Forge: Disallowing path manipulation attempt

Key takeaways END STATE: you can look at any route`` call that throws and say which of the two causes it is, then fix it — verified by a probe you run locally with no deploy. There is one rule with t