thumbgate 1.27.18 → 1.27.20

package/src/api/server.js

@@ -3,6 +3,7 @@ const http = require('http');
 const https = require('https');
 const fs = require('fs');
 const path = require('path');
+const crypto = require('node:crypto');
 const { EventEmitter } = require('node:events');
 const pkg = require('../../package.json');
 const {
@@ -19,7 +20,7 @@ const POSTHOG_STATIC_PATH_PREFIX = '/static/';
 // Stripe catalog, with the per-tier thumbnails wired in. Re-run the
 // bootstrap workflow to regenerate; the new URLs surface in the workflow
 // summary log.
-const FIRST_FAILURE_RULE_CHECKOUT_URL = 'https://buy.stripe.com/fZu28rfCY6zcbO99uj3sI2G';
+const FIRST_FAILURE_RULE_CHECKOUT_URL = 'https://buy.stripe.com/7sY6oHaiEbTw6tP5e33sI3e';
 const QUICK_READ_CHECKOUT_URL = 'https://buy.stripe.com/5kQ7sL76s1eSaK55e33sI2H';
 const WORKFLOW_TEARDOWN_CHECKOUT_URL = 'https://buy.stripe.com/8x214n2Qc4r44lHayn3sI2I';
 const SPRINT_DIAGNOSTIC_CHECKOUT_URL = 'https://buy.stripe.com/28E00j3Uge1E2dzgWL3sI2J';
@@ -96,6 +97,9 @@ const {
 const {
   recordCheckoutFunnelEvent,
 } = require('../../scripts/plausible-server-events');
+const {
+  resolvePlausibleDataDomain,
+} = require('../../scripts/plausible-domain-config');
 const {
   buildCloudflareSandboxPlan,
 } = require('../../scripts/cloudflare-dynamic-sandbox');
@@ -165,7 +169,16 @@ const {
   buildReviewSnapshot,
   readDashboardReviewState,
   writeDashboardReviewState,
+  collectAllFeedbackEntries,
 } = require('../../scripts/dashboard');
+const {
+  collectAggregateLogEntries,
+  computeAggregateFeedbackStats,
+  shouldAggregateFeedback,
+} = require('../../scripts/feedback-aggregate');
+const {
+  guardDfcxWebhook,
+} = require('../../adapters/gcp/dfcx-webhook-gate');
 const {
   buildDashboardRenderSpec,
 } = require('../../scripts/dashboard-render-spec');
@@ -199,6 +212,12 @@ const {
 } = require('../../scripts/rate-limiter');
 const { sendProblem, PROBLEM_TYPES } = require('../../scripts/problem-detail');
 const { TOOLS: MCP_TOOLS } = require('../../scripts/tool-registry');
+const mcpOauth = require('../../scripts/mcp-oauth');
+// OAuth 2.1 (PKCE) authorization-server state for the remote MCP connector
+// (Claude Connectors Directory requires OAuth for authenticated services).
+const oauthStore = mcpOauth.createStore();
+const pendingOauthAuthorizeRequests = new Map();
+const OAUTH_AUTHORIZE_REQUEST_TTL_MS = 10 * 60 * 1000;
 const resendMailer = require('../../scripts/mailer/resend-mailer');
 const {
   buildContextFootprintReport,
@@ -214,17 +233,26 @@ const PRO_PAGE_PATH = path.resolve(__dirname, '../../public/pro.html');
 const DASHBOARD_PAGE_PATH = path.resolve(__dirname, '../../public/dashboard.html');
 const LESSONS_PAGE_PATH = path.resolve(__dirname, '../../public/lessons.html');
 const GUIDE_PAGE_PATH = path.resolve(__dirname, '../../public/guide.html');
+const CHATGPT_APP_PAGE_PATH = path.resolve(__dirname, '../../public/chatgpt-app.html');
 const CODEX_PLUGIN_PAGE_PATH = path.resolve(__dirname, '../../public/codex-plugin.html');
 const COMPARE_PAGE_PATH = path.resolve(__dirname, '../../public/compare.html');
 const LEARN_PAGE_PATH = path.resolve(__dirname, '../../public/learn.html');
 const NUMBERS_PAGE_PATH = path.resolve(__dirname, '../../public/numbers.html');
 const FEDERAL_PAGE_PATH = path.resolve(__dirname, '../../public/federal.html');
+const PRICING_PAGE_PATH = path.resolve(__dirname, '../../public/pricing.html');
+const ABOUT_PAGE_PATH = path.resolve(__dirname, '../../public/about.html');
+const DIAGNOSTIC_PAGE_PATH = path.resolve(__dirname, '../../public/diagnostic.html');
+const INSTALL_PAGE_PATH = path.resolve(__dirname, '../../public/install.html');
 const LEARN_DIR = path.resolve(__dirname, '../../public/learn');
 const GUIDES_DIR = path.resolve(__dirname, '../../public/guides');
 const COMPARE_DIR = path.resolve(__dirname, '../../public/compare');
 const USE_CASES_DIR = path.resolve(__dirname, '../../public/use-cases');
 const PUBLIC_DIR = path.resolve(__dirname, '../../public');
 const PUBLIC_ASSETS_DIR = path.resolve(__dirname, '../../public/assets');
+const LEARN_PAGE_PATHS_BY_SLUG = buildPublicHtmlFileMap(LEARN_DIR);
+const GUIDE_PAGE_PATHS_BY_SLUG = buildPublicHtmlFileMap(GUIDES_DIR);
+const COMPARE_PAGE_PATHS_BY_SLUG = buildPublicHtmlFileMap(COMPARE_DIR);
+const USE_CASE_PAGE_PATHS_BY_SLUG = buildPublicHtmlFileMap(USE_CASES_DIR);
 const BUYER_INTENT_SCRIPT_PATH = path.resolve(__dirname, '../../public/js/buyer-intent.js');
 const STATIC_MIME_BY_EXT = Object.freeze({
   '.png': 'image/png',
@@ -343,6 +371,7 @@ function serveStaticFile(res, filePath, { headOnly = false, cacheSeconds = 86400
   res.setHeader('Content-Type', contentType);
   res.setHeader('Content-Length', stat.size);
   res.setHeader('Cache-Control', `public, max-age=${cacheSeconds}, immutable`);
+  res.setHeader('Referrer-Policy', 'same-origin');
   if (headOnly) {
     res.end();
     return;
@@ -413,27 +442,75 @@ const TRACKED_LINK_TARGETS = Object.freeze({
     },
     allowCustomerEmail: true,
   },
-  // 2026-05-12: Aiventyx marketplace listing routes its Teams clicks through
-  // /go/teams (best-performing listing at ~62% CTR). Without this slug the
-  // server returned 404 + "Tracked link not found". Every Aiventyx Teams
-  // click between the URL swap and this deploy landed on that error page.
-  // Destination: 3-seat Team self-serve Stripe checkout (the path I shipped
-  // in PR #1877 — plan_id=team + seat_count=3 = $147/mo entry).
+  // 2026-06-02: Teams/Aiventyx deprecated. Redirect legacy links to Pro.
   teams: {
+    path: '/go/pro?utm_source=legacy_teams&utm_medium=redirect',
+    ctaId: 'go_pro',
+    ctaPlacement: 'link_router',
+    eventType: 'cta_click',
+  },
+  team: {
+    path: '/go/pro?utm_source=legacy_teams&utm_medium=redirect',
+    ctaId: 'go_pro',
+    ctaPlacement: 'link_router',
+    eventType: 'cta_click',
+  },
+  checkout: {
     path: '/checkout/pro',
-    ctaId: 'go_teams',
+    ctaId: 'go_checkout',
     ctaPlacement: 'link_router',
     eventType: 'cta_click',
     defaults: {
       utm_source: 'website',
       utm_medium: 'link_router',
-      utm_campaign: 'team_self_serve',
-      plan_id: 'team',
-      seat_count: '3',
+      utm_campaign: 'pro_upgrade',
+      plan_id: 'pro',
       billing_cycle: 'monthly',
     },
     allowCustomerEmail: true,
   },
+  diagnostic: {
+    configUrlKey: 'sprintDiagnosticCheckoutUrl',
+    fallbackHref: SPRINT_DIAGNOSTIC_CHECKOUT_URL,
+    external: true,
+    ctaId: 'go_diagnostic',
+    ctaPlacement: 'link_router',
+    eventType: 'cta_click',
+    defaults: {
+      utm_source: 'website',
+      utm_medium: 'link_router',
+      utm_campaign: 'sprint_diagnostic',
+      plan_id: 'sprint_diagnostic',
+    },
+    allowCustomerEmail: true,
+  },
+  sprint: {
+    configUrlKey: 'workflowSprintCheckoutUrl',
+    fallbackHref: WORKFLOW_SPRINT_CHECKOUT_URL,
+    external: true,
+    ctaId: 'go_sprint',
+    ctaPlacement: 'link_router',
+    eventType: 'cta_click',
+    defaults: {
+      utm_source: 'website',
+      utm_medium: 'link_router',
+      utm_campaign: 'workflow_sprint',
+      plan_id: 'workflow_sprint',
+    },
+    allowCustomerEmail: true,
+  },
+  trial: {
+    path: '/guide',
+    ctaId: 'go_trial',
+    ctaPlacement: 'link_router',
+    eventType: 'trial_start_click',
+    defaults: {
+      utm_source: 'website',
+      utm_medium: 'link_router',
+      utm_campaign: 'trial_start',
+      plan_id: 'free_trial',
+    },
+  },
   install: {
     path: '/guide',
     ctaId: 'go_install',
@@ -648,6 +725,51 @@ function resolveRequestProjectDir(req, parsed) {
   });
 }
 
+function debugApiFallback(label, error) {
+  if (process.env.THUMBGATE_DEBUG_API !== '1') return;
+  console.warn(`[api] ${label}: ${error?.message || String(error)}`);
+}
+
+function stripEnvQuotes(value) {
+  return String(value || '').trim().replace(/^["']|["']$/g, '');
+}
+
+function extractEnvValue(content, names) {
+  const pattern = new RegExp(`^(?:${names.join('|')})=(.*)$`, 'm');
+  const match = pattern.exec(content);
+  return match ? stripEnvQuotes(match[1]) : '';
+}
+
+function readProjectChatSettings(req, parsed) {
+  const settings = {
+    geminiKey: '',
+    perplexityKey: '',
+    localEndpoint: '',
+    localModel: '',
+    geminiValidatedAt: null,
+  };
+  try {
+    const projectDir = resolveRequestProjectDir(req, parsed);
+    const envPath = path.join(projectDir, '.env');
+    if (fs.existsSync(envPath)) {
+      const content = fs.readFileSync(envPath, 'utf8');
+      settings.geminiKey = extractEnvValue(content, ['GEMINI_API_KEY', 'GOOGLE_API_KEY', 'THUMBGATE_GEMINI_API_KEY']);
+      settings.perplexityKey = extractEnvValue(content, ['PERPLEXITY_API_KEY', 'THUMBGATE_PERPLEXITY_API_KEY']);
+      settings.localEndpoint = extractEnvValue(content, ['THUMBGATE_LOCAL_LLM_ENDPOINT']);
+      settings.localModel = extractEnvValue(content, ['THUMBGATE_LOCAL_LLM_MODEL']);
+    }
+
+    const statusPath = path.join(projectDir, '.gemini-validated.json');
+    if (fs.existsSync(statusPath)) {
+      const status = JSON.parse(fs.readFileSync(statusPath, 'utf8'));
+      settings.geminiValidatedAt = status.validatedAt || null;
+    }
+  } catch (error) {
+    debugApiFallback('project chat settings unavailable', error);
+  }
+  return settings;
+}
+
 function shouldPreferProjectScopedFeedback(req, parsed) {
   const explicitProject = getEffectiveRequestedProjectSelection(req, parsed);
   if (explicitProject) return true;
@@ -713,16 +835,23 @@ function updateLessonRecord(feedbackDir, lessonId, updater) {
 function getPublicMcpTools() {
   return MCP_TOOLS.map((tool) => ({
     name: tool.name,
+    ...(tool.title ? { title: tool.title } : {}),
     description: tool.description,
     inputSchema: tool.inputSchema,
+    // Serve the tool-registry annotations (readOnlyHint/destructiveHint). Required
+    // by the Claude Connectors Directory (missing annotations = the #1 rejection
+    // cause) and used by MCP clients for permission prompts. Was being dropped here.
+    ...(tool.annotations ? { annotations: tool.annotations } : {}),
   }));
 }
 
 function getServerCardTools() {
   return MCP_TOOLS.map((tool) => ({
     name: tool.name,
+    ...(tool.title ? { title: tool.title } : {}),
     description: tool.description,
     inputSchema: tool.inputSchema,
+    ...(tool.annotations ? { annotations: tool.annotations } : {}),
   }));
 }
 
@@ -762,7 +891,7 @@ function getMcpSkillManifests(hostedConfig) {
         'Inspect prevention_rules after repeats.',
       ],
       installCommand: 'npx thumbgate init',
-      contextUrl: buildPublicUrl(hostedConfig, '/public/llm-context.md'),
+      contextUrl: buildPublicUrl(hostedConfig, '/llm-context.md'),
       proofUrl: VERIFICATION_EVIDENCE_URL,
     },
     {
@@ -789,7 +918,7 @@ function getMcpSkillManifests(hostedConfig) {
         'Evaluate NDCG@10 on visual hard negatives.',
         'Require artifact links before using retrieved evidence in claims.',
       ],
-      contextUrl: buildPublicUrl(hostedConfig, '/public/llm-context.md'),
+      contextUrl: buildPublicUrl(hostedConfig, '/llm-context.md'),
       proofUrl: VERIFICATION_EVIDENCE_URL,
     },
     {
@@ -803,7 +932,7 @@ function getMcpSkillManifests(hostedConfig) {
         'Compact feedback context with anchors for proof-critical lessons.',
         'Record estimated token savings next to the workflow evidence.',
       ],
-      contextUrl: buildPublicUrl(hostedConfig, '/public/llm-context.md'),
+      contextUrl: buildPublicUrl(hostedConfig, '/llm-context.md'),
       footprintUrl: buildPublicUrl(hostedConfig, '/.well-known/mcp/footprint.json'),
       proofUrl: VERIFICATION_EVIDENCE_URL,
     },
@@ -818,7 +947,7 @@ function getMcpSkillManifests(hostedConfig) {
         'Require baseline evals before adding autonomy or subagents.',
         'Classify tool risk before allowing writes, money movement, production changes, or outbound actions.',
       ],
-      contextUrl: buildPublicUrl(hostedConfig, '/public/llm-context.md'),
+      contextUrl: buildPublicUrl(hostedConfig, '/llm-context.md'),
       proofUrl: VERIFICATION_EVIDENCE_URL,
     },
     {
@@ -832,7 +961,7 @@ function getMcpSkillManifests(hostedConfig) {
         'Grade goal inference separately from intervention timing.',
         'Block multi-app proactive writes until rollback and orchestration evidence exists.',
       ],
-      contextUrl: buildPublicUrl(hostedConfig, '/public/llm-context.md'),
+      contextUrl: buildPublicUrl(hostedConfig, '/llm-context.md'),
       proofUrl: VERIFICATION_EVIDENCE_URL,
     },
     {
@@ -846,7 +975,7 @@ function getMcpSkillManifests(hostedConfig) {
         'Map every proxy metric to the real user objective.',
         'Require holdout or regression proof before treating benchmark gains as product gains.',
       ],
-      contextUrl: buildPublicUrl(hostedConfig, '/public/llm-context.md'),
+      contextUrl: buildPublicUrl(hostedConfig, '/llm-context.md'),
       proofUrl: VERIFICATION_EVIDENCE_URL,
     },
     {
@@ -860,7 +989,7 @@ function getMcpSkillManifests(hostedConfig) {
         'Reproduce locally before claiming a fix.',
         'Open one focused PR with tests, proof, and transparent ThumbGate context only when relevant.',
       ],
-      contextUrl: buildPublicUrl(hostedConfig, '/public/llm-context.md'),
+      contextUrl: buildPublicUrl(hostedConfig, '/llm-context.md'),
       proofUrl: VERIFICATION_EVIDENCE_URL,
     },
     {
@@ -874,7 +1003,7 @@ function getMcpSkillManifests(hostedConfig) {
         'Route self-serve intent to the guide and team pain to Workflow Hardening Sprint intake.',
         'Block unsupported ad and landing-page claims before spend scales.',
       ],
-      contextUrl: buildPublicUrl(hostedConfig, '/public/llm-context.md'),
+      contextUrl: buildPublicUrl(hostedConfig, '/llm-context.md'),
       proofUrl: VERIFICATION_EVIDENCE_URL,
     },
   ];
@@ -1008,7 +1137,7 @@ function getMcpDiscoveryManifest(hostedConfig) {
     footprint: getContextFootprintReport(hostedConfig),
     proof: {
       verificationEvidenceUrl: VERIFICATION_EVIDENCE_URL,
-      llmContextUrl: buildPublicUrl(hostedConfig, '/public/llm-context.md'),
+      llmContextUrl: buildPublicUrl(hostedConfig, '/llm-context.md'),
     },
   };
 }
@@ -1418,8 +1547,450 @@ async function loadLiveDashboardDataOrRespondProblem(res, parsed, feedbackDir, i
   }
 }
 
-function buildLossAnalyticsResponse(data, summaryOptions) {
+function buildEnterpriseDataChatStatus(env = process.env) {
+  const vertexProject = normalizeNullableText(env.VERTEX_PROJECT_ID)
+    || normalizeNullableText(env.GOOGLE_VERTEX_PROJECT);
+  const vertexLocation = normalizeNullableText(env.GOOGLE_VERTEX_LOCATION)
+    || normalizeNullableText(env.VERTEX_LOCATION)
+    || 'us-central1';
+  const dfcxFulfillmentUrl = normalizeNullableText(env.THUMBGATE_DFCX_FULFILLMENT_URL);
+  const dfcxAgentId = normalizeNullableText(env.THUMBGATE_DFCX_AGENT_ID);
+  const dfcxLocation = normalizeNullableText(env.THUMBGATE_DFCX_LOCATION);
+
+  return {
+    mode: 'local-dashboard',
+    vertex: {
+      configured: Boolean(vertexProject),
+      projectId: vertexProject,
+      location: vertexLocation,
+      providerMode: normalizeNullableText(env.THUMBGATE_PROVIDER_MODE) || null,
+    },
+    dfcx: {
+      apiSurface: 'Dialogflow CX REST API: projects.locations.agents',
+      liveAgentConfigured: Boolean(dfcxAgentId && dfcxLocation),
+      agentId: dfcxAgentId,
+      location: dfcxLocation,
+      fulfillmentProxyConfigured: Boolean(dfcxFulfillmentUrl),
+      fulfillmentUrlConfigured: Boolean(dfcxFulfillmentUrl),
+      gcloudCxCommandSupported: false,
+      verification: dfcxAgentId && dfcxLocation
+        ? 'Agent metadata is present in env; verify via REST/console before production claims.'
+        : 'No live DFCX agent env configured. Use REST/console/deployed webhook evidence before claiming a live agent.',
+    },
+    chat: {
+      available: true,
+      source: 'local ThumbGate dashboard data with LanceDB-backed retrieval',
+      guard: 'local data-access guard; DFCX adapter optional for customer Dialogflow deployments',
+      providerRequired: false,
+      localLlmEndpointConfigured: Boolean(normalizeNullableText(env.THUMBGATE_LOCAL_LLM_ENDPOINT)),
+    },
+  };
+}
+
+const buildEnterpriseDialogflowStatus = buildEnterpriseDataChatStatus;
+
+function normalizeEnterpriseChatPrompt(value) {
+  const text = normalizeNullableText(value);
+  if (!text) return null;
+  return text.slice(0, 800);
+}
+
+function classifyEnterpriseChatTopic(prompt) {
+  const lower = String(prompt || '').toLowerCase();
+  // Feedback-specific words run FIRST: "what mistakes were blocked today" is a
+  // feedback question, not a gates question — must not be hijacked by /block/.
+  if (/mistake|lesson|memory|feedback|thumb|negative|positive|what (?:went )?wrong|fail|win|success|worked|good/.test(lower)) return 'feedback';
+  if (/gate|block|deny|prevent|guard|enforce/.test(lower)) return 'gates';
+  if (/team|agent|org|enterprise|rollout/.test(lower)) return 'team';
+  if (/token|cost|saving|budget|spend/.test(lower)) return 'cost';
+  if (/vertex|gcp|google|dialogflow|dfcx|cloud/.test(lower)) return 'cloud';
+  return 'overview';
+}
+
+// Parse intent: LIST vs COUNT, and time window. Lets us answer "what mistakes
+// today?" with an actual filtered list instead of a canned total.
+function parseChatIntent(prompt) {
+  const lower = String(prompt || '').toLowerCase();
+  const terms = new Set(lower.split(/[^a-z0-9]+/).filter(Boolean));
+  const hasTerm = (term) => terms.has(term);
+  const wantsList = lower.includes('tell me about') ||
+    ['what', 'which', 'list', 'show', 'example', 'examples'].some(hasTerm);
+  let windowMs = null;
+  let windowLabel = 'across all time';
+  if (/\btoday\b/.test(lower)) { windowMs = 24 * 60 * 60 * 1000; windowLabel = 'today'; }
+  else if (/\byesterday\b/.test(lower)) { windowMs = 48 * 60 * 60 * 1000; windowLabel = 'yesterday'; }
+  else if (/\bthis week\b|\b7 ?d(ay)?s?\b|\blast week\b/.test(lower)) { windowMs = 7 * 24 * 60 * 60 * 1000; windowLabel = 'the last 7 days'; }
+  else if (/\bthis month\b|\b30 ?d(ay)?s?\b|\blast month\b/.test(lower)) { windowMs = 30 * 24 * 60 * 60 * 1000; windowLabel = 'the last 30 days'; }
+  return { wantsList, windowMs, windowLabel };
+}
+
+// Read recent feedback entries (signal-filtered, time-filtered) directly from
+// the feedback log. Bounded + best-effort — never throws into the chat handler.
+// Treat short/placeholder context values as "no real description" so we don't
+// surface `"thumbs down"` × 3 as a useful list. Real feedback always has a
+// concrete sentence somewhere (whatWentWrong, distillation, whatToChange) —
+// pick the longest informative one.
+// Short tokens that mean "no real description" — kept as a plain Set, not a
+// big regex, to keep complexity low and easy to extend.
+const PLACEHOLDER_TOKENS = new Set([
+  'thumbs down', 'thumbs up', 'thumb down', 'thumb up',
+  'good', 'bad', 'ok', 'nice', 'verify', 'verifies', 'verification', 'test', 'testing',
+]);
+
+function isPlaceholder(text) {
+  const t = String(text || '').trim();
+  if (!t || t.length < 20) return true;
+  return PLACEHOLDER_TOKENS.has(t.toLowerCase().replace(/\.$/, ''));
+}
+
+function bestFeedbackDescription(row) {
+  const candidates = [row.whatWentWrong, row.distillation, row.context, row.whatToChange, row.whatWorked, row.reasoning]
+    .map((c) => String(c || '').trim());
+  // Prefer the longest non-placeholder candidate; fall back to any non-empty.
+  const informative = candidates.filter((c) => c && !isPlaceholder(c));
+  const fallback = candidates.find(Boolean) || '';
+  const best = informative.reduce((a, b) => (b.length > a.length ? b : a), '') || fallback;
+  return best.slice(0, 220);
+}
+
+function readRecentFeedbackEntries(feedbackDir, signal, windowMs, limit = 5, opts = {}) {
+  try {
+    if (!feedbackDir) return [];
+    const rows = shouldAggregateFeedback()
+      ? collectAggregateLogEntries('feedback-log.jsonl', { feedbackDir }).entries
+      : (() => {
+          const fsLocal = require('node:fs');
+          const pathLocal = require('node:path');
+          const logPath = pathLocal.join(feedbackDir, 'feedback-log.jsonl');
+          if (!fsLocal.existsSync(logPath)) return [];
+          const { readJsonl } = require('../../scripts/fs-utils');
+          return readJsonl(logPath) || [];
+        })();
+    const cutoff = windowMs ? Date.now() - windowMs : 0;
+    const filtered = rows
+      .filter((r) => !signal || r.signal === signal)
+      .filter((r) => {
+        if (!cutoff) return true;
+        const t = r.timestamp ? Date.parse(r.timestamp) : Number.NaN;
+        return Number.isFinite(t) && t >= cutoff;
+      })
+      .reverse()
+      .map((r) => {
+        const out = {
+          timestamp: r.timestamp,
+          context: bestFeedbackDescription(r),
+          tags: Array.isArray(r.tags) ? r.tags : []
+        };
+        if (opts.includeSignal) out.signal = r.signal;
+        return out;
+      });
+    // For list display, drop entries with no real description so the list is useful,
+    // not three "thumbs down" placeholders. For count-only (high limit), keep all.
+    const useful = opts.skipPlaceholders === false || limit > 50
+      ? filtered
+      : filtered.filter((e) => e.context && !isPlaceholder(e.context));
+    return useful.slice(0, limit);
+  } catch {
+    return [];
+  }
+}
+
+function containsUnsafeEnterpriseChatInput(prompt) {
+  return /[;&|`$<>\\]/.test(String(prompt || ''));
+}
+
+function compactNumber(value) {
+  const n = Number(value || 0);
+  return Number.isFinite(n) ? n : 0;
+}
+
+// Pick a signal preference from the prompt. Returns 'negative' | 'positive' | null.
+function detectFeedbackSignalFromPrompt(prompt) {
+  const lower = String(prompt || '').toLowerCase();
+  const wantsNeg = /mistake|wrong|fail|negative|thumbs? *down|block/.test(lower);
+  const wantsPos = /positive|thumbs? *up|worked|success|wins?\b|good/.test(lower);
+  if (wantsNeg && !wantsPos) return 'negative';
+  if (wantsPos && !wantsNeg) return 'positive';
+  return null;
+}
+
+const FEEDBACK_LIST_LABELS = Object.freeze({
+  negative: 'Recent mistakes',
+  positive: 'Recent wins',
+});
+
+const FEEDBACK_OMITTED_TAGS = Object.freeze(['audit-trail', 'auto-capture']);
+
+function formatChatTimestamp(isoString) {
+  if (!isoString) return 'unknown time';
+  try {
+    const d = new Date(isoString);
+    if (Number.isNaN(d.getTime())) return isoString;
+    const pad = (n) => String(n).padStart(2, '0');
+    const yyyy = d.getFullYear();
+    const mm = pad(d.getMonth() + 1);
+    const dd = pad(d.getDate());
+    const hh = pad(d.getHours());
+    const min = pad(d.getMinutes());
+    const ss = pad(d.getSeconds());
+    return `${yyyy}-${mm}-${dd} ${hh}:${min}:${ss}`;
+  } catch {
+    return isoString;
+  }
+}
+
+function buildFeedbackEntries(windowed, signal) {
+  return (signal ? windowed.filter((r) => r.signal === signal) : windowed)
+    .filter((r) => r.context && !isPlaceholder(r.context))
+    .slice(0, 5);
+}
+
+function formatFeedbackEntry(entry) {
+  const tsFormatted = formatChatTimestamp(entry.timestamp);
+  const signalLabel = entry.signal ? ` [${entry.signal}]` : '';
+  const tagsList = Array.isArray(entry.tags)
+    ? entry.tags.filter((tag) => !FEEDBACK_OMITTED_TAGS.includes(tag))
+    : [];
+  const tagsStr = tagsList.length ? ` (${tagsList.join(', ')})` : '';
+  return `  • ${tsFormatted}${signalLabel}${tagsStr} — ${entry.context}`;
+}
+
+function appendFeedbackListLines(lines, { entries, signal, intent }) {
+  if (!entries.length) {
+    lines.push(`No ${signal || 'feedback'} entries found ${intent.windowLabel}.`);
+    return;
+  }
+  lines.push(`${FEEDBACK_LIST_LABELS[signal] || 'Recent feedback'} (${intent.windowLabel}):`);
+  lines.push(...entries.map(formatFeedbackEntry));
+}
+
+function buildFeedbackSection({ ctx, intent, feedbackDir, approval, lessonPipeline }) {
+  const signal = detectFeedbackSignalFromPrompt(ctx.prompt);
+  // One read of the time-windowed log, then in-memory counts + (signal-filtered,
+  // placeholder-stripped) list. Counts include ALL entries (so "Feedback today: 5"
+  // matches the dashboard tile); the list drops vague entries like literal "thumbs
+  // down" / "good" so it surfaces only entries with real, actionable description.
+  const windowed = readRecentFeedbackEntries(feedbackDir, null, intent.windowMs, 10000, { includeSignal: true });
+  const windowPos = windowed.filter((r) => r.signal === 'positive').length;
+  const windowNeg = windowed.filter((r) => r.signal === 'negative').length;
+  const entries = buildFeedbackEntries(windowed, signal);
+
+  const lines = [
+    intent.windowMs
+    ? `Feedback ${intent.windowLabel}: ${windowed.length} (${windowPos} positive, ${windowNeg} negative).`
+    : `Feedback total: ${compactNumber(approval.total)} (${compactNumber(approval.positive)} positive, ${compactNumber(approval.negative)} negative).`,
+  ];
+
+  if (intent.wantsList) {
+    appendFeedbackListLines(lines, { entries, signal, intent });
+  } else {
+    lines.push(`Lesson pipeline: ${compactNumber(lessonPipeline.lessons || lessonPipeline.generated || 0)} lessons visible in the current dashboard snapshot.`);
+  }
+  return { lines, sources: ['feedback log', intent.wantsList ? 'feedback contexts' : 'lesson pipeline'] };
+}
+
+const GATE_EVENTS_REGEX = /activat|fired|trigger|block|denied|prevent|enforce|hit/;
+
+function describeGate(g) {
+  return `${g.name || g.id || 'unnamed'}${g.severity ? ' [' + g.severity + ']' : ''}`;
+}
+
+function buildGatesSection({ ctx, intent, gates, gateStats }) {
+  const asksEvents = GATE_EVENTS_REGEX.test(String(ctx.prompt || '').toLowerCase());
+  const totalActive = gates.length || compactNumber(gateStats.totalGates);
+  const totalBlocked = compactNumber(gateStats.blocked || gateStats.denied || gateStats.totalBlocked);
+
+  const lines = [];
+  if (asksEvents) {
+    lines.push(`Blocked actions recorded (all time): ${totalBlocked}.`);
+    if (intent.windowMs) {
+      lines.push(`(Per-${intent.windowLabel} block-event breakdown isn't tracked in the local dashboard snapshot — only the running total. Filter the gate-events log directly for a precise window.)`);
+    }
+  } else {
+    lines.push(`Active gates: ${totalActive}.`);
+  }
+  if (intent.wantsList && gates.length) {
+    lines.push('Active gates:');
+    for (const g of gates.slice(0, 8)) lines.push(`  • ${describeGate(g)}`);
+  } else if (gates[0] && !intent.wantsList) {
+    lines.push(`Example gate: ${describeGate(gates[0])}.`);
+  }
+  return { lines, sources: ['gate stats'] };
+}
+
+function buildEnterpriseChatSection(topic, dashboardData, status, ctx = {}) {
+  const approval = dashboardData.approval || {};
+  const gates = Array.isArray(dashboardData.gates) ? dashboardData.gates : [];
+  const gateStats = dashboardData.gateStats || {};
+  const team = dashboardData.team || {};
+  const tokenSavings = dashboardData.tokenSavings || {};
+  const lessonPipeline = dashboardData.lessonPipeline || {};
+  const intent = ctx.intent || { wantsList: false, windowMs: null, windowLabel: 'across all time' };
+  const feedbackDir = ctx.feedbackDir || null;
+
+  if (topic === 'feedback') {
+    return buildFeedbackSection({ ctx, intent, feedbackDir, approval, lessonPipeline });
+  }
+  if (topic === 'gates') {
+    return buildGatesSection({ ctx, intent, gates, gateStats });
+  }
+  if (topic === 'team') {
+    return {
+      lines: [
+        'Team dashboard is available in this local Enterprise view.',
+        `Tracked agents: ${compactNumber(team.totalAgents || team.agentCount || 0)}; risky agents: ${compactNumber(team.riskyAgents || team.highRiskAgents || 0)}.`,
+      ],
+      sources: ['team dashboard'],
+    };
+  }
+  if (topic === 'cost') {
+    return {
+      lines: [
+        `Estimated token savings: ${tokenSavings.dollarsSavedDisplay || '$0.00'} from ${compactNumber(tokenSavings.blockedCalls)} blocked calls.`,
+        'Google Cloud budget alerts are evidence for spend visibility; ThumbGate-side stop conditions must be verified separately before calling them a hard cap.',
+      ],
+      sources: ['token savings', 'budget posture'],
+    };
+  }
+  if (topic === 'cloud') {
+    const vertexLine = status.vertex.configured
+      ? `Vertex routing config is present for project ${status.vertex.projectId} (${status.vertex.location}).`
+      : 'Vertex routing config is not present in this server environment.';
+    const dfcxLine = status.dfcx.liveAgentConfigured
+      ? `DFCX env has agent ${status.dfcx.agentId} in ${status.dfcx.location}; verify it with REST/console before production claims.`
+      : 'No live DFCX agent is configured in env. Do not use the old alpha gcloud CX command group; verify agents with the Dialogflow CX REST API or console.';
+    return {
+      lines: [vertexLine, dfcxLine],
+      sources: ['enterprise cloud status'],
+    };
+  }
+  return {
+    lines: [
+      'Ask about feedback, lessons, active gates, team rollout, token savings, or Vertex/DFCX readiness.',
+      `Current local snapshot: ${compactNumber(approval.total)} feedback events and ${gates.length || compactNumber(gateStats.totalGates)} active gates.`,
+    ],
+    sources: [],
+  };
+}
+
+function buildEnterpriseChatAnswer(prompt, dashboardData, status, opts = {}) {
+  const topic = classifyEnterpriseChatTopic(prompt);
+  const intent = parseChatIntent(prompt);
+  const section = buildEnterpriseChatSection(topic, dashboardData, status, {
+    intent,
+    feedbackDir: opts.feedbackDir,
+    prompt,
+  });
+
+  // List-style answers want newlines; single-line answers join with space.
+  const hasList = section.lines.some((l) => /^\s*•/.test(l));
+  const answer = hasList ? section.lines.join('\n') : section.lines.join(' ');
+
+  return {
+    topic,
+    answer,
+    sources: ['local dashboard data', ...section.sources],
+  };
+}
+
+// Answer the dashboard "Chat with your data" panel LOCALLY (deterministic, no
+// cloud/LLM) from this install's own per-project dashboard data. Returns true if
+// it sent a response; false if the local snapshot was unavailable (caller then
+// falls through). Shared by the local-first path and the no-model fallback.
+async function trySendLocalDashboardChat(res, parsed, feedbackDir, prompt, suffix) {
+  try {
+    const dashboardResult = await buildLiveDashboardData(parsed, feedbackDir);
+    const localChat = buildEnterpriseChatAnswer(
+      prompt,
+      dashboardResult.data,
+      buildEnterpriseDataChatStatus(),
+      { feedbackDir },
+    );
+    sendJson(res, 200, {
+      ok: true,
+      answer: suffix ? `${localChat.answer} ${suffix}` : localChat.answer,
+      sources: (localChat.sources || []).map((title) => ({ title })),
+      topic: localChat.topic,
+      provider: 'local-data',
+      llm: 'none',
+      grounded: true,
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function answerEnterpriseDataChat({ prompt, feedbackDir, parsed }) {
+  const normalizedPrompt = normalizeEnterpriseChatPrompt(prompt);
+  if (!normalizedPrompt) {
+    throw createHttpError(400, 'prompt is required');
+  }
+  const status = buildEnterpriseDataChatStatus();
+  if (containsUnsafeEnterpriseChatInput(normalizedPrompt)) {
+    return {
+      ok: false,
+      blocked: true,
+      answer: 'This prompt contains unsafe control characters and was blocked before data access.',
+      status,
+      dfcx: {
+        blocked: true,
+        evaluation: {
+          allowed: false,
+          gate: 'enterprise-chat-unsafe-input',
+          severity: 'critical',
+        },
+      },
+      sources: ['enterprise input guard'],
+    };
+  }
+
+  const dashboardResult = await buildLiveDashboardData(parsed, feedbackDir);
+  const dashboardData = dashboardResult.data;
+
+  // This guarded stats endpoint stays deterministic for API compatibility.
+  // The dashboard's real local/open-source chatbot turn goes through /v1/chat,
+  // which uses lesson retrieval + optional LanceDB vector search + the user's
+  // configured local or BYO model.
+  const chat = buildEnterpriseChatAnswer(normalizedPrompt, dashboardData, status, { feedbackDir });
+  const dfcxRequest = {
+    fulfillmentInfo: { tag: 'chat-with-data' },
+    sessionInfo: {
+      session: 'local-dashboard/enterprise-chat',
+      parameters: {
+        topic: chat.topic,
+        prompt_key: normalizedPrompt.toLowerCase().replace(/[^a-z0-9._ -]/g, '').slice(0, 64),
+      },
+    },
+    languageCode: 'en',
+  };
+  const guarded = await guardDfcxWebhook(
+    dfcxRequest,
+    async () => ({
+      fulfillment_response: { messages: [{ text: { text: [chat.answer] } }] },
+      session_info: { parameters: { thumbgate_topic: chat.topic } },
+    }),
+    { blockOnRepeat: false },
+  );
+
   return {
+    ok: !guarded.blocked,
+    blocked: Boolean(guarded.blocked),
+    answer: guarded.blocked ? 'ThumbGate blocked this enterprise chat turn before data access.' : chat.answer,
+    status,
+    dfcx: {
+      blocked: Boolean(guarded.blocked),
+      evaluation: guarded.evaluation,
+      response: guarded.response,
+    },
+    sources: chat.sources,
+  };
+}
+
+const answerEnterpriseDialogflowChat = answerEnterpriseDataChat;
+
+function buildLossAnalyticsResponse(data, summaryOptions) {
+  return sanitizeHtmlUnsafeJsonValue({
     window: data.analytics.window || summaryOptions,
     lossAnalysis: data.analytics.lossAnalysis || null,
     buyerLoss: data.analytics.buyerLoss || null,
@@ -1431,13 +2002,50 @@ function buildLossAnalyticsResponse(data, summaryOptions) {
       ctas: data.analytics.telemetry && data.analytics.telemetry.ctas,
       visitors: data.analytics.telemetry && data.analytics.telemetry.visitors,
     },
-  };
+  });
 }
 
 function createJourneyId(prefix) {
   return createTraceId(prefix).replace(/^trace_/, `${prefix}_`);
 }
 
+function normalizeCheckoutInterstitialSampleRate(value) {
+  const parsed = Number.parseFloat(String(value || '').trim());
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return 0;
+  }
+  if (parsed > 1) {
+    return Math.min(parsed / 100, 1);
+  }
+  return Math.min(parsed, 1);
+}
+
+function stableUnitInterval(value) {
+  const text = String(value || '');
+  let hash = 2166136261;
+  for (const character of text) {
+    hash ^= character.codePointAt(0);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0) / 4294967296;
+}
+
+function shouldSampleCheckoutInterstitial({ sampleRate, traceId, analyticsMetadata }) {
+  if (sampleRate <= 0) {
+    return false;
+  }
+  if (sampleRate >= 1) {
+    return true;
+  }
+  const seed = [
+    analyticsMetadata?.visitorId,
+    analyticsMetadata?.sessionId,
+    analyticsMetadata?.acquisitionId,
+    traceId,
+  ].filter(Boolean).join(':');
+  return stableUnitInterval(seed || traceId) < sampleRate;
+}
+
 function appendQueryParam(url, key, value) {
   const normalized = normalizeNullableText(value);
   if (normalized) {
@@ -1497,63 +2105,294 @@ function buildCheckoutIntentHref(baseUrl, metadata = {}, overrides = {}) {
   });
 }
 
-function renderCheckoutIntentPage({
-  confirmHref,
-  workflowIntakeHref,
-}) {
-  const safeConfirmHref = escapeHtmlAttribute(confirmHref);
-  const safeWorkflowIntakeHref = escapeHtmlAttribute(workflowIntakeHref);
-  return `<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Confirm — ThumbGate Pro</title><style>body{background:#0a0a0a;color:#eee;font-family:system-ui,-apple-system,sans-serif;line-height:1.5}main{max-width:520px;margin:8vh auto;padding:0 20px}.brand{display:flex;align-items:center;gap:10px;margin-bottom:24px;font-size:14px;color:#94a3b8}.brand-mark{width:24px;height:24px;background:#22d3ee;border-radius:6px;display:inline-block}h1{font-size:24px;margin:0 0 8px;color:#fff}.price{font-size:32px;font-weight:700;color:#22d3ee;margin:8px 0 4px}.price small{font-size:14px;color:#94a3b8;font-weight:400}p{color:#cbd5e1;margin:8px 0}a{display:block;text-decoration:none}a.primary{background:#22d3ee;color:#000;padding:16px;text-align:center;border-radius:8px;font-weight:700;font-size:16px;margin:20px 0 10px}a.secondary{border:1px solid #374151;color:#cbd5e1;padding:12px;text-align:center;border-radius:8px;margin:8px 0 0;font-size:14px}.trust{margin:24px 0;padding:16px;border:1px solid #1f2937;border-radius:8px;background:#0f172a}.trust-item{font-size:13px;color:#cbd5e1;padding:4px 0;display:flex;gap:8px}.trust-item::before{content:"✓";color:#22d3ee;font-weight:700}.choice-note{font-size:13px;color:#94a3b8;margin-top:14px}.back{text-align:center;color:#64748b;font-size:12px;margin-top:24px}.back a{color:#64748b;display:inline}</style><main><div class="brand"><span class="brand-mark"></span><span>ThumbGate</span></div><h1>Start ThumbGate Pro</h1><div class="price">$19<small>/mo</small></div><p>The npm package runs your gates locally. <strong>Pro</strong> is what keeps them working across every machine, every agent runtime, and every breaking-change week.</p><a class="primary" data-i="pro_checkout_confirmed" rel="nofollow noindex" href="${safeConfirmHref}">Pay $19/mo with Stripe →</a><a class="secondary" data-i="workflow_sprint_intake" href="${safeWorkflowIntakeHref}">Not sure yet? Send the workflow first</a><p class="choice-note">Cancel anytime. 7-day refund, no questions. Diagnostics and sprints have their own pages.</p><div class="trust"><div class="trust-item">Lessons synced across all your machines — no local SQLite to babysit</div><div class="trust-item">Adapter matrix kept current for Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode — version drift is our problem, not yours</div><div class="trust-item">Hosted dashboard: gate stats, DPO export, org-wide rule library</div><div class="trust-item">24×7 ops on the rule engine — SonarCloud regressions fixed in &lt;24h</div></div><p class="back"><a href="/">← Back to thumbgate.ai</a></p></main><script>addEventListener('click',e=>{let a=e.target.closest('[data-i]');if(a&&navigator.sendBeacon)navigator.sendBeacon('/v1/telemetry/ping',new Blob([JSON.stringify({eventType:'checkout_interstitial_cta_clicked',clientType:'web',page:'/checkout/pro',ctaId:a.dataset.i,ctaPlacement:'checkout_interstitial'})],{type:'application/json'}))})</script></html>`;
-}
+const CHECKOUT_HIDDEN_ATTRIBUTION_KEYS = Object.freeze([
+  'trace_id',
+  'acquisition_id',
+  'visitor_id',
+  'session_id',
+  'visitor_session_id',
+  'install_id',
+  'utm_source',
+  'utm_medium',
+  'utm_campaign',
+  'utm_content',
+  'utm_term',
+  'creator',
+  'community',
+  'post_id',
+  'comment_id',
+  'campaign_variant',
+  'offer_code',
+  'cta_id',
+  'cta_placement',
+  'plan_id',
+  'billing_cycle',
+  'seat_count',
+  'landing_path',
+  'referrer_host',
+]);
 
-function buildCheckoutBootstrapBody(parsed, req, journeyState = resolveJourneyState(req, parsed)) {
-  const params = parsed.searchParams;
-  const traceId = pickFirstText(params.get('trace_id')) || createJourneyId('checkout');
-  const planId = normalizePlanId(pickFirstText(params.get('plan_id'), 'pro'));
-  const billingCycle = normalizeBillingCycle(pickFirstText(params.get('billing_cycle'), 'monthly'));
-  const seatCount = planId === 'team'
-    ? normalizeSeatCount(pickFirstText(params.get('seat_count')))
-    : 1;
-  return {
-    traceId,
-    installId: pickFirstText(params.get('install_id')),
-    acquisitionId: journeyState.acquisitionId,
-    visitorId: journeyState.visitorId,
-    sessionId: journeyState.sessionId,
-    customerEmail: pickFirstText(params.get('customer_email')),
-    source: pickFirstText(params.get('source'), params.get('utm_source'), 'website'),
-    utmSource: pickFirstText(params.get('utm_source'), params.get('source'), 'website'),
-    utmMedium: pickFirstText(params.get('utm_medium'), 'cta_button'),
-    utmCampaign: pickFirstText(params.get('utm_campaign'), 'pro_pack'),
-    utmContent: pickFirstText(params.get('utm_content')),
-    utmTerm: pickFirstText(params.get('utm_term')),
-    creator: pickFirstText(params.get('creator'), params.get('creator_handle')),
-    community: pickFirstText(params.get('community'), params.get('subreddit')),
-    postId: pickFirstText(params.get('post_id')),
-    commentId: pickFirstText(params.get('comment_id')),
-    campaignVariant: pickFirstText(params.get('campaign_variant')),
-    offerCode: pickFirstText(params.get('offer_code')),
-    landingPath: pickFirstText(params.get('landing_path'), req.headers.referer ? '/' : '/'),
-    referrerHost: pickFirstText(params.get('referrer_host')),
-    ctaId: pickFirstText(params.get('cta_id'), 'pricing_pro'),
-    ctaPlacement: pickFirstText(params.get('cta_placement'), 'pricing'),
-    planId,
-    billingCycle,
-    seatCount,
-    metadata: {
-      referrer: pickFirstText(params.get('referrer'), req.headers.referer, req.headers.referrer),
-      landingPath: pickFirstText(params.get('landing_path'), '/'),
-      referrerHost: pickFirstText(params.get('referrer_host')),
-    },
-  };
+function normalizeHiddenAttributionValue(value) {
+  const normalized = normalizeNullableText(value);
+  if (!normalized) return '';
+  return normalized.slice(0, 512);
 }
 
-function buildCheckoutConfirmHref(parsed) {
-  const confirmUrl = new URL('/checkout/pro', 'https://thumbgate.invalid');
-  confirmUrl.searchParams.set('confirm', '1');
-  for (const [key, value] of parsed.searchParams.entries()) {
-    if (key === 'confirm') continue;
-    confirmUrl.searchParams.append(key, value);
+function buildCheckoutHiddenAttributionInputs(parsed = null) {
+  if (!parsed?.searchParams) return '';
+
+  const inputs = [];
+  for (const key of CHECKOUT_HIDDEN_ATTRIBUTION_KEYS) {
+    const value = normalizeHiddenAttributionValue(parsed.searchParams.get(key));
+    if (value) {
+      inputs.push(`<input type="hidden" name="${key}" value="${escapeHtmlAttribute(value)}">`);
+    }
+  }
+  return inputs.join('');
+}
+
+function prunePendingOauthAuthorizeRequests(now = Date.now()) {
+  for (const [token, entry] of pendingOauthAuthorizeRequests.entries()) {
+    if (!entry || entry.expiresAt <= now) {
+      pendingOauthAuthorizeRequests.delete(token);
+    }
+  }
+}
+
+function createPendingOauthAuthorizeRequest(params, now = Date.now()) {
+  prunePendingOauthAuthorizeRequests(now);
+  const token = crypto.randomBytes(32).toString('base64url');
+  pendingOauthAuthorizeRequests.set(token, {
+    params,
+    expiresAt: now + OAUTH_AUTHORIZE_REQUEST_TTL_MS,
+  });
+  return token;
+}
+
+function consumePendingOauthAuthorizeRequest(token, now = Date.now()) {
+  if (!token) return null;
+  prunePendingOauthAuthorizeRequests(now);
+  const entry = pendingOauthAuthorizeRequests.get(token);
+  if (!entry) return null;
+  pendingOauthAuthorizeRequests.delete(token);
+  return entry.params;
+}
+
+function getOauthAuthorizeParamsFromQuery(searchParams) {
+  return {
+    clientId: searchParams.get('client_id') || '',
+    redirectUri: searchParams.get('redirect_uri') || '',
+    codeChallenge: searchParams.get('code_challenge') || '',
+    codeChallengeMethod: searchParams.get('code_challenge_method') || '',
+    scope: searchParams.get('scope') || undefined,
+    state: searchParams.get('state') || '',
+    resource: searchParams.get('resource') || '',
+  };
+}
+
+function getOauthAuthorizeParamsFromForm(form, hostedConfig) {
+  const pending = consumePendingOauthAuthorizeRequest(form.get('auth_request_token') || '');
+  if (pending) return pending;
+  return {
+    clientId: form.get('client_id') || '',
+    redirectUri: form.get('redirect_uri') || '',
+    codeChallenge: form.get('code_challenge') || '',
+    codeChallengeMethod: form.get('code_challenge_method') || '',
+    scope: form.get('scope') || undefined,
+    state: form.get('state') || '',
+    resource: form.get('resource') || buildPublicUrl(hostedConfig, '/mcp'),
+  };
+}
+
+function renderCheckoutIntentPage(prefilledEmail = '', parsed = null, options = {}) {
+  const plausibleDomain = escapeHtmlAttribute(resolvePlausibleDataDomain({ host: 'thumbgate.ai' }));
+  const includeHiddenAttribution = options.includeHiddenAttribution === true;
+  const hiddenInputs = includeHiddenAttribution
+    ? buildCheckoutHiddenAttributionInputs(parsed)
+    : '';
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Confirm - ThumbGate Pro</title>
+<script defer data-domain="${plausibleDomain}" src="https://plausible.io/js/script.tagged-events.js"></script>
+<script>window.plausible=window.plausible||function(){(window.plausible.q=window.plausible.q||[]).push(arguments)};</script>
+<style>
+body{background:#0a0a0a;color:#eee;font-family:system-ui,-apple-system,sans-serif;line-height:1.5}
+main{max-width:520px;margin:8vh auto;padding:0 20px}
+.brand{display:flex;align-items:center;gap:10px;margin-bottom:24px;font-size:14px;color:#94a3b8}
+.brand-mark{width:24px;height:24px;background:#22d3ee;border-radius:6px;display:inline-block}
+h1{font-size:24px;margin:0 0 8px;color:#fff}.price{font-size:32px;font-weight:700;color:#22d3ee;margin:8px 0 4px}.price small{font-size:14px;color:#94a3b8;font-weight:400}
+p{color:#cbd5e1;margin:8px 0}form{margin:0}
+input[type=email]{width:100%;box-sizing:border-box;padding:14px 16px;border:1px solid #374151;border-radius:8px;background:#111827;color:#fff;font-size:15px;margin:16px 0 0;outline:none}
+input[type=email]:focus{border-color:#22d3ee}input[type=email]::placeholder{color:#64748b}
+button.primary{background:#22d3ee;color:#000;padding:16px;text-align:center;border-radius:8px;font-weight:700;font-size:16px;margin:10px 0;border:none;cursor:pointer;width:100%}
+a{display:block;text-decoration:none}a.secondary{border:1px solid #374151;color:#cbd5e1;padding:12px;text-align:center;border-radius:8px;margin:8px 0 0;font-size:14px}
+.trust,.objection-box{margin:24px 0;padding:16px;border:1px solid #1f2937;border-radius:8px;background:#0f172a}
+.trust-item{font-size:13px;color:#cbd5e1;padding:4px 0;display:flex;gap:8px}.trust-item::before{content:"✓";color:#22d3ee;font-weight:700}
+.choice-note,.email-note,.objection-note{font-size:13px;color:#94a3b8;margin-top:10px}
+.objection-grid{display:grid;gap:8px;margin-top:12px}
+.objection-grid button{border:1px solid #374151;background:#111827;color:#e5e7eb;border-radius:8px;padding:10px 12px;text-align:left;cursor:pointer}
+.objection-grid button:hover,.objection-grid button:focus{border-color:#22d3ee;outline:none}
+.feedback-saved{display:none;color:#22d3ee;font-size:13px;margin-top:10px}
+.back{text-align:center;color:#64748b;font-size:12px;margin-top:24px}.back a{color:#64748b;display:inline}
+</style>
+</head>
+<body>
+<main>
+<div class="brand"><span class="brand-mark"></span><span>ThumbGate</span></div>
+<h1>Start ThumbGate Pro</h1>
+<div class="price">$19<small>/mo</small></div>
+<p>The npm package runs your gates locally. <strong>Pro</strong> is what keeps them working across every machine, every agent runtime, and every breaking-change week.</p>
+<form action="https://buy.stripe.com/8x2dR91M84r4cSd9uj3sI3f" method="GET" data-i="pro_checkout_confirmed">
+${hiddenInputs}
+<input type="email" name="prefilled_email" value="${escapeHtmlAttribute(prefilledEmail)}" placeholder="you@company.com" autocomplete="email">
+<p class="email-note">Optional. Stripe can collect your email on the secure checkout page.</p>
+<button type="submit" class="primary">Pay $19/mo with Stripe →</button>
+</form>
+<a class="secondary" data-i="workflow_sprint_intake" href="/#workflow-sprint-intake">Not sure yet? Send the workflow first</a>
+<p class="choice-note">Cancel anytime. 7-day refund, no questions. Diagnostics and sprints have their own pages.</p>
+<div class="objection-box" aria-label="Checkout feedback">
+<strong>Not buying today?</strong>
+<p class="objection-note">Tap one reason so we know what to fix. This does not sign you up.</p>
+<div class="objection-grid">
+<button type="button" data-reason="price_unclear">Price or scope is unclear</button>
+<button type="button" data-reason="need_more_proof">Need more proof first</button>
+<button type="button" data-reason="need_team_plan">Need a team/workflow plan instead</button>
+<button type="button" data-reason="not_urgent">Not urgent right now</button>
+</div>
+<div class="feedback-saved" id="feedback-saved">Feedback saved.</div>
+</div>
+<div class="trust"><div class="trust-item">Lessons synced across all your machines — no local SQLite to babysit</div><div class="trust-item">Adapter matrix kept current for Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode — version drift is our problem, not yours</div><div class="trust-item">Hosted dashboard: gate stats, DPO export, org-wide rule library</div><div class="trust-item">24×7 ops on the rule engine — SonarCloud regressions fixed in &lt;24h</div></div>
+<p class="back"><a href="/">← Back to thumbgate.ai</a></p>
+</main>
+<script>
+(function(){
+  var params = new URLSearchParams(window.location.search);
+  var submitted = false;
+  var feedbackSent = false;
+  function pick(key, fallback) { return params.get(key) || fallback || null; }
+  function sendTelemetry(eventType, extra) {
+    var payload = Object.assign({
+      eventType: eventType,
+      clientType: 'web',
+      page: '/checkout/pro',
+      traceId: pick('trace_id'),
+      acquisitionId: pick('acquisition_id'),
+      visitorId: pick('visitor_id'),
+      sessionId: pick('visitor_session_id') || pick('session_id'),
+      installId: pick('install_id'),
+      source: pick('utm_source') || pick('source') || 'website',
+      utmSource: pick('utm_source') || pick('source') || 'website',
+      utmMedium: pick('utm_medium') || 'checkout_interstitial',
+      utmCampaign: pick('utm_campaign') || 'pro_pack',
+      utmContent: pick('utm_content'),
+      utmTerm: pick('utm_term'),
+      creator: pick('creator') || pick('creator_handle'),
+      community: pick('community') || pick('subreddit'),
+      postId: pick('post_id'),
+      commentId: pick('comment_id'),
+      campaignVariant: pick('campaign_variant'),
+      offerCode: pick('offer_code'),
+      ctaId: pick('cta_id') || 'pricing_pro',
+      ctaPlacement: pick('cta_placement') || 'checkout_interstitial',
+      planId: pick('plan_id') || 'pro',
+      billingCycle: pick('billing_cycle') || 'monthly',
+      landingPath: pick('landing_path') || '/',
+      referrerHost: pick('referrer_host'),
+      referrer: document.referrer || null
+    }, extra || {});
+    var body = JSON.stringify(payload);
+    if (navigator.sendBeacon) {
+      navigator.sendBeacon('/v1/telemetry/ping', new Blob([body], { type: 'application/json' }));
+      return;
+    }
+    fetch('/v1/telemetry/ping', { method:'POST', headers:{ 'content-type':'application/json' }, body: body, keepalive: true }).catch(function(){});
+  }
+  document.querySelector('form').addEventListener('submit', function(){
+    submitted = true;
+    var emailInput = document.querySelector('input[name=customer_email]');
+    sendTelemetry('checkout_interstitial_cta_clicked', {
+      ctaId: 'pro_checkout_confirmed',
+      ctaPlacement: 'checkout_interstitial',
+      customerEmail: emailInput ? emailInput.value : null
+    });
+    try { window.plausible && window.plausible('Checkout Pro Email Submitted', { props: { page:'/checkout/pro', source:'interstitial' } }); } catch(_) {}
+  });
+  document.querySelectorAll('[data-reason]').forEach(function(button) {
+    button.addEventListener('click', function(){
+      var reason = button.getAttribute('data-reason');
+      feedbackSent = true;
+      sendTelemetry('reason_not_buying', {
+        reasonCode: reason,
+        ctaId: 'checkout_interstitial_reason_' + reason,
+        ctaPlacement: 'checkout_interstitial_feedback'
+      });
+      try { window.plausible && window.plausible('Checkout Pro Reason Not Buying', { props: { page:'/checkout/pro', reasonCode: reason } }); } catch(_) {}
+      var saved = document.getElementById('feedback-saved');
+      if (saved) saved.style.display = 'block';
+    });
+  });
+  window.addEventListener('pagehide', function(){
+    if (!submitted && !feedbackSent) {
+      sendTelemetry('checkout_interstitial_abandoned', { reasonCode: 'left_without_confirming' });
+    }
+  });
+})();
+</script>
+</body>
+</html>`;
+}
+
+function buildCheckoutBootstrapBody(parsed, req, journeyState = resolveJourneyState(req, parsed)) {
+  const params = parsed.searchParams;
+  const traceId = pickFirstText(params.get('trace_id')) || createJourneyId('checkout');
+  const planId = normalizePlanId(pickFirstText(params.get('plan_id'), 'pro'));
+  const billingCycle = normalizeBillingCycle(pickFirstText(params.get('billing_cycle'), 'monthly'));
+  const seatCount = planId === 'team'
+    ? normalizeSeatCount(pickFirstText(params.get('seat_count')))
+    : 1;
+  return {
+    traceId,
+    installId: pickFirstText(params.get('install_id')),
+    acquisitionId: journeyState.acquisitionId,
+    visitorId: journeyState.visitorId,
+    sessionId: journeyState.sessionId,
+    customerEmail: pickFirstText(params.get('customer_email')),
+    source: pickFirstText(params.get('source'), params.get('utm_source'), 'website'),
+    utmSource: pickFirstText(params.get('utm_source'), params.get('source'), 'website'),
+    utmMedium: pickFirstText(params.get('utm_medium'), 'cta_button'),
+    utmCampaign: pickFirstText(params.get('utm_campaign'), 'pro_pack'),
+    utmContent: pickFirstText(params.get('utm_content')),
+    utmTerm: pickFirstText(params.get('utm_term')),
+    creator: pickFirstText(params.get('creator'), params.get('creator_handle')),
+    community: pickFirstText(params.get('community'), params.get('subreddit')),
+    postId: pickFirstText(params.get('post_id')),
+    commentId: pickFirstText(params.get('comment_id')),
+    campaignVariant: pickFirstText(params.get('campaign_variant')),
+    offerCode: pickFirstText(params.get('offer_code')),
+    landingPath: pickFirstText(params.get('landing_path'), req.headers.referer ? '/' : '/'),
+    referrerHost: pickFirstText(params.get('referrer_host')),
+    ctaId: pickFirstText(params.get('cta_id'), 'pricing_pro'),
+    ctaPlacement: pickFirstText(params.get('cta_placement'), 'pricing'),
+    planId,
+    billingCycle,
+    seatCount,
+    metadata: {
+      referrer: pickFirstText(params.get('referrer'), req.headers.referer, req.headers.referrer),
+      landingPath: pickFirstText(params.get('landing_path'), '/'),
+      referrerHost: pickFirstText(params.get('referrer_host')),
+    },
+  };
+}
+
+function buildCheckoutConfirmHref(parsed) {
+  const confirmUrl = new URL('/checkout/pro', 'https://thumbgate.invalid');
+  confirmUrl.searchParams.set('confirm', '1');
+  for (const [key, value] of parsed.searchParams.entries()) {
+    if (key === 'confirm') continue;
+    confirmUrl.searchParams.append(key, value);
   }
   return `${confirmUrl.pathname}${confirmUrl.search}`;
 }
@@ -1567,17 +2406,6 @@ function normalizeCheckoutCustomerEmail(value) {
   return email;
 }
 
-function renderCheckoutIntentGate(parsed, responseHeaders = {}) {
-  let hiddenInputs = '';
-  for (const [key, value] of parsed.searchParams.entries()) {
-    if (key !== 'confirm' && key !== 'customer_email') hiddenInputs += `<input type=hidden name=${escapeHtmlAttribute(key)} value=${escapeHtmlAttribute(value)}>`;
-  }
-  return {
-    html: `<!doctype html><h1>Email for Stripe receipt</h1><form action=/checkout/pro>${hiddenInputs}<input type=hidden name=confirm value=1><input name=customer_email type=email required><button>Continue</button></form>`,
-    headers: responseHeaders,
-  };
-}
-
 function normalizeTrackedLinkSlug(value) {
   return String(value || '').trim().toLowerCase().replace(/[^a-z0-9-]/g, '');
 }
@@ -1588,6 +2416,27 @@ function normalizePublicPageSlug(value) {
     .replace(/[^a-z0-9-]/g, '');
 }
 
+function buildPublicHtmlFileMap(directory) {
+  const entries = new Map();
+  try {
+    for (const fileName of fs.readdirSync(directory)) {
+      if (!/^[a-z0-9-]+\.html$/i.test(fileName)) continue;
+      const slug = normalizePublicPageSlug(fileName);
+      if (!slug) continue;
+      entries.set(slug, path.join(directory, fileName));
+    }
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+  }
+  return entries;
+}
+
+function resolvePublicHtmlFile(publicPageMap, rawSlug) {
+  const slug = normalizePublicPageSlug(rawSlug);
+  if (!slug) return null;
+  return publicPageMap.get(slug) || null;
+}
+
 function getTrackedLinkTarget(slug) {
   const normalizedSlug = normalizeTrackedLinkSlug(slug);
   return TRACKED_LINK_TARGETS[normalizedSlug]
@@ -1623,8 +2472,10 @@ function appendTrackedLinkQueryParams(destinationUrl, parsed, target) {
 }
 
 function buildTrackedLinkDestination(target, hostedConfig, parsed) {
-  const destinationUrl = target.href
-    ? new URL(target.href)
+  const configuredHref = target.configUrlKey ? hostedConfig[target.configUrlKey] : null;
+  const href = target.href || configuredHref || target.fallbackHref;
+  const destinationUrl = href
+    ? new URL(href)
     : new URL(target.path || '/', hostedConfig.appOrigin);
   appendTrackedLinkQueryParams(destinationUrl, parsed, target);
   return destinationUrl;
@@ -1751,6 +2602,7 @@ function sendJson(res, statusCode, payload, extraHeaders = {}, options = {}) {
   const body = JSON.stringify(payload);
   res.writeHead(statusCode, {
     'Content-Type': 'application/json; charset=utf-8',
+    'X-Content-Type-Options': 'nosniff',
     'Content-Length': Buffer.byteLength(body),
     ...extraHeaders,
   });
@@ -1825,14 +2677,28 @@ function appendBestEffortTelemetry(feedbackDir, payload, headers, context) {
           evidence: [err?.message ? err.message : 'unknown_error'],
         },
       });
-    } catch (_) {}
+    } catch {}
     return false;
   }
 }
 
+function inferActionIntegration(body = {}, headers = {}) {
+  const explicit = pickFirstText(body.integration, body.source, body.actionIntegration, body.provider);
+  const userAgent = String(headers['user-agent'] || '').toLowerCase();
+  if (/chatgpt|gpt[_-]?actions?|openai/.test(String(explicit || '').toLowerCase()) || /chatgpt|openai/.test(userAgent)) {
+    return 'chatgpt_gpt';
+  }
+  return explicit || 'api';
+}
+
+function chatgptActionEventType(integration, suffix) {
+  return integration === 'chatgpt_gpt' ? `chatgpt_action_${suffix}` : `api_action_${suffix}`;
+}
+
 function getPublicOrigin(req) {
-  const proto = String(req.headers['x-forwarded-proto'] || '').split(',')[0].trim() || 'http';
-  const host = String(req.headers['x-forwarded-host'] || req.headers.host || '').split(',')[0].trim() || 'localhost';
+  const rawProto = String(req.headers['x-forwarded-proto'] || '').split(',')[0].trim().toLowerCase();
+  const proto = rawProto === 'https' ? 'https' : 'http';
+  const host = getSafePublicRequestHost(req) || 'localhost';
   return `${proto}://${host}`;
 }
 
@@ -1851,6 +2717,47 @@ function getRequestHostHeader(req) {
   return forwardedHost || req.headers.host || '';
 }
 
+function normalizePublicRequestHost(value) {
+  const rawHost = String(value || '').split(',')[0].trim().toLowerCase();
+  if (!rawHost || rawHost.length > 253) return '';
+
+  const hostWithoutPort = rawHost.startsWith('[')
+    ? rawHost.slice(1).split(']')[0]
+    : rawHost.split(':')[0];
+  const port = rawHost.startsWith('[')
+    ? rawHost.split(']:')[1] || ''
+    : rawHost.split(':')[1] || '';
+
+  if (!isAllowedPublicHostName(hostWithoutPort)) {
+    return '';
+  }
+  if (port && !/^\d{1,5}$/.test(port)) return '';
+  if (port && Number(port) > 65535) return '';
+  return port ? `${hostWithoutPort}:${port}` : hostWithoutPort;
+}
+
+function isAllowedPublicHostName(hostname) {
+  return hostname === 'localhost'
+    || hostname === '::1'
+    || isIpv4Host(hostname)
+    || isDnsHostName(hostname);
+}
+
+function isIpv4Host(hostname) {
+  const parts = hostname.split('.');
+  return parts.length === 4 && parts.every((part) => /^\d{1,3}$/.test(part));
+}
+
+function isDnsHostName(hostname) {
+  return hostname
+    .split('.')
+    .every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label));
+}
+
+function getSafePublicRequestHost(req) {
+  return normalizePublicRequestHost(getRequestHostHeader(req));
+}
+
 function isLoopbackHost(hostValue) {
   const rawHost = String(hostValue || '').split(',')[0].trim();
   if (!rawHost) {
@@ -1896,7 +2803,7 @@ function stripTrailingSlashes(value) {
   return input.slice(0, end);
 }
 
-function normalizePublicMarketingHtml(html, runtimeConfig) {
+function normalizePublicMarketingHtml(html, runtimeConfig, requestHost) {
   const appOrigin = runtimeConfig?.appOrigin
     ? stripTrailingSlashes(runtimeConfig.appOrigin)
     : '';
@@ -1905,10 +2812,14 @@ function normalizePublicMarketingHtml(html, runtimeConfig) {
   let output = String(html);
   output = output.replaceAll(DEFAULT_PUBLIC_APP_ORIGIN, appOrigin);
   try {
-    const host = new URL(appOrigin).host;
+    const host = normalizePublicRequestHost(requestHost) || new URL(appOrigin).host;
+    const plausibleDomain = resolvePlausibleDataDomain({ host });
     output = output.replaceAll(
       'data-domain="thumbgate-production.up.railway.app"',
-      `data-domain="${escapeHtmlAttribute(host)}"`
+      `data-domain="${escapeHtmlAttribute(plausibleDomain)}"`
+    ).replaceAll(
+      'data-domain="thumbgate.ai"',
+      `data-domain="${escapeHtmlAttribute(plausibleDomain)}"`
     );
   } catch {
     // appOrigin is normalized by hosted-config; leave static analytics domains
@@ -1952,12 +2863,12 @@ function loadPublicMarketingTemplateHtml(templatePath, runtimeConfig, pageContex
     '__SERVER_ACQUISITION_ID__': pageContext.serverAcquisitionId || '',
     '__SERVER_TELEMETRY_CAPTURED__': pageContext.serverTelemetryCaptured ? 'true' : 'false',
     '__VERIFICATION_URL__': 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md',
-    '__COMPATIBILITY_REPORT_URL__': 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/proof/compatibility/report.json',
-    '__AUTOMATION_REPORT_URL__': 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/proof/automation/report.json',
+    '__COMPATIBILITY_REPORT_URL__': 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md',
+    '__AUTOMATION_REPORT_URL__': 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md',
     '__GTM_PLAN_URL__': 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/GO_TO_MARKET_REVENUE_WEDGE_2026-03.md',
     '__GITHUB_URL__': 'https://github.com/IgorGanapolsky/ThumbGate',
     '__POSTHOG_API_KEY__': runtimeConfig.posthogApiKey || '',
-  }), runtimeConfig);
+  }), runtimeConfig, pageContext.requestHost);
 }
 
 function loadLandingPageHtml(runtimeConfig, pageContext = {}) {
@@ -1968,6 +2879,30 @@ function loadProPageHtml(runtimeConfig, pageContext = {}) {
   return loadPublicMarketingTemplateHtml(PRO_PAGE_PATH, runtimeConfig, pageContext);
 }
 
+function loadDiagnosticPageHtml(runtimeConfig, pageContext = {}) {
+  return loadPublicMarketingTemplateHtml(DIAGNOSTIC_PAGE_PATH, runtimeConfig, pageContext);
+}
+
+function loadInstallPageHtml(runtimeConfig, pageContext = {}) {
+  return loadPublicMarketingTemplateHtml(INSTALL_PAGE_PATH, runtimeConfig, pageContext);
+}
+
+function loadPricingPageHtml(runtimeConfig, pageContext = {}) {
+  return loadPublicMarketingTemplateHtml(PRICING_PAGE_PATH, runtimeConfig, pageContext);
+}
+
+function loadAboutPageHtml(runtimeConfig, pageContext = {}) {
+  return loadPublicMarketingTemplateHtml(ABOUT_PAGE_PATH, runtimeConfig, pageContext);
+}
+
+function loadGuidePageHtml(runtimeConfig, pageContext = {}) {
+  return loadPublicMarketingTemplateHtml(GUIDE_PAGE_PATH, runtimeConfig, pageContext);
+}
+
+function loadLearnPageHtml(runtimeConfig, pageContext = {}) {
+  return loadPublicMarketingTemplateHtml(LEARN_PAGE_PATH, runtimeConfig, pageContext);
+}
+
 function readOptionalPublicTemplate(filePath) {
   try {
     return fs.readFileSync(filePath, 'utf-8');
@@ -1977,6 +2912,10 @@ function readOptionalPublicTemplate(filePath) {
   }
 }
 
+function escapeJsonForInlineScript(value) {
+  return JSON.stringify(value).replaceAll('<', String.raw`\u003c`);
+}
+
 function resolveLocalPageBootstrap(req, expectedApiKey) {
   const forwardedHost = req.headers['x-forwarded-host'];
   const hostHeader = Array.isArray(forwardedHost)
@@ -1985,7 +2924,13 @@ function resolveLocalPageBootstrap(req, expectedApiKey) {
   const localProBootstrap = process.env.THUMBGATE_PRO_MODE === '1' && Boolean(expectedApiKey) && isLoopbackHost(hostHeader);
   const devOverride = expectedApiKey === null && isLoopbackHost(hostHeader);
   const bootstrapActive = localProBootstrap || devOverride;
-  const serializedBootstrapKey = JSON.stringify(localProBootstrap ? expectedApiKey : devOverride ? 'dev-override' : '').replace(/</g, '\\u003c');
+  let bootstrapKey = '';
+  if (localProBootstrap) {
+    bootstrapKey = expectedApiKey;
+  } else if (devOverride) {
+    bootstrapKey = process.env.THUMBGATE_API_KEY || 'dev-override';
+  }
+  const serializedBootstrapKey = escapeJsonForInlineScript(bootstrapKey);
 
   return {
     bootstrapActive,
@@ -2026,6 +2971,7 @@ window.THUMBGATE_DASHBOARD_BOOTSTRAP = { enabled: ${bootstrapActive ? 'true' : '
 <p>This lightweight npm dashboard is bundled without marketing assets, so installs stay small while core feedback, lessons, and API routes remain available.</p>
 <div class="grid">
 <a class="card" href="/v1/dashboard"><strong>Dashboard JSON</strong><span>Inspect feedback totals, lesson counts, and Reliability Gateway health.</span></a>
+<a class="card" href="/v1/enterprise/data-chat/status"><strong>Governed Data Chat</strong><span>Local RAG (LanceDB vectors + lessons) over your data plus your LLM. Guard simulation is available; Dialogflow/Vertex are optional adapters for customer-owned agent deployments.</span></a>
 <a class="card" href="/lessons"><strong>Lessons</strong><span>Review remembered thumbs-up/down lessons and enforcement context.</span></a>
 <a class="card" href="/health"><strong>Health</strong><span>Verify the installed package version and runtime status.</span></a>
 </div>
@@ -2105,6 +3051,53 @@ function normalizeLessonSignal(signal) {
   return 'down';
 }
 
+function splitLessonTitlePrefix(titleText) {
+  const prefixMatch = /^(MISTAKE|SUCCESS|LEARNING|PREFERENCE):\s*(.*)/i.exec(titleText);
+  if (!prefixMatch) return { prefix: '', rest: titleText };
+  return {
+    prefix: `${prefixMatch[1].toUpperCase()}: `,
+    rest: prefixMatch[2],
+  };
+}
+
+function maybeParseJsonObject(value) {
+  const trimmed = String(value || '').trim();
+  if (!trimmed.startsWith('{') || !trimmed.endsWith('}')) return null;
+  try {
+    return JSON.parse(trimmed);
+  } catch (error) {
+    debugApiFallback('lesson JSON parse skipped', error);
+    return null;
+  }
+}
+
+function formatLessonJsonTitle(prefix, parsed) {
+  const dirName = parsed.cwd ? parsed.cwd.split('/').pop() : '';
+  const suffix = dirName ? ` inside ${dirName}` : '';
+  if (parsed.prompt) return `${prefix}Prompt "${parsed.prompt}"${suffix}`;
+  const hookVal = parsed.hook_event_name || parsed.hookEventName;
+  if (hookVal) return `${prefix}Hook event ${hookVal}${suffix}`;
+  if (parsed.signal) return `${prefix}${parsed.signal === 'up' ? 'Thumbs Up' : 'Thumbs Down'}${suffix}`;
+  return '';
+}
+
+function cleanLessonTitle(titleText) {
+  if (!titleText) return 'Untitled Lesson';
+  const { prefix, rest } = splitLessonTitlePrefix(titleText);
+  const parsed = maybeParseJsonObject(rest);
+  if (parsed) {
+    const jsonTitle = formatLessonJsonTitle(prefix, parsed);
+    if (jsonTitle) return jsonTitle;
+  }
+  return titleText;
+}
+
+function formatLessonTextValue(value) {
+  if (!value) return '';
+  const parsed = maybeParseJsonObject(value);
+  return parsed ? JSON.stringify(parsed, null, 2) : value;
+}
+
 function renderLessonDetailHtml(record, lessonId) {
   if (!record) {
     return `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Lesson Not Found</title>
@@ -2123,10 +3116,15 @@ a{color:#22d3ee;text-decoration:none}</style></head><body>
   const signal = normalizeLessonSignal(merged.signal);
   const emoji = signal === 'up' ? '👍' : '👎';
   const signalColor = signal === 'up' ? '#4ade80' : '#f87171';
-  const title = merged.title || merged.context || 'Untitled Lesson';
-  const context = merged.context || '';
-  const whatWentWrong = merged.whatWentWrong || '';
-  const whatWorked = merged.whatWorked || '';
+  const rawTitle = merged.title || merged.context || 'Untitled Lesson';
+  const rawContext = merged.context || '';
+  const rawWhatWentWrong = merged.whatWentWrong || '';
+  const rawWhatWorked = merged.whatWorked || '';
+
+  const title = cleanLessonTitle(rawTitle);
+  const context = formatLessonTextValue(rawContext);
+  const whatWentWrong = formatLessonTextValue(rawWhatWentWrong);
+  const whatWorked = formatLessonTextValue(rawWhatWorked);
   const whatToChange = merged.whatToChange || '';
   const tags = Array.isArray(merged.tags) ? merged.tags.join(', ') : (merged.tags || '');
   const timestamp = merged.timestamp ? new Date(merged.timestamp).toLocaleString() : '';
@@ -2344,7 +3342,7 @@ nav .container { display: flex; justify-content: space-between; align-items: cen
 </head>
 <body>
 <nav><div class="container">
-  <a href="/dashboard" class="nav-logo"><img src="/assets/brand/thumbgate-mark-inline.svg" alt="ThumbGate" class="logo-mark" width="28" height="28"><span class="logo-text">ThumbGate</span></a>
+  <a href="/dashboard" class="nav-logo"><img src="/assets/brand/thumbgate-mark-inline-v3.svg" alt="ThumbGate" class="logo-mark" width="28" height="28"><span class="logo-text">ThumbGate</span></a>
   <div class="nav-links">
     <a href="/dashboard">Dashboard</a>
     <a href="/lessons">Lessons</a>
@@ -2468,6 +3466,16 @@ function renderRobotsTxt(runtimeConfig) {
     'Disallow: /v1/billing/',
     '',
     '# AI crawler access — allow all major LLM crawlers',
+    'User-agent: OAI-SearchBot',
+    'Allow: /',
+    'Disallow: /checkout/',
+    'Disallow: /v1/billing/',
+    '',
+    'User-agent: ChatGPT-User',
+    'Allow: /',
+    'Disallow: /checkout/',
+    'Disallow: /v1/billing/',
+    '',
     'User-agent: GPTBot',
     'Allow: /',
     'Disallow: /checkout/',
@@ -2476,9 +3484,18 @@ function renderRobotsTxt(runtimeConfig) {
     'User-agent: ClaudeBot',
     'Allow: /',
     '',
+    'User-agent: Claude-SearchBot',
+    'Allow: /',
+    '',
+    'User-agent: Claude-User',
+    'Allow: /',
+    '',
     'User-agent: PerplexityBot',
     'Allow: /',
     '',
+    'User-agent: Perplexity-User',
+    'Allow: /',
+    '',
     'User-agent: Googlebot',
     'Allow: /',
     '',
@@ -2493,6 +3510,7 @@ function renderRobotsTxt(runtimeConfig) {
     '',
     '# LLM context document — clean declarative content for AI retrieval',
     `# ${runtimeConfig.appOrigin}/llm-context.md`,
+    `# ${runtimeConfig.appOrigin}/llms.txt`,
     '',
     `Sitemap: ${runtimeConfig.appOrigin}/sitemap.xml`,
   ].join('\n');
@@ -2502,10 +3520,57 @@ function renderSitemapXml(runtimeConfig) {
   const entries = [
     { path: '/', changefreq: 'weekly', priority: '1.0' },
     { path: '/pro', changefreq: 'weekly', priority: '0.9' },
+    { path: '/diagnostic', changefreq: 'weekly', priority: '0.9' },
+    { path: '/workflow-hardening-sprint', changefreq: 'weekly', priority: '0.9' },
+    { path: '/install', changefreq: 'weekly', priority: '0.9' },
+    { path: '/agent-manager', changefreq: 'weekly', priority: '0.9' },
     { path: '/llm-context.md', changefreq: 'weekly', priority: '0.8' },
+    { path: '/chatgpt-app', changefreq: 'weekly', priority: '0.85' },
     { path: '/codex-plugin', changefreq: 'weekly', priority: '0.75' },
+    { path: '/codex-enterprise', changefreq: 'weekly', priority: '0.85' },
+    { path: '/agents-cost-savings', changefreq: 'weekly', priority: '0.85' },
+    { path: '/ai-malpractice-prevention', changefreq: 'weekly', priority: '0.9' },
+    { path: '/learn/background-agent-control-layer', changefreq: 'weekly', priority: '0.85' },
+    { path: '/learn/ac-dc-runtime-enforcement', changefreq: 'weekly', priority: '0.85' },
+    { path: '/learn/feedback-loop-vs-decision-layer', changefreq: 'weekly', priority: '0.9' },
+    { path: '/learn/agentic-enterprise-context-brain', changefreq: 'weekly', priority: '0.85' },
+    { path: '/learn/deterministic-agent-workflows', changefreq: 'weekly', priority: '0.85' },
+    { path: '/learn/codex-role-plugins-need-governance', changefreq: 'weekly', priority: '0.85' },
+    { path: '/learn/agentic-os-team-governance', changefreq: 'weekly', priority: '0.85' },
+    { path: '/learn/cost-aware-agent-gate-routing', changefreq: 'weekly', priority: '0.85' },
+    { path: '/learn/pretix-stripe-connect-marketplaces', changefreq: 'weekly', priority: '0.9' },
+    { path: '/compare/claude-code-hooks', changefreq: 'weekly', priority: '0.85' },
+    { path: '/compare/bumblebee', changefreq: 'weekly', priority: '0.85' },
+    { path: '/compare/anthropic-containment', changefreq: 'weekly', priority: '0.85' },
+    { path: '/compare/oak-and-sparrow-gatekeeper', changefreq: 'weekly', priority: '0.85' },
+    { path: '/compare/arcjet', changefreq: 'weekly', priority: '0.85' },
+    { path: '/compare/anthropic-claude-for-legal', changefreq: 'weekly', priority: '0.9' },
     ...THUMBGATE_SEO_SITEMAP_ENTRIES,
   ];
+  // Auto-include every hand-written SEO page so /sitemap.xml can never drift out
+  // of sync with public/compare/*.html or public/guides/*.html. Crawlers and AI
+  // answer engines only surface pages they can discover, so a buyer-intent page
+  // missing from the sitemap is invisible on its query. De-duped against entries
+  // already declared above (e.g. seo-gsd specs), which keep explicit priorities.
+  const declaredPaths = new Set(entries.map((entry) => entry.path));
+  try {
+    const seoDirectories = [
+      { dir: 'compare', route: '/compare', priority: '0.85' },
+      { dir: 'guides', route: '/guides', priority: '0.85' },
+    ];
+    for (const catalog of seoDirectories) {
+      const files = fs.readdirSync(path.join(PUBLIC_DIR, catalog.dir)).sort((a, b) => a.localeCompare(b));
+      for (const file of files) {
+        if (!file.endsWith('.html')) continue;
+        const publicPath = `${catalog.route}/${file.replace(/\.html$/, '')}`;
+        if (declaredPaths.has(publicPath)) continue;
+        declaredPaths.add(publicPath);
+        entries.push({ path: publicPath, changefreq: 'weekly', priority: catalog.priority });
+      }
+    }
+  } catch {
+    // SEO directories absent in a stripped bundle — fall back to static entries.
+  }
   return [
     '<?xml version="1.0" encoding="UTF-8"?>',
     '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">',
@@ -2631,11 +3696,13 @@ function servePublicMarketingPage({
     }, req.headers, 'seo_landing_view');
   }
 
+  const requestHost = getSafePublicRequestHost(req);
   const html = renderHtml(hostedConfig, {
     serverVisitorId: journeyState.visitorId,
     serverSessionId: journeyState.sessionId,
     serverAcquisitionId: journeyState.acquisitionId,
     serverTelemetryCaptured: landingTelemetryCaptured,
+    requestHost,
   });
 
   sendHtml(
@@ -2775,11 +3842,12 @@ function renderCheckoutSuccessPage(runtimeConfig) {
   </style>
   <link rel="icon" type="image/png" href="/thumbgate-icon.png">
   <link rel="apple-touch-icon" href="/assets/brand/thumbgate-mark.svg">
-<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
+<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.tagged-events.js"></script>
+<script>window.plausible = window.plausible || function() { (window.plausible.q = window.plausible.q || []).push(arguments); };</script>
 </head>
 <body>
   <main>
-    <a href="/" class="brand-header"><img src="/assets/brand/thumbgate-mark-inline.svg" alt="ThumbGate" class="logo-mark" width="32" height="32"><span class="logo-text">ThumbGate</span></a>
+    <a href="/" class="brand-header"><img src="/assets/brand/thumbgate-mark-inline-v3.svg" alt="ThumbGate" class="logo-mark" width="32" height="32"><span class="logo-text">ThumbGate</span></a>
     <span class="eyebrow">ThumbGate Pro</span>
     <h1>Your local Pro dashboard is ready.</h1>
     <p class="lead">This page verifies your Stripe session, provisions the key if needed, and gives you the exact command to save your license and launch your personal local dashboard.</p>
@@ -2916,7 +3984,7 @@ function renderCheckoutSuccessPage(runtimeConfig) {
         if (window.sessionStorage) {
           window.sessionStorage.setItem(marker, '1');
         }
-      } catch (_) {
+      } catch {
         sendTelemetry(eventType, extra);
       }
     }
@@ -2953,6 +4021,7 @@ function renderCheckoutSuccessPage(runtimeConfig) {
         }
 
         sendTelemetryOnce('checkout_paid_confirmed');
+        try { window.plausible && window.plausible('Checkout Pro Success Page Confirmed', { props: { sessionId: sessionId || '', traceId: traceId || '', source: 'success_page' } }); } catch (_) {}
         statusEl.textContent = 'ThumbGate Pro activated.';
         const resolvedTraceId = body.traceId || traceId || '';
         const emailStatus = body.trialEmail || {};
@@ -3352,6 +4421,39 @@ function renderWorkflowSprintIntakeResultPage(runtimeConfig, { title, detail, le
 </html>`;
 }
 
+function renderBrokerAuditIntakeResultPage(runtimeConfig, { title, detail, leadId = null }) {
+  const safeTitle = escapeHtmlAttribute(title || 'Broker audit request received');
+  const safeDetail = escapeHtmlAttribute(detail || 'Your broker lead-flow audit request is in the queue.');
+  const safeLeadId = leadId ? `<p><strong>Lead ID:</strong> ${escapeHtmlAttribute(leadId)}</p>` : '';
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>${safeTitle}</title>
+  <meta name="robots" content="noindex,nofollow" />
+  <style>
+    body { margin: 0; font-family: system-ui, -apple-system, sans-serif; background: #0b1220; color: #e5edf8; line-height: 1.6; }
+    main { max-width: 680px; margin: 0 auto; padding: 72px 20px; }
+    .card { border: 1px solid #26354f; border-radius: 14px; padding: 24px; background: #111a2b; }
+    h1 { margin: 0 0 10px; font-size: 30px; }
+    p { color: #b8c5d8; }
+    a { color: #7dd3fc; font-weight: 700; text-decoration: none; }
+  </style>
+</head>
+<body>
+  <main>
+    <div class="card">
+      <h1>${safeTitle}</h1>
+      <p>${safeDetail}</p>
+      ${safeLeadId}
+      <p><a href="${escapeHtmlAttribute(runtimeConfig.appOrigin)}/broker-audit">Back to broker audit page</a></p>
+    </div>
+  </main>
+</body>
+</html>`;
+}
+
 function readBodyBuffer(req, maxBytes = 1024 * 1024) {
   return new Promise((resolve, reject) => {
     let total = 0;
@@ -3396,6 +4498,72 @@ async function parseFormBody(req, maxBytes = 1024 * 1024) {
   return Object.fromEntries(params.entries());
 }
 
+function normalizeLeadEmail(value) {
+  const email = normalizeNullableText(value);
+  if (!email || !/^[^\s@]{1,64}@[^\s@]{1,255}\.[^\s@]{1,63}$/.test(email)) {
+    throw createHttpError(400, 'A valid email is required');
+  }
+  return email.toLowerCase();
+}
+
+function normalizeHttpUrl(value, fieldName) {
+  const raw = normalizeNullableText(value);
+  if (!raw) throw createHttpError(400, `${fieldName} is required`);
+  try {
+    const parsedUrl = new URL(raw);
+    if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
+      throw new Error('unsupported protocol');
+    }
+    return parsedUrl.toString();
+  } catch {
+    throw createHttpError(400, `${fieldName} must be an http(s) URL`);
+  }
+}
+
+function appendBrokerAuditLead(feedbackDir, payload) {
+  const lead = {
+    leadId: createTraceId('broker_audit_lead'),
+    status: 'new',
+    offer: 'broker_lead_flow_audit_free',
+    requestedAt: new Date().toISOString(),
+    contact: {
+      name: normalizeNullableText(payload.name),
+      email: normalizeLeadEmail(payload.email),
+      brokerage: normalizeNullableText(payload.brokerage),
+      website: normalizeHttpUrl(payload.website, 'website'),
+    },
+    qualification: {
+      suspectedLeak: normalizeNullableText(payload.suspected_leak || payload.suspectedLeak),
+    },
+    attribution: {
+      traceId: payload.traceId,
+      acquisitionId: payload.acquisitionId,
+      visitorId: payload.visitorId,
+      sessionId: payload.sessionId,
+      source: payload.source,
+      utmSource: payload.utmSource,
+      utmMedium: payload.utmMedium,
+      utmCampaign: payload.utmCampaign,
+      utmContent: payload.utmContent,
+      utmTerm: payload.utmTerm,
+      ctaId: payload.ctaId,
+      ctaPlacement: payload.ctaPlacement,
+      page: payload.page,
+      landingPath: payload.landingPath,
+      referrer: payload.referrer,
+      referrerHost: payload.referrerHost,
+    },
+  };
+
+  if (!lead.contact.name) throw createHttpError(400, 'name is required');
+  if (!lead.contact.brokerage) throw createHttpError(400, 'brokerage is required');
+
+  const leadsPath = path.join(feedbackDir, 'broker-audit-leads.jsonl');
+  fs.mkdirSync(path.dirname(leadsPath), { recursive: true });
+  fs.appendFileSync(leadsPath, `${JSON.stringify(lead)}\n`, 'utf8');
+  return lead;
+}
+
 function parseOptionalObject(input, name) {
   if (input == null) return {};
   if (typeof input === 'object' && !Array.isArray(input)) return input;
@@ -3470,6 +4638,49 @@ function extractApiKey(req) {
   return '';
 }
 
+/**
+ * Map a ThumbGate key presented at the OAuth consent screen to a role.
+ *
+ * - When any key is configured (production), the presented key MUST match a
+ *   configured admin/operator/reviewer key; otherwise returns null (reject) so
+ *   the OAuth flow actually authenticates the holder.
+ * - When NO keys are configured (insecure/dev mode, e.g. local tests), any
+ *   non-empty key is accepted as role 'dev' to preserve local development.
+ *
+ * 'reviewer' (THUMBGATE_REVIEWER_KEY) is a read-only, independently-revocable
+ * credential safe to share with a directory reviewer — tool execution enforces
+ * read-only for it (see the tools/call handler).
+ */
+// Constant-time comparison of two API/OAuth bearer keys. We compare the raw
+// bytes with crypto.timingSafeEqual after an explicit equal-length guard
+// (timingSafeEqual throws on a length mismatch). No digest is taken: these are
+// high-entropy random credentials compared transiently at request time, not
+// user passwords stored at rest, so neither a KDF (bcrypt/scrypt/argon2) nor a
+// length-normalizing hash is appropriate — and hashing the credential here is
+// exactly what static analysis (correctly, for *stored* passwords) flags. The
+// only side-channel is whether the two keys share a length, which reveals
+// nothing useful about a random secret. Once lengths match, the byte compare
+// is constant-time and leaks no information about where they differ.
+function safeKeyEqual(a, b) {
+  const x = Buffer.from(String(a || ''), 'utf8');
+  const y = Buffer.from(String(b || ''), 'utf8');
+  if (x.length === 0 || y.length === 0 || x.length !== y.length) return false;
+  return require('crypto').timingSafeEqual(x, y);
+}
+
+function resolveKeyRole(key) {
+  const k = String(key || '').trim();
+  const adminKey = String(process.env.THUMBGATE_API_KEY || '').trim();
+  const operatorKey = String(process.env.THUMBGATE_OPERATOR_KEY || '').trim();
+  const reviewerKey = String(process.env.THUMBGATE_REVIEWER_KEY || '').trim();
+  const configured = [adminKey, operatorKey, reviewerKey].filter(Boolean);
+  if (configured.length === 0) return k ? 'dev' : null;
+  if (safeKeyEqual(k, adminKey)) return 'admin';
+  if (safeKeyEqual(k, operatorKey)) return 'operator';
+  if (safeKeyEqual(k, reviewerKey)) return 'reviewer';
+  return null;
+}
+
 /**
  * Admin-only guard for static THUMBGATE_API_KEY.
  * Billing keys are intentionally excluded from admin actions.
@@ -3570,6 +4781,42 @@ function normalizeJobIdFromPath(pathname, suffix = '') {
   return match ? decodeURIComponent(match[1]) : null;
 }
 
+function escapeHtml(value) {
+  return String(value)
+    .replaceAll('&', '&amp;')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+    .replaceAll("'", '&#39;');
+}
+
+function escapeHtmlUnsafeJsonString(value) {
+  return String(value)
+    .replaceAll('<', String.raw`\u003c`)
+    .replaceAll('>', String.raw`\u003e`)
+    .replaceAll('&', String.raw`\u0026`)
+    .replaceAll('\u2028', String.raw`\u2028`)
+    .replaceAll('\u2029', String.raw`\u2029`);
+}
+
+function sanitizeHtmlUnsafeJsonValue(value) {
+  if (typeof value === 'string') {
+    return escapeHtmlUnsafeJsonString(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => sanitizeHtmlUnsafeJsonValue(entry));
+  }
+  if (!value || typeof value !== 'object') {
+    return value;
+  }
+  return Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => [
+      escapeHtmlUnsafeJsonString(key),
+      sanitizeHtmlUnsafeJsonValue(entry),
+    ])
+  );
+}
+
 function normalizeDocumentIdFromPath(pathname) {
   const match = pathname.match(/^\/v1\/documents\/([^/]+)$/);
   return match ? decodeURIComponent(match[1]) : null;
@@ -3679,12 +4926,75 @@ function createApiServer() {
                   tools: getPublicMcpTools(),
                 },
               });
+            } else if (msg.method === 'tools/call') {
+              // Authenticated tool execution. Accept either an OAuth 2.1 access
+              // token (audience-bound to this MCP server, RFC 8707) or a raw
+              // ThumbGate API key, both via the Bearer header.
+              const bearer = extractBearerToken(req);
+              const resourceUrl = buildPublicUrl(hostedConfig, '/mcp');
+              const oauthSession = mcpOauth.resolveAccessToken(oauthStore, bearer);
+              // OAuth path: token must resolve AND be audience-bound to this server
+              // (RFC 8707). Raw-key path: only an exact match to a configured
+              // operator/admin key — never "any non-empty bearer".
+              const adminKey = String(process.env.THUMBGATE_API_KEY || '').trim();
+              const operatorKey = String(process.env.THUMBGATE_OPERATOR_KEY || '').trim();
+              const reviewerKey = String(process.env.THUMBGATE_REVIEWER_KEY || '').trim();
+              const rawKeyValid = Boolean(bearer) && (safeKeyEqual(bearer, adminKey) || safeKeyEqual(bearer, operatorKey) || safeKeyEqual(bearer, reviewerKey));
+              const authed = oauthSession
+                ? mcpOauth.tokenAudienceValid(oauthSession, resourceUrl)
+                : rawKeyValid;
+              if (!authed) {
+                res.writeHead(401, {
+                  'Content-Type': 'application/json',
+                  // RFC 9728: point unauthenticated clients at the resource metadata.
+                  'WWW-Authenticate': `Bearer resource_metadata="${buildPublicUrl(hostedConfig, '/.well-known/oauth-protected-resource')}"`,
+                });
+                res.end(JSON.stringify({
+                  jsonrpc: '2.0', id: msg.id,
+                  error: { code: -32001, message: 'Authentication required. Use OAuth 2.1 (see /.well-known/oauth-protected-resource) or a ThumbGate API key.' },
+                }));
+                return;
+              }
+              // The reviewer credential (THUMBGATE_REVIEWER_KEY) is read-only: it may
+              // only invoke tools annotated readOnlyHint:true. This makes a credential
+              // safe to share (e.g. with a directory reviewer) without granting the
+              // ability to mutate shared server state.
+              const effectiveKey = oauthSession ? String(oauthSession.boundKey || '') : bearer;
+              const isReviewer = Boolean(reviewerKey) && safeKeyEqual(effectiveKey, reviewerKey);
+              if (isReviewer) {
+                const name = msg.params && msg.params.name;
+                const tool = MCP_TOOLS.find((t) => t.name === name);
+                const readOnly = Boolean(tool && tool.annotations && tool.annotations.readOnlyHint === true);
+                if (!readOnly) {
+                  sendJson(res, 200, {
+                    jsonrpc: '2.0', id: msg.id,
+                    error: { code: -32002, message: `Tool "${name}" requires write access; the reviewer credential is read-only.` },
+                  });
+                  return;
+                }
+              }
+              (async () => {
+                try {
+                  const { callTool } = require('../../adapters/mcp/server-stdio');
+                  const name = msg.params && msg.params.name;
+                  const args = (msg.params && msg.params.arguments) || {};
+                  const result = await callTool(name, args);
+                  sendJson(res, 200, {
+                    jsonrpc: '2.0', id: msg.id,
+                    result: { content: [{ type: 'text', text: typeof result === 'string' ? result : JSON.stringify(result) }] },
+                  });
+                } catch (err) {
+                  sendJson(res, 200, {
+                    jsonrpc: '2.0', id: msg.id,
+                    result: { isError: true, content: [{ type: 'text', text: String(err && err.message || err) }] },
+                  });
+                }
+              })();
             } else {
-              // All other tool calls require auth — return method not found for unauthenticated
               sendJson(res, 200, {
                 jsonrpc: '2.0',
                 id: msg.id,
-                error: { code: -32601, message: 'Method requires authentication. Provide Bearer token.' },
+                error: { code: -32601, message: `Method not found: ${msg.method}` },
               });
             }
           } catch (_e) {
@@ -3772,7 +5082,10 @@ function createApiServer() {
           });
           sendJson(res, 200, result);
         } catch (e) {
-          sendJson(res, 500, { error: 'feedback submission failed' });
+          sendJson(res, 500, {
+            error: 'feedback submission failed',
+            message: e?.message || 'Unable to submit dashboard feedback.',
+          });
         }
       });
       return;
@@ -3908,7 +5221,7 @@ function createApiServer() {
     if (req.method === 'POST' && pathname === '/api/event') {
       // Filter bots from analytics to keep Plausible data clean
       let _botDetector;
-      try { _botDetector = require('../../scripts/bot-detector'); } catch (_e) { _botDetector = null; }
+      try { _botDetector = require('../../scripts/bot-detection'); } catch (_e) { _botDetector = null; }
       if (_botDetector && _botDetector.shouldExcludeFromAnalytics(req)) {
         sendJson(res, 202, { status: 'filtered', reason: 'bot' });
         return;
@@ -3961,7 +5274,7 @@ function createApiServer() {
       return;
     }
 
-    if (isGetLikeRequest && pathname === '/.well-known/llms.txt') {
+    if (isGetLikeRequest && (pathname === '/.well-known/llms.txt' || pathname === '/llms.txt')) {
       const llmsTxtPath = path.join(__dirname, '..', '..', '.well-known', 'llms.txt');
       try {
         const content = fs.readFileSync(llmsTxtPath, 'utf8');
@@ -3972,11 +5285,22 @@ function createApiServer() {
       return;
     }
 
-    if (isGetLikeRequest && pathname === '/sitemap.xml') {
-      sendText(res, 200, renderSitemapXml(hostedConfig), {
-        'Content-Type': 'application/xml; charset=utf-8',
-      }, {
-        headOnly: isHeadRequest,
+    if (isGetLikeRequest && pathname === '/.well-known/agentic-verify.txt') {
+      const agenticVerifyPath = path.join(__dirname, '..', '..', '.well-known', 'agentic-verify.txt');
+      try {
+        const content = fs.readFileSync(agenticVerifyPath, 'utf8');
+        sendText(res, 200, content, { 'Content-Type': 'text/plain; charset=utf-8', 'Cache-Control': 'public, max-age=3600' }, { headOnly: isHeadRequest });
+      } catch {
+        sendJson(res, 404, { error: 'agentic verification file not found' });
+      }
+      return;
+    }
+
+    if (isGetLikeRequest && pathname === '/sitemap.xml') {
+      sendText(res, 200, renderSitemapXml(hostedConfig), {
+        'Content-Type': 'application/xml; charset=utf-8',
+      }, {
+        headOnly: isHeadRequest,
       });
       return;
     }
@@ -4264,12 +5588,66 @@ async function addContext(){
       return;
     }
 
+    if (isGetLikeRequest && (pathname === '/about' || pathname === '/about.html')) {
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: loadAboutPageHtml,
+          extraTelemetry: {
+            pageType: 'about',
+          },
+        });
+      } catch (err) {
+        sendText(res, 500, err.message || 'About page unavailable');
+      }
+      return;
+    }
+
     if (isGetLikeRequest && (pathname === '/guide' || pathname === '/guide.html')) {
       try {
-        const html = fs.readFileSync(GUIDE_PAGE_PATH, 'utf-8');
-        sendHtml(res, 200, html, {}, { headOnly: isHeadRequest });
-      } catch {
-        sendJson(res, 404, { error: 'Guide page not found' });
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: loadGuidePageHtml,
+          extraTelemetry: {
+            pageType: 'guide',
+          },
+        });
+      } catch (err) {
+        sendText(res, 500, err.message || 'Guide page unavailable');
+      }
+      return;
+    }
+
+    if (isGetLikeRequest && (
+      pathname === '/install'
+      || pathname === '/install.html'
+      || pathname === '/marketplace'
+      || pathname === '/marketplace.html'
+      || pathname === '/marketplaces'
+      || pathname === '/marketplaces.html'
+    )) {
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: loadInstallPageHtml,
+          extraTelemetry: {
+            pageType: 'install',
+          },
+        });
+      } catch (err) {
+        sendText(res, 500, err.message || 'Install page unavailable');
       }
       return;
     }
@@ -4284,6 +5662,28 @@ async function addContext(){
       return;
     }
 
+    if (isGetLikeRequest && (
+      pathname === '/chatgpt-app'
+      || pathname === '/chatgpt-app.html'
+      || pathname === '/chatgpt-plugin'
+      || pathname === '/chatgpt-plugin.html'
+    )) {
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: () => fs.readFileSync(CHATGPT_APP_PAGE_PATH, 'utf-8'),
+          extraTelemetry: { pageType: 'chatgpt_app' },
+        });
+      } catch {
+        sendJson(res, 404, { error: 'ChatGPT app page not found' });
+      }
+      return;
+    }
+
     if (isGetLikeRequest && (pathname === '/compare' || pathname === '/compare.html')) {
       try {
         const html = fs.readFileSync(COMPARE_PAGE_PATH, 'utf-8');
@@ -4307,10 +5707,19 @@ async function addContext(){
 
     if (isGetLikeRequest && (pathname === '/learn' || pathname === '/learn.html')) {
       try {
-        const html = fs.readFileSync(LEARN_PAGE_PATH, 'utf-8');
-        sendHtml(res, 200, html, {}, { headOnly: isHeadRequest });
-      } catch {
-        sendJson(res, 404, { error: 'Learn page not found' });
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: loadLearnPageHtml,
+          extraTelemetry: {
+            pageType: 'learn',
+          },
+        });
+      } catch (err) {
+        sendText(res, 500, err.message || 'Learn page unavailable');
       }
       return;
     }
@@ -4333,13 +5742,16 @@ async function addContext(){
       return;
     }
 
-    // Natural marketing URLs for the Workflow Hardening Sprint. Outbound
-    // messages, social posts, and word-of-mouth all refer to "the sprint"
-    // or "workflow hardening" — recipients who type or paste the natural
-    // URLs currently hit the generic API 401 JSON error and bounce.
-    // Redirect them to the canonical intake anchor instead.
+    // Natural marketing URLs for the Workflow Hardening Diagnostic/Sprint.
+    // High-intent outreach refers to "the diagnostic", "the sprint", or
+    // "workflow hardening"; serve a focused buyer page instead of sending
+    // qualified traffic to the generic homepage anchor.
     if (isGetLikeRequest && (
-      pathname === '/sprint'
+      pathname === '/diagnostic'
+      || pathname === '/diagnostic.html'
+      || pathname === '/workflow-diagnostic'
+      || pathname === '/workflow-diagnostic.html'
+      || pathname === '/sprint'
       || pathname === '/sprint.html'
       || pathname === '/workflow-hardening'
       || pathname === '/workflow-hardening.html'
@@ -4348,11 +5760,21 @@ async function addContext(){
       || pathname === '/workflow-sprint'
       || pathname === '/workflow-sprint.html'
     )) {
-      res.writeHead(302, {
-        Location: '/#workflow-sprint-intake',
-        'Cache-Control': 'no-store',
-      });
-      res.end();
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: loadDiagnosticPageHtml,
+          extraTelemetry: {
+            pageType: 'diagnostic',
+          },
+        });
+      } catch (err) {
+        sendText(res, 500, err.message || 'Diagnostic page unavailable');
+      }
       return;
     }
 
@@ -4398,6 +5820,94 @@ async function addContext(){
       return;
     }
 
+    if (isGetLikeRequest && (pathname === '/agent-manager' || pathname === '/agent-manager.html')) {
+      // ICP landing page for the role Anthropic named (Agent Manager —
+      // hybrid PM/engineer DRI who owns CLAUDE.md hierarchy, plugin
+      // marketplace, permissions policy, and which skills ship). Routed
+      // through servePublicMarketingPage so arrivals via X/Bluesky/LinkedIn
+      // threads about the role capture UTM attribution and
+      // landing_page_view telemetry for downstream pilot-pipeline analysis.
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: () => fs.readFileSync(path.join(PUBLIC_DIR, 'agent-manager.html'), 'utf-8'),
+          extraTelemetry: { pageType: 'agent_manager' },
+        });
+      } catch {
+        sendJson(res, 404, { error: 'Agent Manager page not found' });
+      }
+      return;
+    }
+
+    if (isGetLikeRequest && (pathname === '/codex-enterprise' || pathname === '/codex-enterprise.html')) {
+      // Landing page riding the 2026-05-20 OpenAI×Dell Codex Enterprise
+      // partnership announcement. Dell-distributed Codex expands the TAM
+      // for ThumbGate's governance layer — capture every agent decision,
+      // promote repeat failures to PreToolUse gates, ship the audit trail
+      // procurement requires. Routed through servePublicMarketingPage so
+      // arrivals via the partnership news cycle capture UTM attribution
+      // and landing_page_view telemetry with pageType: 'codex_enterprise'.
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: () => fs.readFileSync(path.join(PUBLIC_DIR, 'codex-enterprise.html'), 'utf-8'),
+          extraTelemetry: { pageType: 'codex_enterprise' },
+        });
+      } catch {
+        sendJson(res, 404, { error: 'Codex Enterprise page not found' });
+      }
+      return;
+    }
+
+    if (isGetLikeRequest && (pathname === '/agents-cost-savings' || pathname === '/agents-cost-savings.html')) {
+      // FinOps-for-AI positioning page. Pairs with the `thumbgate cost` CLI
+      // shipped in #2281: the CLI prints the dollar amount, this page is
+      // the public-facing explanation of why "prevention" (ThumbGate's
+      // PreToolUse gates) is a distinct category from "reporting" (Finout,
+      // Helicone, Vantage, AgentOps). Reply-to-pitch surface for buyers
+      // who get a FinOps-for-AI marketing email and need a frame.
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: () => fs.readFileSync(path.join(PUBLIC_DIR, 'agents-cost-savings.html'), 'utf-8'),
+          extraTelemetry: { pageType: 'agents_cost_savings' },
+        });
+      } catch {
+        sendJson(res, 404, { error: 'Agents Cost Savings page not found' });
+      }
+      return;
+    }
+
+    if (isGetLikeRequest && (pathname === '/ai-malpractice-prevention' || pathname === '/ai-malpractice-prevention.html')) {
+      // Legal-vertical landing page (2026-05-21).
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: () => fs.readFileSync(path.join(PUBLIC_DIR, 'ai-malpractice-prevention.html'), 'utf-8'),
+          extraTelemetry: { pageType: 'ai_malpractice_prevention' },
+        });
+      } catch {
+        sendJson(res, 404, { error: 'AI Malpractice Prevention page not found' });
+      }
+      return;
+    }
+
     if (isGetLikeRequest && pathname === '/learn/learn.css') {
       try {
         const cssPath = path.join(LEARN_DIR, 'learn.css');
@@ -4413,13 +5923,13 @@ async function addContext(){
 
     if (isGetLikeRequest && pathname.startsWith('/learn/')) {
       try {
-        const slug = normalizePublicPageSlug(pathname.replace('/learn/', ''));
-        const articlePath = path.join(LEARN_DIR, `${slug}.html`);
-        if (!articlePath.startsWith(LEARN_DIR)) {
-          sendJson(res, 403, { error: 'Forbidden' });
+        const articlePath = resolvePublicHtmlFile(LEARN_PAGE_PATHS_BY_SLUG, pathname.replace('/learn/', ''));
+        if (!articlePath) {
+          sendJson(res, 404, { error: 'Article not found' });
           return;
         }
-        const html = fs.readFileSync(articlePath, 'utf-8');
+        const requestHost = getSafePublicRequestHost(req);
+        const html = normalizePublicMarketingHtml(fs.readFileSync(articlePath, 'utf-8'), hostedConfig, requestHost);
         sendHtml(res, 200, html, {}, { headOnly: isHeadRequest });
       } catch {
         sendJson(res, 404, { error: 'Article not found' });
@@ -4429,10 +5939,10 @@ async function addContext(){
 
     if (isGetLikeRequest && pathname.startsWith('/guides/')) {
       try {
-        const slug = normalizePublicPageSlug(pathname.replace('/guides/', ''));
-        const guidePath = path.join(GUIDES_DIR, `${slug}.html`);
-        if (!guidePath.startsWith(GUIDES_DIR)) { sendJson(res, 403, { error: 'Forbidden' }); return; }
-        const html = fs.readFileSync(guidePath, 'utf-8');
+        const guidePath = resolvePublicHtmlFile(GUIDE_PAGE_PATHS_BY_SLUG, pathname.replace('/guides/', ''));
+        if (!guidePath) { sendJson(res, 404, { error: 'Guide not found' }); return; }
+        const requestHost = getSafePublicRequestHost(req);
+        const html = normalizePublicMarketingHtml(fs.readFileSync(guidePath, 'utf-8'), hostedConfig, requestHost);
         sendHtml(res, 200, html, {}, { headOnly: isHeadRequest });
       } catch { sendJson(res, 404, { error: 'Guide not found' }); }
       return;
@@ -4440,10 +5950,10 @@ async function addContext(){
 
     if (isGetLikeRequest && pathname.startsWith('/compare/') && pathname !== '/compare') {
       try {
-        const slug = normalizePublicPageSlug(pathname.replace('/compare/', ''));
-        const comparePath = path.join(COMPARE_DIR, `${slug}.html`);
-        if (!comparePath.startsWith(COMPARE_DIR)) { sendJson(res, 403, { error: 'Forbidden' }); return; }
-        const html = fs.readFileSync(comparePath, 'utf-8');
+        const comparePath = resolvePublicHtmlFile(COMPARE_PAGE_PATHS_BY_SLUG, pathname.replace('/compare/', ''));
+        if (!comparePath) { sendJson(res, 404, { error: 'Comparison not found' }); return; }
+        const requestHost = getSafePublicRequestHost(req);
+        const html = normalizePublicMarketingHtml(fs.readFileSync(comparePath, 'utf-8'), hostedConfig, requestHost);
         sendHtml(res, 200, html, {}, { headOnly: isHeadRequest });
       } catch { sendJson(res, 404, { error: 'Comparison not found' }); }
       return;
@@ -4451,10 +5961,10 @@ async function addContext(){
 
     if (isGetLikeRequest && pathname.startsWith('/use-cases/')) {
       try {
-        const slug = normalizePublicPageSlug(pathname.replace('/use-cases/', ''));
-        const useCasePath = path.join(USE_CASES_DIR, `${slug}.html`);
-        if (!useCasePath.startsWith(USE_CASES_DIR)) { sendJson(res, 403, { error: 'Forbidden' }); return; }
-        const html = fs.readFileSync(useCasePath, 'utf-8');
+        const useCasePath = resolvePublicHtmlFile(USE_CASE_PAGE_PATHS_BY_SLUG, pathname.replace('/use-cases/', ''));
+        if (!useCasePath) { sendJson(res, 404, { error: 'Use case not found' }); return; }
+        const requestHost = getSafePublicRequestHost(req);
+        const html = normalizePublicMarketingHtml(fs.readFileSync(useCasePath, 'utf-8'), hostedConfig, requestHost);
         sendHtml(res, 200, html, {}, { headOnly: isHeadRequest });
       } catch { sendJson(res, 404, { error: 'Use case not found' }); }
       return;
@@ -4471,6 +5981,18 @@ async function addContext(){
       return;
     }
 
+    if (isGetLikeRequest && pathname.startsWith('/media/')) {
+      const rel = pathname.slice('/media/'.length);
+      const mediaDir = path.join(PUBLIC_DIR, 'media');
+      const resolved = path.resolve(mediaDir, rel);
+      if (!resolved.startsWith(mediaDir + path.sep) && resolved !== mediaDir) {
+        sendJson(res, 403, { error: 'Forbidden' });
+        return;
+      }
+      serveStaticFile(res, resolved, { headOnly: isHeadRequest });
+      return;
+    }
+
     if (isGetLikeRequest && (
       pathname === '/favicon.ico'
       || pathname === '/thumbgate-logo.png'
@@ -4489,7 +6011,7 @@ async function addContext(){
           version: pkg.version,
           status: 'ok',
           docs: 'https://github.com/IgorGanapolsky/ThumbGate',
-          endpoints: ['/health', '/dashboard', '/guide', '/codex-plugin', '/compare', '/learn', '/v1/feedback/capture', '/v1/feedback/stats', '/v1/feedback/summary', '/v1/lessons/search', '/v1/search', '/v1/documents', '/v1/documents/import', '/v1/documents/{documentId}', '/v1/dashboard', '/v1/dashboard/render-spec', '/v1/decisions/evaluate', '/v1/decisions/outcome', '/v1/decisions/metrics', '/v1/settings/status', '/v1/dpo/export', '/v1/jobs', '/v1/jobs/harness', '/v1/analytics/databricks/export'],
+          endpoints: ['/health', '/dashboard', '/guide', '/chatgpt-app', '/codex-plugin', '/compare', '/learn', '/pricing', '/v1/feedback/capture', '/v1/feedback/stats', '/v1/feedback/summary', '/v1/lessons/search', '/v1/search', '/v1/documents', '/v1/documents/import', '/v1/documents/{documentId}', '/v1/dashboard', '/v1/dashboard/ai-inventory', '/v1/dashboard/render-spec', '/v1/decisions/evaluate', '/v1/decisions/outcome', '/v1/decisions/metrics', '/v1/settings/status', '/v1/dpo/export', '/v1/jobs', '/v1/jobs/harness', '/v1/analytics/databricks/export'],
         }, {}, {
           headOnly: isHeadRequest,
         });
@@ -4514,9 +6036,14 @@ async function addContext(){
       return;
     }
 
-    if (isGetLikeRequest && pathname === '/checkout/pro') {
+    // HOTFIX 2026-06-04 — accept ANY method (GET/HEAD/POST) on /checkout/pro
+    // to prevent the API-key guard from 401'ing real prospective customers
+    // whose forms or fetch() calls land via POST. Audit: 69 emails submitted
+    // → 0 paid because POST hit the auth gate. Query params still drive the
+    // Stripe session creation; POST bodies are ignored harmlessly.
+    if ((isGetLikeRequest || req.method === 'POST') && pathname === '/checkout/pro') {
       if (isHeadRequest) {
-        sendText(res, 200, '', {}, {
+        sendHtml(res, 200, '', {}, {
           headOnly: true,
         });
         return;
@@ -4545,10 +6072,76 @@ async function addContext(){
       // (form submission JS-less bots don't do), (b) a `customer_email`
       // query param treats the request as confirmed even from a bot UA,
       // because no real crawler appends customer_email to discovered URLs.
+      const rawCheckoutEmail = normalizeNullableText(bootstrapBody.customerEmail);
+      const normalizedCheckoutEmail = normalizeCheckoutCustomerEmail(rawCheckoutEmail);
       const hasCustomerEmailHint = !!parsed?.searchParams?.has('customer_email');
-      const botShouldBypass = !botClassification.isBot || hasCustomerEmailHint;
-      const isConfirmedCheckout = req.method === 'POST'
-        || (hasConfirmFlag && botShouldBypass);
+      const hasValidCustomerEmailHint = !!normalizedCheckoutEmail;
+      const botShouldBypass = !botClassification.isBot || hasValidCustomerEmailHint;
+      // 2026-06-29 conversion audit: requiring email before Stripe gave us a
+      // recoverable abandoned-session theory, but the hosted funnel showed
+      // traffic with 0 checkout starts. Let confirmed human clicks reach
+      // Stripe; Stripe can collect email on the secure checkout page. Bots
+      // still need a valid email hint to bypass deflection.
+      const isConfirmedCheckout = (
+        (req.method === 'POST' && hasValidCustomerEmailHint)
+        || hasConfirmFlag
+      ) && botShouldBypass;
+      // 2026-06-05 revenue bypass: env-gated direct-to-Stripe redirect.
+      // Live 30d billing showed 254 interstitial views → 1 Stripe click-through
+      // → 0 paid. When THUMBGATE_CHECKOUT_INTERSTITIAL_BYPASS=1 is set we
+      // route raw /checkout/pro GETs (no confirm=1, no POST) straight to the
+      // pro Stripe Payment Link, preserving UTM + attribution metadata via
+      // buildCheckoutFallbackUrl. Default-off; bot-deflection still applies
+      // (bot + no email hint still falls through to the existing interstitial).
+      const interstitialBypassEnabled = process.env.THUMBGATE_CHECKOUT_INTERSTITIAL_BYPASS !== '0';
+      const interstitialSampleRate = normalizeCheckoutInterstitialSampleRate(
+        process.env.THUMBGATE_CHECKOUT_INTERSTITIAL_SAMPLE_RATE
+      );
+      const interstitialSampled = shouldSampleCheckoutInterstitial({
+        sampleRate: interstitialSampleRate,
+        traceId,
+        analyticsMetadata,
+      });
+      if (
+        !isConfirmedCheckout
+        && interstitialBypassEnabled
+        && req.method !== 'POST'
+        && botShouldBypass
+        && !interstitialSampled
+      ) {
+        // Always target the pro Stripe Payment Link directly. The
+        // hostedConfig.checkoutFallbackUrl (e.g. https://thumbgate.ai/go/pro)
+        // is a router that 302s back to /checkout/pro, which would create a
+        // redirect loop when bypass is on. Env override via
+        // THUMBGATE_CHECKOUT_PRO_STRIPE_URL is supported for future
+        // price-link rotation without a redeploy.
+        const bypassTarget = process.env.THUMBGATE_CHECKOUT_PRO_STRIPE_URL
+          || FIRST_FAILURE_RULE_CHECKOUT_URL;
+        appendBestEffortTelemetry(FEEDBACK_DIR, {
+          eventType: 'checkout_interstitial_bypass_redirect',
+          clientType: 'web',
+          traceId,
+          acquisitionId: analyticsMetadata.acquisitionId,
+          visitorId: analyticsMetadata.visitorId,
+          sessionId: analyticsMetadata.sessionId,
+          utmSource: analyticsMetadata.utmSource,
+          utmMedium: analyticsMetadata.utmMedium,
+          utmCampaign: analyticsMetadata.utmCampaign,
+          utmContent: analyticsMetadata.utmContent,
+          utmTerm: analyticsMetadata.utmTerm,
+          referrer: analyticsMetadata.referrer,
+          referrerHost: analyticsMetadata.referrerHost,
+          page: '/checkout/pro',
+          planId: analyticsMetadata.planId,
+          interstitialSampleRate,
+        }, req.headers, 'checkout_interstitial_bypass_redirect');
+        res.writeHead(302, {
+          ...responseHeaders,
+          Location: buildCheckoutFallbackUrl(bypassTarget, analyticsMetadata),
+        });
+        res.end();
+        return;
+      }
       // Plausible funnel event #1 of 3: page view. Fired before interstitial
       // deflection so we get the full top-of-funnel count, with isBot as a
       // prop so the dashboard can filter human vs. crawler traffic. Fire-and-forget.
@@ -4586,6 +6179,7 @@ async function addContext(){
         const eventType = botClassification.isBot
           ? 'checkout_bot_deflected'
           : 'checkout_interstitial_view';
+        const missingConfirmedEmail = hasConfirmFlag && !hasValidCustomerEmailHint;
         appendBestEffortTelemetry(FEEDBACK_DIR, {
           eventType,
           clientType: 'web',
@@ -4604,27 +6198,24 @@ async function addContext(){
           ctaId: analyticsMetadata.ctaId,
           ctaPlacement: analyticsMetadata.ctaPlacement,
           planId: analyticsMetadata.planId,
+          billingCycle: analyticsMetadata.billingCycle,
+          landingPath: analyticsMetadata.landingPath,
           isBot: botClassification.isBot ? 'true' : 'false',
-          reason: botClassification.reason,
+          interstitialSampled: interstitialSampled ? 'true' : 'false',
+          interstitialSampleRate,
+          reason: missingConfirmedEmail
+            ? (hasCustomerEmailHint ? 'invalid_customer_email' : 'missing_customer_email')
+            : botClassification.reason,
+          confirmEmailRequired: missingConfirmedEmail ? 'true' : 'false',
         }, req.headers, eventType);
-        const workflowIntakeHref = buildCheckoutIntentHref(`${hostedConfig.appOrigin}/#workflow-sprint-intake`, analyticsMetadata, {
-          utmMedium: 'checkout_interstitial_recovery',
-          utmCampaign: analyticsMetadata.utmCampaign || 'checkout_interstitial_workflow_sprint',
-          ctaId: 'checkout_interstitial_workflow_sprint_intake',
-          ctaPlacement: 'checkout_interstitial',
-          planId: 'team',
-        });
-        const html = renderCheckoutIntentPage({
-          confirmHref: buildCheckoutConfirmHref(parsed),
-          workflowIntakeHref,
-          botClassification,
+        const prefilledEmail = parsed?.searchParams?.get('customer_email') || '';
+        const html = renderCheckoutIntentPage(prefilledEmail, parsed, {
+          includeHiddenAttribution: !botClassification.isBot,
         });
         sendHtml(res, 200, html, responseHeaders);
         return;
       }
 
-      const rawCheckoutEmail = normalizeNullableText(bootstrapBody.customerEmail);
-      const normalizedCheckoutEmail = normalizeCheckoutCustomerEmail(rawCheckoutEmail);
       if (!normalizedCheckoutEmail) {
         appendBestEffortTelemetry(FEEDBACK_DIR, {
           eventType: 'checkout_email_deferred_to_stripe',
@@ -4881,10 +6472,13 @@ async function addContext(){
       // Public-facing broker lead-flow audit landing page. Wedge for the
       // real-estate broker outreach. Static HTML served from src/api/static.
       try {
-        const html = fs.readFileSync(
+        const host = getSafePublicRequestHost(req);
+        const html = normalizePublicMarketingHtml(fillTemplate(fs.readFileSync(
           path.resolve(__dirname, '../../assets/static/broker-audit.html'),
           'utf8'
-        );
+        ), {
+          '__POSTHOG_API_KEY__': hostedConfig.posthogApiKey || '',
+        }), hostedConfig, host);
         if (isHeadRequest) {
           sendHtml(res, 200, html, {}, { headOnly: true });
           return;
@@ -4897,6 +6491,25 @@ async function addContext(){
       return;
     }
 
+    if (isGetLikeRequest && pathname === '/leash-beta') {
+      // Hermes Mobile founding beta landing (mac-yolo-safeguards/hermes-mobile/docs/beta-page).
+      try {
+        const html = fs.readFileSync(
+          path.resolve(__dirname, '../../assets/static/leash-beta.html'),
+          'utf8'
+        );
+        if (isHeadRequest) {
+          sendHtml(res, 200, html, {}, { headOnly: true });
+          return;
+        }
+        sendHtml(res, 200, html);
+      } catch (err) {
+        console.error('leash-beta page read failed:', err?.message);
+        sendJson(res, 500, { error: 'leash-beta page unavailable' });
+      }
+      return;
+    }
+
     if (isGetLikeRequest && pathname === '/.well-known/mcp.json') {
       sendJson(res, 200, getMcpDiscoveryManifest(hostedConfig), {}, {
         headOnly: isHeadRequest,
@@ -4904,6 +6517,117 @@ async function addContext(){
       return;
     }
 
+    // OAuth 2.1 discovery metadata for the remote MCP connector (RFC 9728 / RFC 8414).
+    // Lets Claude discover how to authenticate before calling authenticated tools.
+    if (isGetLikeRequest && pathname === '/.well-known/oauth-protected-resource') {
+      sendJson(res, 200, mcpOauth.buildProtectedResourceMetadata(buildPublicUrl(hostedConfig, '')), {}, {
+        headOnly: isHeadRequest,
+      });
+      return;
+    }
+    if (isGetLikeRequest && (pathname === '/.well-known/oauth-authorization-server' || pathname === '/.well-known/openid-configuration')) {
+      sendJson(res, 200, mcpOauth.buildAuthServerMetadata(buildPublicUrl(hostedConfig, '')), {}, {
+        headOnly: isHeadRequest,
+      });
+      return;
+    }
+
+    // --- OAuth 2.1 (PKCE) endpoints for the remote MCP connector ---
+    // RFC 7591 Dynamic Client Registration.
+    if (req.method === 'POST' && pathname === '/oauth/register') {
+      let body = '';
+      req.on('data', (c) => { body += c; if (body.length > 16384) req.destroy(); });
+      req.on('end', () => {
+        let parsed = {};
+        try { parsed = body ? JSON.parse(body) : {}; } catch { /* ignore */ }
+        const reg = mcpOauth.registerClient(oauthStore, parsed);
+        if (reg.error) { sendJson(res, 400, reg); return; }
+        sendJson(res, 201, reg);
+      });
+      return;
+    }
+    // Authorization endpoint: GET renders consent, POST issues the code.
+    if (pathname === '/oauth/authorize') {
+      if (isGetLikeRequest) {
+        const authRequestToken = createPendingOauthAuthorizeRequest(
+          getOauthAuthorizeParamsFromQuery(parsed.searchParams)
+        );
+        const html = `<!doctype html><html><head><meta charset="utf-8"><title>Authorize ThumbGate</title>
+<style>body{font:15px system-ui;margin:0;background:#0b0b0c;color:#eee;display:flex;min-height:100vh;align-items:center;justify-content:center}
+.card{background:#161618;border:1px solid #2a2a2e;border-radius:12px;padding:28px;max-width:420px}
+input[type=password]{width:100%;padding:10px;margin:8px 0 16px;border-radius:8px;border:1px solid #2a2a2e;background:#0b0b0c;color:#eee}
+button{width:100%;padding:11px;border-radius:8px;border:0;background:#10b981;color:#04120c;font-weight:600;cursor:pointer}
+a{color:#8b9}</style></head><body><form class="card" method="post" action="/oauth/authorize">
+<h2>Authorize Claude → ThumbGate</h2>
+<p>Paste your ThumbGate API key to let this connector act as you. Get one with <code>npx thumbgate init</code> or from your <a href="/dashboard">dashboard</a>.</p>
+<input type="hidden" name="auth_request_token" value="${escapeHtmlAttribute(authRequestToken)}">
+<input type="password" name="api_key" placeholder="ThumbGate API key" autocomplete="off" required>
+<button type="submit" name="approve" value="yes">Approve</button>
+</form></body></html>`;
+        sendHtml(res, 200, html, {}, { headOnly: isHeadRequest });
+        return;
+      }
+      if (req.method === 'POST') {
+        let body = '';
+        req.on('data', (c) => { body += c; if (body.length > 16384) req.destroy(); });
+        req.on('end', () => {
+          const form = new URLSearchParams(body);
+          const authorizationParams = getOauthAuthorizeParamsFromForm(form, hostedConfig);
+          const redirectUri = authorizationParams.redirectUri;
+          const state = authorizationParams.state;
+          // Validate the presented ThumbGate key before issuing a code. When keys
+          // are configured (production) the key MUST match a configured admin /
+          // operator / reviewer key — otherwise OAuth would authenticate nobody.
+          // In insecure/dev mode (no keys configured) any non-empty key is accepted.
+          if (!resolveKeyRole(form.get('api_key') || '')) {
+            sendJson(res, 400, { error: 'access_denied', error_description: 'invalid ThumbGate API key' });
+            return;
+          }
+          const issued = mcpOauth.createAuthorizationCode(oauthStore, {
+            clientId: authorizationParams.clientId,
+            redirectUri,
+            codeChallenge: authorizationParams.codeChallenge,
+            codeChallengeMethod: authorizationParams.codeChallengeMethod,
+            scope: authorizationParams.scope,
+            resource: authorizationParams.resource || buildPublicUrl(hostedConfig, '/mcp'),
+            boundKey: form.get('api_key') || '',
+            state,
+          });
+          if (issued.error) {
+            sendJson(res, 400, { error: issued.error, error_description: issued.error_description });
+            return;
+          }
+          const sep = redirectUri.includes('?') ? '&' : '?';
+          const loc = `${redirectUri}${sep}code=${encodeURIComponent(issued.code)}${state ? `&state=${encodeURIComponent(state)}` : ''}`;
+          res.writeHead(302, { Location: loc });
+          res.end();
+        });
+        return;
+      }
+    }
+    // Token endpoint (authorization_code + PKCE).
+    if (req.method === 'POST' && pathname === '/oauth/token') {
+      let body = '';
+      req.on('data', (c) => { body += c; if (body.length > 16384) req.destroy(); });
+      req.on('end', () => {
+        const form = new URLSearchParams(body);
+        if (form.get('grant_type') !== 'authorization_code') {
+          sendJson(res, 400, { error: 'unsupported_grant_type' });
+          return;
+        }
+        const tok = mcpOauth.exchangeCode(oauthStore, {
+          code: form.get('code') || '',
+          codeVerifier: form.get('code_verifier') || '',
+          clientId: form.get('client_id') || '',
+          redirectUri: form.get('redirect_uri') || '',
+          resource: form.get('resource') || undefined,
+        });
+        if (tok.error) { sendJson(res, 400, tok); return; }
+        sendJson(res, 200, tok, { 'Cache-Control': 'no-store' });
+      });
+      return;
+    }
+
     if (isGetLikeRequest && pathname === '/.well-known/mcp/tools.json') {
       sendJson(res, 200, {
         name: 'thumbgate',
@@ -5016,40 +6740,57 @@ async function addContext(){
       // was down, when feedback-dir was unwritable, when env was misconfigured.
       // The fix is shallow but meaningful: probe each critical subsystem and
       // surface failures with HTTP 503 + a per-check breakdown.
+      // Tiered failure classification — not all degradations should kill the
+      // container. A *service-failing* check (feedback dir unwritable,
+      // appOrigin missing) returns 503 → Railway's healthcheck fails → SIGTERM
+      // → restart loop → outage (this exact failure mode took prod down
+      // 2026-05-21 18:21Z → 19:30Z when BUILD_METADATA.buildSha came up empty
+      // after a Railway env-var cleanup). A *telemetry-degraded* check (missing
+      // buildSha) returns 200 with `degraded: true` so observability stays
+      // visible but Railway doesn't kill an otherwise-healthy container over
+      // a SHA gap.
       const checks = {};
-      let allOk = true;
+      let failing = false;     // any service-failing check → 503
+      let degraded = false;    // any telemetry-degraded check → 200 + flag
 
       // Check 1: feedback dir exists and is writable.
+      // SERVICE-FAILING — if we can't write feedback, the API can't function.
       try {
         const { FEEDBACK_DIR } = getFeedbackPaths();
         fs.accessSync(FEEDBACK_DIR, fs.constants.W_OK);
         checks.feedbackDir = { ok: true };
       } catch (err) {
-        checks.feedbackDir = { ok: false, error: err?.code || 'inaccessible' };
-        allOk = false;
+        checks.feedbackDir = { ok: false, error: err?.code || 'inaccessible', severity: 'failing' };
+        failing = true;
       }
 
       // Check 2: hosted config resolves the canonical app origin.
-      // If appOrigin is missing/empty, redirects + checkout flow break silently.
+      // SERVICE-FAILING — if appOrigin is missing/empty, redirects + checkout
+      // flow break silently.
       if (hostedConfig?.appOrigin) {
         checks.hostedConfig = { ok: true };
       } else {
-        checks.hostedConfig = { ok: false, error: 'missing_appOrigin' };
-        allOk = false;
+        checks.hostedConfig = { ok: false, error: 'missing_appOrigin', severity: 'failing' };
+        failing = true;
       }
 
-      // Check 3: build metadata loaded. If BUILD_METADATA.buildSha is empty,
-      // Railway didn't inject the deploy SHA — observability is degraded.
+      // Check 3: build metadata loaded.
+      // TELEMETRY-DEGRADED — observability gap, not a runtime outage. The
+      // container still serves requests fine; we just can't tag responses with
+      // the deployed SHA. Surfaces the gap to monitors via `degraded: true`
+      // without triggering Railway's SIGTERM-on-503 loop.
       if (BUILD_METADATA?.buildSha) {
         checks.buildMetadata = { ok: true };
       } else {
-        checks.buildMetadata = { ok: false, error: 'missing_buildSha' };
-        allOk = false;
+        checks.buildMetadata = { ok: false, error: 'missing_buildSha', severity: 'degraded' };
+        degraded = true;
       }
 
-      const statusCode = allOk ? 200 : 503;
+      const statusCode = failing ? 503 : 200;
+      const status = failing ? 'failing' : (degraded ? 'degraded' : 'ok');
       sendJson(res, statusCode, {
-        status: allOk ? 'ok' : 'degraded',
+        status,
+        degraded: degraded || failing,
         version: pkg.version,
         buildSha: BUILD_METADATA.buildSha,
         uptime: process.uptime(),
@@ -5119,7 +6860,7 @@ async function addContext(){
               evidence: [err?.message ? err.message : 'unknown_error'],
             },
           });
-        } catch (_) {
+        } catch {
           // Telemetry is best-effort and must never fail the caller.
         }
       }
@@ -5144,18 +6885,28 @@ async function addContext(){
     }
 
     if (req.method === 'GET' && pathname === '/v1/metrics/real') {
-      const bd = require('../../scripts/bot-detector');
+      const bd = require('../../scripts/bot-detection');
       const { FEEDBACK_DIR: metricsDir } = getFeedbackPaths();
       const telemetryPath = path.join(metricsDir, 'telemetry-pings.jsonl');
-      let entries = [];
-      try {
-        if (fs.existsSync(telemetryPath)) {
-          entries = fs.readFileSync(telemetryPath, 'utf8')
-            .split('\n').filter(Boolean)
-            .map(l => { try { return JSON.parse(l); } catch(_e) { return null; } })
-            .filter(Boolean);
-        }
-      } catch { entries = []; }
+
+      // Cache parsed entries for 60s to avoid re-parsing 72K+ JSON lines per request
+      const cacheKey = '_metricsRealCache';
+      const cacheTTL = 60_000;
+      let entries;
+      if (global[cacheKey] && (Date.now() - global[cacheKey].ts) < cacheTTL) {
+        entries = global[cacheKey].entries;
+      } else {
+        entries = [];
+        try {
+          if (fs.existsSync(telemetryPath)) {
+            entries = fs.readFileSync(telemetryPath, 'utf8')
+              .split('\n').filter(Boolean)
+              .map(l => { try { return JSON.parse(l); } catch(_e) { return null; } })
+              .filter(Boolean);
+          }
+        } catch { entries = []; }
+        global[cacheKey] = { entries, ts: Date.now() };
+      }
 
       const now = Date.now();
       const sevenDaysAgo = now - 7 * 24 * 60 * 60 * 1000;
@@ -5184,6 +6935,52 @@ async function addContext(){
         byVisitorType[e.visitorType] = (byVisitorType[e.visitorType] || 0) + 1;
       });
 
+      // ---------------------------------------------------------------
+      // Active user analytics: group by installId to distinguish real
+      // users from bots/mirrors. "Active" = performed a meaningful CLI
+      // action (capture, recall, search, gate-check, stats) — not just init.
+      // ---------------------------------------------------------------
+      // Only events that prove a human used the product beyond init.
+      // cli_pro_view excluded: browsing the upgrade page is not "using" the product.
+      // cli_gate_check excluded: runs as subprocess, never fires trackEvent().
+      // cli_search excluded: event name doesn't exist in production telemetry.
+      const ACTIVE_EVENTS = new Set([
+        'cli_capture', 'cli_recall', 'cli_stats',
+        'activation_first_rule_promoted',
+      ]);
+      const thirtyDaysAgo = now - 30 * 24 * 60 * 60 * 1000;
+      const last30 = classified.filter(e => {
+        const ts = e.timestamp || e.receivedAt;
+        return ts && new Date(ts).getTime() > thirtyDaysAgo;
+      });
+
+      // Per-install activity (all-time and recent windows)
+      const activeInstalls7d = new Set();
+      const activeInstalls30d = new Set();
+      const allTimeActiveInstalls = new Set();
+      const uniqueSessions7d = new Set();
+      const uniqueSessions30d = new Set();
+
+      for (const e of classified) {
+        if (!e.installId) continue;
+        const et = e.eventType || '';
+        if (!ACTIVE_EVENTS.has(et)) continue;
+        if (e.visitorType === 'bot' || e.visitorType === 'ci') continue;
+        allTimeActiveInstalls.add(e.installId);
+      }
+      for (const e of recent) {
+        if (!e.installId) continue;
+        if (e.visitorType === 'bot' || e.visitorType === 'ci') continue;
+        if (ACTIVE_EVENTS.has(e.eventType || '')) activeInstalls7d.add(e.installId);
+        if (e.sessionId) uniqueSessions7d.add(e.sessionId);
+      }
+      for (const e of last30) {
+        if (!e.installId) continue;
+        if (e.visitorType === 'bot' || e.visitorType === 'ci') continue;
+        if (ACTIVE_EVENTS.has(e.eventType || '')) activeInstalls30d.add(e.installId);
+        if (e.sessionId) uniqueSessions30d.add(e.sessionId);
+      }
+
       sendJson(res, 200, {
         allTime: {
           total: classified.length,
@@ -5192,6 +6989,12 @@ async function addContext(){
           owner: classified.filter(e => e.visitorType === 'owner').length,
           ci: classified.filter(e => e.visitorType === 'ci').length,
           uniqueInstalls: uniqueInstallIds.size,
+          activeInstalls: allTimeActiveInstalls.size,
+        },
+        last30Days: {
+          uniqueInstalls: new Set(last30.filter(e => e.installId).map(e => e.installId)).size,
+          activeInstalls: activeInstalls30d.size,
+          uniqueSessions: uniqueSessions30d.size,
         },
         last7Days: {
           total: recent.length,
@@ -5200,6 +7003,8 @@ async function addContext(){
           owner: recent.filter(e => e.visitorType === 'owner').length,
           ci: recent.filter(e => e.visitorType === 'ci').length,
           uniqueInstalls: recentInstallIds.size,
+          activeInstalls: activeInstalls7d.size,
+          uniqueSessions: uniqueSessions7d.size,
         },
         byEventType,
         byVisitorType,
@@ -5264,6 +7069,7 @@ async function addContext(){
         source,
         telemetry: { rows: [], truncated: false, totalAfterSince: 0 },
         funnel: { rows: [], truncated: false, totalAfterSince: 0 },
+        journeySummary: null,
       };
 
       function readJsonlSince(p) {
@@ -5293,25 +7099,173 @@ async function addContext(){
         result.telemetry.truncated = all.length > limit;
       }
 
-      if (wantFunnel) {
-        // Use the canonical funnel ledger path from scripts/billing.js so
-        // any test override (THUMBGATE_FUNNEL_LEDGER_PATH / _TEST_FUNNEL_LEDGER_PATH)
-        // resolves correctly. Falls back to the feedback dir's funnel-events.jsonl.
-        let funnelPath;
+      if (wantFunnel) {
+        // Use the canonical funnel ledger path from scripts/billing.js so
+        // any test override (THUMBGATE_FUNNEL_LEDGER_PATH / _TEST_FUNNEL_LEDGER_PATH)
+        // resolves correctly. Falls back to the feedback dir's funnel-events.jsonl.
+        let funnelPath;
+        try {
+          const billing = require('../../scripts/billing');
+          funnelPath = (billing._FUNNEL_LEDGER_PATH && billing._FUNNEL_LEDGER_PATH())
+            || path.join(exportDir, 'funnel-events.jsonl');
+        } catch {
+          funnelPath = path.join(exportDir, 'funnel-events.jsonl');
+        }
+        const all = readJsonlSince(funnelPath);
+        result.funnel.totalAfterSince = all.length;
+        result.funnel.rows = all.slice(-limit);
+        result.funnel.truncated = all.length > limit;
+      }
+
+      try {
+        const { buildVisitorJourneySummary } = require('../../scripts/visitor-journey');
+        result.journeySummary = buildVisitorJourneySummary({
+          telemetryRows: wantTelemetry ? result.telemetry.rows : [],
+          funnelRows: wantFunnel ? result.funnel.rows : [],
+          limit: Math.min(limit, 500),
+        });
+      } catch (err) {
+        result.journeySummary = {
+          error: err && err.message ? err.message : 'journey_summary_unavailable',
+        };
+      }
+
+      sendJson(res, 200, result);
+      return;
+    }
+
+    if (req.method === 'OPTIONS' && pathname === '/v1/marketing/install-email') {
+      // CORS preflight for the npm postinstall email-capture endpoint.
+      // The endpoint is called from `npx thumbgate subscribe <email>` so
+      // the CLI gets the right CORS headers if it ever hits the proxy
+      // path; in practice CLI hits the server directly so this is mostly
+      // defense-in-depth.
+      sendPublicBillingPreflight(res);
+      return;
+    }
+
+    if (req.method === 'POST' && pathname === '/v1/marketing/install-email') {
+      // Email-capture wedge for npm installers. The `subscribe` CLI
+      // subcommand POSTs { email, source, installId, cliVersion } here;
+      // we validate the email, persist it to a dedicated capture ledger
+      // (telemetry sanitizer would strip the email as PII), emit a
+      // privacy-clean telemetry ping for funnel attribution, and fire
+      // a Resend newsletter welcome (if RESEND_API_KEY is configured).
+      // No auth required — this is a public opt-in surface.
+      const { FEEDBACK_DIR } = getFeedbackPaths();
+      let body = '';
+      let total = 0;
+      let oversize = false;
+      const MAX_BODY = 2048;
+      req.on('data', (chunk) => {
+        total += chunk.length;
+        if (total > MAX_BODY) {
+          oversize = true;
+          return; // stop appending; let 'end' fire naturally to send 413
+        }
+        body += chunk;
+      });
+      req.on('end', async () => {
+        if (oversize) {
+          sendJson(res, 413, { error: 'payload_too_large' });
+          return;
+        }
+        let parsed;
+        try {
+          parsed = body ? JSON.parse(body) : {};
+        } catch {
+          sendJson(res, 400, { error: 'invalid_json' });
+          return;
+        }
+        const rawEmail = typeof parsed.email === 'string' ? parsed.email.trim() : '';
+        // RFC 5321-bounded email shape — same regex shape as the CLI side
+        // to keep the contract honest.
+        const emailValid = /^[^\s@]{1,64}@[^\s@]{1,255}\.[^\s@]{1,64}$/.test(rawEmail);
+        if (!emailValid) {
+          sendJson(res, 400, { error: 'invalid_email' });
+          return;
+        }
+        const source = typeof parsed.source === 'string' && parsed.source.length <= 64
+          ? parsed.source
+          : 'cli_subscribe';
+        const installId = typeof parsed.installId === 'string' && parsed.installId.length <= 128
+          ? parsed.installId
+          : null;
+        const cliVersion = typeof parsed.cliVersion === 'string' && parsed.cliVersion.length <= 32
+          ? parsed.cliVersion
+          : null;
+
+        // Persist the capture to a dedicated ledger. The standard
+        // telemetry sanitizer in scripts/telemetry-analytics.js
+        // intentionally strips arbitrary fields (PII protection), so
+        // we cannot rely on appendBestEffortTelemetry to preserve the
+        // email. The capture ledger lives alongside other feedback
+        // artifacts and is the source of truth for the marketing drip.
+        try {
+          const fsModule = require('node:fs');
+          const pathModule = require('node:path');
+          const captureDir = pathModule.resolve(FEEDBACK_DIR);
+          fsModule.mkdirSync(captureDir, { recursive: true });
+          const capturePath = pathModule.join(captureDir, 'marketing-install-emails.jsonl');
+          fsModule.appendFileSync(capturePath, JSON.stringify({
+            capturedAt: new Date().toISOString(),
+            email: rawEmail,
+            source,
+            installId,
+            cliVersion,
+            remoteAddr: req.socket?.remoteAddress || null,
+            userAgent: req.headers['user-agent'] || null,
+          }) + '\n', 'utf-8');
+        } catch (err) {
+          // Capture failure is recoverable — we still want to fire the
+          // welcome email and surface the failure to ops via diagnostic.
+          try {
+            const { appendDiagnosticRecord } = require('../../scripts/feedback-loop');
+            appendDiagnosticRecord({
+              source: 'install_email_capture',
+              step: 'capture_persist',
+              context: 'failed to persist install-email capture to ledger',
+              metadata: { error: err?.message || 'unknown' },
+            });
+          } catch {}
+        }
+
+        // Privacy-clean telemetry ping for funnel attribution (no email).
+        appendBestEffortTelemetry(FEEDBACK_DIR, {
+          eventType: 'marketing_install_email_captured',
+          clientType: 'cli',
+          source,
+          installId,
+          cliVersion,
+          utmSource: source,
+          utmMedium: 'npm_postinstall',
+          utmCampaign: 'install_email_capture',
+        }, req.headers, 'marketing_install_email_captured');
+
+        // Fire Resend welcome. If RESEND_API_KEY is unset the mailer
+        // returns { sent: false, reason: 'no_api_key' } and the
+        // capture still succeeds — the operator can drip later from
+        // the captured ledger.
+        let mailerResult = { sent: false, reason: 'not_attempted' };
         try {
-          const billing = require('../../scripts/billing');
-          funnelPath = (billing._FUNNEL_LEDGER_PATH && billing._FUNNEL_LEDGER_PATH())
-            || path.join(exportDir, 'funnel-events.jsonl');
-        } catch {
-          funnelPath = path.join(exportDir, 'funnel-events.jsonl');
+          const { sendNewsletterWelcomeEmail } = require('../../scripts/mailer');
+          mailerResult = await sendNewsletterWelcomeEmail({
+            to: rawEmail,
+            source,
+            installId,
+            cliVersion,
+          });
+        } catch (err) {
+          mailerResult = { sent: false, reason: `mailer_error:${err.message || 'unknown'}` };
         }
-        const all = readJsonlSince(funnelPath);
-        result.funnel.totalAfterSince = all.length;
-        result.funnel.rows = all.slice(-limit);
-        result.funnel.truncated = all.length > limit;
-      }
 
-      sendJson(res, 200, result);
+        sendJson(res, 200, {
+          ok: true,
+          captured: true,
+          mailerSent: !!mailerResult.sent,
+          mailerReason: mailerResult.reason || null,
+        });
+      });
       return;
     }
 
@@ -5320,6 +7274,130 @@ async function addContext(){
       return;
     }
 
+    if (req.method === 'OPTIONS' && pathname === '/v1/intake/broker-audit') {
+      sendPublicBillingPreflight(res);
+      return;
+    }
+
+    if (req.method === 'POST' && pathname === '/v1/intake/broker-audit') {
+      const { FEEDBACK_DIR } = getFeedbackPaths();
+      const traceId = createTraceId('broker_audit');
+      const journeyState = resolveJourneyState(req, parsed);
+      const referrerAttribution = buildReferrerAttribution(req);
+      const contentType = String(req.headers['content-type'] || '').toLowerCase();
+      const isFormSubmission = contentType.includes('application/x-www-form-urlencoded');
+      try {
+        const body = isFormSubmission
+          ? await parseFormBody(req, 16 * 1024)
+          : await parseJsonBody(req, 16 * 1024);
+        const lead = appendBrokerAuditLead(FEEDBACK_DIR, {
+          ...body,
+          traceId: body.traceId || traceId,
+          acquisitionId: body.acquisitionId || journeyState.acquisitionId,
+          visitorId: body.visitorId || journeyState.visitorId,
+          sessionId: body.sessionId || journeyState.sessionId,
+          page: body.page || referrerAttribution.page || '/broker-audit',
+          landingPath: body.landingPath || referrerAttribution.landingPath || '/broker-audit',
+          ctaId: body.ctaId || 'broker_audit_form',
+          ctaPlacement: body.ctaPlacement || 'broker_audit',
+          source: body.source || body.utmSource || referrerAttribution.source || 'website',
+          utmSource: body.utmSource || body.source || referrerAttribution.utmSource || 'website',
+          utmMedium: body.utmMedium || referrerAttribution.utmMedium || 'broker_audit',
+          utmCampaign: body.utmCampaign || referrerAttribution.utmCampaign || 'broker_audit_free',
+          utmContent: body.utmContent || referrerAttribution.utmContent || null,
+          utmTerm: body.utmTerm || referrerAttribution.utmTerm || null,
+          referrerHost: body.referrerHost || referrerAttribution.referrerHost || null,
+          referrer: body.referrer || referrerAttribution.referrer || null,
+        });
+
+        appendBestEffortTelemetry(FEEDBACK_DIR, {
+          eventType: 'broker_audit_lead_submitted',
+          clientType: 'web',
+          traceId: lead.attribution.traceId,
+          acquisitionId: lead.attribution.acquisitionId,
+          visitorId: lead.attribution.visitorId,
+          sessionId: lead.attribution.sessionId,
+          source: lead.attribution.source,
+          utmSource: lead.attribution.utmSource,
+          utmMedium: lead.attribution.utmMedium,
+          utmCampaign: lead.attribution.utmCampaign,
+          utmContent: lead.attribution.utmContent,
+          utmTerm: lead.attribution.utmTerm,
+          ctaId: lead.attribution.ctaId,
+          ctaPlacement: lead.attribution.ctaPlacement,
+          page: lead.attribution.page,
+          landingPath: lead.attribution.landingPath,
+          referrerHost: lead.attribution.referrerHost,
+          referrer: lead.attribution.referrer,
+        }, req.headers, 'broker_audit_lead_submitted');
+
+        if (isFormSubmission && !wantsJson(req, parsed)) {
+          sendHtml(
+            res,
+            201,
+            renderBrokerAuditIntakeResultPage(hostedConfig, {
+              title: 'Broker audit request received',
+              detail: 'Your free broker lead-flow audit request is captured. The next step is the 1-page PDF with the specific lead leaks.',
+              leadId: lead.leadId,
+            }),
+            journeyState.setCookieHeaders.length ? { 'Set-Cookie': journeyState.setCookieHeaders } : {}
+          );
+          return;
+        }
+
+        sendJson(res, 201, {
+          ok: true,
+          leadId: lead.leadId,
+          status: lead.status,
+          offer: lead.offer,
+          nextStep: 'deliver_1_page_pdf',
+        }, {
+          ...getPublicBillingHeaders(lead.attribution.traceId),
+          ...(journeyState.setCookieHeaders.length ? { 'Set-Cookie': journeyState.setCookieHeaders } : {}),
+        });
+      } catch (err) {
+        appendBestEffortTelemetry(FEEDBACK_DIR, {
+          eventType: 'broker_audit_lead_failed',
+          clientType: 'web',
+          traceId,
+          acquisitionId: journeyState.acquisitionId,
+          visitorId: journeyState.visitorId,
+          sessionId: journeyState.sessionId,
+          source: referrerAttribution.source || 'website',
+          utmSource: referrerAttribution.utmSource || 'website',
+          utmMedium: referrerAttribution.utmMedium || 'broker_audit',
+          utmCampaign: referrerAttribution.utmCampaign || 'broker_audit_free',
+          ctaId: 'broker_audit_form',
+          ctaPlacement: 'broker_audit',
+          page: referrerAttribution.page || '/broker-audit',
+          landingPath: referrerAttribution.landingPath || '/broker-audit',
+          referrerHost: referrerAttribution.referrerHost,
+          referrer: referrerAttribution.referrer,
+          failureCode: err?.message ? err.message : 'broker_audit_lead_failed',
+          httpStatus: err && err.statusCode ? err.statusCode : null,
+        }, req.headers, 'broker_audit_lead_failed');
+        if (isFormSubmission && !wantsJson(req, parsed)) {
+          sendHtml(
+            res,
+            err.statusCode || 500,
+            renderBrokerAuditIntakeResultPage(hostedConfig, {
+              title: 'Broker audit request failed',
+              detail: err.message || 'Unable to capture broker audit request.',
+            }),
+            journeyState.setCookieHeaders.length ? { 'Set-Cookie': journeyState.setCookieHeaders } : {}
+          );
+          return;
+        }
+        sendProblem(res, {
+          type: !err.statusCode || err.statusCode >= 500 ? PROBLEM_TYPES.INTERNAL : PROBLEM_TYPES.BAD_REQUEST,
+          title: !err.statusCode || err.statusCode >= 500 ? 'Internal Server Error' : 'Request Error',
+          status: err.statusCode || 500,
+          detail: err.message || 'Unable to capture broker audit request.',
+        }, getPublicBillingHeaders(traceId));
+      }
+      return;
+    }
+
     if (req.method === 'POST' && pathname === '/v1/intake/workflow-sprint') {
       const { FEEDBACK_DIR } = getFeedbackPaths();
       const traceId = createTraceId('sprint_intake');
@@ -5467,7 +7545,19 @@ async function addContext(){
 
     // Public OpenAPI spec — no auth required (needed for ChatGPT GPT Store import)
     if (isGetLikeRequest && (pathname === '/openapi.json' || pathname === '/openapi.yaml')) {
-      const specPath = path.join(__dirname, '../../adapters/chatgpt/openapi.yaml');
+      const specPath = [
+        path.join(__dirname, '../../openapi/openapi.yaml'),
+        path.join(__dirname, '../../adapters/chatgpt/openapi.yaml'),
+      ].find((candidate) => fs.existsSync(candidate));
+      if (!specPath) {
+        sendProblem(res, {
+          type: PROBLEM_TYPES.NOT_FOUND,
+          title: 'Not Found',
+          status: 404,
+          detail: 'OpenAPI spec not found.',
+        });
+        return;
+      }
       try {
         const yaml = renderOpenApiYamlForRequest(fs.readFileSync(specPath, 'utf8'), req);
         if (pathname === '/openapi.yaml') {
@@ -5543,38 +7633,14 @@ async function addContext(){
     // surface that was missing: thumbgate.ai had no /case-studies, so visitors
     // landed on CLI install commands without seeing whether anyone actually
     // got value. First entry is the Aiventyx Teams listing integration: real
-    // third-party CTR signal (5/8 clicks before the /go/teams fix, end-to-end
-    // verified after).
+    // third-party CTR signal (5/8 clicks before the /go/teams fix, now routed
+    // through team intake so scope happens before checkout).
     if (isGetLikeRequest && pathname === '/case-studies') {
       sendHtml(res, 200, `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Case Studies — ThumbGate</title><meta name="description" content="Real integrations of ThumbGate's pre-action checks for AI coding agents. Proof, not promises."><style>body{font-family:system-ui,-apple-system,sans-serif;max-width:780px;margin:0 auto;padding:32px 20px;line-height:1.55;color:#1f2937}h1{font-size:32px;margin:0 0 8px}.lede{color:#6b7280;font-size:18px;margin:0 0 32px}article{border:1px solid #e5e7eb;border-radius:12px;padding:24px;margin-bottom:24px;background:#fff}article h2{margin:0 0 4px;font-size:22px}.meta{color:#6b7280;font-size:13px;margin-bottom:16px}h3{font-size:15px;margin:20px 0 8px;color:#374151;text-transform:uppercase;letter-spacing:0.5px}.metric{display:inline-block;background:#0f172a;color:#fff;padding:4px 10px;border-radius:6px;font-weight:600;font-size:14px;margin:0 4px 4px 0}p{margin:8px 0}a{color:#0066cc}code{background:#f3f4f6;padding:1px 6px;border-radius:4px;font-size:13.5px}footer{margin-top:48px;padding-top:24px;border-top:1px solid #e5e7eb;color:#6b7280;font-size:14px}</style></head><body>
 <h1>Case Studies</h1>
 <p class="lede">Real integrations. No fabricated logos, no aspirational numbers — every claim below is reproducible.</p>
 
-<article>
-<h2>Aiventyx marketplace — Teams listing CTR recovery</h2>
-<p class="meta">Integration partner: <a href="https://www.aiventyx.com">Aiventyx</a> · Reported by: Qaiser Mehdi · Verified: 2026-05-13</p>
-
-<h3>The problem</h3>
-<p>Aiventyx is a marketplace for AI tools. ThumbGate's Teams listing was their highest-CTR external surface — <span class="metric">62% CTR</span> (5 clicks on 8 views, May 7–9 window). When their integrator rolled out canonical tracked URLs, every Teams click started landing on:</p>
-<p><code>{"error":"Tracked link not found","allowed":["gpt","pro","install","reddit","linkedin","x","github"]}</code></p>
-<p>The <code>/go/teams</code> slug wasn't registered in our redirector — a 404 was eating every paid-intent click from their strongest external surface.</p>
-
-<h3>The fix</h3>
-<p>Added <code>teams</code> to <code>TRACKED_LINK_TARGETS</code>: HTTP 302 redirect to <code>/checkout/pro?plan_id=team&seat_count=3&billing_cycle=monthly</code> — the 3-seat $147/mo self-serve Stripe Team checkout. Caller-supplied UTMs flow through to Stripe metadata end-to-end.</p>
-
-<h3>The verification</h3>
-<p>Qaiser's own incognito test, May 13 6:04 AM (full email on record):</p>
-<p><code>https://thumbgate.ai/go/teams?utm_source=aiventyx</code><br>
-→ 302 to Stripe checkout<br>
-→ "Subscribe to ThumbGate Team" page loads<br>
-→ $147/mo, 3-seat Team plan confirmed<br>
-→ Aiventyx UTMs intact in URL</p>
-
-<h3>What this proves</h3>
-<p>End-to-end attribution from a third-party marketplace through ThumbGate's redirector into Stripe checkout, with the caller's UTM chain preserved. Two regression tests pin the redirect contract so it can't silently break.</p>
-
-<p><a href="/go/teams?utm_source=case-study">Try the live redirect →</a></p>
-</article>
+<p><em>New case studies for individual Pro operators coming soon.</em></p>
 
 <footer>
 <p>Want to be the next case study? The product is real, the integration is 30 seconds: <code>npx thumbgate init</code>. If you ship something with ThumbGate and want it documented here, email <a href="mailto:igor.ganapolsky@gmail.com">igor.ganapolsky@gmail.com</a>.</p>
@@ -5593,87 +7659,66 @@ async function addContext(){
     // Sprint (proof-pack, sales-led) → Pro (self-serve recurring) → Team
     // (after qualification). Every paid CTA across the site should funnel
     // here OR directly into Stripe checkout — never a different price.
-    if (isGetLikeRequest && pathname === '/pricing') {
-      sendHtml(res, 200, `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Pricing — ThumbGate</title><meta name="description" content="ThumbGate pricing: free CLI, $19/mo Pro, $49/seat Team. One subscription decision, no consulting upsell."><style>body{font-family:system-ui,-apple-system,sans-serif;max-width:980px;margin:0 auto;padding:32px 20px;line-height:1.55;color:#1f2937}h1{font-size:36px;margin:0 0 8px;text-align:center}.lede{color:#6b7280;font-size:18px;margin:0 0 32px;text-align:center;max-width:560px;margin-left:auto;margin-right:auto}.grid{display:grid;grid-template-columns:1fr;gap:20px;margin-bottom:24px}@media(min-width:720px){.grid{grid-template-columns:repeat(3,1fr)}}.card{border:1px solid #e5e7eb;border-radius:12px;padding:24px;background:#fff;display:flex;flex-direction:column}.hero{border:2px solid #3b82f6;background:linear-gradient(135deg,#eff6ff,#fff);position:relative}.hero::before{content:"Most popular";position:absolute;top:-10px;left:50%;transform:translateX(-50%);background:#3b82f6;color:#fff;padding:3px 12px;border-radius:6px;font-size:11px;font-weight:700;letter-spacing:0.5px}.tag{display:inline-block;background:#0f172a;color:#fff;padding:3px 10px;border-radius:6px;font-size:12px;font-weight:600;letter-spacing:0.5px;margin-bottom:12px}.tag-free{background:#10b981}.tag-pro{background:#3b82f6}.tag-team{background:#8b5cf6}h2{margin:0 0 4px;font-size:22px}.price{font-size:30px;font-weight:700;margin:8px 0 12px}.price small{font-size:14px;color:#6b7280;font-weight:400}.tagline{color:#374151;margin:0 0 16px;font-size:15px}ul{margin:0 0 20px;padding-left:18px}li{margin:6px 0;font-size:14px}.cta{display:inline-block;background:#0f172a;color:#fff;padding:12px 24px;border-radius:8px;font-weight:600;text-decoration:none;text-align:center;margin-top:auto}.cta-primary{background:#3b82f6}.cta-secondary{background:#fff;color:#0f172a;border:1px solid #0f172a}.cta-free{background:#10b981}details.consulting{margin-top:32px;border:1px solid #e5e7eb;border-radius:12px;padding:18px 22px;background:#fafafa}details.consulting summary{cursor:pointer;font-size:15px;font-weight:600;color:#475569;list-style:none}details.consulting summary::-webkit-details-marker{display:none}details.consulting[open] summary{margin-bottom:16px}.consulting-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:14px;margin:8px 0}.consulting-card{border:1px solid #e5e7eb;border-radius:8px;padding:14px;background:#fff}.consulting-card .cp{font-size:18px;font-weight:700;color:#0f172a}.consulting-card .cl{font-size:13px;color:#6b7280;margin:4px 0 10px}.consulting-card a{color:#0066cc;font-size:13px;text-decoration:none;font-weight:600}footer{margin-top:32px;padding-top:24px;border-top:1px solid #e5e7eb;color:#6b7280;font-size:14px;text-align:center}footer a{color:#0066cc}</style></head><body>
-<h1>Pricing</h1>
-<p class="lede">Three tiers. Pick the one that matches your scale. Self-serve checkout on every subscription plan — no calls.</p>
-
-<div class="grid">
-
-<div class="card">
-<span class="tag tag-free">Free — Solo developer</span>
-<h2>ThumbGate CLI</h2>
-<div class="price">$0 <small>forever</small></div>
-<p class="tagline">The pre-action gate layer for one developer. Block your first repeated AI mistake in 5 minutes.</p>
-<ul>
-<li>Unlimited feedback captures</li>
-<li>Up to 5 active prevention rules</li>
-<li>All MCP integrations (Claude Code, Cursor, Codex, Gemini, Amp)</li>
-<li>No account, no signup, no data leaves your machine</li>
-</ul>
-<a class="cta cta-free" href="/go/install?utm_source=pricing">Install free →</a>
-</div>
+    if (isGetLikeRequest && (pathname === '/pricing' || pathname === '/pricing.html')) {
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: loadPricingPageHtml,
+          extraTelemetry: {
+            pageType: 'pricing',
+          },
+        });
+      } catch (err) {
+        sendText(res, 500, err.message || 'Pricing page unavailable');
+      }
+      return;
+    }
 
-<div class="card hero">
-<span class="tag tag-pro">Pro — Self-serve recurring</span>
-<h2>ThumbGate Pro</h2>
-<div class="price">$19 <small>/ month · $149 / year</small></div>
-<p class="tagline">For developers running multiple agents who hit the 5-rule wall. Unlimited rules, lesson recall, audit-ready evidence.</p>
-<ul>
-<li>Unlimited active prevention rules</li>
-<li>Local dashboard + lesson search across sessions</li>
-<li>DPO export for offline preference fine-tuning</li>
-<li>Visual check debugger — see every blocked action</li>
-<li>7-day refund window. Cancel anytime.</li>
-</ul>
-<a class="cta cta-primary" href="/go/pro?utm_source=pricing&utm_medium=hero_card">Start Pro — $19/mo →</a>
-</div>
 
-<div class="card">
-<span class="tag tag-team">Team — Shared enforcement</span>
-<h2>ThumbGate Team</h2>
-<div class="price">$49 <small>/ seat / month · 3-seat min</small></div>
-<p class="tagline">For engineering teams with shared AI-agent workflows. One engineer's save protects the whole team.</p>
+    // Remote MCP connector documentation — the `resource_documentation` target
+    // advertised by /.well-known/oauth-protected-resource. The Claude Connectors
+    // Directory requires this URL to resolve (200) for submission review.
+    if (isGetLikeRequest && (pathname === '/docs/connectors' || pathname === '/docs/connectors/')) {
+      const mcpUrl = buildPublicUrl(hostedConfig, '/mcp');
+      const cardUrl = buildPublicUrl(hostedConfig, '/.well-known/mcp/server-card.json');
+      const prmUrl = buildPublicUrl(hostedConfig, '/.well-known/oauth-protected-resource');
+      sendHtml(res, 200, `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Remote MCP Connector — ThumbGate</title><meta name="description" content="Connect ThumbGate to Claude as a remote MCP server: OAuth 2.1 (PKCE) authorization, available tools, and the read-only reviewer credential."><style>body{font-family:system-ui,-apple-system,sans-serif;max-width:780px;margin:0 auto;padding:32px 20px;line-height:1.55;color:#1f2937}h1{font-size:30px;margin:0 0 8px}.lede{color:#6b7280;font-size:18px;margin:0 0 28px}h2{font-size:20px;margin:28px 0 8px}code{background:#f3f4f6;padding:1px 6px;border-radius:4px;font-size:13.5px}pre{background:#0f172a;color:#e2e8f0;padding:14px 16px;border-radius:8px;overflow:auto;font-size:13px}a{color:#0066cc}ol,ul{padding-left:22px}li{margin:6px 0}.note{border-left:3px solid #22d3ee;background:#ecfeff;padding:10px 14px;border-radius:0 8px 8px 0;margin:16px 0}footer{margin-top:40px;padding-top:20px;border-top:1px solid #e5e7eb;color:#6b7280;font-size:14px}</style></head><body>
+<h1>ThumbGate — Remote MCP Connector</h1>
+<p class="lede">ThumbGate is a remote Model Context Protocol (MCP) server. Add it as a connector in Claude to give an agent governed access to ThumbGate's feedback capture, lesson retrieval, context assembly, and pre-action gate tools — over HTTP, authenticated with OAuth 2.1.</p>
+
+<h2>Connect URL</h2>
+<pre>${esc(mcpUrl)}</pre>
+<p>In Claude, add a custom connector and paste the URL above. Claude discovers the authorization server automatically via the protected-resource metadata at <a href="${esc(prmUrl)}">${esc(prmUrl)}</a>.</p>
+
+<h2>Authorization (OAuth 2.1 + PKCE)</h2>
+<ol>
+  <li>Claude reads the <code>resource</code> and <code>authorization_servers</code> from the protected-resource metadata.</li>
+  <li>It runs the standard OAuth 2.1 authorization-code flow with PKCE (<code>S256</code> only — <code>plain</code> is rejected).</li>
+  <li>The issued access token is audience-bound to the <code>${esc(mcpUrl)}</code> resource (RFC 8707); a token for any other audience is rejected.</li>
+  <li>The bearer token is then sent on the <code>Authorization</code> header for every <code>tools/call</code>.</li>
+</ol>
+
+<h2>Available tools</h2>
+<p>The full, machine-readable tool registry — names, input schemas, and the <code>readOnlyHint</code> / <code>destructiveHint</code> annotations — is published at <a href="${esc(cardUrl)}">${esc(cardUrl)}</a>. Tools fall into these groups:</p>
 <ul>
-<li>Shared lesson database across all seats</li>
-<li>Org dashboard + audit-ready policy rollout</li>
-<li>Self-serve checkout starts at $147/mo</li>
-<li>Email support during pilot rollout</li>
+  <li><strong>Feedback &amp; lessons</strong> — <code>capture_feedback</code>, <code>feedback_summary</code>, <code>search_lessons</code>, <code>retrieve_lessons</code>, <code>prevention_rules</code>.</li>
+  <li><strong>Context engineering</strong> — <code>construct_context_pack</code>, <code>evaluate_context_pack</code>, <code>unified_context</code>, <code>recall</code>.</li>
+  <li><strong>Pre-action gates &amp; governance</strong> — <code>satisfy_gate</code>, <code>track_action</code>, <code>approve_protected_action</code>, <code>verify_claim</code>, <code>enforcement_matrix</code>.</li>
+  <li><strong>Diagnostics &amp; planning</strong> — <code>diagnose_failure</code>, <code>suggest_fix</code>, <code>security_scan</code>, and the <code>plan_*</code> advisory tools.</li>
 </ul>
-<a class="cta cta-secondary" href="/go/teams?utm_source=pricing">Start Team →</a>
-</div>
 
-</div>
+<h2>Reviewer credential (read-only)</h2>
+<div class="note">For directory reviewers: ThumbGate issues a dedicated <strong>read-only</strong> reviewer credential. A token bound to that credential may invoke only tools annotated <code>readOnlyHint: true</code>; any write or mutating tool call is rejected. This makes the credential safe to share for review without granting the ability to mutate shared server state. Request it from the contact below.</div>
 
-<details class="consulting">
-<summary>▸ Need a one-off diagnostic, hardening sprint, or governance setup? View paid services</summary>
-<p style="color:#6b7280;font-size:14px;margin:0 0 14px;">For teams that want a stakeholder-visible artifact (PR, briefing, deployed hooks) before subscribing. Each is one-time, fixed-scope, refundable if we can't extract a rule from your failure trace.</p>
-<div class="consulting-grid">
-<div class="consulting-card">
-<div class="cp">$499</div>
-<div class="cl">Sprint Diagnostic — 2-day triage on one workflow, top-5 rules ranked, PR delivered.</div>
-<a href="mailto:igor.ganapolsky@gmail.com?subject=ThumbGate%20Sprint%20Diagnostic">Email to start →</a>
-</div>
-<div class="consulting-card">
-<div class="cp">$1,500</div>
-<div class="cl">Workflow Hardening Sprint — full hardening engagement, hooks deployed, rollout review.</div>
-<a href="mailto:igor.ganapolsky@gmail.com?subject=ThumbGate%20Workflow%20Hardening%20Sprint">Email to start →</a>
-</div>
-<div class="consulting-card">
-<div class="cp">$97</div>
-<div class="cl">OpenClaw Agent Governance Kit — self-serve digital kit, prevention-rule starters, proof report template.</div>
-<a href="https://buy.stripe.com/bJe14naiE9Lo7xT49Z3sI12">Buy kit →</a>
-</div>
-</div>
-</details>
+<h2>Source &amp; contact</h2>
+<p>Open-source CLI and server: <a href="https://github.com/IgorGanapolsky/ThumbGate">github.com/IgorGanapolsky/ThumbGate</a>. Questions or reviewer-credential requests: <a href="mailto:igor.ganapolsky@gmail.com">igor.ganapolsky@gmail.com</a>.</p>
 
-<footer>
-<p>One source of truth for ThumbGate pricing. Numbers here override anything stale elsewhere on the site.</p>
-<p><a href="/">Home</a> · <a href="/case-studies">Case Studies</a> · <a href="/support">Support</a> · <a href="/privacy">Privacy</a> · <a href="/terms">Terms</a></p>
-</footer>
-</body></html>`, {}, {
-        headOnly: isHeadRequest,
-      });
+<footer><a href="/">ThumbGate</a> · <a href="/support">Support</a> · <a href="/privacy">Privacy</a> · <a href="/terms">Terms</a></footer>
+</body></html>`, {}, { headOnly: isHeadRequest });
       return;
     }
 
@@ -5916,6 +7961,14 @@ async function addContext(){
       return;
     }
 
+    // Catch non-API GET requests that didn't match any public page route above.
+    // Without this, /about, /docs, /demo etc. fall through to the API auth gate
+    // and return a raw JSON 401 instead of a user-friendly 404.
+    if (isGetLikeRequest && !pathname.startsWith('/v1/') && !pathname.startsWith('/api/')) {
+      sendHtml(res, 404, `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Page Not Found — ThumbGate</title><style>body{background:#0a0a0a;color:#e2e8f0;font-family:system-ui,-apple-system,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0}main{text-align:center;padding:2rem}h1{font-size:4rem;margin:0;color:#22d3ee}p{font-size:1.1rem;color:#94a3b8;margin:1rem 0}a{color:#22d3ee;text-decoration:underline}</style></head><body><main><h1>404</h1><p>This page doesn't exist.</p><p><a href="/">Back to ThumbGate</a></p></main></body></html>`);
+      return;
+    }
+
     // Operator key is allowed to bypass the general admin gate for its dedicated endpoint
     const _reqToken = extractApiKey(req);
     const isOperatorBillingRequest = Boolean(expectedOperatorKey)
@@ -5941,7 +7994,161 @@ async function addContext(){
 
     try {
       if (req.method === 'GET' && pathname === '/v1/feedback/stats') {
-        sendJson(res, 200, analyzeFeedback(requestFeedbackPaths.FEEDBACK_LOG_PATH));
+        const stats = shouldAggregateFeedback()
+          ? computeAggregateFeedbackStats({ feedbackDir: requestFeedbackPaths.FEEDBACK_DIR })
+          : analyzeFeedback(requestFeedbackPaths.FEEDBACK_LOG_PATH);
+        try {
+          const { getStatuslineMeta } = require('../../scripts/statusline-meta');
+          const meta = getStatuslineMeta({ env: process.env });
+          stats.tier = meta.tier;
+        } catch (error) {
+          debugApiFallback('statusline meta unavailable', error);
+          stats.tier = 'Pro';
+        }
+
+        const projectChatSettings = readProjectChatSettings(req, parsed);
+
+        stats.geminiConfigured = Boolean(
+          projectChatSettings.geminiKey ||
+          process.env.GEMINI_API_KEY ||
+          process.env.THUMBGATE_GEMINI_API_KEY ||
+          process.env.GOOGLE_API_KEY
+        );
+        stats.perplexityConfigured = Boolean(
+          projectChatSettings.perplexityKey ||
+          process.env.PERPLEXITY_API_KEY ||
+          process.env.THUMBGATE_PERPLEXITY_API_KEY
+        );
+        stats.geminiValidatedAt = projectChatSettings.geminiValidatedAt;
+        stats.geminiKeyStatus = 'none';
+        if (projectChatSettings.geminiKey) {
+          stats.geminiKeyStatus = 'present';
+        }
+        if (projectChatSettings.geminiValidatedAt) {
+          stats.geminiKeyStatus = 'validated';
+        }
+        stats.hybridInferenceAvailable = !!(stats.geminiConfigured || stats.perplexityConfigured);
+        stats.localLlmConfigured = Boolean(process.env.THUMBGATE_LOCAL_LLM_ENDPOINT);
+        stats.localLlmEndpoint = process.env.THUMBGATE_LOCAL_LLM_ENDPOINT || null;
+        stats.localLlmModel = process.env.THUMBGATE_LOCAL_LLM_MODEL || null;
+        sendJson(res, 200, stats);
+        return;
+      }
+
+      // Chat with your data — LOCAL-FIRST. Powers the dashboard "Chat with your
+      // data" panel. Factual/metric questions (gates, blocks, feedback, token
+      // savings, team) are answered DETERMINISTICALLY from this install's own
+      // dashboard data — no cloud, no LLM, no API key (the local-first thesis).
+      // Only open-ended/qualitative questions fall through to lesson retrieval +
+      // the user's configured LOCAL model (a BYO cloud key is optional, not required).
+      if (req.method === 'POST' && pathname === '/v1/chat') {
+        const body = await parseJsonBody(req);
+        const question = body.question || body.q || body.message;
+        const normalizedChatPrompt = normalizeEnterpriseChatPrompt(question);
+        const chatFeedbackDir = requestFeedbackPaths.FEEDBACK_DIR;
+
+        // Local-first: factual/metric questions (gates, blocks, feedback, cost,
+        // team) are answered deterministically from local data — no cloud/LLM/key.
+        if (
+          normalizedChatPrompt
+          && !containsUnsafeEnterpriseChatInput(normalizedChatPrompt)
+          && classifyEnterpriseChatTopic(normalizedChatPrompt) !== 'overview'
+          && await trySendLocalDashboardChat(res, parsed, chatFeedbackDir, normalizedChatPrompt)
+        ) {
+          return;
+        }
+
+        const { answerDataQuestion } = require('../../scripts/dashboard-chat');
+
+        const projectChatSettings = readProjectChatSettings(req, parsed);
+
+        const result = await answerDataQuestion(question, {
+          feedbackDir: chatFeedbackDir,
+          model: typeof body.model === 'string' ? body.model : undefined,
+          apiKey: projectChatSettings.perplexityKey || projectChatSettings.geminiKey || process.env.PERPLEXITY_API_KEY || process.env.THUMBGATE_PERPLEXITY_API_KEY || process.env.GEMINI_API_KEY || process.env.THUMBGATE_GEMINI_API_KEY || process.env.GOOGLE_API_KEY || '',
+          localEndpoint: projectChatSettings.localEndpoint || process.env.THUMBGATE_LOCAL_LLM_ENDPOINT || '',
+          localModel: projectChatSettings.localModel || process.env.THUMBGATE_LOCAL_LLM_MODEL || '',
+        });
+
+        // Local-first guarantee: if no model is configured, never hard-fail with
+        // "no_api_key" — fall back to a deterministic local answer. No cloud required.
+        if (
+          !result.ok
+          && (result.error === 'no_api_key' || result.error === 'no_model')
+          && await trySendLocalDashboardChat(res, parsed, chatFeedbackDir, normalizedChatPrompt || question, '(Connect a local model via THUMBGATE_LOCAL_LLM_ENDPOINT for open-ended analysis over your lessons.)')
+        ) {
+          return;
+        }
+
+        sendJson(res, result.ok ? 200 : (result.error === 'no_api_key' ? 503 : 400), result);
+        return;
+      }
+
+      // Save Gemini API key from the dashboard UI
+      if (req.method === 'POST' && pathname === '/v1/settings/gemini-key') {
+        const body = await parseJsonBody(req);
+        const key = String(body.key || '').trim();
+        if (!key) {
+          sendJson(res, 400, { ok: false, error: 'missing_key', message: 'No API key provided.' });
+          return;
+        }
+
+        // Validate the candidate key using the *exact* same code path as /v1/chat
+        // (project-scoped .env read + RAG + Gemini call). This prevents saving a
+        // key that will later produce the confusing "API key not valid" error in chat.
+        let validation;
+        try {
+          const { answerDataQuestion } = require('../../scripts/dashboard-chat');
+          validation = await answerDataQuestion('Reply with the single word: PONG', {
+            feedbackDir: requestFeedbackPaths.FEEDBACK_DIR,
+            apiKey: key,
+          });
+        } catch (e) {
+          validation = { ok: false, error: 'validation_exception', message: String(e?.message || e) };
+        }
+
+        if (!validation.ok) {
+          const detail = validation.error === 'gemini_error'
+            ? (validation.message || 'Gemini rejected the key')
+            : (validation.message || validation.error || 'unknown error');
+          sendJson(res, 400, {
+            ok: false,
+            error: 'invalid_key',
+            message: 'Key validation failed: ' + detail + '. Get a fresh key from https://aistudio.google.com/app/apikey (or run `npx thumbgate setup-vertex` for Vertex) and try again.'
+          });
+          return;
+        }
+
+        try {
+          const projectDir = resolveRequestProjectDir(req, parsed);
+          const envPath = path.join(projectDir, '.env');
+          let content = '';
+          if (fs.existsSync(envPath)) {
+            content = fs.readFileSync(envPath, 'utf8');
+          }
+          const regex = /^GEMINI_API_KEY=.*$/m;
+          if (regex.test(content)) {
+            content = content.replace(regex, `GEMINI_API_KEY=${key}`);
+          } else {
+            content = content.trim() + `\nGEMINI_API_KEY=${key}\n`;
+          }
+          fs.writeFileSync(envPath, content, 'utf8');
+          // Also set it in the current process so it takes effect immediately without restart
+          process.env.GEMINI_API_KEY = key;
+          // Persist validation success for reliable "configured" status in stats/hints
+          try {
+            const statusPath = path.join(projectDir, '.gemini-validated.json');
+            fs.writeFileSync(statusPath, JSON.stringify({
+              validatedAt: new Date().toISOString(),
+              validatedBy: 'dashboard-save'
+            }, null, 2));
+          } catch (error) {
+            debugApiFallback('Gemini validation marker unavailable', error);
+          }
+          sendJson(res, 200, { ok: true, message: 'Key saved and validated.' });
+        } catch (e) {
+          sendJson(res, 500, { ok: false, error: 'fs_error', message: 'Failed to write to .env file: ' + e.message });
+        }
         return;
       }
 
@@ -6000,6 +8207,28 @@ async function addContext(){
         return;
       }
 
+      if (req.method === 'GET' && (
+        pathname === '/v1/enterprise/data-chat/status'
+        || pathname === '/v1/enterprise/dialogflow/status'
+      )) {
+        sendJson(res, 200, buildEnterpriseDataChatStatus());
+        return;
+      }
+
+      if (req.method === 'POST' && (
+        pathname === '/v1/enterprise/data-chat/chat'
+        || pathname === '/v1/enterprise/dialogflow/chat'
+      )) {
+        const body = await parseJsonBody(req, 16 * 1024);
+        const result = await answerEnterpriseDataChat({
+          prompt: body.prompt || body.message || body.query,
+          feedbackDir: requestFeedbackDir,
+          parsed,
+        });
+        sendJson(res, 200, result);
+        return;
+      }
+
       if (req.method === 'GET' && pathname === '/v1/intents/catalog') {
         const mcpProfile = parsed.searchParams.get('mcpProfile') || undefined;
         const bundleId = parsed.searchParams.get('bundleId') || undefined;
@@ -6025,6 +8254,7 @@ async function addContext(){
             bundleId: body.bundleId,
             partnerProfile: body.partnerProfile,
             delegationMode: body.delegationMode,
+            enforcePlanQuality: body.enforcePlanQuality === true,
             approved: body.approved === true,
             repoPath: body.repoPath,
           });
@@ -6283,6 +8513,7 @@ async function addContext(){
           summary: body.summary,
           allowedPaths: body.allowedPaths,
           protectedPaths: body.protectedPaths,
+          workflowContract: body.workflowContract,
           repoPath: body.repoPath,
           localOnly: body.localOnly === true,
           clear: body.clear === true,
@@ -6360,6 +8591,11 @@ async function addContext(){
       }
 
       if (req.method === 'GET' && pathname === '/v1/lessons/search') {
+        const lessonLimit = checkLimit('search_lessons');
+        if (!lessonLimit.allowed) {
+          sendJson(res, 429, { error: 'Free tier: lesson search requires Pro. Upgrade at /pricing', code: 'PRO_REQUIRED' });
+          return;
+        }
         const query = parsed.searchParams.get('q') || parsed.searchParams.get('query') || '';
         const limit = Number(parsed.searchParams.get('limit') || 10);
         const category = parsed.searchParams.get('category') || '';
@@ -6379,17 +8615,24 @@ async function addContext(){
       }
 
       if (req.method === 'GET' && pathname === '/v1/search') {
+        const searchLimit = checkLimit('search_thumbgate');
+        if (!searchLimit.allowed) {
+          sendJson(res, 429, { error: 'Free tier: search requires Pro. Upgrade at /pricing', code: 'PRO_REQUIRED' });
+          return;
+        }
         const query = parsed.searchParams.get('q') || parsed.searchParams.get('query') || '';
         const limit = Number(parsed.searchParams.get('limit') || 10);
         const source = parsed.searchParams.get('source') || 'all';
         const signal = parsed.searchParams.get('signal') || null;
         let results;
         try {
+          const requestFeedbackPaths = getRequestFeedbackPaths(req, parsed);
           results = searchThumbgate({
             query,
             limit: Number.isFinite(limit) ? limit : 10,
             source,
             signal,
+            feedbackDir: requestFeedbackPaths.FEEDBACK_DIR,
           });
         } catch (err) {
           throw createHttpError(400, err.message || 'Invalid ThumbGate search request');
@@ -6399,14 +8642,21 @@ async function addContext(){
       }
 
       if (req.method === 'POST' && pathname === '/v1/search') {
+        const searchLimit = checkLimit('search_thumbgate');
+        if (!searchLimit.allowed) {
+          sendJson(res, 429, { error: 'Free tier: search requires Pro. Upgrade at /pricing', code: 'PRO_REQUIRED' });
+          return;
+        }
         const body = await parseJsonBody(req);
         let results;
         try {
+          const requestFeedbackPaths = getRequestFeedbackPaths(req, parsed);
           results = searchThumbgate({
             query: body.query || body.q || '',
             limit: body.limit,
             source: body.source,
             signal: body.signal,
+            feedbackDir: requestFeedbackPaths.FEEDBACK_DIR,
           });
         } catch (err) {
           throw createHttpError(400, err.message || 'Invalid ThumbGate search request');
@@ -6432,11 +8682,14 @@ async function addContext(){
       {
         const documentId = normalizeDocumentIdFromPath(pathname);
         if (req.method === 'GET' && documentId) {
+          if (!/^[a-zA-Z0-9-_]+$/.test(documentId)) {
+            throw createHttpError(400, 'Invalid document ID format');
+          }
           const document = readImportedDocument(documentId, {
             feedbackDir: requestFeedbackDir,
           });
           if (!document) {
-            throw createHttpError(404, `Imported document not found: ${documentId}`);
+            throw createHttpError(404, `Imported document not found: ${escapeHtml(documentId)}`);
           }
           sendJson(res, 200, { document });
           return;
@@ -6463,7 +8716,7 @@ async function addContext(){
               feedbackDir: getSafeDataDir(),
               limit: 10,
             });
-          } catch (_) { /* best-effort — conversation window is optional */ }
+          } catch { /* best-effort — conversation window is optional */ }
         }
         const result = captureFeedback({
           signal: body.signal,
@@ -6482,6 +8735,18 @@ async function addContext(){
           tags: extractTags(body.tags),
           skill: body.skill,
         });
+        const actionIntegration = inferActionIntegration(body, req.headers);
+        appendBestEffortTelemetry(requestFeedbackDir, {
+          eventType: chatgptActionEventType(actionIntegration, 'capture_feedback'),
+          clientType: 'api',
+          source: actionIntegration,
+          integration: actionIntegration,
+          actionOperation: 'captureFeedback',
+          endpoint: '/v1/feedback/capture',
+          actionStatus: result.accepted ? 'accepted' : 'clarification_required',
+          accepted: Boolean(result.accepted),
+          failureCode: result.accepted ? null : 'clarification_required',
+        }, req.headers, 'api_action_capture_feedback');
         if (result?.accepted) {
           // Fan out to any connected dashboard clients so they re-render
           // without polling. Non-sensitive summary only (no chat history,
@@ -6562,6 +8827,11 @@ async function addContext(){
       }
 
       if (req.method === 'POST' && pathname === '/v1/dpo/export') {
+        const dpoLimit = checkLimit('export_dpo');
+        if (!dpoLimit.allowed) {
+          sendJson(res, 429, { error: 'Free tier: DPO export requires Pro. Upgrade at /pricing', code: 'PRO_REQUIRED' });
+          return;
+        }
         const body = await parseJsonBody(req);
         const paths = resolveDpoExportPaths(body, {
           safeDataDir: requestSafeDataDir,
@@ -7139,6 +9409,40 @@ async function addContext(){
         return;
       }
 
+      // GET /v1/dashboard/ai-inventory -- Enterprise AI inventory evidence
+      if (req.method === 'GET' && pathname === '/v1/dashboard/ai-inventory') {
+        try {
+          const {
+            scanAiComponents,
+            buildCycloneDxMlBom,
+          } = require('../../scripts/ai-component-inventory');
+          const requestedRoot = parsed.searchParams.get('root');
+          const serverRoot = process.cwd();
+          const rootDir = requestedRoot ? path.resolve(requestedRoot) : serverRoot;
+          const rootRel = path.relative(serverRoot, rootDir);
+          if (rootRel.startsWith('..') || path.isAbsolute(rootRel)) {
+            sendJson(res, 400, {
+              error: 'ai_inventory_root_out_of_scope',
+              message: 'Dashboard AI inventory root must stay within the server working directory. Use the CLI for explicit cross-project scans.',
+            });
+            return;
+          }
+          const inventory = scanAiComponents({
+            rootDir,
+            maxFiles: parsed.searchParams.get('maxFiles') ? Number(parsed.searchParams.get('maxFiles')) : undefined,
+            includeSnippets: parsed.searchParams.get('snippets') !== '0',
+          });
+          const format = String(parsed.searchParams.get('format') || 'json').toLowerCase();
+          sendJson(res, 200, format === 'cyclonedx' ? buildCycloneDxMlBom(inventory, { version: pkg.version }) : inventory);
+        } catch (err) {
+          sendJson(res, 500, {
+            error: 'ai_inventory_failed',
+            message: err?.message || 'Unable to scan AI component inventory.',
+          });
+        }
+        return;
+      }
+
       // GET /v1/dashboard/review-state -- incremental review baseline and deltas
       if (req.method === 'GET' && pathname === '/v1/dashboard/review-state') {
         const reviewState = readDashboardReviewState(requestFeedbackDir);
@@ -7155,7 +9459,12 @@ async function addContext(){
 
       // POST /v1/dashboard/review-state -- mark current dashboard state as reviewed
       if (req.method === 'POST' && pathname === '/v1/dashboard/review-state') {
+        const body = await parseJsonBody(req);
         const snapshot = buildReviewSnapshot(requestFeedbackDir);
+        // Override snapshot timestamp with client-provided one if available
+        if (body?.reviewedAt) {
+          snapshot.reviewedAt = body.reviewedAt;
+        }
         writeDashboardReviewState(requestFeedbackDir, snapshot);
         const data = generateDashboard(requestFeedbackDir, {
           reviewBaseline: snapshot,
@@ -7287,6 +9596,18 @@ async function addContext(){
         });
         report.actionId = evaluation.actionId;
         if (report.decisionControl) report.decisionControl.actionId = evaluation.actionId;
+        const actionIntegration = inferActionIntegration(body, req.headers);
+        appendBestEffortTelemetry(requestFeedbackDir, {
+          eventType: chatgptActionEventType(actionIntegration, 'evaluate_decision'),
+          clientType: 'api',
+          source: actionIntegration,
+          integration: actionIntegration,
+          actionOperation: 'evaluateDecision',
+          endpoint: '/v1/decisions/evaluate',
+          actionStatus: 'accepted',
+          accepted: true,
+          decisionMode: report.decisionControl && report.decisionControl.executionMode,
+        }, req.headers, 'api_action_evaluate_decision');
         sendJson(res, 200, report);
         return;
       }
@@ -7391,6 +9712,7 @@ function startServer({ port, host } = {}) {
   const listenPort = Number(port ?? process.env.PORT ?? 8787);
   const listenHost = String(host ?? process.env.HOST ?? '0.0.0.0').trim() || '0.0.0.0';
   const server = createApiServer();
+  registerGracefulShutdown(server);
   return new Promise((resolve) => {
     server.listen(listenPort, listenHost, () => {
       const address = server.address();
@@ -7406,6 +9728,39 @@ function startServer({ port, host } = {}) {
   });
 }
 
+// Railway / Cloud Run / Kubernetes deploy rotations send SIGTERM to swap
+// containers. Without a handler, Node exits immediately — in-flight requests
+// are killed and the orchestrator may mark the container as "crashed" (instead
+// of "gracefully stopped"), wasting its restart-policy budget on a healthy
+// shutdown. Drain HTTP, give a deadline, then force-exit if anything hangs.
+function registerGracefulShutdown(server, { gracePeriodMs = 25_000 } = {}) {
+  if (server[GRACEFUL_SHUTDOWN_KEY]) return;
+  server[GRACEFUL_SHUTDOWN_KEY] = true;
+  let shuttingDown = false;
+  const stop = (signal) => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    console.log(`[shutdown] ${signal} received — draining connections (deadline ${gracePeriodMs}ms)`);
+    const forceTimer = setTimeout(() => {
+      console.error('[shutdown] grace period elapsed — forcing exit');
+      process.exit(1);
+    }, gracePeriodMs);
+    if (typeof forceTimer.unref === 'function') forceTimer.unref();
+    server.close((err) => {
+      if (err) {
+        console.error('[shutdown] server.close error:', err.message);
+        process.exit(1);
+      }
+      console.log('[shutdown] drained cleanly');
+      process.exit(0);
+    });
+  };
+  process.on('SIGTERM', () => stop('SIGTERM'));
+  process.on('SIGINT', () => stop('SIGINT'));
+}
+
+const GRACEFUL_SHUTDOWN_KEY = Symbol.for('thumbgate.gracefulShutdownRegistered');
+
 module.exports = {
   createApiServer,
   startServer,
@@ -7423,6 +9778,15 @@ module.exports = {
     renderPackagedLessonsHtml,
     readOptionalPublicTemplate,
     resolveLocalPageBootstrap,
+    getPublicMcpTools,
+    getServerCardTools,
+    buildEnterpriseDataChatStatus,
+    buildEnterpriseDialogflowStatus,
+    buildEnterpriseChatAnswer,
+    answerEnterpriseDataChat,
+    answerEnterpriseDialogflowChat,
+    buildLossAnalyticsResponse,
+    sanitizeHtmlUnsafeJsonValue,
   },
 };