@@ -32,6 +32,7 @@ use crate::error::{AppError, Result};
 use crate::git::store;
 use crate::git::visibility_pack::{
     allowed_blob_set_for_caller, allowed_tree_set_for_caller, has_path_scoped_rule,
+    reachable_commit_tag_oids,
 };
 use crate::state::AppState;
 use crate::visibility::{visibility_check, Decision};
@@ -64,15 +65,16 @@ pub(crate) const MAX_HISTORY_WALKS_PER_REQUEST: u32 = 16;
 /// row than the one read (KTD2a). We check object existence via
 /// `store::object_type` *before* the expensive reachability walk so random-CID
 /// spray cannot trigger full-history git walks on repos that don't carry the
-/// object. When the row carries path-scoped rules (KTD4) the served object must
-/// be either a `commit`/`tag` (root-level metadata the caller already cleared the
-/// `"/"` gate for) OR a `blob`/`tree` in the caller's *reachable* allowed-set
-/// (`allowed_blob_set_for_caller` / `allowed_tree_set_for_caller`). A withheld
-/// subtree's tree object is denied here exactly as `get_tree` denies its path, so
-/// its child names and oids cannot leak by CID (#135). The reachable allowed-sets
-/// exclude dangling objects — a blob or tree written via plumbing and never
-/// committed has no path to gate, so it is fail-closed 404'd under path-scoped
-/// rules (#126). Denial and genuine not-found both fall through to an opaque 404.
+/// object. When the row carries path-scoped rules (KTD4) the served object is
+/// gated by type: a `blob`/`tree` must be in the caller's *reachable* allowed-set
+/// (`allowed_blob_set_for_caller` / `allowed_tree_set_for_caller`), and a
+/// `commit`/`tag` must be in the repo's *reachable* commit/tag set
+/// (`reachable_commit_tag_oids`, #173). A withheld subtree's tree object is denied
+/// here exactly as `get_tree` denies its path, so its child names and oids cannot
+/// leak by CID (#135). All these sets exclude dangling objects — a blob, tree,
+/// commit, or tag written via plumbing and never referenced has no reachable path,
+/// so it is fail-closed 404'd under path-scoped rules (#126, #173). Denial and
+/// genuine not-found both fall through to an opaque 404.
 ///
 /// Scope: this closes the direct unauthenticated scan, including the dangling
 /// case. A stale-public mirror row still serves withheld content (tracked
@@ -175,6 +177,11 @@ pub async fn get_by_cid(
     // it. Built lazily and only for a tree fetch (a request is one CID = one object
     // type), so one request builds exactly one of the two sets — no double walk.
     let mut allowed_tree_memo: HashMap<String, HashSet<String>> = HashMap::new();
+    // The reachable commit/tag set (#173, F2): a dangling commit/tag is in no
+    // repo's set, so it fails closed under a path-scoped rule. Caller-independent
+    // (reachability is objective), so keyed on repo.id alone. Built lazily on a
+    // commit/tag fetch, sharing the walk cap + IP quota with the blob/tree walks.
+    let mut reachable_ct_memo: HashMap<String, HashSet<String>> = HashMap::new();
 
     // The `/ipfs/{cid}` route is anonymous and a valid tree CID makes each
     // path-scoped repo pay a fresh full-history allowed-set walk, memoized only
@@ -234,30 +241,37 @@ pub async fn get_by_cid(
 
             // Per-object gating applies only when a path-scoped rule exists (KTD4);
             // without one, the "/" gate above is the whole story. Under a path-scoped
-            // rule a `blob` is gated against the caller's allowed-blob-set and a `tree`
-            // against the allowed-tree-set (#135 — a withheld subtree's tree structure
-            // must not leak by CID where get_tree protects it). A `commit`/`tag` exposes
-            // only "/"-level metadata the caller already cleared the "/" gate for, so it
-            // falls through to serve.
+            // rule the fetched object is gated by type: a `blob` against the caller's
+            // allowed-blob-set, a `tree` against the allowed-tree-set (#135 — a
+            // withheld subtree's structure must not leak by CID), and a `commit`/`tag`
+            // against the repo's REACHABLE commit/tag set (#173, F2 — a dangling
+            // commit/tag has no authorized reachable path, so it must not serve its
+            // message/metadata; a reachable one already cleared the "/" gate). Each
+            // set is a full-history git walk, so all three share the per-request cap
+            // and per-walk IP quota below.
             let path_scoped = has_path_scoped_rule(rules);
-            if path_scoped && (obj_type == "blob" || obj_type == "tree") {
-                let is_blob = obj_type == "blob";
-                let memo = if is_blob {
-                    &mut allowed_blob_memo
-                } else {
-                    &mut allowed_tree_memo
+            let gated =
+                path_scoped && matches!(obj_type.as_str(), "blob" | "tree" | "commit" | "tag");
+            if gated {
+                // One memo per kind: blob/tree gate on the caller's allowed-set,
+                // commit/tag on reachability (caller-independent — reachability is
+                // objective, so the set is not keyed on the caller).
+                let memo = match obj_type.as_str() {
+                    "blob" => &mut allowed_blob_memo,
+                    "tree" => &mut allowed_tree_memo,
+                    _ => &mut reachable_ct_memo,
                 };
                 if !memo.contains_key(&repo.id) {
                     // Per-request fan-out ceiling (INV-10): once this request has
                     // spawned MAX_HISTORY_WALKS_PER_REQUEST walks, skip THIS
                     // walk-requiring candidate and keep scanning (#173, F4). A plain
                     // `continue`, not `break`: a later candidate servable WITHOUT a
-                    // walk (a `commit`/`tag`, or a no-rule public copy) must still be
-                    // reached and served — breaking the loop would 404 that publicly
-                    // readable content for no amplification benefit. `walks` is only
-                    // incremented inside this walk block, so walk-free candidates
-                    // never consume the budget and the ceiling still bounds spawned
-                    // walks to MAX_HISTORY_WALKS_PER_REQUEST.
+                    // walk (a walk-free reachable copy, or a no-rule public copy) must
+                    // still be reached and served — breaking the loop would 404 that
+                    // publicly readable content for no amplification benefit. `walks`
+                    // is only incremented inside this walk block, so walk-free
+                    // candidates never consume the budget and the ceiling still bounds
+                    // spawned walks to MAX_HISTORY_WALKS_PER_REQUEST.
                     if walks >= MAX_HISTORY_WALKS_PER_REQUEST {
                         continue;
                     }
@@ -270,15 +284,13 @@ pub async fn get_by_cid(
                     // charged. When no key resolves (e.g. a test `oneshot` with no
                     // peer and no trusted header) the limiter is skipped, exactly as
                     // the other IP brakes behave.
+                    if let Some(key) =
+                        crate::rate_limit::client_key(&headers, peer, state.push_limiter_trust)
                     {
-                        if let Some(key) =
-                            crate::rate_limit::client_key(&headers, peer, state.push_limiter_trust)
-                        {
-                            if !state.ipfs_rate_limiter.check(&key).await {
-                                return Err(AppError::TooManyRequests(
-                                    "ipfs retrieval rate limit exceeded — try again later".into(),
-                                ));
-                            }
+                        if !state.ipfs_rate_limiter.check(&key).await {
+                            return Err(AppError::TooManyRequests(
+                                "ipfs retrieval rate limit exceeded — try again later".into(),
+                            ));
                         }
                     }
 
@@ -287,32 +299,32 @@ pub async fn get_by_cid(
                     let is_public = repo.is_public;
                     let owner = repo.owner_did.clone();
                     let caller_for_walk = caller_owned.clone();
-                    // Full-history walk shells out to git — keep it off the async runtime.
-                    // Only the fetched object's type is walked (blob XOR tree), so a tree
-                    // fetch never pays the blob walk and vice-versa.
-                    let walk = tokio::task::spawn_blocking(move || {
-                        if is_blob {
-                            allowed_blob_set_for_caller(
-                                &rp,
-                                &r,
-                                is_public,
-                                &owner,
-                                caller_for_walk.as_deref(),
-                            )
-                        } else {
-                            allowed_tree_set_for_caller(
-                                &rp,
-                                &r,
-                                is_public,
-                                &owner,
-                                caller_for_walk.as_deref(),
-                            )
-                        }
+                    let kind = obj_type.clone();
+                    // Full-history walk shells out to git — keep it off the async
+                    // runtime. Only the fetched object's type is walked.
+                    let walk = tokio::task::spawn_blocking(move || match kind.as_str() {
+                        "blob" => allowed_blob_set_for_caller(
+                            &rp,
+                            &r,
+                            is_public,
+                            &owner,
+                            caller_for_walk.as_deref(),
+                        ),
+                        "tree" => allowed_tree_set_for_caller(
+                            &rp,
+                            &r,
+                            is_public,
+                            &owner,
+                            caller_for_walk.as_deref(),
+                        ),
+                        // commit | tag: caller-independent reachable set.
+                        _ => reachable_commit_tag_oids(&rp),
                     })
                     .await;
                     // Fail closed on EITHER a task panic (JoinError) or a walk error:
-                    // we cannot prove the caller may read here, so skip this repo and
-                    // let a public copy (if any) serve. Never serve on an unproven gate.
+                    // we cannot prove the object is readable here, so skip this repo
+                    // and let a public copy (if any) serve. Never serve on an unproven
+                    // gate.
                     let set = match walk {
                         Ok(Ok(set)) => set,
                         Ok(Err(e)) => {
@@ -326,10 +338,10 @@ pub async fn get_by_cid(
                     };
                     memo.insert(repo.id.clone(), set);
                 }
-                let in_allowed = memo
+                let in_set = memo
                     .get(&repo.id)
                     .is_some_and(|set| set.contains(sha256_hex));
-                if !in_allowed {
+                if !in_set {
                     continue;
                 }
             }
 
@@ -3,9 +3,12 @@
 //! denied. Since #135 a tree is likewise withheld on the CID serve surface
 //! (`GET /ipfs/{cid}`) when every path at which it appears is denied, via the
 //! parallel `allowed_tree_set_for_caller` — so a withheld subtree's structure does
-//! not leak by content address. Commits and tags are never withheld here, and
-//! trees still replicate freely on the pin path (the withheld-tree pin gap is
-//! tracked as #172). Mode B keeps all object SHAs intact; only readability is gated.
+//! not leak by content address. Since #173 a commit or tag is likewise gated on the
+//! CID serve surface: a DANGLING (unreachable) commit/tag is withheld under a
+//! path-scoped rule via `reachable_commit_tag_oids`, so its message/metadata does
+//! not leak by content address; a reachable one still serves. Trees still replicate
+//! freely on the pin path (the withheld-tree pin gap is tracked as #172). Mode B
+//! keeps all object SHAs intact; only readability is gated.
 
 use crate::db::VisibilityRule;
 use crate::git::store;
@@ -161,6 +164,36 @@ fn reachable_commits(repo_path: &Path) -> Result<Vec<String>> {
         .collect())
 }
 
+/// Every reachable commit oid PLUS every annotated-tag OBJECT oid at a ref (#173,
+/// F2). `reachable_commits` (`rev-list --all`) dereferences annotated tags to their
+/// commits, so the tag objects themselves are absent; a CID for a REACHABLE tag
+/// object must still serve, so union the tag-object oids from the refs. A DANGLING
+/// commit/tag (referenced by no ref) is in neither set, so the `/ipfs/{cid}`
+/// resolver denies it under a path-scoped rule instead of leaking its message.
+/// Nested tag-of-tag inner objects are over-denied (safe: availability, not a leak
+/// — the outer ref tag is still served). Fails closed on any git error.
+pub fn reachable_commit_tag_oids(repo_path: &Path) -> Result<HashSet<String>> {
+    let mut set: HashSet<String> = reachable_commits(repo_path)?.into_iter().collect();
+    let out = std::process::Command::new("git")
+        .args(["for-each-ref", "--format=%(objectname) %(objecttype)"])
+        .current_dir(repo_path)
+        .output()
+        .context("git for-each-ref (tag objects) failed")?;
+    if !out.status.success() {
+        anyhow::bail!(
+            "git for-each-ref failed: {}",
+            String::from_utf8_lossy(&out.stderr)
+        );
+    }
+    for line in String::from_utf8_lossy(&out.stdout).lines() {
+        let mut it = line.split_whitespace();
+        if let (Some(oid), Some("tag")) = (it.next(), it.next()) {
+            set.insert(oid.to_string());
+        }
+    }
+    Ok(set)
+}
+
 /// Every `(oid, "/repo/relative/path", kind)` triple reachable from any commit in
 /// `repo_path` — the single walk seam that `blob_paths` (`kind == "blob"`) and
 /// `tree_paths` (`kind == "tree"`) both filter, so the blob and tree visibility