beyond
+    that gets the plain shell instead of waiting.
+  - A render error (`render.ErrTooComplex` or a page outside the policy) means the plain
+    shell, never a 500. The failure is cached for that page version and logged once as a
+    warning with the route and without page content; refused renders are logged once per
+    process. A client that has gone away by the time a render slot is free gets no render.
+  - Cost: child links and wikilink targets (also a `[[Folder/Title]]` resolved through the
+    route-path fallback) come from locked tree lookups without file reads. The page itself is
+    read twice per crawler request, once by the page meta contributor and once by the crawler
+    body, each through the page-view read (which reads the file for the content and again for
+    the frontmatter). Sharing that read would need request-scoped state across contributors,
+    which the shell seam does not have; it is left as is because only crawler requests pay
+    it. Browser requests read nothing more than before: the user agent is checked first.
+  - Reads go through the pages slice's use cases (`ListChildRoutesUseCase`,
+    `ResolveWikiLinkUseCase`). Once anonymous readers see only part of a wiki
+    (`internal/scopedread`, [ADR-0015](./0015-scoped-read-boundary.md)), the reader must drop
+    hidden children and resolve wikilinks against visible pages only, before ambiguity is
+    counted; otherwise a link that is ambiguous only because of a hidden page would reveal it.
diff --git a/docs/development/adr/0020-server-rendered-page-html-for-crawlers.md b/docs/development/adr/0020-server-rendered-page-html-for-crawlers.md
index 74baaa43a..75e81003c 100644
--- a/docs/development/adr/0020-server-rendered-page-html-for-crawlers.md
+++ b/docs/development/adr/0020-server-rendered-page-html-for-crawlers.md
@@ -2,10 +2,11 @@
 
 ## Status
 
-Proposed (2026-10-29)
+Accepted (2026-11-09; proposed 2026-10-29).
 
-Open: whether this decision is folded into ADR-0018 (search-engine rendering for public wikis,
-proposed in the same series) while that one is still Proposed.
+It stays separate from ADR-0018: that one decides when and where the wiki answers search
+engines, this one how page HTML is rendered and sanitized, which a later non-crawler user of
+`internal/render` (exports, link previews) depends on without the SEO decisions.
 
 ## Context
 
@@ -104,3 +105,11 @@ type Options struct { BasePath, RoutePath string; ResolveWikiLink func(target st
 - Every new tag or attribute the crawler HTML needs is a policy change with an XSS-corpus
   test (`policy_test.go`). Revisit when the shell gets a CSP, or when the frontend schema
   changes in a way the pinned hash flags.
+
+## Later changes
+
+- **2026-11 (#1292, crawler body):** the `seo` slice's crawler body contributor wires the
+  renderer in (see [ADR-0018](./0018-search-engine-rendering-for-public-wikis.md), "Later
+  changes"): renders are cached per page version in a 16 MB LRU cache, at most two run at
+  once, and `ErrTooComplex` or any other render error means the plain shell, logged once
+  without page content.
diff --git a/docs/development/adr/README.md b/docs/development/adr/README.md
index 5f9a007b0..824d16d9d 100644
--- a/docs/development/adr/README.md
+++ b/docs/development/adr/README.md
@@ -64,5 +64,5 @@ Status values: `Proposed`, `Accepted`, `Rejected`, `Deprecated`, `Superseded by
 | [0017](./0017-spa-shell-contributors.md) | The SPA shell is rendered through registered responders and contributors | Proposed |
 | [0018](./0018-search-engine-rendering-for-public-wikis.md) | Public wikis are rendered for search engines through the `seo` slice, gated on public access | Accepted |
 | [0019](./0019-capability-routes-without-identity.md) | Capability-URL routes run without identity, in their own route group | Proposed |
-| [0020](./0020-server-rendered-page-html-for-crawlers.md) | Page HTML for crawlers is rendered in `internal/render` and sanitized by a stricter server policy | Proposed |
+| [0020](./0020-server-rendered-page-html-for-crawlers.md) | Page HTML for crawlers is rendered in `internal/render` and sanitized by a stricter server policy | Accepted |
 | [0021](./0021-page-side-panel-sections.md) | The page side panel renders sections composed by the page viewer | Proposed |
diff --git a/docs/development/source-map.md b/docs/development/source-map.md
index 863cc7f44..7abaf8507 100644
--- a/docs/development/source-map.md
+++ b/docs/development/source-map.md
@@ -209,7 +209,7 @@ resync-derived state.
   `router.go` builds the `gin.Engine`, embeds the built frontend (`//go:embed dist/**`, gated by
   the `EmbedFrontend` build-time flag), sets up request logging via `slog`. `shell.go` serves
   the SPA fallback route: it runs the registered `ShellResponder`s and renders `index.html`
-  from the `ShellContributor`s on `FrontendConfig` (title, head, `#root` markup; built-ins for
+  from the `ShellContributor`s on `FrontendConfig` (title, head, `#root` markup, `Vary` fields; built-ins for
   the custom stylesheet and `InjectCodeInHeader` last), see
   [ADR-0017](./adr/0017-spa-shell-contributors.md). `registrar.go` defines
   the `RouteRegistrar` interface and `RouterContext` (engine, auth cookie manager, CSRF cookie
@@ -270,7 +270,7 @@ shape for that domain.
 
 - **`internal/wiki/pages`** — the largest domain slice: CRUD + tree operations exposed over HTTP.
   One file per use case — `create_page.go`, `update_page.go`, `move_page.go`, `copy_page.go`,
-  `delete_page.go`, `convert_page.go` (page↔section), `get_page_view.go` (`GetPageViewByIDUseCase`/`GetPageViewByPathUseCase` — the single-page view shared by API and SEO: page plus frontmatter tags and properties via `page_metadata.go`; not a visibility layer), `get_first_page_path.go` (`GetFirstPagePathUseCase` — the first top-level page or section in navigation order, the target of the root redirect), `list_page_routes.go` (`ListPageRoutesUseCase` — route path, kind and last update of every page and section in navigation order, from one locked tree read; feeds the sitemap), `get_page.go` (`PageQueries` — the remaining read-only lookups: path lookup, title, permalink), `pin_page.go` (global editorial pin, see
+  `delete_page.go`, `convert_page.go` (page↔section), `get_page_view.go` (`GetPageViewByIDUseCase`/`GetPageViewByPathUseCase` — the single-page view shared by API and SEO: page plus frontmatter tags and properties via `page_metadata.go`; not a visibility layer), `get_first_page_path.go` (`GetFirstPagePathUseCase` — the first top-level page or section in navigation order, the target of the root redirect), `list_page_routes.go` (`ListPageRoutesUseCase` — route path, kind and last update of every page and section in navigation order, from one locked tree read; feeds the sitemap; `ListChildRoutesUseCase`, a page's direct children for the crawler body), `resolve_wiki_link.go` (`ResolveWikiLinkUseCase` — a `[[target]]` to its page's route by the rule stored links follow, for the crawler body), `get_page.go` (`PageQueries` — the remaining read-only lookups: path lookup, title, permalink), `pin_page.go` (global editorial pin, see
   distinction from favorites below), `ensure_path.go`, `refactor.go` (link-refactor
   trigger), `add_favorite.go`/`remove_favorite.go`/`list_favorites.go` (per-user favorites, note the explicit distinction: pin is global/editorial via
   `tree.SetPinned` in page frontmatter, favorites is per-user via `internal/favorites`, deliberately
@@ -325,7 +325,8 @@ shape for that domain.
   file. `shell.go`: `PublicOnly` (every registration and route of the slice runs only while
   public access is on; `Handler(on, off)` for routes), the root redirect (`GET /` → 302 to the
   first page), the page Markdown responder (`Accept: text/markdown` → the page's Markdown) and
-  the page meta contributor (robots `noindex` for routes without a page); `routes.go`:
+  the page meta contributor (robots `noindex` for routes without a page), then the crawler
+  body contributor (`Vary: User-Agent` on every public shell); `routes.go`:
   `Routes` (`robots.txt`, `sitemap.xml`, GET and HEAD); `root_target.go`:
   `GetRootTargetUseCase` behind the narrow `FirstPageReader`; `urls.go`: the URL helpers the
   features share (escaped wiki path, absolute URL from `--public-url`, the page read's route
@@ -335,7 +336,10 @@ shape for that domain.
   `NoIndex` when no page is at the route; `PermalinkResolver` for permalinks) and
   `markdown.go` (`GetPageMarkdownUseCase` and the `Accept` negotiation); `robots.go`:
   `GetRobotsUseCase` and `PrivateRobots`; `sitemap.go`: `BuildSitemapUseCase` behind
-  `PageRouteLister`, streamed by `WriteXML`. The readers are implemented in
+  `PageRouteLister`, streamed by `WriteXML`; `crawler_body.go`: `GetCrawlerBodyUseCase`
+  (title, `internal/render` HTML and child links for search-engine user agents, behind
+  `PageReader` and `CrawlerBodyReader`; renders cached per page version, parallel renders
+  capped, least recently used dropped first). The readers are implemented in
   `internal/wiki/seo_adapter.go` with the pages slice's read use cases.
 
 ## Frontend — `ui/leafwiki-ui/src/`
diff --git a/e2e/tests/seo-crawler-body.spec.ts b/e2e/tests/seo-crawler-body.spec.ts
new file mode 100644
index 000000000..8a07fd33e
--- /dev/null
+++ b/e2e/tests/seo-crawler-body.spec.ts
@@ -0,0 +1,72 @@
+import { APIRequestContext, expect, request, test } from '@playwright/test';
+import { createPageViaApi, csrfHeader, loggedIn } from '../helpers/apiContext';
+
+const baseURL = process.env.E2E_BASE_URL || 'http://localhost:8080';
+const googlebot = 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)';
+const chrome =
+  'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36';
+
+async function setPublicAccess(admin: APIRequestContext, enabled: boolean) {
+  const resp = await admin.put('/api/admin/settings/public-access', {
+    headers: await csrfHeader(admin),
+    data: { enabled },
+  });
+  expect(resp.ok(), `public access ${enabled}`).toBeTruthy();
+}
+
+// Search-engine crawlers get the rendered page inside #root of a public
+// wiki's page source (#1292). The SPA mounts with createRoot, which replaces
+// that markup, so a crawler that runs JavaScript still sees the page once.
+test('crawler gets the rendered page in #root, the SPA shows it once', async ({ browser }) => {
+  const admin = await loggedIn();
+  const slug = `seo-crawler-${Date.now()}`;
+  const title = `SEO Crawler ${slug}`;
+  const paragraph = `Crawler body paragraph ${slug}.`;
+  await createPageViaApi(admin, { title, slug, content: paragraph });
+
+  const pageSource = async (userAgent: string) => {
+    const ctx = await request.newContext({ baseURL, userAgent });
+    try {
+      const resp = await ctx.get(`/${slug}`);
+      expect(resp.status()).toBe(200);
+      return { html: await resp.text(), vary: resp.headers()['vary'] ?? '' };
+    } finally {
+      await ctx.dispose();
+    }
+  };
+
+  try {
+    await setPublicAccess(admin, true);
+
+    const crawler = await pageSource(googlebot);
+    expect(crawler.html).toContain(`<div id="root"><article><h1>${title}</h1><p>${paragraph}</p>`);
+    expect(crawler.vary).toContain('User-Agent');
+
+    const visitor = await pageSource(chrome);
+    expect(visitor.html).toContain('<div id="root"></div>');
+    expect(visitor.vary).toContain('User-Agent');
+
+    const context = await browser.newContext({ baseURL, userAgent: googlebot });
+    try {
+      const page = await context.newPage();
+      await page.goto(`/${slug}`);
+      // The server's article is a direct child of #root; the SPA's sits
+      // inside its layout, so this waits until the SPA has replaced it.
+      await expect(page.locator('#root > article')).toHaveCount(0);
+      await expect(page.getByText(paragraph, { exact: true })).toBeVisible();
+      await expect(page.getByText(paragraph, { exact: true })).toHaveCount(1);
+      // The server's <h1> is gone; the SPA shows the title at most once.
+      expect(await page.locator('h1', { hasText: title }).count()).toBeLessThanOrEqual(1);
+    } finally {
+      await context.close();
+    }
+
+    await setPublicAccess(admin, false);
+    const privateSource = await pageSource(googlebot);
+    expect(privateSource.html).toContain('<div id="root"></div>');
+    expect(privateSource.vary).not.toContain('User-Agent');
+  } finally {
+    await setPublicAccess(admin, false);
+    await admin.dispose();
+  }
+});
diff --git a/internal/core/tree/tree_reads.go b/internal/core/tree/tree_reads.go
index 10735c085..7c8291b5e 100644
--- a/internal/core/tree/tree_reads.go
+++ b/internal/core/tree/tree_reads.go
@@ -94,6 +94,34 @@ func (t *TreeService) PageRoutes(limit int) (entries []RouteEntry, truncated boo
 	return entries, truncated, err
 }
 
+// ChildRoutes returns the direct children of the node with id ("root" for
+// the top level), pages and sections, in the order the navigation shows. Like
+// PageRoutes it is one locked read without file reads. It returns
+// ErrTreeNotLoaded before the tree is loaded and ErrPageNotFound for an
+// unknown id.
+func (t *TreeService) ChildRoutes(id string) ([]RouteEntry, error) {
+	var entries []RouteEntry
+	err := t.withRLockedTree(func() error {
+		if t.tree == nil {
+			return ErrTreeNotLoaded
+		}
+		node := t.getNodeByIDLocked(id)
+		if node == nil {
+			return ErrPageNotFound
+		}
+		parentPath := strings.TrimPrefix(node.CalculatePath(), "/") // root-relative, like PageRoutes
+		entries = make([]RouteEntry, 0, len(node.Children))
+		for _, child := range node.Children {
+			entries = append(entries, newRouteEntry(child, parentPath))
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return entries, nil
+}
+
 // RoutesByTitle returns the route of every node whose title matches title
 // (trimmed, case-insensitive, like FindPagesByTitle). Unlike the nodes
 // FindPagesByTitle returns, the route paths are computed under the read
diff --git a/internal/core/tree/tree_reads_test.go b/internal/core/tree/tree_reads_test.go
index 364a215c1..1db4d1d25 100644
--- a/internal/core/tree/tree_reads_test.go
+++ b/internal/core/tree/tree_reads_test.go
@@ -305,3 +305,72 @@ func TestTreeService_RouteLookups_ConcurrentWithMoves(t *testing.T) {
 	}
 	<-done
 }
+
+func TestTreeService_ChildRoutes_ListsDirectChildrenInNavigationOrder(t *testing.T) {
+	svc, ids := subtreeFixture(t)
+	if err := svc.SortPages(ids["docs"], []string{ids["faq"], ids["guide"]}); err != nil {
+		t.Fatalf("SortPages failed: %v", err)
+	}
+
+	tests := []struct {
+		name string
+		id   string
+		want []string
+	}{
+		{name: "section", id: ids["docs"], want: []string{"docs/faq", "docs/guide"}},
+		{name: "nested page", id: ids["guide"], want: []string{"docs/guide/intro"}},
+		{name: "leaf page", id: ids["intro"], want: []string{}},
+		{name: "root", id: "root", want: []string{"docs", "other"}},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			entries, err := svc.ChildRoutes(tc.id)
+			if err != nil {
+				t.Fatalf("ChildRoutes failed: %v", err)
+			}
+			got := make([]string, len(entries))
+			for i, e := range entries {
+				got[i] = e.RoutePath
+			}
+			if strings.Join(got, ",") != strings.Join(tc.want, ",") {
+				t.Errorf("route paths = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestTreeService_ChildRoutes_CopiesNodeFields(t *testing.T) {
+	svc, ids := subtreeFixture(t)
+
+	entries, err := svc.ChildRoutes(ids["guide"])
+	if err != nil || len(entries) != 1 {
+		t.Fatalf("ChildRoutes = %v, %v, want one entry", entries, err)
+	}
+	node := svc.GetTree().Children[0].Children[0].Children[0]
+	want := RouteEntry{ID: ids["intro"], Title: "intro", RoutePath: "docs/guide/intro", Kind: NodeKindPage, UpdatedAt: node.Metadata.UpdatedAt}
+	if entries[0] != want || want.UpdatedAt.IsZero() {
+		t.Errorf("entry = %+v, want %+v", entries[0], want)
+	}
+}
+
+func TestTreeService_ChildRoutes_Errors(t *testing.T) {
+	loaded, _ := subtreeFixture(t)
+	tests := []struct {
+		name string
+		svc  *TreeService
+		id   string
+		want error
+	}{
+		{name: "tree not loaded", svc: NewTreeService(t.TempDir()), id: "root", want: ErrTreeNotLoaded},
+		{name: "unknown id", svc: loaded, id: "missing", want: ErrPageNotFound},
+		{name: "empty id", svc: loaded, id: "", want: ErrPageNotFound},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			entries, err := tc.svc.ChildRoutes(tc.id)
+			if !errors.Is(err, tc.want) || entries != nil {
+				t.Fatalf("ChildRoutes = %v, %v, want nil, %v", entries, err, tc.want)
+			}
+		})
+	}
+}
diff --git a/internal/links/helpers.go b/internal/links/helpers.go
index 50ffd5548..27ed60817 100644
--- a/internal/links/helpers.go
+++ b/internal/links/helpers.go
@@ -158,15 +158,29 @@ func resolveWikiLinkTargets(treeService *tree.TreeService, targets []string) []T
 
 	result := make([]TargetLink, 0, len(targets))
 	for _, target := range targets {
-		result = append(result, resolveWikiLinkTarget(treeService, target))
+		link, _ := resolveWikiLinkTarget(treeService, target)
+		result = append(result, link)
 	}
 	return result
 }
 
-// resolveWikiLinkTarget resolves one target for resolveWikiLinkTargets.
-// Route paths come from the tree's locked lookups, never from a node read
-// after the lock is released, and no page file is read.
-func resolveWikiLinkTarget(treeService *tree.TreeService, target string) TargetLink {
+// ResolveWikiLinkTarget returns the route path ("/docs/setup") of the one page
+// a [[target]] points at, by the rule stored links follow (see
+// resolveWikiLinkTargets). ok is false for a broken or ambiguous target and
+// before the tree is loaded.
+func ResolveWikiLinkTarget(treeService *tree.TreeService, target string) (routePath string, ok bool) {
+	link, routePath := resolveWikiLinkTarget(treeService, target)
+	if link.State != LinkResolved {
+		return "", false
+	}
+	return routePath, true
+}
+
+// resolveWikiLinkTarget resolves one target for resolveWikiLinkTargets and
+// also returns the matched page's route path ("" unless resolved). Route
+// paths come from the tree's locked lookups, never from a node read after
+// the lock is released, and no page file is read.
+func resolveWikiLinkTarget(treeService *tree.TreeService, target string) (TargetLink, string) {
 	pages, _ := treeService.RoutesByTitle(target) // not loaded: no match, like an empty tree
 
 	// A slash-containing target with NO title match is retried as a direct
@@ -174,11 +188,12 @@ func resolveWikiLinkTarget(treeService *tree.TreeService, target string) TargetL
 	if strings.Contains(target, "/") && len(pages) == 0 {
 		routePath := strings.TrimPrefix(target, "/")
 		if page, err := treeService.RouteByPath(routePath); err == nil {
+			resolved := markdown.NormalizeRoutePath(page.RoutePath)
 			return TargetLink{
 				TargetPageID:   page.ID,
-				TargetPagePath: markdown.NormalizeRoutePath(page.RoutePath),
+				TargetPagePath: resolved,
 				State:          LinkResolved,
-			}
+			}, resolved
 		}
 		// Store as a normal broken route path so
 		// HealLinksForExactPath can heal it when the page is later
@@ -186,7 +201,7 @@ func resolveWikiLinkTarget(treeService *tree.TreeService, target string) TargetL
 		return TargetLink{
 			State:          LinkBroken,
 			TargetPagePath: "/" + routePath,
-		}
+		}, ""
 	}
 
 	link := TargetLink{
@@ -195,8 +210,9 @@ func resolveWikiLinkTarget(treeService *tree.TreeService, target string) TargetL
 	}
 	if len(pages) == 1 {
 		link.TargetPageID = pages[0].ID
+		return link, markdown.NormalizeRoutePath(pages[0].RoutePath)
 	}
-	return link
+	return link, ""
 }
 
 // collectTargetsFromContent extracts and resolves all link targets from a page's
diff --git a/internal/links/link_service_test.go b/internal/links/link_service_test.go
index 05fe470d3..bcd62f7e2 100644
--- a/internal/links/link_service_test.go
+++ b/internal/links/link_service_test.go
@@ -1604,6 +1604,53 @@ func TestResolveWikiLinkTargets_AmbiguousSlashTitle_ReturnsBroken(t *testing.T)
 	}
 }
 
+// ─── ResolveWikiLinkTarget ───────────────────────────────────────────────────
+
+// ResolveWikiLinkTarget follows the rule stored links follow (see the
+// resolveWikiLinkTargets tests above) and returns the route path of the page.
+func TestResolveWikiLinkTarget_FollowsTheStoredLinkRule(t *testing.T) {
+	ts, _, _ := setupTreeForLinksTest(t)
+	create := func(parentID *string, title, slug string) *string {
+		t.Helper()
+		id, err := ts.CreateNode("system", parentID, title, slug, pageNodeKind())
+		if err != nil {
+			t.Fatalf("CreateNode %s: %v", slug, err)
+		}
+		return id
+	}
+	create(nil, "Notes", "notes-a")
+	create(nil, "Notes", "notes-b")
+	create(create(nil, "TCP Docs", "TCP"), "IP Notes", "IP")
+	create(nil, "TCP/IP", "tcp-ip-guide")
+
+	tests := []struct {
+		name   string
+		tree   *tree.TreeService
+		target string
+		want   string
+		wantOK bool
+	}{
+		{name: "title", tree: ts, target: "Page 1", want: "/docs/page1", wantOK: true},
+		{name: "title, other case", tree: ts, target: "page 1", want: "/docs/page1", wantOK: true},
+		{name: "unknown title", tree: ts, target: "Nonexistent Page"},
+		{name: "ambiguous title", tree: ts, target: "Notes"},
+		{name: "path hint", tree: ts, target: "docs/page2", want: "/docs/page2", wantOK: true},
+		{name: "path hint with leading slash", tree: ts, target: "/docs/page2", want: "/docs/page2", wantOK: true},
+		{name: "unknown path hint", tree: ts, target: "docs/nonexistent"},
+		{name: "slash title wins over a colliding route path", tree: ts, target: "TCP/IP", want: "/tcp-ip-guide", wantOK: true},
+		{name: "empty target", tree: ts, target: ""},
+		{name: "tree not loaded", tree: tree.NewTreeService(t.TempDir()), target: "Page 1"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, ok := ResolveWikiLinkTarget(tc.tree, tc.target)
+			if got != tc.want || ok != tc.wantOK {
+				t.Fatalf("ResolveWikiLinkTarget(%q) = %q, %v, want %q, %v", tc.target, got, ok, tc.want, tc.wantOK)
+			}
+		})
+	}
+}
+
 // Run with -race: resolving reads route paths while a move rewrites the
 // target's parent.
 func TestResolveWikiLinkTargets_ConcurrentWithMoves(t *testing.T) {
diff --git a/internal/wiki/pages/list_page_routes.go b/internal/wiki/pages/list_page_routes.go
index 39808cbda..b94645333 100644
--- a/internal/wiki/pages/list_page_routes.go
+++ b/internal/wiki/pages/list_page_routes.go
@@ -39,3 +39,35 @@ func (uc *ListPageRoutesUseCase) Execute(_ context.Context, in ListPageRoutesInp
 	}
 	return &ListPageRoutesOutput{Routes: routes, Truncated: truncated}, nil
 }
+
+// ListChildRoutesInput is the input for ListChildRoutesUseCase.
+type ListChildRoutesInput struct {
+	PageID string
+}
+
+// ListChildRoutesOutput is the result of ListChildRoutesUseCase.
+type ListChildRoutesOutput struct {
+	// Routes are the page's direct children in navigation order.
+	Routes []tree.RouteEntry
+}
+
+// ListChildRoutesUseCase lists the routes of a page's direct children, e.g.
+// for the crawler body. Like the page-view reads, it is not a visibility layer.
+type ListChildRoutesUseCase struct {
+	tree *tree.TreeService
+}
+
+// NewListChildRoutesUseCase constructs a ListChildRoutesUseCase.
+func NewListChildRoutesUseCase(t *tree.TreeService) *ListChildRoutesUseCase {
+	return &ListChildRoutesUseCase{tree: t}
+}
+
+// Execute returns the child routes; tree.ErrTreeNotLoaded and
+// tree.ErrPageNotFound are passed through.
+func (uc *ListChildRoutesUseCase) Execute(_ context.Context, in ListChildRoutesInput) (*ListChildRoutesOutput, error) {
+	routes, err := uc.tree.ChildRoutes(in.PageID)
+	if err != nil {
+		return nil, err
+	}
+	return &ListChildRoutesOutput{Routes: routes}, nil
+}
diff --git a/internal/wiki/pages/list_page_routes_test.go b/internal/wiki/pages/list_page_routes_test.go
index 0b56d208f..db9f59a82 100644
--- a/internal/wiki/pages/list_page_routes_test.go
+++ b/internal/wiki/pages/list_page_routes_test.go
@@ -65,3 +65,46 @@ func TestListPageRoutesUseCase_TreeNotLoaded_ReturnsError(t *testing.T) {
 		t.Errorf("out = %+v, want nil", out)
 	}
 }
+
+func TestListChildRoutesUseCase_ListsDirectChildren(t *testing.T) {
+	deps := newTestDeps(t)
+	create := pages.NewCreatePageUseCase(deps.tree, deps.slug, deps.orchestrator(), slog.Default(), nil)
+	docs, err := create.Execute(context.Background(), pages.CreatePageInput{UserID: "user1", Title: "Docs", Slug: "docs", Kind: sectionKind()})
+	if err != nil {
+		t.Fatalf("CreatePage(docs) failed: %v", err)
+	}
+	setup, err := create.Execute(context.Background(), pages.CreatePageInput{UserID: "user1", Title: "Setup", Slug: "setup", Kind: pageKind(), ParentID: &docs.Page.ID})
+	if err != nil {
+		t.Fatalf("CreatePage(setup) failed: %v", err)
+	}
+	if _, err := create.Execute(context.Background(), pages.CreatePageInput{UserID: "user1", Title: "Linux", Slug: "linux", Kind: pageKind(), ParentID: &setup.Page.ID}); err != nil {
+		t.Fatalf("CreatePage(linux) failed: %v", err)
+	}
+
+	out, err := pages.NewListChildRoutesUseCase(deps.tree).Execute(context.Background(), pages.ListChildRoutesInput{PageID: docs.Page.ID})
+	if err != nil {
+		t.Fatalf("Execute failed: %v", err)
+	}
+	if len(out.Routes) != 1 || out.Routes[0].RoutePath != "docs/setup" || out.Routes[0].Title != "Setup" {
+		t.Errorf("routes = %+v, want only docs/setup", out.Routes)
+	}
+}
+
+func TestListChildRoutesUseCase_Errors(t *testing.T) {
+	tests := []struct {
+		name string
+		tree *tree.TreeService
+		want error
+	}{
+		{name: "tree not loaded", tree: tree.NewTreeService(t.TempDir()), want: tree.ErrTreeNotLoaded},
+		{name: "unknown page", tree: newTestDeps(t).tree, want: tree.ErrPageNotFound},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			out, err := pages.NewListChildRoutesUseCase(tc.tree).Execute(context.Background(), pages.ListChildRoutesInput{PageID: "missing"})
+			if !errors.Is(err, tc.want) || out != nil {
+				t.Fatalf("Execute = %+v, %v, want nil, %v", out, err, tc.want)
+			}
+		})
+	}
+}
diff --git a/internal/wiki/pages/resolve_wiki_link.go b/internal/wiki/pages/resolve_wiki_link.go
new file mode 100644
index 000000000..30f8c783d
--- /dev/null
+++ b/internal/wiki/pages/resolve_wiki_link.go
@@ -0,0 +1,42 @@
+package pages
+
+import (
+	"context"
+
+	"github.com/perber/wiki/internal/core/tree"
+	"github.com/perber/wiki/internal/links"
+)
+
+// ResolveWikiLinkInput is the input for ResolveWikiLinkUseCase.
+type ResolveWikiLinkInput struct {
+	// Target is the text inside [[...]] before an alias.
+	Target string
+}
+
+// ResolveWikiLinkOutput is the page a wikilink points at.
+type ResolveWikiLinkOutput struct {
+	// RoutePath starts with "/" (e.g. "/docs/setup").
+	RoutePath string
+}
+
+// ResolveWikiLinkUseCase resolves a [[target]] to the one page it points at,
+// by the rule stored links follow, e.g. for the crawler body. Like the
+// page-view reads, it is not a visibility layer.
+type ResolveWikiLinkUseCase struct {
+	tree *tree.TreeService
+}
+
+// NewResolveWikiLinkUseCase constructs a ResolveWikiLinkUseCase.
+func NewResolveWikiLinkUseCase(t *tree.TreeService) *ResolveWikiLinkUseCase {
+	return &ResolveWikiLinkUseCase{tree: t}
+}
+
+// Execute returns the target page's route, or nil for an unknown or
+// ambiguous target and before the tree is loaded.
+func (uc *ResolveWikiLinkUseCase) Execute(_ context.Context, in ResolveWikiLinkInput) (*ResolveWikiLinkOutput, error) {
+	routePath, ok := links.ResolveWikiLinkTarget(uc.tree, in.Target)
+	if !ok {
+		return nil, nil
+	}
+	return &ResolveWikiLinkOutput{RoutePath: routePath}, nil
+}
diff --git a/internal/wiki/pages/resolve_wiki_link_test.go b/internal/wiki/pages/resolve_wiki_link_test.go
new file mode 100644
index 000000000..5c0f5c32b
--- /dev/null
+++ b/internal/wiki/pages/resolve_wiki_link_test.go
@@ -0,0 +1,54 @@
+package pages_test
+
+import (
+	"context"
+	"log/slog"
+	"testing"
+
+	"github.com/perber/wiki/internal/wiki/pages"
+)
+
+func TestResolveWikiLinkUseCase_ResolvesLikeStoredLinks(t *testing.T) {
+	deps := newTestDeps(t)
+	create := pages.NewCreatePageUseCase(deps.tree, deps.slug, deps.orchestrator(), slog.Default(), nil)
+	docs, err := create.Execute(context.Background(), pages.CreatePageInput{UserID: "user1", Title: "Docs", Slug: "docs", Kind: sectionKind()})
+	if err != nil {
+		t.Fatalf("CreatePage(docs) failed: %v", err)
+	}
+	for _, in := range []pages.CreatePageInput{
+		{UserID: "user1", Title: "Setup", Slug: "setup", Kind: pageKind(), ParentID: &docs.Page.ID},
+		{UserID: "user1", Title: "Twin", Slug: "twin-a", Kind: pageKind()},
+		{UserID: "user1", Title: "Twin", Slug: "twin-b", Kind: pageKind()},
+	} {
+		if _, err := create.Execute(context.Background(), in); err != nil {
+			t.Fatalf("CreatePage(%s) failed: %v", in.Slug, err)
+		}
+	}
+
+	tests := []struct {
+		name   string
+		target string
+		want   string
+	}{
+		{name: "title", target: "setup", want: "/docs/setup"},
+		{name: "path hint", target: "docs/setup", want: "/docs/setup"},
+		{name: "ambiguous title", target: "Twin"},
+		{name: "unknown", target: "Missing"},
+	}
+	uc := pages.NewResolveWikiLinkUseCase(deps.tree)
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			out, err := uc.Execute(context.Background(), pages.ResolveWikiLinkInput{Target: tc.target})
+			if err != nil {
+				t.Fatalf("Execute failed: %v", err)
+			}
+			got := ""
+			if out != nil {
+				got = out.RoutePath
+			}
+			if got != tc.want {
+				t.Errorf("route = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
diff --git a/internal/wiki/seo/crawler_body.go b/internal/wiki/seo/crawler_body.go
new file mode 100644
index 000000000..c8897588c
--- /dev/null
+++ b/internal/wiki/seo/crawler_body.go
@@ -0,0 +1,285 @@
+package seo
+
+import (
+	"container/list"
+	"context"
+	"crypto/sha256"
+	"errors"
+	"fmt"
+	"html"
+	"io"
+	"strings"
+	"sync"
+
+	"github.com/perber/wiki/internal/render"
+)
+
+// ─── GetCrawlerBodyUseCase ───────────────────────────────────────────────────
+
+// ChildPage is a direct child of a page, as the crawler body links to it.
+type ChildPage struct {
+	Title string
+	// RoutePath is the child's route path without a leading "/".
+	RoutePath string
+}
+
+// CrawlerBodyReader reads what the crawler body needs besides the page: its
+// children and the targets of its wikilinks.
+type CrawlerBodyReader interface {
+	// ChildPages returns the page's direct children in navigation order; none
+	// when it can't tell (tree not loaded yet).
+	ChildPages(ctx context.Context, pageID string) ([]ChildPage, error)
+	// ResolveWikiLink returns the route path of the one page a [[target]]
+	// points at; ok is false for an unknown or ambiguous target.
+	ResolveWikiLink(ctx context.Context, target string) (routePath string, ok bool)
+}
+
+// GetCrawlerBodyInput is the input for GetCrawlerBodyUseCase.
+type GetCrawlerBodyInput struct {
+	// RoutePath is the shell request's route path, starting with "/".
+	RoutePath string
+	// BasePath is the URL prefix the wiki is served under ("" or e.g. "/wiki").
+	BasePath  string
+	UserAgent string
+}
+
+// GetCrawlerBodyOutput is the page as HTML for #root.
+type GetCrawlerBodyOutput struct {
+	// HTML is trusted markup: the title and child links are escaped here, the
+	// page content is sanitized by internal/render.
+	HTML string
+}
+
+const (
+	// maxParallelRenders caps concurrent renders; any client can claim to be
+	// a crawler, and a render can take most of a second on small hardware.
+	maxParallelRenders = 2
+	// maxRenderCacheBytes bounds the rendered HTML kept between requests.
+	maxRenderCacheBytes = 16 << 20
+)
+
+// errRendersBusy means maxParallelRenders renders are running; the request
+// gets the plain shell instead of waiting.
+var errRendersBusy = errors.New("seo: too many crawler body renders running")
+
+// errRenderFailed replaces a render error other than render.ErrTooComplex.
+var errRenderFailed = errors.New("seo: crawler body render failed")
+
+// GetCrawlerBodyUseCase renders the page a search-engine crawler asks for,
+// so the shell carries its content before (or without) the SPA running.
+type GetCrawlerBodyUseCase struct {
+	pages   PageReader
+	reader  CrawlerBodyReader
+	render  func(content string, opt render.Options) (string, error)
+	renders chan struct{}
+	cache   *renderCache
+}
+
+// NewGetCrawlerBodyUseCase constructs a GetCrawlerBodyUseCase.
+func NewGetCrawlerBodyUseCase(pages PageReader, reader CrawlerBodyReader) *GetCrawlerBodyUseCase {
+	return &GetCrawlerBodyUseCase{
+		pages:   pages,
+		reader:  reader,
+		render:  render.RenderHTML,
+		renders: make(chan struct{}, maxParallelRenders),
+		cache:   &renderCache{entries: map[renderKey]*list.Element{}},
+	}
+}
+
+// Execute returns the page's body, or nil when the user agent is no search
+// engine, the route is the root or a permalink (then nothing is read), no
+// page is there, the page failed to render before, or the client went away
+// before the render. The first render
+// failure and a refused render (too many running) are returned as errors.
+func (uc *GetCrawlerBodyUseCase) Execute(ctx context.Context, in GetCrawlerBodyInput) (*GetCrawlerBodyOutput, error) {
+	routePath := pageRoutePath(in.RoutePath)
+	if routePath == "" || !isSearchEngineCrawler(in.UserAgent) {
+		return nil, nil
+	}
+	// A permalink shows its target page in the SPA; its canonical link sends
+	// search engines there, so it gets no body of its own (ADR-0018).
+	if _, ok := permalinkID(routePath); ok {
+		return nil, nil
+	}
+	page, err := uc.pages.PageByRoutePath(ctx, routePath)
+	if errors.Is(err, ErrPageNotFound) {
+		return nil, nil
+	}
+	if err != nil || page == nil {
+		return nil, err
+	}
+	children, err := uc.reader.ChildPages(ctx, page.ID)
+	if err != nil {
+		return nil, err
+	}
+	content, ok, err := uc.renderContent(ctx, in.BasePath, routePath, page.Body)
+	if err != nil || !ok {
+		return nil, err
+	}
+
+	var b strings.Builder
+	b.WriteString("<article><h1>" + html.EscapeString(page.Title) + "</h1>" + content + "</article>")
+	var items strings.Builder
+	for _, child := range children {
+		href, err := wikiPath(in.BasePath, child.RoutePath)
+		if err != nil {
+			continue
+		}
+		items.WriteString(`<li><a href="` + html.EscapeString(href) + `">` + html.EscapeString(child.Title) + `</a></li>`)
+	}
+	if items.Len() > 0 {
+		b.WriteString("<nav><ul>" + items.String() + "</ul></nav>")
+	}
+	return &GetCrawlerBodyOutput{HTML: b.String()}, nil
+}
+
+// renderContent returns the page content as sanitized HTML from the cache
+// or a new render. ok is false for a page whose render failed before and
+// when the client went away before the render.
+func (uc *GetCrawlerBodyUseCase) renderContent(ctx context.Context, basePath, routePath, content string) (string, bool, error) {
+	key := renderKeyOf(basePath, routePath, content)
+	if cached := uc.cache.get(key); cached != nil && uc.linksUnchanged(ctx, cached.links) {
+		return cached.html, !cached.failed, nil
+	}
+	select {
+	case uc.renders <- struct{}{}:
+		defer func() { <-uc.renders }()
+	default:
+		return "", false, errRendersBusy
+	}
+	if ctx.Err() != nil {
+		// The client went away: don't spend the slot on a render nobody
+		// receives, and cache nothing.
+		return "", false, nil
+	}
+	links := map[string]wikiLinkTarget{}
+	rendered, err := uc.render(content, render.Options{
+		BasePath:  basePath,
+		RoutePath: "/" + routePath,
+		ResolveWikiLink: func(target string) (string, bool) {
+			routePath, ok := uc.reader.ResolveWikiLink(ctx, target)
+			links[target] = wikiLinkTarget{routePath: routePath, ok: ok}
+			return routePath, ok
+		},
+	})
+	uc.cache.put(key, &renderedPage{html: rendered, failed: err != nil, links: links})
+	if errors.Is(err, render.ErrTooComplex) {
+		return "", false, err
+	}
+	if err != nil {
+		// The cause may quote page markup; it must not reach the log.
+		return "", false, errRenderFailed
+	}
+	return rendered, true, nil
+}
+
+// linksUnchanged reports whether every wikilink still resolves as it did when
+// the page was rendered; a moved or renamed target page means a new render.
+func (uc *GetCrawlerBodyUseCase) linksUnchanged(ctx context.Context, links map[string]wikiLinkTarget) bool {
+	for target, was := range links {
+		routePath, ok := uc.reader.ResolveWikiLink(ctx, target)
+		if (wikiLinkTarget{routePath: routePath, ok: ok}) != was {
+			return false
+		}
+	}
+	return true
+}
+
+// searchEngineCrawlers are lower-case substrings of the user agents of the
+// search engines that get a rendered body. Anyone can send them; the body
+// is the same public content the SPA shows, so that is harmless.
+// google-inspectiontool is Search Console's URL Inspection and the Rich
+// Results Test, so site owners can check what Google sees.
+var searchEngineCrawlers = []string{"googlebot", "google-inspectiontool", "bingbot", "duckduckbot", "yandex", "baiduspider", "applebot"}
+
+func isSearchEngineCrawler(userAgent string) bool {
+	userAgent = strings.ToLower(userAgent)
+	for _, crawler := range searchEngineCrawlers {
+		if strings.Contains(userAgent, crawler) {
+			return true
+		}
+	}
+	return false
+}
+
+// renderKey identifies a page version: base path, route path (relative
+// links resolve below it) and content.
+type renderKey [sha256.Size]byte
+
+func renderKeyOf(basePath, routePath, content string) renderKey {
+	h := sha256.New()
+	_, _ = fmt.Fprintf(h, "%d:%s%d:%s", len(basePath), basePath, len(routePath), routePath)
+	_, _ = io.WriteString(h, content)
+	var key renderKey
+	h.Sum(key[:0])
+	return key
+}
+
+type wikiLinkTarget struct {
+	routePath string
+	ok        bool
+}
+
+// renderedPage is one cached render; it is never changed once cached.
+type renderedPage struct {
+	html   string
+	failed bool
+	// links are the wikilink targets as they resolved during the render.
+	links map[string]wikiLinkTarget
+}
+
+func (p *renderedPage) cost() int {
+	n := len(p.html) + 128
+	for target, link := range p.links {
+		n += len(target) + len(link.routePath) + 64
+	}
+	return n
+}
+
+// renderCache keeps rendered pages up to maxRenderCacheBytes and drops the
+// least recently used first.
+type renderCache struct {
+	mu      sync.Mutex
+	entries map[renderKey]*list.Element // values are *cacheEntry
+	order   list.List                   // front: least recently used
+	size    int
+}
+
+type cacheEntry struct {
+	key  renderKey
+	page *renderedPage
+}
+
+func (c *renderCache) get(key renderKey) *renderedPage {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	el, ok := c.entries[key]
+	if !ok {
+		return nil
+	}
+	c.order.MoveToBack(el)
+	return el.Value.(*cacheEntry).page
+}
+
+func (c *renderCache) put(key renderKey, page *renderedPage) {
+	cost := page.cost()
+	if cost > maxRenderCacheBytes {
+		return
+	}
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if el, ok := c.entries[key]; ok {
+		entry := el.Value.(*cacheEntry)
+		c.size -= entry.page.cost()
+		entry.page = page
+		c.order.MoveToBack(el)
+	} else {
+		c.entries[key] = c.order.PushBack(&cacheEntry{key: key, page: page})
+	}
+	c.size += cost
+	for c.size > maxRenderCacheBytes {
+		oldest := c.order.Remove(c.order.Front()).(*cacheEntry)
+		delete(c.entries, oldest.key)
+		c.size -= oldest.page.cost()
+	}
+}
diff --git a/internal/wiki/seo/crawler_body_test.go b/internal/wiki/seo/crawler_body_test.go
new file mode 100644
index 000000000..d532a272f
--- /dev/null
+++ b/internal/wiki/seo/crawler_body_test.go
@@ -0,0 +1,600 @@
+package seo_test
+
+import (
+	"context"
+	"errors"
+	"reflect"
+	"runtime"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	xhtml "golang.org/x/net/html"
+
+	"github.com/perber/wiki/internal/render"
+	"github.com/perber/wiki/internal/wiki/seo"
+)
+
+const (
+	googlebotUA = "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
+	chromeUA    = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"
+)
+
+// fakeCrawlerBodyReader returns fixed child pages per page ID and resolves
+// wikilinks from a map; block, when set, holds every resolve until closed.
+type fakeCrawlerBodyReader struct {
+	mu       sync.Mutex
+	children map[string][]seo.ChildPage
+	links    map[string]string
+	err      error
+	reads    int
+	entered  chan struct{}
+	block    chan struct{}
+}
+
+func (f *fakeCrawlerBodyReader) ChildPages(_ context.Context, pageID string) ([]seo.ChildPage, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.reads++
+	return f.children[pageID], f.err
+}
+
+func (f *fakeCrawlerBodyReader) ResolveWikiLink(_ context.Context, target string) (string, bool) {
+	if f.block != nil {
+		f.entered <- struct{}{}
+		<-f.block
+	}
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	routePath, ok := f.links[target]
+	return routePath, ok
+}
+
+func (f *fakeCrawlerBodyReader) setLink(target, routePath string) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.links[target] = routePath
+}
+
+func (f *fakeCrawlerBodyReader) deleteLink(target string) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	delete(f.links, target)
+}
+
+// lockedPageReader serializes reads of a fakePageReader for concurrent tests.
+type lockedPageReader struct {
+	mu    sync.Mutex
+	inner *fakePageReader
+}
+
+func (l *lockedPageReader) PageByRoutePath(ctx context.Context, routePath string) (*seo.Page, error) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	return l.inner.PageByRoutePath(ctx, routePath)
+}
+
+// countingRender wraps render.RenderHTML and counts the calls.
+type countingRender struct {
+	mu    sync.Mutex
+	calls int
+}
+
+func (c *countingRender) render(content string, opt render.Options) (string, error) {
+	c.mu.Lock()
+	c.calls++
+	c.mu.Unlock()
+	return render.RenderHTML(content, opt)
+}
+
+func (c *countingRender) count() int {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.calls
+}
+
+func crawlerBodyUseCase(pages seo.PageReader, reader *fakeCrawlerBodyReader) (*seo.GetCrawlerBodyUseCase, *countingRender) {
+	uc := seo.NewGetCrawlerBodyUseCase(pages, reader)
+	counter := &countingRender{}
+	seo.SetRenderFunc(uc, counter.render)
+	return uc, counter
+}
+
+func crawlerInput(basePath, routePath string) seo.GetCrawlerBodyInput {
+	return seo.GetCrawlerBodyInput{RoutePath: routePath, BasePath: basePath, UserAgent: googlebotUA}
+}
+
+func setupPage() seo.Page {
+	return seo.Page{ID: "setup-id", Title: "Setup", Body: "Install it."}
+}
+
+func TestGetCrawlerBodyUseCase_UserAgent_OnlySearchEnginesGetABody(t *testing.T) {
+	tests := []struct {
+		name     string
+		ua       string
+		wantBody bool
+	}{
+		{name: "Googlebot desktop", ua: googlebotUA, wantBody: true},
+		{name: "Googlebot smartphone", ua: "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)", wantBody: true},
+		{name: "Bingbot", ua: "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)", wantBody: true},
+		{name: "YandexBot", ua: "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)", wantBody: true},
+		{name: "Applebot", ua: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)", wantBody: true},
+		{name: "DuckDuckBot", ua: "DuckDuckBot/1.1; (+http://duckduckgo.com/duckduckbot.html)", wantBody: true},
+		{name: "Baiduspider", ua: "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)", wantBody: true},
+		{name: "Google-InspectionTool (URL Inspection, Rich Results Test)", ua: "Mozilla/5.0 (compatible; Google-InspectionTool/1.0;)", wantBody: true},
+		{name: "upper case", ua: "GOOGLEBOT", wantBody: true},
+		{name: "mixed case", ua: "Mozilla/5.0 (compatible; GoOgLeBoT/2.1)", wantBody: true},
+		{name: "Googlebot-Image", ua: "Googlebot-Image/1.0", wantBody: true},
+		{name: "Bingbot mobile", ua: "Mozilla/5.0 (iPhone; CPU iPhone OS 7_0 like Mac OS X) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11A465 Safari/9537.53 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)", wantBody: true},
+		{name: "spoofed browser naming Googlebot", ua: chromeUA + " Googlebot", wantBody: true},
+		{name: "other bot", ua: "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)"},
+		{name: "browser with a bot-like token", ua: chromeUA + " MyCompanyBot/1.0"},
+		{name: "link preview bot", ua: "Slackbot-LinkExpanding 1.0 (+https://api.slack.com/robots)"},
+		{name: "Facebook preview", ua: "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)"},
+		{name: "AdsBot-Google", ua: "AdsBot-Google (+http://www.google.com/adsbot.html)"},
+		{name: "whitespace only", ua: "   "},
+		{name: "Chrome", ua: chromeUA},
+		{name: "Edge", ua: chromeUA + " Edg/130.0.0.0"},
+		{name: "Firefox", ua: "Mozilla/5.0 (X11; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0"},
+		{name: "empty", ua: ""},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			pages := pageAt("docs/setup", setupPage())
+			uc, _ := crawlerBodyUseCase(pages, &fakeCrawlerBodyReader{})
+
+			out, err := uc.Execute(context.Background(), seo.GetCrawlerBodyInput{RoutePath: "/docs/setup", UserAgent: tc.ua})
+			if err != nil {
+				t.Fatalf("Execute failed: %v", err)
+			}
+			if (out != nil) != tc.wantBody {
+				t.Fatalf("body = %+v, want body: %v", out, tc.wantBody)
+			}
+			if !tc.wantBody && pages.reads != 0 {
+				t.Errorf("reads = %d, want none for a browser", pages.reads)
+			}
+		})
+	}
+}
+
+func TestGetCrawlerBodyUseCase_Page_BuildsArticleWithLinksAndChildren(t *testing.T) {
+	tests := []struct {
+		name     string
+		basePath string
+		page     seo.Page
+		children []seo.ChildPage
+		want     string
+	}{
+		{
+			name: "page without children",
+			page: setupPage(),
+			want: `<article><h1>Setup</h1><p>Install it.</p>` + "\n" + `</article>`,
+		},
+		{
+			name:     "title and child titles escaped, child hrefs escaped below the base path",
+			basePath: "/wiki",
+			page:     seo.Page{ID: "setup-id", Title: `<Set & "up">`, Body: "Read [[Install]]."},
+			children: []seo.ChildPage{
+				{Title: "<b>Linux</b>", RoutePath: "docs/setup/linux"},
+				{Title: "Mac", RoutePath: "docs/setup/mac os"},
+				{Title: "broken route is skipped", RoutePath: "docs//x"},
+			},
+			want: `<article><h1>&lt;Set &amp; &#34;up&#34;&gt;</h1><p>Read <a href="/wiki/docs/install">Install</a>.</p>` + "\n" + `</article>` +
+				`<nav><ul><li><a href="/wiki/docs/setup/linux">&lt;b&gt;Linux&lt;/b&gt;</a></li><li><a href="/wiki/docs/setup/mac%20os">Mac</a></li></ul></nav>`,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			reader := &fakeCrawlerBodyReader{
+				children: map[string][]seo.ChildPage{"setup-id": tc.children},
+				links:    map[string]string{"Install": "docs/install"},
+			}
+			uc, _ := crawlerBodyUseCase(pageAt("docs/setup", tc.page), reader)
+
+			out, err := uc.Execute(context.Background(), crawlerInput(tc.basePath, "/docs/setup/"))
+			if err != nil || out == nil {
+				t.Fatalf("Execute = %+v, %v, want a body", out, err)
+			}
+			if out.HTML != tc.want {
+				t.Errorf("HTML =\n%s\nwant\n%s", out.HTML, tc.want)
+			}
+		})
+	}
+}
+
+func TestGetCrawlerBodyUseCase_NoPage_ReturnsNothing(t *testing.T) {
+	tests := []struct {
+		name      string
+		routePath string
+		pages     *fakePageReader
+		wantReads int
+	}{
+		{name: "root", routePath: "/", pages: pageAt("docs/setup", setupPage()), wantReads: 0},
+		{name: "permalink", routePath: "/p/setup-id", pages: pageAt("p/setup-id", setupPage()), wantReads: 0},
+		{name: "unknown page", routePath: "/docs/missing", pages: pageAt("docs/setup", setupPage()), wantReads: 1},
+		{name: "tree not loaded", routePath: "/docs/setup", pages: &fakePageReader{notLoaded: true}, wantReads: 1},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			reader := &fakeCrawlerBodyReader{}
+			uc, counter := crawlerBodyUseCase(tc.pages, reader)
+
+			out, err := uc.Execute(context.Background(), crawlerInput("", tc.routePath))
+			if out != nil || err != nil {
+				t.Fatalf("Execute = %+v, %v, want nothing", out, err)
+			}
+			if tc.pages.reads != tc.wantReads || reader.reads != 0 || counter.count() != 0 {
+				t.Errorf("page reads = %d (want %d), child reads = %d, renders = %d, want no child read or render",
+					tc.pages.reads, tc.wantReads, reader.reads, counter.count())
+			}
+		})
+	}
+}
+
+func TestGetCrawlerBodyUseCase_ReadError_IsReturned(t *testing.T) {
+	readErr := errors.New("disk on fire")
+	tests := []struct {
+		name   string
+		pages  *fakePageReader
+		reader *fakeCrawlerBodyReader
+	}{
+		{name: "page read", pages: &fakePageReader{err: readErr}, reader: &fakeCrawlerBodyReader{}},
+		{name: "child read", pages: pageAt("docs/setup", setupPage()), reader: &fakeCrawlerBodyReader{err: readErr}},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			uc, _ := crawlerBodyUseCase(tc.pages, tc.reader)
+			out, err := uc.Execute(context.Background(), crawlerInput("", "/docs/setup"))
+			if out != nil || !errors.Is(err, readErr) {
+				t.Fatalf("Execute = %+v, %v, want %v", out, err, readErr)
+			}
+		})
+	}
+}
+
+// A page that is too complex to render gets no body; the failure is reported
+// once and then remembered for this page version, so a crawler can't make
+// the server retry the expensive part on every request.
+func TestGetCrawlerBodyUseCase_RenderFails_ReportedOnceThenNoBody(t *testing.T) {
+	huge := seo.Page{ID: "huge-id", Title: "Huge", Body: strings.Repeat("a", 300<<10)}
+	pages := pageAt("huge", huge)
+	uc, counter := crawlerBodyUseCase(pages, &fakeCrawlerBodyReader{})
+
+	out, err := uc.Execute(context.Background(), crawlerInput("", "/huge"))
+	if out != nil || !errors.Is(err, render.ErrTooComplex) {
+		t.Fatalf("first Execute = %+v, %v, want ErrTooComplex", out, err)
+	}
+	out, err = uc.Execute(context.Background(), crawlerInput("", "/huge"))
+	if out != nil || err != nil {
+		t.Fatalf("second Execute = %+v, %v, want nothing", out, err)
+	}
+	if counter.count() != 1 {
+		t.Errorf("renders = %d, want 1", counter.count())
+	}
+
+	pages.pages["huge"].Body = "Small now."
+	if out, err := uc.Execute(context.Background(), crawlerInput("", "/huge")); err != nil || out == nil {
+		t.Fatalf("Execute after an edit = %+v, %v, want a body", out, err)
+	}
+}
+
+// The rendered HTML is cached per page version: the same content, route and
+// wikilink targets render once; any of them changing renders again.
+func TestGetCrawlerBodyUseCase_RenderCache_PerPageVersion(t *testing.T) {
+	pages := &fakePageReader{pages: map[string]*seo.Page{
+		"docs/setup": {ID: "setup-id", Title: "Setup", Body: "See [[Install]]."},
+		"docs/copy":  {ID: "copy-id", Title: "Copy", Body: "See [[Install]]."},
+	}}
+	reader := &fakeCrawlerBodyReader{links: map[string]string{"Install": "docs/install"}}
+	uc, counter := crawlerBodyUseCase(pages, reader)
+	execute := func(routePath, wantLink string) {
+		t.Helper()
+		out, err := uc.Execute(context.Background(), crawlerInput("", routePath))
+		if err != nil || out == nil {
+			t.Fatalf("Execute(%s) = %+v, %v, want a body", routePath, out, err)
+		}
+		// An empty wantLink means the wikilink must render as plain text.
+		if wantLink == "" && strings.Contains(out.HTML, "<a ") || wantLink != "" && !strings.Contains(out.HTML, `href="`+wantLink+`"`) {
+			t.Fatalf("Execute(%s) = %s, want link %q", routePath, out.HTML, wantLink)
+		}
+	}
+
+	steps := []struct {
+		name        string
+		change      func()
+		routePath   string
+		wantLink    string
+		wantRenders int
+	}{
+		{name: "first request renders", routePath: "/docs/setup", wantLink: "/docs/install", wantRenders: 1},
+		{name: "same version is cached", routePath: "/docs/setup", wantLink: "/docs/install", wantRenders: 1},
+		{name: "same content at another route renders", routePath: "/docs/copy", wantLink: "/docs/install", wantRenders: 2},
+		{name: "wikilink target moved renders", change: func() { reader.setLink("Install", "guide/install") }, routePath: "/docs/setup", wantLink: "/guide/install", wantRenders: 3},
+		{name: "edited content renders", change: func() { pages.pages["docs/setup"].Body = "See [[Install]] now." }, routePath: "/docs/setup", wantLink: "/guide/install", wantRenders: 4},
+		{name: "wikilink target deleted renders plain text", change: func() { reader.deleteLink("Install") }, routePath: "/docs/setup", wantLink: "", wantRenders: 5},
+		{name: "broken wikilink is cached", routePath: "/docs/setup", wantLink: "", wantRenders: 5},
+		{name: "wikilink target created again renders", change: func() { reader.setLink("Install", "docs/install") }, routePath: "/docs/setup", wantLink: "/docs/install", wantRenders: 6},
+	}
+	for _, step := range steps {
+		if step.change != nil {
+			step.change()
+		}
+		execute(step.routePath, step.wantLink)
+		if counter.count() != step.wantRenders {
+			t.Fatalf("%s: renders = %d, want %d", step.name, counter.count(), step.wantRenders)
+		}
+	}
+}
+
+// Renders beyond the cap are refused instead of queued, so a flood of
+// crawler requests can't pile up render work; the shell is served plain.
+func TestGetCrawlerBodyUseCase_ParallelRendersCapped(t *testing.T) {
+	reader := &fakeCrawlerBodyReader{
+		links:   map[string]string{},
+		entered: make(chan struct{}),
+		block:   make(chan struct{}),
+	}
+	pages := &fakePageReader{pages: map[string]*seo.Page{}}
+	for i := range seo.MaxParallelRenders + 1 {
+		routePath := "page" + string(rune('a'+i))
+		pages.pages[routePath] = &seo.Page{ID: routePath, Title: routePath, Body: "[[" + routePath + "]]"}
+	}
+	uc, _ := crawlerBodyUseCase(&lockedPageReader{inner: pages}, reader)
+	var wg sync.WaitGroup
+	for i := range seo.MaxParallelRenders {
+		routePath := "page" + string(rune('a'+i))
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			if _, err := uc.Execute(context.Background(), crawlerInput("", "/"+routePath)); err != nil {
+				t.Errorf("blocked render failed: %v", err)
+			}
+		}()
+		<-reader.entered
+	}
+
+	last := "page" + string(rune('a'+seo.MaxParallelRenders))
+	out, err := uc.Execute(context.Background(), crawlerInput("", "/"+last))
+	if out != nil || !errors.Is(err, seo.ErrRendersBusy) {
+		t.Errorf("Execute over the cap = %+v, %v, want ErrRendersBusy", out, err)
+	}
+	close(reader.block)
+	wg.Wait()
+}
+
+// A render error other than ErrTooComplex may quote page markup; it is
+// replaced by an opaque one so it never reaches the log.
+func TestGetCrawlerBodyUseCase_RenderError_CarriesNoContent(t *testing.T) {
+	uc := seo.NewGetCrawlerBodyUseCase(pageAt("docs/setup", setupPage()), &fakeCrawlerBodyReader{})
+	seo.SetRenderFunc(uc, func(string, render.Options) (string, error) {
+		return "", errors.New(`disallowed markup <b onclick="SECRET">`)
+	})
+
+	out, err := uc.Execute(context.Background(), crawlerInput("", "/docs/setup"))
+	if out != nil || err == nil || strings.Contains(err.Error(), "SECRET") {
+		t.Fatalf("Execute = %+v, %v, want an error without the cause", out, err)
+	}
+}
+
+// The cache holds at most 16 MB of rendered HTML: the oldest pages are
+// dropped first, and a page bigger than that is never kept.
+func TestGetCrawlerBodyUseCase_RenderCache_Bounded(t *testing.T) {
+	const mb = 1 << 20
+	sizes := map[string]int{"a": 6 * mb, "b": 6 * mb, "c": 6 * mb, "huge": 17 * mb}
+	pages := &fakePageReader{pages: map[string]*seo.Page{}}
+	for routePath := range sizes {
+		pages.pages[routePath] = &seo.Page{ID: routePath, Title: routePath, Body: routePath}
+	}
+	uc := seo.NewGetCrawlerBodyUseCase(pages, &fakeCrawlerBodyReader{})
+	rendered := map[string]int{}
+	seo.SetRenderFunc(uc, func(content string, _ render.Options) (string, error) {
+		rendered[content]++
+		return strings.Repeat("x", sizes[content]), nil
+	})
+
+	for _, routePath := range []string{"a", "b", "c", "a", "c", "huge", "huge"} {
+		if out, err := uc.Execute(context.Background(), crawlerInput("", "/"+routePath)); err != nil || out == nil {
+			t.Fatalf("Execute(%s) = %v, want a body", routePath, err)
+		}
+	}
+	// c pushed a out (18 MB > 16 MB); a again pushed b out; c stayed cached.
+	want := map[string]int{"a": 2, "b": 1, "c": 1, "huge": 2}
+	if !reflect.DeepEqual(rendered, want) {
+		t.Errorf("renders = %v, want %v", rendered, want)
+	}
+}
+
+// The cache drops the least recently used page, so a crawl that keeps
+// coming back to some pages keeps them cached while others come and go.
+func TestGetCrawlerBodyUseCase_RenderCache_DropsLeastRecentlyUsed(t *testing.T) {
+	const mb = 1 << 20
+	pages := &fakePageReader{pages: map[string]*seo.Page{}}
+	for _, routePath := range []string{"a", "b", "c"} {
+		pages.pages[routePath] = &seo.Page{ID: routePath, Title: routePath, Body: routePath}
+	}
+	uc := seo.NewGetCrawlerBodyUseCase(pages, &fakeCrawlerBodyReader{})
+	rendered := map[string]int{}
+	seo.SetRenderFunc(uc, func(content string, _ render.Options) (string, error) {
+		rendered[content]++
+		return strings.Repeat("x", 6*mb), nil
+	})
+
+	// Three 6 MB pages don't fit into 16 MB. a is used again before c
+	// arrives, so c pushes out b, and b then pushes out c.
+	for _, routePath := range []string{"a", "b", "a", "c", "a", "b"} {
+		if out, err := uc.Execute(context.Background(), crawlerInput("", "/"+routePath)); err != nil || out == nil {
+			t.Fatalf("Execute(%s) = %v, want a body", routePath, err)
+		}
+	}
+	want := map[string]int{"a": 1, "b": 2, "c": 1}
+	if !reflect.DeepEqual(rendered, want) {
+		t.Errorf("renders = %v, want %v", rendered, want)
+	}
+}
+
+// A client that went away gets no render: the slot is released and nothing
+// is cached, so the next request renders.
+func TestGetCrawlerBodyUseCase_ClientGone_NoRender(t *testing.T) {
+	uc, counter := crawlerBodyUseCase(pageAt("docs/setup", setupPage()), &fakeCrawlerBodyReader{})
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	for range seo.MaxParallelRenders + 1 {
+		out, err := uc.Execute(ctx, crawlerInput("", "/docs/setup"))
+		if out != nil || err != nil {
+			t.Fatalf("Execute with a cancelled context = %+v, %v, want nothing", out, err)
+		}
+	}
+	if counter.count() != 0 {
+		t.Fatalf("renders = %d, want none", counter.count())
+	}
+	if out, err := uc.Execute(context.Background(), crawlerInput("", "/docs/setup")); err != nil || out == nil {
+		t.Fatalf("Execute afterwards = %+v, %v, want a body", out, err)
+	}
+}
+
+// Many crawler requests for the same uncached page at once: at most
+// MaxParallelRenders render, the rest get the plain shell right away (no
+// waiting, no deadlock), no goroutine is left behind, and the page is cached
+// for the next request.
+func TestGetCrawlerBodyUseCase_ConcurrentFirstRequests_SamePage(t *testing.T) {
+	before := runtime.NumGoroutine()
+	pages := &lockedPageReader{inner: pageAt("docs/setup", seo.Page{ID: "setup-id", Title: "Setup", Body: "See [[Install]]."})}
+	reader := &fakeCrawlerBodyReader{links: map[string]string{"Install": "docs/install"}, entered: make(chan struct{}, 64), block: make(chan struct{})}
+	uc, counter := crawlerBodyUseCase(pages, reader)
+
+	const requests = 20
+	var wg sync.WaitGroup
+	var mu sync.Mutex
+	var bodies, busy int
+	for range requests {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			out, err := uc.Execute(context.Background(), crawlerInput("", "/docs/setup"))
+			mu.Lock()
+			defer mu.Unlock()
+			switch {
+			case errors.Is(err, seo.ErrRendersBusy):
+				busy++
+			case err == nil && out != nil:
+				bodies++
+			default:
+				t.Errorf("Execute = %+v, %v", out, err)
+			}
+		}()
+	}
+	for range seo.MaxParallelRenders {
+		<-reader.entered
+	}
+	// Every request that did not get a render slot returns without waiting.
+	deadline := time.Now().Add(5 * time.Second)
+	for {
+		mu.Lock()
+		done := busy
+		mu.Unlock()
+		if done == requests-seo.MaxParallelRenders {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("busy = %d after 5s, want %d: refused requests are waiting", done, requests-seo.MaxParallelRenders)
+		}
+		time.Sleep(time.Millisecond)
+	}
+	close(reader.block) // later resolves (cache check) pass straight through
+	wg.Wait()
+
+	if bodies != seo.MaxParallelRenders || counter.count() != seo.MaxParallelRenders {
+		t.Errorf("bodies = %d, renders = %d, want %d each", bodies, counter.count(), seo.MaxParallelRenders)
+	}
+	if out, err := uc.Execute(context.Background(), crawlerInput("", "/docs/setup")); err != nil || out == nil || counter.count() != seo.MaxParallelRenders {
+		t.Errorf("after the burst: %+v, %v, renders = %d; want the cached body", out, err, counter.count())
+	}
+	deadline = time.Now().Add(5 * time.Second)
+	for runtime.NumGoroutine() > before && time.Now().Before(deadline) {
+		time.Sleep(10 * time.Millisecond)
+	}
+	if n := runtime.NumGoroutine(); n > before {
+		t.Errorf("goroutines = %d, want <= %d", n, before)
+	}
+}
+
+// Hostile page content, wikilink targets and titles never reach #root as
+// markup: the content is sanitized, the title and child titles escaped.
+func TestGetCrawlerBodyUseCase_HostileContent_IsSanitized(t *testing.T) {
+	page := seo.Page{
+		ID:    "setup-id",
+		Title: `</h1><script>alert("title")</script>`,
+		Body: "<script>alert(1)</script>\n\n<img src=x onerror=alert(2)>\n\n[x](javascript:alert(3))\n\n" +
+			"<a href=\"jAvAsCrIpT:alert(4)\">y</a>\n\n<iframe src=\"https://evil.example\"></iframe>\n\n" +
+			"<div style=\"background:url(javascript:alert(5))\" onclick=\"alert(6)\">z</div>\n\n" +
+			"[[<script>alert(7)</script>]] [[Evil]]\n\n</div></div><svg onload=alert(8)>",
+	}
+	reader := &fakeCrawlerBodyReader{
+		children: map[string][]seo.ChildPage{"setup-id": {{Title: `"><img src=x onerror=alert(9)>`, RoutePath: `docs/"><script>`}}},
+		links:    map[string]string{"Evil": `x"><script>alert(10)</script>`},
+	}
+	uc, _ := crawlerBodyUseCase(pageAt("docs/setup", page), reader)
+
+	out, err := uc.Execute(context.Background(), crawlerInput("", "/docs/setup"))
+	if err != nil || out == nil {
+		t.Fatalf("Execute = %+v, %v, want a body", out, err)
+	}
+	// Walk the markup as a browser tokenizes it: no active element, no event
+	// handler, no script URL, and every element opened is closed again, so
+	// nothing escapes #root.
+	depth := map[string]int{}
+	z := xhtml.NewTokenizer(strings.NewReader(out.HTML))
+	for {
+		tt := z.Next()
+		if tt == xhtml.ErrorToken {
+			break
+		}
+		tok := z.Token()
+		switch tt {
+		case xhtml.StartTagToken, xhtml.SelfClosingTagToken:
+			switch tok.Data {
+			case "script", "iframe", "svg", "object", "embed", "style":
+				t.Errorf("body has a <%s> element:\n%s", tok.Data, out.HTML)
+			}
+			for _, a := range tok.Attr {
+				if strings.HasPrefix(strings.ToLower(a.Key), "on") || a.Key == "style" ||
+					strings.Contains(strings.ToLower(strings.TrimSpace(a.Val)), "javascript:") {
+					t.Errorf("body has attribute %s=%q:\n%s", a.Key, a.Val, out.HTML)
+				}
+			}
+			if tt == xhtml.StartTagToken && tok.Data != "img" && tok.Data != "br" && tok.Data != "hr" {
+				depth[tok.Data]++
+			}
+		case xhtml.EndTagToken:
+			depth[tok.Data]--
+			if depth[tok.Data] < 0 {
+				t.Errorf("body closes </%s> it never opened:\n%s", tok.Data, out.HTML)
+			}
+		}
+	}
+	for tag, n := range depth {
+		if n != 0 {
+			t.Errorf("<%s> left open %d times:\n%s", tag, n, out.HTML)
+		}
+	}
+}
+
+// A body with Unicode in title, content and child routes is kept intact and
+// the child hrefs are percent-encoded.
+func TestGetCrawlerBodyUseCase_Unicode(t *testing.T) {
+	page := seo.Page{ID: "id", Title: "Übersicht 日本語 🌿", Body: "Grüße — ✓"}
+	reader := &fakeCrawlerBodyReader{children: map[string][]seo.ChildPage{"id": {{Title: "Ärger", RoutePath: "übersicht/ärger"}}}}
+	uc, _ := crawlerBodyUseCase(pageAt("übersicht", page), reader)
+
+	out, err := uc.Execute(context.Background(), crawlerInput("/wiki", "/übersicht"))
+	if err != nil || out == nil {
+		t.Fatalf("Execute = %+v, %v, want a body", out, err)
+	}
+	for _, want := range []string{"<h1>Übersicht 日本語 🌿</h1>", "Grüße — ✓", `href="/wiki/%C3%BCbersicht/%C3%A4rger">Ärger</a>`} {
+		if !strings.Contains(out.HTML, want) {
+			t.Errorf("body lacks %q:\n%s", want, out.HTML)
+		}
+	}
+}
diff --git a/internal/wiki/seo/export_test.go b/internal/wiki/seo/export_test.go
new file mode 100644
index 000000000..3bf7ab987
--- /dev/null
+++ b/internal/wiki/seo/export_test.go
@@ -0,0 +1,14 @@
+package seo
+
+import "github.com/perber/wiki/internal/render"
+
+// MaxParallelRenders is the cap on concurrent crawler body renders.
+const MaxParallelRenders = maxParallelRenders
+
+// SetRenderFunc replaces the renderer of uc, so tests can count renders.
+func SetRenderFunc(uc *GetCrawlerBodyUseCase, fn func(string, render.Options) (string, error)) {
+	uc.render = fn
+}
+
+// ErrRendersBusy is returned while MaxParallelRenders renders are running.
+var ErrRendersBusy = errRendersBusy
diff --git a/internal/wiki/seo/page.go b/internal/wiki/seo/page.go
index 788c342c9..ea8729920 100644
--- a/internal/wiki/seo/page.go
+++ b/internal/wiki/seo/page.go
@@ -8,6 +8,8 @@ import (
 // Page is one page as the use cases of this package read it, shared by
 // every use case that reads a single page by its route path.
 type Page struct {
+	// ID is the page's stable ID.
+	ID    string
 	Title string
 	// Body is the page's Markdown without frontmatter.
 	Body string
diff --git a/internal/wiki/seo/shell.go b/internal/wiki/seo/shell.go
index 1089b1605..a4d9c2268 100644
--- a/internal/wiki/seo/shell.go
+++ b/internal/wiki/seo/shell.go
@@ -2,12 +2,14 @@ package seo
 
 import (
 	"context"
+	"errors"
 	"html/template"
 	"io"
 	"log/slog"
 	"net/http"
 	"strconv"
 	"strings"
+	"sync/atomic"
 
 	httpinternal "github.com/perber/wiki/internal/http"
 	"github.com/perber/wiki/internal/publicaccess"
@@ -191,3 +193,45 @@ func (p *pageMeta) ContributeShell(ctx context.Context, req httpinternal.ShellRe
 		NoCache: true,
 	}
 }
+
+// crawlerBody puts the rendered page into #root for search-engine crawlers,
+// so they see the content without running the SPA (ADR-0018). The SPA's
+// createRoot replaces it once it runs.
+type crawlerBody struct {
+	body       *GetCrawlerBodyUseCase
+	log        *slog.Logger
+	busyLogged atomic.Bool
+}
+
+// NewCrawlerBody returns the shell contributor for the crawler body.
+func NewCrawlerBody(body *GetCrawlerBodyUseCase, log *slog.Logger) httpinternal.ShellContributor {
+	return &crawlerBody{body: body, log: log}
+}
+
+func (c *crawlerBody) ContributeShell(ctx context.Context, req httpinternal.ShellRequest) httpinternal.ShellParts {
+	// Whether the shell carries the page depends on User-Agent, on every
+	// route: caches must keep the variants apart and revalidate them.
+	parts := httpinternal.ShellParts{Vary: []string{"User-Agent"}, NoCache: true}
+	out, err := c.body.Execute(ctx, GetCrawlerBodyInput{
+		RoutePath: req.RoutePath,
+		BasePath:  req.BasePath,
+		UserAgent: req.Request.UserAgent(),
+	})
+	switch {
+	case errors.Is(err, errRendersBusy):
+		// Swallowed here: the crawler gets the plain shell. Logged once per
+		// process, a crawl can hit this on every request.
+		if !c.busyLogged.Swap(true) {
+			c.log.Warn("crawler body skipped, too many renders running, serving the plain shell; further skips are not logged",
+				"max_parallel_renders", maxParallelRenders)
+		}
+	case err != nil:
+		// Swallowed here: the crawler gets the plain shell. A failed render
+		// is cached, so this logs once per page version; the error carries
+		// no page content.
+		c.log.Warn("crawler body skipped, serving the plain shell", "route", req.RoutePath, "error", err)
+	case out != nil:
+		parts.Body = template.HTML(out.HTML) // escaped and sanitized by the use case
+	}
+	return parts
+}
diff --git a/internal/wiki/seo/shell_test.go b/internal/wiki/seo/shell_test.go
index 6c1f50cb4..abf4202ae 100644
--- a/internal/wiki/seo/shell_test.go
+++ b/internal/wiki/seo/shell_test.go
@@ -3,6 +3,7 @@ package seo_test
 import (
 	"context"
 	"errors"
+	"html/template"
 	"io"
 	"log/slog"
 	"net/http"
@@ -10,6 +11,7 @@ import (
 	"reflect"
 	"strconv"
 	"strings"
+	"sync"
 	"testing"
 
 	wikihttp "github.com/perber/wiki/internal/http"
@@ -539,3 +541,109 @@ func TestPageMarkdown_Body_ServedVerbatim(t *testing.T) {
 		})
 	}
 }
+
+func crawlerBody(pages seo.PageReader, reader *fakeCrawlerBodyReader, log *slog.Logger) wikihttp.ShellContributor {
+	return seo.NewCrawlerBody(seo.NewGetCrawlerBodyUseCase(pages, reader), log)
+}
+
+func requestWithUA(routePath, userAgent string) wikihttp.ShellRequest {
+	req := shellRequest("", routePath)
+	req.Request.Header.Set("User-Agent", userAgent)
+	return req
+}
+
+// Every public shell says it varies by User-Agent and must be revalidated,
+// so a cache never hands a crawler's variant to a browser or the reverse.
+var crawlerVaryParts = wikihttp.ShellParts{Vary: []string{"User-Agent"}, NoCache: true}
+
+func TestCrawlerBody_ContributesBodyOnlyToCrawlers(t *testing.T) {
+	tests := []struct {
+		name      string
+		routePath string
+		userAgent string
+		pages     *fakePageReader
+		wantBody  string
+	}{
+		{name: "browser gets only Vary", routePath: "/docs/setup", userAgent: chromeUA, pages: pageAt("docs/setup", setupPage())},
+		{name: "crawler gets the body", routePath: "/docs/setup", userAgent: googlebotUA, pages: pageAt("docs/setup", setupPage()), wantBody: "<article><h1>Setup</h1><p>Install it.</p>\n</article>"},
+		{name: "crawler on an unknown page gets only Vary", routePath: "/docs/missing", userAgent: googlebotUA, pages: pageAt("docs/setup", setupPage())},
+		{name: "read error: only Vary", routePath: "/docs/setup", userAgent: googlebotUA, pages: &fakePageReader{err: errors.New("boom")}},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := crawlerBody(tc.pages, &fakeCrawlerBodyReader{}, discardLogger()).ContributeShell(context.Background(), requestWithUA(tc.routePath, tc.userAgent))
+			want := crawlerVaryParts
+			want.Body = template.HTML(tc.wantBody)
+			if !reflect.DeepEqual(got, want) {
+				t.Errorf("parts = %+v, want %+v", got, want)
+			}
+		})
+	}
+}
+
+func TestPublicOnly_CrawlerBodyPublicAccessOff_ContributesAndReadsNothing(t *testing.T) {
+	pages := pageAt("docs/setup", setupPage())
+	reader := &fakeCrawlerBodyReader{}
+	contributor := seo.NewPublicOnly(publicaccess.Fixed(false)).Contributor(crawlerBody(pages, reader, discardLogger()))
+
+	if got := contributor.ContributeShell(context.Background(), requestWithUA("/docs/setup", googlebotUA)); !reflect.DeepEqual(got, wikihttp.ShellParts{}) {
+		t.Errorf("parts = %+v, want empty (no Vary either)", got)
+	}
+	if pages.reads != 0 || reader.reads != 0 {
+		t.Errorf("page reads %d, child reads %d; want nothing read", pages.reads, reader.reads)
+	}
+}
+
+// A page that fails to render is logged once per page version, without its
+// content, and the crawler gets the plain shell.
+func TestCrawlerBody_RenderFails_LoggedOnceWithoutContent(t *testing.T) {
+	secret := "SECRET-CONTENT "
+	pages := pageAt("huge", seo.Page{ID: "huge-id", Title: "Huge", Body: strings.Repeat(secret, 300<<10/len(secret)+1)})
+	var logs strings.Builder
+	contributor := crawlerBody(pages, &fakeCrawlerBodyReader{}, slog.New(slog.NewTextHandler(&logs, nil)))
+
+	for range 3 {
+		if got := contributor.ContributeShell(context.Background(), requestWithUA("/huge", googlebotUA)); !reflect.DeepEqual(got, crawlerVaryParts) {
+			t.Fatalf("parts = %+v, want only Vary", got)
+		}
+	}
+	if n := strings.Count(logs.String(), "level=WARN"); n != 1 {
+		t.Errorf("%d warnings, want 1:\n%s", n, logs.String())
+	}
+	if strings.Contains(logs.String(), "SECRET") || !strings.Contains(logs.String(), "too complex") {
+		t.Errorf("log = %s, want the reason without page content", logs.String())
+	}
+}
+
+// Refused renders are logged once per process, not once per request.
+func TestCrawlerBody_RendersBusy_LoggedOnce(t *testing.T) {
+	reader := &fakeCrawlerBodyReader{links: map[string]string{}, entered: make(chan struct{}), block: make(chan struct{})}
+	pages := &fakePageReader{pages: map[string]*seo.Page{}}
+	for i := range seo.MaxParallelRenders + 1 {
+		routePath := "page" + string(rune('a'+i))
+		pages.pages[routePath] = &seo.Page{ID: routePath, Title: routePath, Body: "[[" + routePath + "]]"}
+	}
+	var logs strings.Builder
+	contributor := crawlerBody(&lockedPageReader{inner: pages}, reader, slog.New(slog.NewTextHandler(&logs, nil)))
+	var wg sync.WaitGroup
+	for i := range seo.MaxParallelRenders {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			contributor.ContributeShell(context.Background(), requestWithUA("/page"+string(rune('a'+i)), googlebotUA))
+		}()
+		<-reader.entered
+	}
+
+	last := "/page" + string(rune('a'+seo.MaxParallelRenders))
+	for range 3 {
+		if got := contributor.ContributeShell(context.Background(), requestWithUA(last, googlebotUA)); !reflect.DeepEqual(got, crawlerVaryParts) {
+			t.Errorf("parts = %+v, want only Vary", got)
+		}
+	}
+	close(reader.block)
+	wg.Wait()
+	if n := strings.Count(logs.String(), "level=WARN"); n != 1 {
+		t.Errorf("%d warnings, want 1:\n%s", n, logs.String())
+	}
+}
diff --git a/internal/wiki/seo_adapter.go b/internal/wiki/seo_adapter.go
index 79016bfa1..b775fedec 100644
--- a/internal/wiki/seo_adapter.go
+++ b/internal/wiki/seo_adapter.go
@@ -28,13 +28,16 @@ func (w *Wiki) seoShellResponders() []httpinternal.ShellResponder {
 // all gated on public access by one seo.PublicOnly.
 func (w *Wiki) seoShellContributors() []httpinternal.ShellContributor {
 	public := seo.NewPublicOnly(w.publicAccess)
-	pageMeta := seo.NewGetPageMetaUseCase(
-		seoPageReader{uc: wikipages.NewGetPageViewByPathUseCase(w.tree)},
-		seoPermalinkResolver{queries: wikipages.NewPageQueries(w.tree)},
-		w.siteName, w.publicURL,
-	)
+	log := w.log.With("component", "SEO")
+	pages := seoPageReader{uc: wikipages.NewGetPageViewByPathUseCase(w.tree)}
+	pageMeta := seo.NewGetPageMetaUseCase(pages, seoPermalinkResolver{queries: wikipages.NewPageQueries(w.tree)}, w.siteName, w.publicURL)
+	crawlerBody := seo.NewGetCrawlerBodyUseCase(pages, seoCrawlerBodyReader{
+		children:  wikipages.NewListChildRoutesUseCase(w.tree),
+		wikiLinks: wikipages.NewResolveWikiLinkUseCase(w.tree),
+	})
 	return []httpinternal.ShellContributor{
-		public.Contributor(seo.NewPageMeta(pageMeta, w.log.With("component", "SEO"))),
+		public.Contributor(seo.NewPageMeta(pageMeta, log)),
+		public.Contributor(seo.NewCrawlerBody(crawlerBody, log)),
 	}
 }
 
@@ -83,7 +86,7 @@ func (r seoPageReader) PageByRoutePath(ctx context.Context, routePath string) (*
 	if err != nil {
 		return nil, err
 	}
-	return &seo.Page{Title: view.Page.Title, Body: view.Page.Content, Properties: view.Properties}, nil
+	return &seo.Page{ID: view.Page.ID, Title: view.Page.Title, Body: view.Page.Content, Properties: view.Properties}, nil
 }
 
 // seoPermalinkResolver implements seo.PermalinkResolver with the pages
@@ -106,6 +109,36 @@ func (r seoPermalinkResolver) ResolvePermalink(_ context.Context, id string) (*s
 	return &seo.PermalinkTarget{RoutePath: target.Path}, nil
 }
 
+// seoCrawlerBodyReader implements seo.CrawlerBodyReader with the pages
+// slice's child listing and wikilink resolution; seo must not import pages.
+type seoCrawlerBodyReader struct {
+	children  *wikipages.ListChildRoutesUseCase
+	wikiLinks *wikipages.ResolveWikiLinkUseCase
+}
+
+func (r seoCrawlerBodyReader) ChildPages(ctx context.Context, pageID string) ([]seo.ChildPage, error) {
+	out, err := r.children.Execute(ctx, wikipages.ListChildRoutesInput{PageID: pageID})
+	if errors.Is(err, tree.ErrPageNotFound) || errors.Is(err, tree.ErrTreeNotLoaded) {
+		return nil, nil // the page went away since it was read; it is listed without children
+	}
+	if err != nil {
+		return nil, err
+	}
+	children := make([]seo.ChildPage, len(out.Routes))
+	for i, r := range out.Routes {
+		children[i] = seo.ChildPage{Title: r.Title, RoutePath: r.RoutePath}
+	}
+	return children, nil
+}
+
+func (r seoCrawlerBodyReader) ResolveWikiLink(ctx context.Context, target string) (string, bool) {
+	out, err := r.wikiLinks.Execute(ctx, wikipages.ResolveWikiLinkInput{Target: target})
+	if err != nil || out == nil {
+		return "", false
+	}
+	return out.RoutePath, true
+}
+
 // seoPageRouteLister implements seo.PageRouteLister with the pages slice's
 // read use case; seo must not import pages. A public wiki shows every page to
 // anonymous readers, so every page and section is listed (ADR-0018).
diff --git a/internal/wiki/seo_adapter_test.go b/internal/wiki/seo_adapter_test.go
index ecf135436..768cf3a27 100644
--- a/internal/wiki/seo_adapter_test.go
+++ b/internal/wiki/seo_adapter_test.go
@@ -5,6 +5,7 @@ import (
 	"encoding/xml"
 	"errors"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -238,6 +239,7 @@ func contributeShell(t *testing.T, w *Wiki, basePath, routePath string, headers
 		merged.Head += parts.Head
 		merged.Body += parts.Body
 		merged.NoCache = merged.NoCache || parts.NoCache
+		merged.Vary = append(merged.Vary, parts.Vary...)
 	}
 	return merged
 }
@@ -350,12 +352,16 @@ func TestWiki_PageMeta_FollowsPublicAccessAtRuntime(t *testing.T) {
 	}
 }
 
-// noindexParts is what the page meta contributor adds for a route without a page.
-var noindexParts = httpinternal.ShellParts{Head: `<meta name="robots" content="noindex">`, NoCache: true}
+// publicShellParts is what every shell of a public wiki gets: the crawler
+// body depends on User-Agent, so caches must keep the variants apart.
+var publicShellParts = httpinternal.ShellParts{NoCache: true, Vary: []string{"User-Agent"}}
+
+// noindexParts is what a public wiki's shell gets for a route without a page.
+var noindexParts = httpinternal.ShellParts{Head: `<meta name="robots" content="noindex">`, NoCache: true, Vary: []string{"User-Agent"}}
 
 // The root and the root's permalink are no page route: the root redirect or
-// the SPA decides there, so nothing is added.
-func TestWiki_PageMeta_NotAPageRoute_ContributesNothing(t *testing.T) {
+// the SPA decides there, so no page meta is added.
+func TestWiki_PageMeta_NotAPageRoute_AddsNoMeta(t *testing.T) {
 	tests := []struct {
 		name      string
 		routePath string
@@ -367,8 +373,8 @@ func TestWiki_PageMeta_NotAPageRoute_ContributesNothing(t *testing.T) {
 	setPublicAccess(t, public, true)
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			if got := contributeShell(t, w, "", tc.routePath, nil); !reflect.DeepEqual(got, httpinternal.ShellParts{}) {
-				t.Fatalf("parts = %+v, want none", got)
+			if got := contributeShell(t, w, "", tc.routePath, nil); !reflect.DeepEqual(got, publicShellParts) {
+				t.Fatalf("parts = %+v, want only %+v", got, publicShellParts)
 			}
 		})
 	}
@@ -1550,8 +1556,9 @@ func TestWiki_PageMarkdown_NotAPageOrNotPreferred_ServesTheShell(t *testing.T) {
 				return
 			}
 			vary := rec.Header().Values("Vary")
-			if tc.wantVary && (len(vary) != 1 || vary[0] != "Accept") {
-				t.Errorf("Vary = %q, want [Accept]", vary)
+			// Accept once, from the Markdown responder; User-Agent from the crawler body.
+			if tc.wantVary && !reflect.DeepEqual(vary, []string{"Accept", "User-Agent"}) {
+				t.Errorf("Vary = %q, want [Accept User-Agent]", vary)
 			}
 			if !tc.wantVary && len(vary) != 0 {
 				t.Errorf("Vary = %q, want none", vary)
@@ -1574,3 +1581,300 @@ func TestWiki_PageMarkdown_EmptyWikiRoot_ServesTheShell(t *testing.T) {
 		t.Fatalf("got %d %q, want the 200 shell", rec.Code, rec.Header().Get("Content-Type"))
 	}
 }
+
+const googlebotUserAgent = "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
+
+// crawlerBodyWiki builds a public wiki under /wiki with a section, a page
+// linking another page by wikilink and a child page.
+func crawlerBodyWiki(t *testing.T) (*Wiki, *publicaccess.Service, *gin.Engine) {
+	t.Helper()
+	w, public, router := newSEOTestRouter(t, "/wiki")
+	setPublicAccess(t, public, true)
+	sectionKind := tree.NodeKindSection
+	docs := createPageForTest(t, w, SYSTEM_USER_ID, nil, "Docs", "docs", &sectionKind)
+	setup := createPageForTest(t, w, SYSTEM_USER_ID, &docs.ID, "Setup <&>", "setup", pageNodeKind())
+	createPageForTest(t, w, SYSTEM_USER_ID, &setup.ID, "Linux", "linux", pageNodeKind())
+	createPageForTest(t, w, SYSTEM_USER_ID, nil, "Install Guide", "install", pageNodeKind())
+	content := "See [[Install Guide]] and [Linux](linux).\n\n<script>alert(1)</script>"
+	updatePageForTest(t, w, SYSTEM_USER_ID, setup.ID, "Setup <&>", "setup", &content, pageNodeKind())
+	return w, public, router
+}
+
+func TestWiki_CrawlerBody_PageForCrawlersOnly(t *testing.T) {
+	useEmbeddedFrontend(t)
+	_, _, router := crawlerBodyWiki(t)
+	ua := map[string]string{"User-Agent": googlebotUserAgent}
+
+	t.Run("crawler gets title, rendered content and child links", func(t *testing.T) {
+		parts := crawlerRoot(t, router, "/wiki/docs/setup", ua)
+		want := `<article><h1>Setup &lt;&amp;&gt;</h1><p>See <a href="/wiki/install">Install Guide</a> and <a href="/wiki/docs/setup/linux">Linux</a>.</p>` + "\n" +
+			`</article><nav><ul><li><a href="/wiki/docs/setup/linux">Linux</a></li></ul></nav>`
+		if parts != want {
+			t.Errorf("#root =\n%s\nwant\n%s", parts, want)
+		}
+	})
+	for _, tc := range []struct {
+		name    string
+		path    string
+		headers map[string]string
+	}{
+		{name: "browser", path: "/wiki/docs/setup", headers: map[string]string{"User-Agent": "Mozilla/5.0 Chrome/130.0"}},
+		{name: "crawler on an unknown page", path: "/wiki/docs/missing", headers: ua},
+		{name: "crawler on a SPA route", path: "/wiki/settings/branding", headers: ua},
+	} {
+		t.Run(tc.name+" gets an empty #root", func(t *testing.T) {
+			if got := crawlerRoot(t, router, tc.path, tc.headers); got != "" {
+				t.Errorf("#root = %q, want empty", got)
+			}
+		})
+	}
+}
+
+// crawlerRoot serves path on the real router and returns what #root
+// holds; the router must serve the embedded frontend (useEmbeddedFrontend).
+func crawlerRoot(t *testing.T, router http.Handler, path string, headers map[string]string) string {
+	t.Helper()
+	rec := serveGET(router, path, headers)
+	_, root, ok := strings.Cut(rec.Body.String(), `<div id="root">`)
+	if !ok {
+		t.Fatalf("no #root in %d %q", rec.Code, rec.Body.String())
+	}
+	root, _, _ = strings.Cut(root, "</div>\n")
+	return root
+}
+
+// Every shell of a public wiki varies by User-Agent and Accept and is
+// no-cache; HEAD answers like GET. A private wiki's shell has neither.
+func TestWiki_CrawlerBody_VaryAndHeadOnRealRouter(t *testing.T) {
+	useEmbeddedFrontend(t)
+	w, public, router := crawlerBodyWiki(t)
+	setupID := w.tree.GetTree().Children[1].Children[0].ID
+	tests := []struct {
+		name        string
+		public      bool
+		path        string
+		userAgent   string
+		wantVary    []string
+		wantArticle bool
+	}{
+		{name: "crawler, page", public: true, path: "/wiki/docs/setup", userAgent: googlebotUserAgent, wantVary: []string{"Accept", "User-Agent"}, wantArticle: true},
+		{name: "browser, page", public: true, path: "/wiki/docs/setup", userAgent: "Mozilla/5.0 Firefox/132.0", wantVary: []string{"Accept", "User-Agent"}},
+		{name: "crawler, permalink", public: true, path: "/wiki/p/" + setupID, userAgent: googlebotUserAgent, wantVary: []string{"Accept", "User-Agent"}},
+		{name: "crawler, private wiki", public: false, path: "/wiki/docs/setup", userAgent: googlebotUserAgent},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			setPublicAccess(t, public, tc.public)
+			get := serveGET(router, tc.path, map[string]string{"User-Agent": tc.userAgent})
+			head := httptest.NewRecorder()
+			req := httptest.NewRequest(http.MethodHead, tc.path, nil)
+			req.Header.Set("User-Agent", tc.userAgent)
+			router.ServeHTTP(head, req)
+
+			if get.Code != http.StatusOK || head.Code != http.StatusOK {
+				t.Fatalf("status GET %d, HEAD %d, want 200", get.Code, head.Code)
+			}
+			if got := get.Header().Values("Vary"); !reflect.DeepEqual(got, tc.wantVary) {
+				t.Errorf("Vary = %q, want %q", got, tc.wantVary)
+			}
+			if !reflect.DeepEqual(head.Header(), get.Header()) {
+				t.Errorf("headers differ\n GET: %v\nHEAD: %v", get.Header(), head.Header())
+			}
+			if got := head.Header().Get("Content-Length"); got != strconv.Itoa(get.Body.Len()) {
+				t.Errorf("Content-Length = %s, want %d", got, get.Body.Len())
+			}
+			if got := strings.Contains(get.Body.String(), "<article>"); got != tc.wantArticle {
+				t.Errorf("article in body: %v, want %v", got, tc.wantArticle)
+			}
+			if tc.public && get.Header().Get("Cache-Control") != "no-cache" {
+				t.Errorf("Cache-Control = %q, want no-cache", get.Header().Get("Cache-Control"))
+			}
+		})
+	}
+}
+
+// The cached crawler body follows every change a reader would see: an edit
+// of the page, a renamed, moved, deleted or recreated wikilink target and a
+// renamed or added child. After each change the long-lived router's #root
+// must equal what a fresh router (empty cache) renders.
+func TestWiki_CrawlerBody_CacheFollowsTheWiki(t *testing.T) {
+	useEmbeddedFrontend(t)
+	w, public, router := crawlerBodyWiki(t)
+	ua := map[string]string{"User-Agent": googlebotUserAgent}
+	docs := w.tree.GetTree().Children[1]
+	setup := docs.Children[0]
+	linux := setup.Children[0]
+	install := w.tree.GetTree().Children[2]
+	freshRoot := func() string {
+		t.Helper()
+		fresh := httpinternal.NewRouter(w.Registrars(), w.FrontendConfig(), httpinternal.RouterOptions{
+			BasePath: "/wiki", PublicAccess: public, DisableRequestLog: true,
+		})
+		return crawlerRoot(t, fresh, "/wiki/docs/setup", ua)
+	}
+	crawlerRoot(t, router, "/wiki/docs/setup", ua) // fill the cache
+
+	steps := []struct {
+		name    string
+		change  func()
+		want    string
+		notWant string
+	}{
+		{name: "page edited", change: func() {
+			content := "Edited: see [[Install Guide]]."
+			updatePageForTest(t, w, SYSTEM_USER_ID, setup.ID, "Setup <&>", "setup", &content, pageNodeKind())
+		}, want: `Edited: see <a href="/wiki/install">Install Guide</a>`},
+		{name: "wikilink target moved", change: func() {
+			movePageForTest(t, w, &tree.Page{PageNode: install}, docs.ID)
+		}, want: `<a href="/wiki/docs/install">Install Guide</a>`},
+		{name: "wikilink target slug changed", change: func() {
+			updatePageForTest(t, w, SYSTEM_USER_ID, install.ID, "Install Guide", "installation", nil, pageNodeKind())
+		}, want: `<a href="/wiki/docs/installation">Install Guide</a>`},
+		{name: "wikilink target renamed", change: func() {
+			updatePageForTest(t, w, SYSTEM_USER_ID, install.ID, "Installation", "installation", nil, pageNodeKind())
+		}, notWant: `href="/wiki/docs/installation"`},
+		{name: "second page takes the old title", change: func() {
+			createPageForTest(t, w, SYSTEM_USER_ID, nil, "Install Guide", "guide", pageNodeKind())
+		}, want: `<a href="/wiki/guide">Install Guide</a>`},
+		{name: "wikilink target becomes ambiguous", change: func() {
+			createPageForTest(t, w, SYSTEM_USER_ID, nil, "Install Guide", "guide-two", pageNodeKind())
+		}, notWant: `href="/wiki/guide`},
+		{name: "child renamed", change: func() {
+			updatePageForTest(t, w, SYSTEM_USER_ID, linux.ID, "Linux ✓", "linux", nil, pageNodeKind())
+		}, want: `<li><a href="/wiki/docs/setup/linux">Linux ✓</a></li>`},
+		{name: "child added", change: func() {
+			createPageForTest(t, w, SYSTEM_USER_ID, &setup.ID, "Mac", "mac", pageNodeKind())
+		}, want: `<li><a href="/wiki/docs/setup/mac">Mac</a></li>`},
+		{name: "child deleted", change: func() {
+			deletePageForTest(t, w, SYSTEM_USER_ID, linux.ID, true)
+		}, notWant: `/wiki/docs/setup/linux`},
+	}
+	for _, step := range steps {
+		step.change()
+		got := crawlerRoot(t, router, "/wiki/docs/setup", ua)
+		if want := freshRoot(); got != want {
+			t.Fatalf("%s: cached #root =\n%s\nfresh render =\n%s", step.name, got, want)
+		}
+		if step.want != "" && !strings.Contains(got, step.want) {
+			t.Fatalf("%s: #root lacks %q:\n%s", step.name, step.want, got)
+		}
+		if step.notWant != "" && strings.Contains(got, step.notWant) {
+			t.Fatalf("%s: #root still has %q:\n%s", step.name, step.notWant, got)
+		}
+	}
+}
+
+// A crawler that asks for Markdown gets the Markdown: the responder answers
+// before any contributor runs, on GET and HEAD alike.
+func TestWiki_CrawlerBody_MarkdownRequestedByCrawler_MarkdownWins(t *testing.T) {
+	useEmbeddedFrontend(t)
+	_, _, router := crawlerBodyWiki(t)
+	for _, method := range []string{http.MethodGet, http.MethodHead} {
+		t.Run(method, func(t *testing.T) {
+			rec := serveAccept(router, method, "/wiki/docs/setup", "text/markdown", map[string]string{"User-Agent": googlebotUserAgent})
+			if rec.Code != http.StatusOK || !strings.HasPrefix(rec.Header().Get("Content-Type"), "text/markdown") {
+				t.Fatalf("got %d %q, want 200 Markdown", rec.Code, rec.Header().Get("Content-Type"))
+			}
+			if strings.Contains(rec.Body.String(), "<article>") {
+				t.Errorf("Markdown response carries the crawler body: %q", rec.Body.String())
+			}
+			if got := rec.Header().Values("Vary"); !reflect.DeepEqual(got, []string{"Accept"}) {
+				t.Errorf("Vary = %q, want [Accept]", got)
+			}
+		})
+	}
+}
+
+// A page too complex to render gives the crawler the plain shell (still with
+// the page meta) and one warning for any number of requests.
+func TestWiki_CrawlerBody_TooComplexPage_PlainShellWarnedOnce(t *testing.T) {
+	useEmbeddedFrontend(t)
+	w, public := newSEOTestWiki(t, "")
+	var logs syncBuffer
+	w.log = slog.New(slog.NewTextHandler(&logs, nil))
+	router := httpinternal.NewRouter(w.Registrars(), w.FrontendConfig(), httpinternal.RouterOptions{PublicAccess: public, DisableRequestLog: true})
+	setPublicAccess(t, public, true)
+	huge := createPageForTest(t, w, SYSTEM_USER_ID, nil, "Huge", "huge", pageNodeKind())
+	content := strings.Repeat("SECRET-CONTENT ", 300<<10/15+1)
+	updatePageForTest(t, w, SYSTEM_USER_ID, huge.ID, "Huge", "huge", &content, pageNodeKind())
+
+	for range 3 {
+		rec := serveGET(router, "/huge", map[string]string{"User-Agent": googlebotUserAgent})
+		if rec.Code != http.StatusOK || strings.Contains(rec.Body.String(), "<article>") || !strings.Contains(rec.Body.String(), "<title>Huge") {
+			t.Fatalf("got %d, want the plain shell with page meta", rec.Code)
+		}
+	}
+	got := logs.String()
+	if n := strings.Count(got, "crawler body skipped"); n != 1 {
+		t.Errorf("%d crawler warnings, want 1:\n%s", n, got)
+	}
+	if strings.Contains(got, "SECRET") {
+		t.Errorf("log carries page content")
+	}
+}
+
+// syncBuffer is a strings.Builder safe for concurrent log writes.
+type syncBuffer struct {
+	mu sync.Mutex
+	b  strings.Builder
+}
+
+func (s *syncBuffer) Write(p []byte) (int, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.b.Write(p)
+}
+
+func (s *syncBuffer) String() string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.b.String()
+}
+
+// Crawler requests run while the wikilink target and a child move and get
+// renamed; under -race nothing may race, and every answer is either the
+// page or the plain shell.
+func TestWiki_CrawlerBody_ConcurrentWithTreeChanges(t *testing.T) {
+	w, public := newSEOTestWiki(t, "")
+	setPublicAccess(t, public, true)
+	sectionKind := tree.NodeKindSection
+	docs := createPageForTest(t, w, SYSTEM_USER_ID, nil, "Docs", "docs", &sectionKind)
+	other := createPageForTest(t, w, SYSTEM_USER_ID, nil, "Other", "other", &sectionKind)
+	setup := createPageForTest(t, w, SYSTEM_USER_ID, &docs.ID, "Setup", "setup", pageNodeKind())
+	child := createPageForTest(t, w, SYSTEM_USER_ID, &setup.ID, "Child", "child", pageNodeKind())
+	install := createPageForTest(t, w, SYSTEM_USER_ID, &docs.ID, "Install Guide", "install", pageNodeKind())
+	content := "See [[Install Guide]]."
+	updatePageForTest(t, w, SYSTEM_USER_ID, setup.ID, "Setup", "setup", &content, pageNodeKind())
+	contributors := w.seoShellContributors()
+
+	stop := make(chan struct{})
+	var wg sync.WaitGroup
+	for range 4 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for {
+				select {
+				case <-stop:
+					return
+				default:
+				}
+				req := httptest.NewRequest(http.MethodGet, "/docs/setup", nil)
+				req.Header.Set("User-Agent", googlebotUserAgent)
+				for _, c := range contributors {
+					c.ContributeShell(req.Context(), httpinternal.ShellRequest{Request: req, RoutePath: "/docs/setup"})
+				}
+			}
+		}()
+	}
+	for i := range 20 {
+		parent := docs.ID
+		if i%2 == 0 {
+			parent = other.ID
+		}
+		movePageForTest(t, w, install, parent)
+		updatePageForTest(t, w, SYSTEM_USER_ID, child.ID, fmt.Sprintf("Child %d", i), "child", nil, pageNodeKind())
+	}
+	close(stop)
+	wg.Wait()
+}