create-ailk 0.10.0 → 0.11.1

package/site-templates/shapes/local-business-service/content/en/Service/second-job.mdx

@@ -11,29 +11,29 @@ schema:
     name: "Your Company"
 ---
 
-# {Second job}
+# \{Second job}
 
-{Open with the situation a reader is in when they come looking for this. Two or
+\{Open with the situation a reader is in when they come looking for this. Two or
 three sentences, no more — the detail belongs under the headings below.}
 
 ## What it covers
 
-- {The first thing you actually do}
-- {The second thing you actually do}
-- {The third thing you actually do}
+- \{The first thing you actually do}
+- \{The second thing you actually do}
+- \{The third thing you actually do}
 
 ## How it runs
 
-{One paragraph on the shape of the visit: how it is scheduled, how long it
+\{One paragraph on the shape of the visit: how it is scheduled, how long it
 takes, who turns up, and what you need from the customer beforehand.}
 
 ## What you end up with
 
-{One paragraph on the result. Be concrete — describe the property when the
+\{One paragraph on the result. Be concrete — describe the property when the
 crew drives away.}
 
 ## What it costs
 
-{One line on the pricing shape — flat rate, hourly, or by the job — and what it
+\{One line on the pricing shape — flat rate, hourly, or by the job — and what it
 excludes. Replace with your real numbers, or delete this section and let a
 call do it.}

package/site-templates/shapes/local-business-service/content/en/Service/third-job.mdx

@@ -11,29 +11,29 @@ schema:
     name: "Your Company"
 ---
 
-# {Third job}
+# \{Third job}
 
-{Open with the situation a reader is in when they come looking for this. Two or
+\{Open with the situation a reader is in when they come looking for this. Two or
 three sentences, no more — the detail belongs under the headings below.}
 
 ## What it covers
 
-- {The first thing you actually do}
-- {The second thing you actually do}
-- {The third thing you actually do}
+- \{The first thing you actually do}
+- \{The second thing you actually do}
+- \{The third thing you actually do}
 
 ## How it runs
 
-{One paragraph on the shape of the visit: how it is scheduled, how long it
+\{One paragraph on the shape of the visit: how it is scheduled, how long it
 takes, who turns up, and what you need from the customer beforehand.}
 
 ## What you end up with
 
-{One paragraph on the result. Be concrete — describe the property when the
+\{One paragraph on the result. Be concrete — describe the property when the
 crew drives away.}
 
 ## What it costs
 
-{One line on the pricing shape — flat rate, hourly, or by the job — and what it
+\{One line on the pricing shape — flat rate, hourly, or by the job — and what it
 excludes. Replace with your real numbers, or delete this section and let a
 call do it.}

package/site-templates/shapes/organization-service/content/en/Service/first-engagement.mdx

@@ -10,29 +10,29 @@ schema:
     name: "Your Company"
 ---
 
-# {First engagement}
+# \{First engagement}
 
-{Open with the situation a reader is in when they come looking for this. Two or
+\{Open with the situation a reader is in when they come looking for this. Two or
 three sentences, no more — the detail belongs under the headings below.}
 
 ## What it covers
 
-- {The first thing you actually do}
-- {The second thing you actually do}
-- {The third thing you actually do}
+- \{The first thing you actually do}
+- \{The second thing you actually do}
+- \{The third thing you actually do}
 
 ## How it runs
 
-{One paragraph on the shape of the engagement: how it starts, how long it runs,
+\{One paragraph on the shape of the engagement: how it starts, how long it runs,
 who is involved on both sides, and what a week looks like.}
 
 ## What you end up with
 
-{One paragraph on the deliverable. Be concrete — name the artefact, not the
+\{One paragraph on the deliverable. Be concrete — name the artefact, not the
 feeling.}
 
 ## What it costs
 
-{One line on the pricing shape — fixed fee, retainer, day rate — and what it
+\{One line on the pricing shape — fixed fee, retainer, day rate — and what it
 excludes. Replace with your real numbers, or delete this section and let the
 call do it.}

package/site-templates/shapes/organization-service/content/en/Service/second-engagement.mdx

@@ -10,29 +10,29 @@ schema:
     name: "Your Company"
 ---
 
-# {Second engagement}
+# \{Second engagement}
 
-{Open with the situation a reader is in when they come looking for this. Two or
+\{Open with the situation a reader is in when they come looking for this. Two or
 three sentences, no more — the detail belongs under the headings below.}
 
 ## What it covers
 
-- {The first thing you actually do}
-- {The second thing you actually do}
-- {The third thing you actually do}
+- \{The first thing you actually do}
+- \{The second thing you actually do}
+- \{The third thing you actually do}
 
 ## How it runs
 
-{One paragraph on the shape of the engagement: how it starts, how long it runs,
+\{One paragraph on the shape of the engagement: how it starts, how long it runs,
 who is involved on both sides, and what a week looks like.}
 
 ## What you end up with
 
-{One paragraph on the deliverable. Be concrete — name the artefact, not the
+\{One paragraph on the deliverable. Be concrete — name the artefact, not the
 feeling.}
 
 ## What it costs
 
-{One line on the pricing shape — fixed fee, retainer, day rate — and what it
+\{One line on the pricing shape — fixed fee, retainer, day rate — and what it
 excludes. Replace with your real numbers, or delete this section and let the
 call do it.}

package/site-templates/shapes/organization-service/content/en/Service/third-engagement.mdx

@@ -10,29 +10,29 @@ schema:
     name: "Your Company"
 ---
 
-# {Third engagement}
+# \{Third engagement}
 
-{Open with the situation a reader is in when they come looking for this. Two or
+\{Open with the situation a reader is in when they come looking for this. Two or
 three sentences, no more — the detail belongs under the headings below.}
 
 ## What it covers
 
-- {The first thing you actually do}
-- {The second thing you actually do}
-- {The third thing you actually do}
+- \{The first thing you actually do}
+- \{The second thing you actually do}
+- \{The third thing you actually do}
 
 ## How it runs
 
-{One paragraph on the shape of the engagement: how it starts, how long it runs,
+\{One paragraph on the shape of the engagement: how it starts, how long it runs,
 who is involved on both sides, and what a week looks like.}
 
 ## What you end up with
 
-{One paragraph on the deliverable. Be concrete — name the artefact, not the
+\{One paragraph on the deliverable. Be concrete — name the artefact, not the
 feeling.}
 
 ## What it costs
 
-{One line on the pricing shape — fixed fee, retainer, day rate — and what it
+\{One line on the pricing shape — fixed fee, retainer, day rate — and what it
 excludes. Replace with your real numbers, or delete this section and let the
 call do it.}

package/site-templates/shapes/person-service/content/en/Service/first-engagement.mdx

@@ -10,29 +10,29 @@ schema:
     name: "Your Name"
 ---
 
-# {First engagement}
+# \{First engagement}
 
-{Open with the situation a reader is in when they come looking for this. Two or
+\{Open with the situation a reader is in when they come looking for this. Two or
 three sentences, no more — the detail belongs under the headings below.}
 
 ## What it covers
 
-- {The first thing you actually do}
-- {The second thing you actually do}
-- {The third thing you actually do}
+- \{The first thing you actually do}
+- \{The second thing you actually do}
+- \{The third thing you actually do}
 
 ## How it runs
 
-{One paragraph on the shape of the engagement: how it starts, how long it runs,
+\{One paragraph on the shape of the engagement: how it starts, how long it runs,
 who is involved, and what a week looks like.}
 
 ## What you end up with
 
-{One paragraph on the deliverable. Be concrete — name the artefact, not the
+\{One paragraph on the deliverable. Be concrete — name the artefact, not the
 feeling.}
 
 ## What it costs
 
-{One line on the pricing shape — fixed fee, retainer, day rate — and what it
+\{One line on the pricing shape — fixed fee, retainer, day rate — and what it
 excludes. Replace with your real numbers, or delete this section and let the
 call do it.}

package/site-templates/shapes/person-service/content/en/Service/second-engagement.mdx

@@ -10,29 +10,29 @@ schema:
     name: "Your Name"
 ---
 
-# {Second engagement}
+# \{Second engagement}
 
-{Open with the situation a reader is in when they come looking for this. Two or
+\{Open with the situation a reader is in when they come looking for this. Two or
 three sentences, no more — the detail belongs under the headings below.}
 
 ## What it covers
 
-- {The first thing you actually do}
-- {The second thing you actually do}
-- {The third thing you actually do}
+- \{The first thing you actually do}
+- \{The second thing you actually do}
+- \{The third thing you actually do}
 
 ## How it runs
 
-{One paragraph on the shape of the engagement: how it starts, how long it runs,
+\{One paragraph on the shape of the engagement: how it starts, how long it runs,
 who is involved, and what a week looks like.}
 
 ## What you end up with
 
-{One paragraph on the deliverable. Be concrete — name the artefact, not the
+\{One paragraph on the deliverable. Be concrete — name the artefact, not the
 feeling.}
 
 ## What it costs
 
-{One line on the pricing shape — fixed fee, retainer, day rate — and what it
+\{One line on the pricing shape — fixed fee, retainer, day rate — and what it
 excludes. Replace with your real numbers, or delete this section and let the
 call do it.}

package/site-templates/shapes/person-service/content/en/Service/third-engagement.mdx

@@ -10,29 +10,29 @@ schema:
     name: "Your Name"
 ---
 
-# {Third engagement}
+# \{Third engagement}
 
-{Open with the situation a reader is in when they come looking for this. Two or
+\{Open with the situation a reader is in when they come looking for this. Two or
 three sentences, no more — the detail belongs under the headings below.}
 
 ## What it covers
 
-- {The first thing you actually do}
-- {The second thing you actually do}
-- {The third thing you actually do}
+- \{The first thing you actually do}
+- \{The second thing you actually do}
+- \{The third thing you actually do}
 
 ## How it runs
 
-{One paragraph on the shape of the engagement: how it starts, how long it runs,
+\{One paragraph on the shape of the engagement: how it starts, how long it runs,
 who is involved, and what a week looks like.}
 
 ## What you end up with
 
-{One paragraph on the deliverable. Be concrete — name the artefact, not the
+\{One paragraph on the deliverable. Be concrete — name the artefact, not the
 feeling.}
 
 ## What it costs
 
-{One line on the pricing shape — fixed fee, retainer, day rate — and what it
+\{One line on the pricing shape — fixed fee, retainer, day rate — and what it
 excludes. Replace with your real numbers, or delete this section and let the
 call do it.}

package/templates/.claude/settings.json

@@ -11,5 +11,17 @@
         ]
       }
     ]
+  },
+  "extraKnownMarketplaces": {
+    "working-theory": {
+      "source": {
+        "source": "github",
+        "repo": "working-theory-labs/claude-plugins"
+      },
+      "autoUpdate": true
+    }
+  },
+  "enabledPlugins": {
+    "ailk@working-theory": true
   }
 }

package/templates/.env.example

@@ -50,10 +50,6 @@ CONTENT_ADAPTER=mdx
 # Developers → Webhooks → <your endpoint> → Signing secret.
 # Format: whsec_*. Server-only — must NOT be prefixed with NEXT_PUBLIC_.
 # STRIPE_WEBHOOK_SECRET=
-# Internal URL of the billing service — used by marketing-api's webhook
-# proxy (POST /v1/webhooks/stripe) to forward verified deliveries. Format:
-# https://<vercel-deployment>.vercel.app (no trailing slash, no path).
-# BILLING_SERVICE_URL=
 
 # ── Auth (Better Auth — apps/web only) ───────────────────────────────────────
 # BETTER_AUTH_URL=http://localhost:3000
@@ -314,7 +310,7 @@ CONTENT_ADAPTER=mdx
 # AILK_LICENSE_KEY=
 # Override the daily refresh upstream (self-hosters point at their own server
 # implementing the @working-theory/validation refresh contract).
-# Default: https://ailaunchkit.ai/api/license/refresh
+# Default: https://api.ailaunchkit.ai/v1/licenses/refresh
 # AILK_LICENSE_REFRESH_URL=
 # Self-host override — replaces the bundled public key with a PEM-encoded one.
 # Only set this if you operate your own license-signing infrastructure.

package/templates/CLAUDE.md

@@ -21,7 +21,7 @@ apps/api/         Fastify HTTP API — lead capture, checkout, webhooks
 apps/mcp/         MCP server — agent-callable tools
 database/         Prisma schema + migrations
 content/          Site settings (_site.mdx) and MDX pages (en/<TypeName>/)
-.claude/          Rules, skills and agent definitions for Claude Code
+.claude/          Rules, the agent definition and settings for Claude Code
 tools/            This repo's own checks (architecture, CLAUDE.md drift)
 ```
 
@@ -67,7 +67,7 @@ your module set; `pnpm architecture` enforces it, and a hook in
 | Diff hygiene when editing existing files       | `.claude/rules/preserve-existing-style.md`                                                         |
 | Code style, testing, security                  | `CONVENTIONS.md`                                                                                   |
 | Environment variables and what they unlock     | `.env.example`                                                                                     |
-| Deploy configuration                           | `apps/api/vercel.json`; the `setup-deploy` skill                                                   |
+| Deploy configuration                           | `apps/api/vercel.json`; the `/ailk:setup-deploy` skill                                             |
 | Verification before push                       | `pnpm preflight` (see § Checks)                                                                    |
 
 <!-- /ailk:template id="resource-map" -->
@@ -76,18 +76,34 @@ your module set; `pnpm architecture` enforces it, and a hook in
 
 ## Skills
 
-In `.claude/skills/`; Claude Code finds them at session start.
+The AI Launch Kit skills come from the `ailk` Claude Code plugin, not from
+this repo. `.claude/settings.json` names its marketplace and enables it, so
+Claude Code loads it once you trust this folder. To install it by hand, run
+these two lines in a Claude Code session:
 
-| Skill            | Use when                                                          |
-| ---------------- | ----------------------------------------------------------------- |
-| `add-page`       | You need a new page, or extra JSON-LD on an existing one          |
-| `update-page`    | A page should live at a different URL, or needs a new title       |
-| `fill-page`      | A page still carries `{placeholder}` copy                         |
-| `check-site`     | You want the site's citation-readiness score and findings         |
-| `setup-database` | Leads should land in a database inbox at `/leads`                 |
-| `setup-deploy`   | You are ready to deploy to Vercel                                 |
-| `add-auth`       | Visitors need to sign in (email, Google, GitHub)                  |
-| `upgrade-plan`   | You are weighing Free against a paid level or the commerce add-on |
+```
+/plugin marketplace add working-theory-labs/claude-plugins
+/plugin install ailk@working-theory
+```
+
+| Skill                  | Use when                                                          |
+| ---------------------- | ----------------------------------------------------------------- |
+| `/ailk:add-page`       | You need a new page, or extra JSON-LD on an existing one          |
+| `/ailk:update-page`    | A page should live at a different URL, or needs a new title       |
+| `/ailk:fill-page`      | A page still carries `{placeholder}` copy                         |
+| `/ailk:check-site`     | You want the site's citation-readiness score and findings         |
+| `/ailk:setup-database` | Leads should land in a database inbox at `/leads`                 |
+| `/ailk:setup-deploy`   | You are ready to deploy to Vercel                                 |
+| `/ailk:add-auth`       | Visitors need to sign in (email, Google, GitHub)                  |
+| `/ailk:upgrade-plan`   | You are weighing Free against a paid level or the commerce add-on |
+
+A repo scaffolded by an earlier create-ailk also carries its own older
+copies of these skills. Once the plugin is installed, delete those copies;
+keep scaffold-commerce, which the commerce module delivers.
+
+For design work, the third-party impeccable plugin is optional:
+`/plugin marketplace add pbakaus/impeccable`, then
+`/plugin install impeccable@impeccable`.
 
 <!-- /ailk:template id="skills" -->
 
@@ -95,15 +111,15 @@ In `.claude/skills/`; Claude Code finds them at session start.
 
 ## Checks
 
-| Command                | Catches                                                  |
-| ---------------------- | -------------------------------------------------------- |
-| `pnpm preflight`       | The next four and `build`, not `test`. Run before a push |
-| `pnpm architecture`    | An import that crosses a boundary in `architecture.yaml` |
-| `pnpm claude-md:check` | A hand-edit inside a template-owned section of this file |
-| `pnpm type-check`      | Type errors in every workspace                           |
-| `pnpm lint`            | Lint errors in every workspace                           |
-| `pnpm test`            | Failing unit tests                                       |
-| `check-site` skill     | Missing or invalid JSON-LD, weak citation-readiness      |
+| Command                  | Catches                                                  |
+| ------------------------ | -------------------------------------------------------- |
+| `pnpm preflight`         | The next four and `build`, not `test`. Run before a push |
+| `pnpm architecture`      | An import that crosses a boundary in `architecture.yaml` |
+| `pnpm claude-md:check`   | A hand-edit inside a template-owned section of this file |
+| `pnpm type-check`        | Type errors in every workspace                           |
+| `pnpm lint`              | Lint errors in every workspace                           |
+| `pnpm test`              | Failing unit tests                                       |
+| `/ailk:check-site` skill | Missing or invalid JSON-LD, weak citation-readiness      |
 
 <!-- /ailk:template id="checks" -->
 

package/templates/README.md

@@ -73,7 +73,7 @@ A page marked `--shape organization-product` is in your site when you scaffolded
 
 To customize the home page, edit [`content/en/HomePage/home.mdx`](./content/en/HomePage/home.mdx). Save and reload the dev server. No build step.
 
-To add a new page, ask Claude Code to run the `add-page` skill — it writes the page's content file and nav link in one confirm-before-write pass, and adds a missing route with `create-ailk add-route` first. See [Skills](#skills).
+To add a new page, ask Claude Code to run the `/ailk:add-page` skill — it writes the page's content file and nav link in one confirm-before-write pass, and adds a missing route with `create-ailk add-route` first. See [Skills](#skills).
 
 > `content/_site.mdx` stays at the top level (not under `content/en/`) — site identity is locale-blind.
 
@@ -200,20 +200,20 @@ Change the ranges by hand. Below 1.0 a caret range (`^0.26.0`) never crosses a m
 
 ## Skills
 
-This project ships Claude Code skills in `.claude/skills/`. Claude Code discovers them at session start — ask for one by name.
+The AI Launch Kit skills come from the `ailk` Claude Code plugin; `.claude/settings.json` names it, and CLAUDE.md § Skills has the two install lines.
 
 <!-- generated:begin skills -->
 
-| Skill            | What it does                                                                                                                                                                                                                       |
-| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `add-page`       | Add a page this site can serve — its content file, structured data and nav link — adding a missing route with `create-ailk add-route` first. Also documents the `schema:` frontmatter override for any page.                       |
-| `update-page`    | Rename a page — give it a new URL and/or a new title — in one plan-then-confirm pass: its content files, its own route folder, exact internal links and the manifest row move together, and the old URL gets a permanent redirect. |
-| `add-auth`       | Activate auth providers — magic-link via Resend, Google OAuth, GitHub OAuth.                                                                                                                                                       |
-| `setup-deploy`   | Emit deploy configuration — `vercel.json`, `.env.example`, and `RUNBOOK.md` — for a Vercel deploy. Asks where leads go (email or a database) and warns when neither is set.                                                        |
-| `setup-database` | Take the site from no database to a working lead inbox: provision Postgres, create the tables, pin the owner, and verify one test message lands in `/leads`.                                                                       |
-| `check-site`     | Run `ailk-audit --json` and explain the score and findings in plain language.                                                                                                                                                      |
-| `fill-page`      | Fill one page's section content from a category profile: labelled sample content (tier 1) or your own first draft from a short intake (tier 2).                                                                                    |
-| `upgrade-plan`   | Compare Free, Pro, Pro Plus, Agency and the commerce add-on side by side, with the prices the public pricing page publishes right now, and recommend one option for this site with a reason.                                       |
+| Skill                  | What it does                                                                                                                            |
+| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
+| `/ailk:add-auth`       | Activate the site's sign-in providers (email-and-password, Google OAuth, GitHub OAuth) and write the env vars for the ones you pick.    |
+| `/ailk:add-page`       | Add a new page — its content file, its structured data and its nav link — in one confirm-before-write pass.                             |
+| `/ailk:check-site`     | Run `ailk-audit` on the site and explain the score and findings in plain language. It never edits files.                                |
+| `/ailk:fill-page`      | Fill one existing page's section content from a category profile: labelled sample content, or your own first draft from a short intake. |
+| `/ailk:setup-database` | Take the site from no database to a working lead inbox, and prove it with one test message that must appear in the inbox.               |
+| `/ailk:setup-deploy`   | Emit deploy configuration — `vercel.json` and `RUNBOOK.md`, plus an env checklist read from the site's own `.env.example`.              |
+| `/ailk:update-page`    | Rename a page — its URL, its title, or both — in one plan-then-confirm pass, with a permanent redirect from the old URL.                |
+| `/ailk:upgrade-plan`   | Explain the AI Launch Kit options side by side, recommend one option for this site, and link the public pricing page for prices.        |
 
 <!-- generated:end -->
 

package/templates/apps/api/jest.config.cjs

@@ -64,6 +64,7 @@ module.exports = {
     '^@working-theory/schema-pack-registry$': '<rootDir>/../../packages/schema-pack-registry/src/index.ts',
     '^@working-theory/schema-validator$': '<rootDir>/../../packages/schema-validator/src/index.ts',
     '^@working-theory/stripe-client$': '<rootDir>/../../packages/stripe-client/src/index.ts',
+    '^@working-theory/metadata$': '<rootDir>/../../packages/metadata/src/index.ts',
     '^@working-theory/validation$': '<rootDir>/../../packages/validation/src/index.ts',
     '^(\\.{1,2}/.*)\\.js$': '$1',
   },

package/templates/apps/api/package.json

@@ -49,7 +49,7 @@
     "@working-theory/stripe-client": "workspace:*",
     "@working-theory/validation": "workspace:*",
     "dotenv": "^17.4.2",
-    "fastify": "^5.12.1",
+    "fastify": "^5.12.5",
     "pdf-lib": "^1.17.1",
     "pg": "^8.22.0",
     "yaml": "^2.9.0",
@@ -60,6 +60,7 @@
     "@types/node": "^22.20.0",
     "@types/pg": "^8.20.0",
     "@vercel/node": "^5.8.22",
+    "@working-theory/metadata": "workspace:*",
     "jest": "^30.4.2",
     "pdfjs-dist": "^6.3.289",
     "prisma": "^7.8.0",

package/templates/apps/mcp/CLAUDE.md

@@ -25,8 +25,8 @@ Every tool maps 1:1 to an `apps/api` endpoint. When you change a tool, change th
 **Read (9):** `list_pages`, `read_content`, `search_content`, `get_site_info`, `get_business_hours`, `get_locations`, `get_offerings`, `get_pricing`, `get_faq`
 **Conversion-write (3):** `capture_lead`, `subscribe_newsletter`, `request_callback`
 **Maintenance (2):** `audit`, `create_project`
-**Flow (2):** `get_flow`, `submit_flow_step` — module-gated (`module: "signal-collectors"`, D-48, #5366): identity-blind and free of any `requirePaidTier()` call like every tool in this list, but registered only when the signal-collectors module is present, the same shape Booking below already has
-**Booking (3):** `list_availability`, `get_event_meta`, `create_booking` — module-gated (`module: "scheduling"`)
+**Flow (2):** `get_flow`, `submit_flow_step` — module-gated (`module: "signal-collectors"`, D-48, #5366) and licence-feature-tagged (`feature: "flows-deliverables"`, #7136): identity-blind like every tool in this list, registered only when the signal-collectors module is present, and gated on the deployment's `flows-deliverables` licence feature under `MCP_FEATURE_GATE_MODE`, the same shape Booking below has
+**Booking (3):** `list_availability`, `get_event_meta`, `create_booking` — module-gated (`module: "scheduling"`) and licence-feature-tagged (`feature: "scheduling"`, #7136), gated on the deployment's `scheduling` licence feature under `MCP_FEATURE_GATE_MODE`
 
 ### Why the parity test counts 20 and a keyless server registers 19
 
@@ -41,11 +41,21 @@ Every tool maps 1:1 to an `apps/api` endpoint. When you change a tool, change th
   `addon: "commerce"`, so it is the one entry whose presence depends on the
   licence — 19 without the claim, 20 with it.
 - **19 free anonymous tools**: since #5853 retired the three content-write
-  tools, NO registered tool is gated at call time by `requirePaidTier()`, so
-  every registered tool is free and anonymous. The five carrying `tier: "pro"`
+  tools, every registered tool remains anonymous — call-time gating checks a
+  licence claim, never an identity. The five carrying `tier: "pro"`
   (`get_flow`, `submit_flow_step`, `list_availability`, `get_event_meta`,
-  `create_booking`) are MODULE-gated at registration, not payment-gated at
-  call time — the shape the Flow and Booking rows above describe.
+  `create_booking`) are gated at REGISTRATION **and at call time** (#7315):
+  each needs its module, and each catalog row names the licence `feature:`
+  that entitles it. `start_purchase` is gated at call time by both this
+  server-wide gate and its own Gate 2 in `tools/purchase.ts`.
+  `MCP_FEATURE_GATE_MODE` (`packages/metadata`) decides what an unheld
+  feature does. In `"warn"` mode (this release) the five register on module
+  presence alone, and `index.ts` logs one boot warning (stderr) per tool
+  served without its feature. In `"refuse"` mode (the next release) they
+  also need the deployment's licence to hold the feature, and
+  `/.well-known/mcp.json` drops them in step. The claim is resolved at boot
+  and re-read every `MCP_CLAIM_REFRESH_MS` through `checkLicense()`
+  (`lib/commerce-claim.ts`) and fails closed.
   `index.ts` is the transport entry point and exports no tools — registration
   is entirely via `createMcpServer`.
 
@@ -69,7 +79,8 @@ Every tool maps 1:1 to an `apps/api` endpoint. When you change a tool, change th
   `commerce` licence claim, per its `addon: "commerce"` catalog marker. A
   keyless site advertises it in neither the discovery manifest nor the running
   server's tool list, and calling it by name there returns the module-disabled
-  `not_found` body. The claim is resolved once at boot
+  `not_found` body. The claim is resolved at boot and re-read every
+  `MCP_CLAIM_REFRESH_MS`
   (`src/lib/commerce-claim.ts`, awaited in `src/index.ts`) and read
   synchronously by both the registration filter and the handler's own
   re-check. Calls are rate-limited per IP by the AbuseGuard
@@ -111,14 +122,16 @@ Example (lead routing):
 ## What NOT to do
 
 - Don't add identity arguments to OSS tools.
-- Don't expose a Pro tool without its `requirePaidTier()` gate.
+- Don't add a paid tool without a `feature:` marker on its catalog row — registration and the manifest gate on the deployment's claim, never on a caller-supplied key or argument.
 - Don't import `@working-theory/*` from `apps/mcp`.
 - Don't add a tool without the matching `apps/api` endpoint.
 - Don't put business logic in tool handlers — they're adapters.
 
-Last updated: 2026-09-17 — #5971: `start_purchase` re-enabled behind the `commerce` licence claim. `OSS_DISABLED_TOOLS` is now empty; the registered count is 19 on a keyless deployment and 20 on a commerce-claimed one; the tool's input field is `productCode` (was `priceId`), matching its HTTP twin; a per-IP daily cap (`MCP_ABUSE_START_PURCHASE_DAILY_CAP`) covers it.
+Last updated: 2026-09-29 — #7136: the five `tier: "pro"` tools name their licence `feature:` (`scheduling`, `flows-deliverables`) and gate on the deployment's own claim under `MCP_FEATURE_GATE_MODE` — `"warn"` this release (served, one boot warning each), `"refuse"` the next. The unused call-time paid-tier guard is deleted.
 
-Prior: 2026-07-09 — corrected the tool-count explanation (18 catalog → 17 registered → 14 free anonymous) and the Pro-tool gating (registered + `requirePaidTier()`-gated, not `OSS_DISABLED_TOOLS`-disabled).
+Prior: 2026-09-17 — #5971: `start_purchase` re-enabled behind the `commerce` licence claim. `OSS_DISABLED_TOOLS` is now empty; the registered count is 19 on a keyless deployment and 20 on a commerce-claimed one; the tool's input field is `productCode` (was `priceId`), matching its HTTP twin; a per-IP daily cap (`MCP_ABUSE_START_PURCHASE_DAILY_CAP`) covers it.
+
+Prior: 2026-07-09 — corrected the tool-count explanation (18 catalog → 17 registered → 14 free anonymous) and the Pro-tool gating (registered + gated by the call-time paid-tier guard, not `OSS_DISABLED_TOOLS`-disabled).
 
 Last updated: 2026-09-17 — doc-sync: tool counts "23 catalog → 22 registered → 19 free anonymous" → "20 in TOOLS → 19 registered → 19 free anonymous", and the Pro-tools section rewritten to record that `create_page`/`update_page`/`delete_page` were RETIRED by #5853 rather than disabled (D7) — derived from `packages/metadata/src/mcp-tool-catalog.ts` and verified against `apps/mcp/src/server.ts`.