diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index eaba8f31..c804532a 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -761,6 +761,9 @@ jobs:
       - name: Discovery & trust surfaces (/.well-known/x402, /api/reliability)
         run: node scripts/test-discovery.js
 
+      - name: Manifest resources[] dedup (a tool registered under 2 HTTP methods lists its URL once, not twice)
+        run: node scripts/test-manifest-resources-dedup.js
+
       - name: Revenue detector classification (real x402 buys vs funding/tests)
         run: node scripts/test-revenue-scan.js
 
@@ -881,6 +884,9 @@ jobs:
       - name: /openapi.json coverage (every CATALOG tool has a path + operationId + x-price)
         run: node scripts/test-openapi-coverage.js
 
+      - name: /openapi.json header parameters (Idempotency-Key on every op, X-Pow-Solution only where PoW-eligible)
+        run: node scripts/test-openapi-header-params.js
+
       - name: /.well-known/x402 manifest contract (envelope + payment + capabilities + discovery)
         run: node scripts/test-x402-manifest.js
 
@@ -893,6 +899,12 @@ jobs:
       - name: /llms.txt content lock (tool count + discovery URLs + PoW/MCP/wallet signals)
         run: node scripts/test-llms-txt.js
 
+      - name: /llms.txt MPP/x402 dual-header reading note (issue #794 guidance, offline)
+        run: node scripts/test-llms-mpp-header-note.js
+
+      - name: /llms.txt route-execute tier pricing derived from EXEC_TIERS (a future 5th tier can't go silently missing — offline)
+        run: node scripts/test-llms-route-execute-tiers.js
+
       - name: Rails-copy lock (rails.js ↔ payments.js + every key page renders every rail)
         run: TARGET_URL=http://localhost:3000 node scripts/test-rails.js
 
@@ -984,6 +996,33 @@ jobs:
       - name: Reveal-on-scroll no hero flash (the hero must never hide behind opacity:0 waiting on the observer)
         run: node scripts/test-reveal-no-hero-flash.js
 
+      - name: CSP violations sitewide (real browser, every distinct page template + real interactions on click-gated pages - script-src has no 'unsafe-inline' since 2026-08-16)
+        run: TARGET_URL=http://localhost:3000 node scripts/test-csp-violations.js
+
+      - name: CSS tokens resolve (every :root custom property must actually resolve in a real browser, not just exist as text)
+        run: TARGET_URL=http://localhost:3000 node scripts/test-css-tokens-resolve.js
+
+      - name: Focus-visible on search/demo inputs (real browser check - inline style can silently defeat a stylesheet :focus rule)
+        run: TARGET_URL=http://localhost:3000 node scripts/test-focus-visible.js
+
+      - name: Single <main> landmark per page (no page-level renderer may nest a second <main> inside ledgerShell's own)
+        run: TARGET_URL=http://localhost:3000 node scripts/test-single-main-landmark.js
+
+      - name: /compare tables scroll independently on narrow viewports (real browser check - scrollWidth>clientWidth alone can't prove overflow-x is enabled)
+        run: TARGET_URL=http://localhost:3000 node scripts/test-compare-scroll.js
+
+      - name: Wrong-method 405 with Allow header (a known catalog path hit with the wrong verb no longer looks like a dead route)
+        run: TARGET_URL=http://localhost:3000 node scripts/test-wrong-method-405.js
+
+      - name: Reveal-on-scroll data-reveal-eager opt-in (a second above-fold section can be exempted explicitly, never leaks to unmarked pages)
+        run: TARGET_URL=http://localhost:3000 node scripts/test-reveal-eager.js
+
+      - name: Reveal-on-scroll skip-over safety net (a single fast scroll jump must never leave a section permanently invisible — real browser, found live on /marketplace 2026-08-16)
+        run: TARGET_URL=http://localhost:3000 node scripts/test-reveal-scroll-skip.js
+
+      - name: Hamburger menu aria-label toggles with aria-expanded (real browser click, not a static string check)
+        run: TARGET_URL=http://localhost:3000 node scripts/test-burger-aria-label.js
+
       - name: Self-listing exclusion (crawled agent402.tools origin never appears as an "external" seller — offline)
         run: node scripts/test-self-listing-exclusion.js
 
@@ -1005,6 +1044,9 @@ jobs:
       - name: Revenue buyers series (distinct-count semantics; seeded ledger — offline)
         run: node scripts/test-revenue-buyers.js
 
+      - name: Revenue buyers trend (rolling 14d recent-vs-prior comparison — offline)
+        run: node scripts/test-buyers-trend.js
+
       - name: Settle-fallback chain (PayAI -> Solvador; double-settle gate between fallbacks — offline)
         run: node scripts/test-settle-fallback.js
 
@@ -1071,9 +1113,15 @@ jobs:
       - name: MPP dual-stack shim (real mppx client buys over WWW-Authenticate/Authorization wire; single settle; x402 pass-through; HMAC tamper — offline)
         run: node scripts/test-mpp-shim.js
 
+      - name: MPP_CHALLENGE_NETWORKS default verified against installed mppx registry (drift guard — offline)
+        run: node scripts/test-mpp-shim-mppx-registry.js
+
       - name: HEAD paywall bypass closed (HEAD on paid GET routes 402s with challenges + empty body; free surfaces untouched — offline)
         run: node scripts/test-head-paywall.js
 
+      - name: Wildcard route bypass closed (@x402/core 2.21.0 dotAll fix — percent-encoded line terminators can't skip payment on /api/convert/* — offline)
+        run: node scripts/test-wildcard-route-bypass.js
+
       - name: Boot /supported guard (a dead facilitator costs ONE rail, not every paid route — the 2026-08-01 Celo outage; probe-driven drop, fail-open on total blindness, escape hatch — offline)
         run: node scripts/test-supported-guard.js
 
@@ -1094,6 +1142,11 @@ jobs:
           REDIS_URL: redis://127.0.0.1:6379
         run: node scripts/test-redis-integration.js
 
+      - name: "Replay guard, cross-replica (REAL redis — two guard instances prove shared claim/settle/release; fails open to local state on a redis outage — 2026-08-16)"
+        env:
+          REDIS_URL: redis://127.0.0.1:6379
+        run: node scripts/test-replay-guard-redis.js
+
       - name: Well-known store (operator-published domain-verification docs; traversal impossible, reserved names refused, no shadowing of /.well-known/x402 — offline)
         run: node scripts/test-well-known-store.js
 
@@ -1174,6 +1227,9 @@ jobs:
       - name: MCP outer transport limits (R-11 — per-IP cap + concurrency ceiling bound floods before server/transport allocation — spawns child)
         run: node scripts/test-mcp-limits.js
 
+      - name: MCP Registry find-latest-version helper (used by the publish job to auto-deprecate a superseded version — offline)
+        run: node scripts/test-mcp-find-latest-version.js
+
       - name: PostHog analytics proxy abuse controls (R-17 — method allowlist + per-IP cap before the upstream call — spawns child)
         run: node scripts/test-posthog-proxy.js
 
@@ -1401,9 +1457,15 @@ jobs:
       - name: Operator auth (A402-07 no ?token= query; session cookie + header; hardened cookie flags — spawns child)
         run: node scripts/test-operator-auth.js
 
+      - name: Operator revenue visibility (zero-revenue rail flagging + top-by-revenue vs top-by-calls, offline)
+        run: node scripts/test-operator-revenue-visibility.js
+
       - name: Index self-serve registration tests (offline)
         run: node scripts/test-index-register.js
 
+      - name: Seller registration conversion/churn table (first_seen immutable, last_settled_seen sticky — offline)
+        run: node scripts/test-seller-registrations.js
+
       - name: Index openapi-fallback crawl tests (payment-signal gate, Bazaar merge, ranking — offline)
         run: node scripts/test-openapi-fallback.js
 
@@ -1490,6 +1552,7 @@ jobs:
           node scripts/test-encoding-kit.js
           node scripts/test-math-kit.js
           node scripts/test-theme.js
+          node scripts/test-faint-contrast.js
           node scripts/test-reveal-on-scroll.js
           node scripts/test-validation-kit.js
           node scripts/test-text-analysis-kit.js
@@ -2307,9 +2370,17 @@ jobs:
           # "mcpName" to the server.json name and confirming the npm package is
           # published — so this runs after the npm publish above.
           VER=$(node -p "require('./mcp/package.json').version")
-          if curl -s "https://registry.modelcontextprotocol.io/v0/servers?search=io.github.MikeyPetrillo/agent402" | grep -q "\"version\":\"$VER\""; then
+          SEARCH_RESULT=$(curl -s "https://registry.modelcontextprotocol.io/v0/servers?search=io.github.MikeyPetrillo/agent402&limit=100")
+          if echo "$SEARCH_RESULT" | grep -q "\"version\":\"$VER\""; then
             echo "io.github.mikeypetrillo/agent402@$VER already in the MCP Registry — nothing to do"; exit 0
           fi
+          # Capture whichever version is isLatest RIGHT NOW - it's about to
+          # become stale the moment the new publish below lands. Deprecation
+          # tooling gap found 2026-08-16: nothing ever marked a superseded
+          # version deprecated, so 24 of 25 published versions were still
+          # "active" in the registry. Best-effort: a lookup failure here
+          # leaves PREV_LATEST empty and the deprecate step below just skips.
+          PREV_LATEST=$(echo "$SEARCH_RESULT" | node scripts/mcp-find-latest-version.js || true)
           asset="mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz"
           if [ -n "${MCP_PUBLISHER_VERSION:-}" ]; then base="https://github.com/modelcontextprotocol/registry/releases/download/$MCP_PUBLISHER_VERSION"; else base="https://github.com/modelcontextprotocol/registry/releases/latest/download"; fi
           # Download to disk and fail fast (no curl|tar of unverified bytes).
@@ -2352,6 +2423,16 @@ jobs:
           ../mcp-publisher login github-oidc
           ../mcp-publisher publish
           echo "published io.github.mikeypetrillo/agent402@$VER → https://registry.modelcontextprotocol.io"
+          # Deprecate the version this publish just superseded. Only ever
+          # touches the ONE immediately-previous version - never a bulk
+          # rewrite of history - and never fails the job: a registry hiccup
+          # here is a missed housekeeping step, not a publish failure.
+          if [ -n "$PREV_LATEST" ] && [ "$PREV_LATEST" != "$VER" ]; then
+            ../mcp-publisher status --status deprecated --message "Superseded by $VER" \
+              io.github.MikeyPetrillo/agent402 "$PREV_LATEST" \
+              && echo "deprecated superseded version $PREV_LATEST" \
+              || echo "::warning::failed to deprecate superseded version $PREV_LATEST (non-fatal)"
+          fi
 
   probe:
     needs: markers
diff --git a/assets/js/api-explorer.js b/assets/js/api-explorer.js
new file mode 100644
index 00000000..88596d40
--- /dev/null
+++ b/assets/js/api-explorer.js
@@ -0,0 +1,128 @@
+(function(){
+  var wrapEl=document.querySelector('.ae-wrap');
+  var BASE=wrapEl?(wrapEl.getAttribute('data-base')||''):'';
+  var list=document.getElementById('aeList');
+  var search=document.getElementById('aeSearch');
+  var countEl=document.getElementById('aeCount');
+  var catsEl=document.getElementById('aeCats');
+  var endpoints=[];
+  var activeCategory='all';
+
+  function el(tag,cls,text){
+    var e=document.createElement(tag);
+    if(cls)e.className=cls;
+    if(text)e.textContent=text;
+    return e;
+  }
+
+  fetch(BASE+'/openapi.json').then(function(r){return r.json()}).then(function(spec){
+    var paths=spec.paths||{};
+    Object.keys(paths).sort().forEach(function(p){
+      var methods=paths[p];
+      ['get','post','put','delete','patch'].forEach(function(m){
+        if(!methods[m])return;
+        var op=methods[m];
+        endpoints.push({method:m.toUpperCase(),path:p,name:op.summary||op.operationId||'',desc:op.description||'',category:(op.tags&&op.tags[0])||'other',schema:op.requestBody&&op.requestBody.content&&op.requestBody.content['application/json']&&op.requestBody.content['application/json'].schema||null,params:op.parameters||[]});
+      });
+    });
+    renderCats();
+    renderList();
+  }).catch(function(){list.textContent='Failed to load API spec.';});
+
+  function renderCats(){
+    while(catsEl.firstChild)catsEl.removeChild(catsEl.firstChild);
+    var cats={};
+    endpoints.forEach(function(e){cats[e.category]=true;});
+    var allBtn=el('button','ae-cat-btn active','All');
+    allBtn.setAttribute('data-cat','all');
+    catsEl.appendChild(allBtn);
+    Object.keys(cats).sort().forEach(function(c){
+      var btn=el('button','ae-cat-btn',c);
+      btn.setAttribute('data-cat',c);
+      catsEl.appendChild(btn);
+    });
+    catsEl.addEventListener('click',function(ev){
+      var btn=ev.target.closest('.ae-cat-btn');
+      if(!btn)return;
+      activeCategory=btn.getAttribute('data-cat');
+      catsEl.querySelectorAll('.ae-cat-btn').forEach(function(x){x.classList.remove('active');});
+      btn.classList.add('active');
+      renderList();
+    });
+  }
+
+  function renderList(){
+    var q=search.value.toLowerCase().trim();
+    while(list.firstChild)list.removeChild(list.firstChild);
+    var shown=0;
+    endpoints.forEach(function(ep){
+      if(activeCategory!=='all'&&ep.category!==activeCategory)return;
+      if(q&&ep.method.toLowerCase().indexOf(q)===-1&&ep.path.toLowerCase().indexOf(q)===-1&&ep.name.toLowerCase().indexOf(q)===-1&&ep.desc.toLowerCase().indexOf(q)===-1)return;
+      shown++;
+
+      var div=el('div','ae-endpoint');
+      var head=el('div','ae-ep-head');
+      head.appendChild(el('span','ae-method '+ep.method,ep.method));
+      head.appendChild(el('span','ae-path',ep.path));
+      head.appendChild(el('span','ae-ep-name',ep.name));
+      head.addEventListener('click',function(){div.classList.toggle('open');});
+      div.appendChild(head);
+
+      var body=el('div','ae-ep-body');
+
+      if(ep.desc){
+        var sec=el('div','ae-section');
+        sec.appendChild(el('div','ae-section-title','Description'));
+        var p=el('p','',ep.desc);
+        p.style.cssText='font-size:.9rem;color:var(--muted);margin:0';
+        sec.appendChild(p);
+        body.appendChild(sec);
+      }
+
+      if(ep.params.length){
+        var sec2=el('div','ae-section');
+        sec2.appendChild(el('div','ae-section-title','Parameters'));
+        var schema=el('div','ae-schema');
+        ep.params.forEach(function(pm){
+          var row=el('div','ae-prop');
+          row.appendChild(el('span','ae-prop-name',pm.name));
+          row.appendChild(document.createTextNode(' '));
+          row.appendChild(el('span','ae-prop-type',pm.in||'query'));
+          if(pm.description){row.appendChild(document.createTextNode(' '));row.appendChild(el('span','ae-prop-desc',pm.description));}
+          schema.appendChild(row);
+        });
+        sec2.appendChild(schema);
+        body.appendChild(sec2);
+      }
+
+      if(ep.schema&&ep.schema.properties){
+        var sec3=el('div','ae-section');
+        sec3.appendChild(el('div','ae-section-title','Request Body'));
+        var schema2=el('div','ae-schema');
+        Object.keys(ep.schema.properties).forEach(function(k){
+          var prop=ep.schema.properties[k];
+          var row=el('div','ae-prop');
+          row.appendChild(el('span','ae-prop-name',k));
+          row.appendChild(document.createTextNode(' '));
+          row.appendChild(el('span','ae-prop-type',prop.type||'any'));
+          if(prop.description){row.appendChild(document.createTextNode(' '));row.appendChild(el('span','ae-prop-desc',prop.description));}
+          schema2.appendChild(row);
+        });
+        sec3.appendChild(schema2);
+        body.appendChild(sec3);
+      }
+
+      var sec4=el('div','ae-section');
+      var tryBtn=el('a','ae-try-btn','Try in Playground →');
+      tryBtn.href='/playground';
+      sec4.appendChild(tryBtn);
+      body.appendChild(sec4);
+
+      div.appendChild(body);
+      list.appendChild(div);
+    });
+    countEl.textContent=shown+' endpoint'+(shown===1?'':'s');
+  }
+
+  search.addEventListener('input',renderList);
+})();
diff --git a/assets/js/catalog-search.js b/assets/js/catalog-search.js
new file mode 100644
index 00000000..21a68501
--- /dev/null
+++ b/assets/js/catalog-search.js
@@ -0,0 +1,25 @@
+(function() {
+  var search = document.getElementById('cat-search');
+  var rows = document.querySelectorAll('.cat-row');
+  var empty = document.getElementById('cat-empty');
+  var emptyQ = document.getElementById('cat-empty-q');
+  function applyFilter() {
+    var q = (search.value || '').toLowerCase().trim();
+    var visible = 0;
+    rows.forEach(function(row) {
+      var label = row.querySelector('th a').textContent.toLowerCase();
+      var blurb = row.querySelector('.cat-blurb').textContent.toLowerCase();
+      var match = !q || label.indexOf(q) !== -1 || blurb.indexOf(q) !== -1;
+      row.style.display = match ? '' : 'none';
+      if (match) visible++;
+    });
+    empty.style.display = visible === 0 ? 'block' : 'none';
+    if (visible === 0) emptyQ.textContent = search.value;
+  }
+  search.addEventListener('input', applyFilter);
+  try {
+    var params = new URLSearchParams(window.location.search);
+    var q0 = params.get('q');
+    if (q0) { search.value = q0; applyFilter(); }
+  } catch (e) {}
+})();
diff --git a/assets/js/copy-buttons.js b/assets/js/copy-buttons.js
new file mode 100644
index 00000000..32529c07
--- /dev/null
+++ b/assets/js/copy-buttons.js
@@ -0,0 +1,25 @@
+(function(){
+  // Shared "copy code snippet" button handler for every page that has one:
+  // adapter docs (.ml-adp-copy), badges (.bdg-copy), contribute (.ct-copy),
+  // quickstart (.qs-copy). All four copy their own <code> sibling's text and
+  // give the same "Copied!" feedback - unified into one file (CSP hardening,
+  // 2026-08-16) instead of four near-identical inline scripts. .ml-adp-copy
+  // originally used inline style.color instead of a "copied" CSS class;
+  // both behaviors are preserved exactly, keyed by which class matched, so
+  // no page's visual behavior changed.
+  function wire(selector, feedback){
+    document.querySelectorAll(selector).forEach(function(btn){
+      btn.addEventListener("click",function(){
+        var code=btn.parentElement.querySelector("code");
+        var text=code.textContent;
+        navigator.clipboard.writeText(text).then(function(){
+          btn.textContent="Copied!";
+          feedback(btn, true);
+          setTimeout(function(){btn.textContent="Copy";feedback(btn, false);},1500);
+        });
+      });
+    });
+  }
+  wire(".ml-adp-copy", function(btn, on){ btn.style.color = on ? "var(--accent)" : ""; });
+  wire(".bdg-copy, .ct-copy, .qs-copy", function(btn, on){ btn.classList.toggle("copied", on); });
+})();
diff --git a/assets/js/docs-sidebar.js b/assets/js/docs-sidebar.js
new file mode 100644
index 00000000..737c36b5
--- /dev/null
+++ b/assets/js/docs-sidebar.js
@@ -0,0 +1,30 @@
+(function(){
+  var toggle=document.getElementById('ml-docs-mobile-toggle');
+  var side=document.getElementById('ml-docs-side');
+  if(!toggle||!side)return;
+  toggle.addEventListener('click',function(){
+    var open=side.classList.toggle('ml-docs-side-open');
+    toggle.setAttribute('aria-expanded',open?'true':'false');
+  });
+})();
+(function(){
+  var input=document.getElementById('ml-docs-search-input');
+  if(!input)return;
+  var side=input.closest('.ml-docs-side');
+  if(!side)return;
+  input.addEventListener('input',function(){
+    var q=input.value.trim().toLowerCase();
+    var lists=side.querySelectorAll('.ml-docs-side-ul');
+    lists.forEach(function(ul){
+      var anyVisible=false;
+      ul.querySelectorAll('li').forEach(function(li){
+        var match=!q||(li.textContent||'').toLowerCase().indexOf(q)>-1;
+        li.classList.toggle('ml-docs-side-hidden',!match);
+        if(match)anyVisible=true;
+      });
+      var h=ul.previousElementSibling;
+      if(h&&h.classList.contains('ml-docs-side-h'))h.classList.toggle('ml-docs-side-hidden',!anyVisible);
+      ul.classList.toggle('ml-docs-side-hidden',!anyVisible);
+    });
+  });
+})();
diff --git a/assets/js/home-hero.js b/assets/js/home-hero.js
new file mode 100644
index 00000000..1201e2b4
--- /dev/null
+++ b/assets/js/home-hero.js
@@ -0,0 +1,249 @@
+(function() {
+  // --- live counter + rails/leaderboard poll (seeds from server-rendered
+  // values above so the number is real and SEO-visible even with JS off;
+  // polling every 30s is a pure enhancement on top). ---
+  var counterEl = document.getElementById('hm-counter');
+  var counterEmptyEl = document.getElementById('hm-counter-empty');
+  var freePowEl = document.getElementById('hm-freepow');
+  var shownN = Number(counterEl ? counterEl.getAttribute('data-via-usdc') : 0) || 0;
+  function animateTo(target, dur) {
+    var from = shownN, t0 = performance.now();
+    function step(t) {
+      var p = Math.min(1, (t - t0) / dur);
+      var eased = 1 - Math.pow(1 - p, 3);
+      var n = Math.round(from + (target - from) * eased);
+      counterEl.textContent = n.toLocaleString('en-US');
+      if (n > 0) { counterEl.style.display = ''; counterEmptyEl.style.display = 'none'; }
+      if (p < 1) requestAnimationFrame(step);
+    }
+    requestAnimationFrame(step);
+  }
+  function pollStats() {
+    fetch('/api/stats', { headers: { accept: 'application/json' } }).then(function(r) { return r.ok ? r.json() : null; }).then(function(j) {
+      if (!j || !j.toolCallsServed) return;
+      var paid = Number(j.toolCallsServed.viaUSDC) || 0;
+      var pow = Number(j.toolCallsServed.viaProofOfWork) || 0;
+      if (freePowEl) freePowEl.textContent = pow.toLocaleString('en-US');
+      if (paid && paid !== shownN) { animateTo(paid, shownN ? 1000 : 1500); shownN = paid; }
+    }).catch(function() {});
+  }
+  setInterval(pollStats, 30000);
+
+  // --- real, live proof-of-work demo: fetch a real challenge, solve it in
+  // this tab, submit it, exactly matching src/pow.js's own semantics
+  // (hash the "challenge" field, submit the "token" field). ---
+  var input = document.getElementById('hm-demo-in');
+  var runBtn = document.getElementById('hm-demo-run');
+  var statusEl = document.getElementById('hm-demo-status');
+  var outEl = document.getElementById('hm-demo-out');
+  var receiptEl = document.getElementById('hm-demo-receipt');
+  var step1 = document.getElementById('hm-step1'), step1m = document.getElementById('hm-step1-mark');
+  var step2 = document.getElementById('hm-step2'), step2m = document.getElementById('hm-step2-mark');
+  var step3 = document.getElementById('hm-step3'), step3m = document.getElementById('hm-step3-mark');
+  var busy = false;
+
+  function lzOf(buf) {
+    var bits = 0, arr = new Uint8Array(buf);
+    for (var i = 0; i < arr.length; i++) {
+      if (arr[i] === 0) { bits += 8; continue; }
+      bits += Math.clz32(arr[i]) - 24;
+      break;
+    }
+    return bits;
+  }
+
+  runBtn.addEventListener('click', function() {
+    if (busy) return;
+    var text = (input.value || 'hello').slice(0, 200);
+    busy = true;
+    runBtn.textContent = 'WORKING…';
+    statusEl.textContent = 'challenge';
+    outEl.textContent = 'requesting a signed challenge…';
+    receiptEl.textContent = 'waiting on the live server';
+    step1m.textContent = '·'; step2m.textContent = '·'; step3m.textContent = '·';
+
+    fetch('/api/pow/challenge?slug=hash', { headers: { accept: 'application/json' } })
+      .then(function(r) { if (!r.ok) throw new Error('challenge returned ' + r.status); return r.json(); })
+      .then(function(c) {
+        if (!c || !c.challenge || !c.token) throw new Error('challenge response missing challenge/token');
+        statusEl.textContent = c.difficulty + '-bit puzzle';
+        step1m.textContent = '✓';
+        step1.textContent = c.difficulty + '-bit sha256 puzzle issued';
+        outEl.textContent = 'solving…';
+
+        var t0 = performance.now();
+        var enc = new TextEncoder();
+        var BATCH = 512, CAP = 4000000, base = 0, nonce = null;
+
+        function solveBatch() {
+          var jobs = [];
+          for (var i = 0; i < BATCH; i++) jobs.push(crypto.subtle.digest('SHA-256', enc.encode(c.challenge + ':' + (base + i))));
+          return Promise.all(jobs).then(function(digests) {
+            for (var i = 0; i < BATCH; i++) {
+              if (lzOf(digests[i]) >= c.difficulty) { nonce = base + i; return; }
+            }
+            base += BATCH;
+            outEl.textContent = 'solving… ' + base.toLocaleString('en-US') + ' hashes tried';
+            step2.textContent = base.toLocaleString('en-US') + ' hashes…';
+            if (base > CAP) throw new Error('gave up after 4M hashes');
+            return solveBatch();
+          });
+        }
+
+        return solveBatch().then(function() {
+          var ms = Math.round(performance.now() - t0);
+          step2m.textContent = '✓';
+          step2.textContent = 'nonce ' + nonce.toLocaleString('en-US') + ' found in ' + ms + 'ms';
+          statusEl.textContent = 'X-Pow-Solution sent';
+          outEl.textContent = 'solution accepted locally - calling the tool…';
+          receiptEl.textContent = 'solved in ' + ms + 'ms';
+          return fetch('/api/hash', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', 'X-Pow-Solution': c.token + ':' + nonce },
+            body: JSON.stringify({ text: text, algo: 'sha256' }),
+          }).then(function(rr) {
+            return rr.text().then(function(body) {
+              if (!rr.ok) throw new Error('tool returned ' + rr.status + ' - ' + body.slice(0, 160));
+              var out = body;
+              try { out = JSON.stringify(JSON.parse(body), null, 2); } catch (e) {}
+              step3m.textContent = '✓';
+              step3.textContent = 'served free - no payment, no key';
+              statusEl.textContent = '200 OK';
+              outEl.textContent = out;
+              receiptEl.textContent = 'paid with ' + (nonce + 1).toLocaleString('en-US') + ' hashes · ' + ms + 'ms of your CPU · $0.00 · nonce ' + nonce.toLocaleString('en-US');
+            });
+          });
+        });
+      })
+      .catch(function(e) {
+        statusEl.textContent = 'error';
+        outEl.textContent = "couldn't complete the live call: " + (e && e.message ? e.message : 'unknown error');
+        receiptEl.textContent = 'try again, or see the curl example above';
+      })
+      .then(function() {
+        busy = false;
+        runBtn.textContent = 'RUN IT AGAIN';
+      });
+  });
+
+  // --- inline seller registration (same POST /api/index/register the /sell
+  // page's own form uses - listing an API shouldn't require a click-through
+  // to a second page just to paste one URL). ---
+  var regBtn = document.getElementById('hm-reg-go');
+  var regIn = document.getElementById('hm-reg-origin');
+  var regOut = document.getElementById('hm-reg-out');
+  // The two hero-style "LIST YOUR API" buttons jump here via #sell instead of
+  // navigating to /sell - focus the input so the jump visibly lands on
+  // something typeable, not just a scroll position.
+  document.querySelectorAll('a[href="#sell"]').forEach(function(a) {
+    a.addEventListener('click', function() { setTimeout(function() { if (regIn) regIn.focus(); }, 400); });
+  });
+  if (regBtn) {
+    function submitReg() {
+      regOut.textContent = 'probing...';
+      fetch('/api/index/register', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ origin: regIn.value }) })
+        .then(function(r) { return r.json(); })
+        .then(function(j) {
+          regOut.textContent = j.listed
+            ? ('Listed - ' + (j.seller && j.seller.displayName ? j.seller.displayName : j.origin) + ' (' + (j.seller && j.seller.toolCount ? j.seller.toolCount : 0) + ' tools). Appears on /marketplace and any chain page it advertises.')
+            : ('Not listed: ' + (j.error || 'unknown error'));
+        })
+        .catch(function() { regOut.textContent = 'submission failed - try again'; });
+    }
+    regBtn.addEventListener('click', submitReg);
+    regIn.addEventListener('keydown', function(e) { if (e.key === 'Enter') submitReg(); });
+  }
+
+  // --- reveal-on-scroll: the shared script in ledger-chrome.js now applies
+  // this to every header/section site-wide on its own; no per-page opt-in
+  // needed here anymore. ---
+
+  // --- dot world map: real Natural Earth geometry (world-atlas 110m, public
+  // domain), rasterised to a land mask, sampled into a dot grid, with
+  // animated settlement arcs. Waits for the pinned d3/topojson tags above. ---
+  (function() {
+    var c = document.getElementById('hm-map');
+    if (!c) return;
+    function waitForLibs(timeoutMs) {
+      return new Promise(function(resolve, reject) {
+        var t0 = Date.now();
+        (function tick() {
+          if (window.d3 && window.topojson) return resolve();
+          if (Date.now() - t0 > (timeoutMs || 8000)) return reject(new Error('d3/topojson did not load'));
+          setTimeout(tick, 60);
+        })();
+      });
+    }
+    waitForLibs().then(function() {
+      return fetch('https://cdn.jsdelivr.net/npm/world-atlas@2.0.2/countries-110m.json').then(function(r) { return r.json(); });
+    }).then(function(topo) {
+      var all = window.topojson.feature(topo, topo.objects.countries);
+      var land = { type: 'FeatureCollection', features: all.features.filter(function(f) { return String(f.id) !== '010'; }) };
+      var reduce = window.matchMedia && window.matchMedia('(prefers-reduced-motion: reduce)').matches;
+      var dpr = Math.min(2, window.devicePixelRatio || 1);
+      var ctx = c.getContext('2d');
+      var W = 0, H = 0, dots = [], arcs = [], raf = null;
+
+      function build() {
+        W = Math.max(300, c.parentElement.clientWidth);
+        H = Math.round(W / 2.05);
+        c.width = W * dpr; c.height = H * dpr;
+        c.style.height = H + 'px';
+        ctx.setTransform(dpr, 0, 0, dpr, 0, 0);
+        var proj = window.d3.geoEquirectangular().fitExtent([[8, 8], [W - 8, H - 8]], land);
+        var off = document.createElement('canvas');
+        off.width = W; off.height = H;
+        var octx = off.getContext('2d');
+        octx.fillStyle = '#fff';
+        octx.beginPath();
+        window.d3.geoPath(proj, octx)(land);
+        octx.fill();
+        var px = octx.getImageData(0, 0, W, H).data;
+        dots = [];
+        var step = W > 460 ? 4 : 5;
+        for (var y = 0; y < H; y += step) for (var x = 0; x < W; x += step) if (px[(y * W + x) * 4 + 3] > 140) dots.push([x + 0.5, y + 0.5]);
+        arcs = [];
+        var minSpan = W * 0.24;
+        for (var i = 0; i < 9 && dots.length > 40; i++) {
+          var a = null, b = null;
+          for (var tries = 0; tries < 60; tries++) {
+            var p = dots[(Math.random() * dots.length) | 0];
+            var q = dots[(Math.random() * dots.length) | 0];
+            if (Math.hypot(p[0] - q[0], p[1] - q[1]) >= minSpan) { a = p; b = q; break; }
+          }
+          if (a && b) arcs.push({ a: a, b: b, phase: Math.random() });
+        }
+      }
+
+      function draw(t) {
+        ctx.clearRect(0, 0, W, H);
+        ctx.fillStyle = '#8C8C88';
+        ctx.globalAlpha = 0.44;
+        for (var i = 0; i < dots.length; i++) { ctx.beginPath(); ctx.arc(dots[i][0], dots[i][1], 1.05, 0, 6.2832); ctx.fill(); }
+        for (var j = 0; j < arcs.length; j++) {
+          var arc = arcs[j], a = arc.a, b = arc.b;
+          var span = Math.hypot(a[0] - b[0], a[1] - b[1]);
+          var mx = (a[0] + b[0]) / 2, my = (a[1] + b[1]) / 2 - span * 0.34;
+          ctx.globalAlpha = 0.2; ctx.strokeStyle = '#F0522E'; ctx.lineWidth = 1;
+          ctx.beginPath(); ctx.moveTo(a[0], a[1]); ctx.quadraticCurveTo(mx, my, b[0], b[1]); ctx.stroke();
+          ctx.fillStyle = '#F0522E'; ctx.globalAlpha = 0.7;
+          ctx.beginPath(); ctx.arc(a[0], a[1], 2, 0, 6.2832); ctx.fill();
+          ctx.beginPath(); ctx.arc(b[0], b[1], 2, 0, 6.2832); ctx.fill();
+          if (!reduce) {
+            var tt = (t * 0.00014 + arc.phase) % 1, u = 1 - tt;
+            var qx = u * u * a[0] + 2 * u * tt * mx + tt * tt * b[0];
+            var qy = u * u * a[1] + 2 * u * tt * my + tt * tt * b[1];
+            ctx.globalAlpha = 0.22; ctx.beginPath(); ctx.arc(qx, qy, 6.5, 0, 6.2832); ctx.fill();
+            ctx.globalAlpha = 1; ctx.beginPath(); ctx.arc(qx, qy, 2.6, 0, 6.2832); ctx.fill();
+          }
+        }
+        ctx.globalAlpha = 1;
+        if (!reduce) raf = requestAnimationFrame(draw);
+      }
+
+      build();
+      window.addEventListener('resize', function() { build(); if (reduce) draw(0); });
+      if (reduce) draw(0); else raf = requestAnimationFrame(draw);
+    }).catch(function() { /* map is decorative - silently fall back to the panel without it */ });
+  })();
+})();
diff --git a/assets/js/market-filter-bar.js b/assets/js/market-filter-bar.js
new file mode 100644
index 00000000..67f8a9c3
--- /dev/null
+++ b/assets/js/market-filter-bar.js
@@ -0,0 +1,20 @@
+document.addEventListener('DOMContentLoaded',function(){
+  var rows=Array.prototype.slice.call(document.querySelectorAll('[data-mfb-row]'));
+  if(!rows.length)return;
+  var parent=rows[0].parentNode;
+  var num=function(el,k){var v=Number(el.getAttribute('data-'+k));return isFinite(v)?v:0;};
+  var sortSel=document.querySelector('select[data-mfb-sort]');
+  if(sortSel)sortSel.addEventListener('change',function(){
+    var k=sortSel.value;
+    rows.slice().sort(function(a,b){
+      if(k==='health'&&num(a,'health')!==num(b,'health'))return num(b,'health')-num(a,'health');
+      var m=k==='health'?'calls':k;
+      return num(b,m)-num(a,m);
+    }).forEach(function(r){parent.appendChild(r);});
+  });
+  var searchIn=document.querySelector('input[data-mfb-search]');
+  if(searchIn)searchIn.addEventListener('input',function(){
+    var q=searchIn.value.trim().toLowerCase();
+    rows.forEach(function(r){r.style.display=!q||(r.textContent||'').toLowerCase().indexOf(q)>-1?'':'none';});
+  });
+});
diff --git a/assets/js/market-seller-switch.js b/assets/js/market-seller-switch.js
new file mode 100644
index 00000000..e10b2f5a
--- /dev/null
+++ b/assets/js/market-seller-switch.js
@@ -0,0 +1,28 @@
+(function(){
+  // In-place seller switching: fetch the same-origin, server-rendered (and fully
+  // escaped) market panel and swap it without a full reload. Progressive
+  // enhancement - the roster links are real hrefs, so this whole block is a
+  // no-op fallback to normal navigation when JS/fetch/history are unavailable
+  // or a request fails. Content is parsed with createContextualFragment +
+  // replaceChildren (not innerHTML); it is our own output, never user input.
+  var panel=document.getElementById('market-panel');
+  var CHAIN=panel?(panel.getAttribute('data-chain')||''):'';
+  if(!panel||!window.fetch||!window.history||!history.pushState||!document.createRange().createContextualFragment)return;
+  function loading(on){panel.style.transition='opacity .15s';panel.style.opacity=on?'.5':'';}
+  function mark(host){document.querySelectorAll('[data-seller-link]').forEach(function(a){var h=a.getAttribute('data-seller-host')||'';a.classList.toggle('sel',host?(h===host):(a.getAttribute('data-seller-local')==='1'));});}
+  function swap(html){panel.replaceChildren(document.createRange().createContextualFragment(html));}
+  function load(host,push){
+    loading(true);
+    return fetch('/api/market/'+CHAIN+'/panel'+(host?('?seller='+encodeURIComponent(host)):''),{headers:{accept:'application/json'}})
+      .then(function(r){if(!r.ok)throw 0;return r.json();})
+      .then(function(j){swap(j.html);mark(host);loading(false);
+        if(push){var u=host?(location.pathname.split('?')[0]+'?seller='+encodeURIComponent(host)):location.pathname.split('?')[0];history.pushState({s:host},'',u+'#activity');var el=document.getElementById('activity');if(el)el.scrollIntoView({behavior:'smooth',block:'start'});}
+        return true;});
+  }
+  document.addEventListener('click',function(e){
+    var a=e.target.closest&&e.target.closest('[data-seller-link]');if(!a)return;
+    e.preventDefault();var host=a.getAttribute('data-seller-host')||'';
+    load(host,true).catch(function(){window.location.href=a.getAttribute('href');});
+  });
+  window.addEventListener('popstate',function(){var m=location.search.match(/[?&]seller=([^&#]+)/);load(m?decodeURIComponent(m[1]):'',false).catch(function(){location.reload();});});
+})();
diff --git a/assets/js/operator-dashboard.js b/assets/js/operator-dashboard.js
new file mode 100644
index 00000000..e9575fad
--- /dev/null
+++ b/assets/js/operator-dashboard.js
@@ -0,0 +1,68 @@
+(function(){
+  // The session cookie authenticates same-origin requests automatically; nav is
+  // plain links and the refresh below needs no token handling.
+  function esc(t){ return String(t==null?'':t).replace(/[&<>"']/g,function(c){return({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'})[c];}); }
+  var tbody=document.getElementById('tbody');
+  var feed=document.getElementById('feed');
+  // Live per-tool data - was templated directly into this script's text
+  // (`rowsCache=${JSON.stringify(tools)}`); now read from the JSON island
+  // op-rows-data emits (CSP hardening, 2026-08-16 - this value is genuinely
+  // per-request, unlike most of this site's other inline-script data).
+  var rowsDataEl = document.getElementById('op-rows-data');
+  var sortK='calls', sortDir=-1, rowsCache = rowsDataEl ? JSON.parse(rowsDataEl.textContent) : [];
+
+  function renderRows(){
+    var q=(document.getElementById('filter').value||'').toLowerCase();
+    var rs=rowsCache.filter(function(r){ return !q || r.slug.toLowerCase().indexOf(q)>=0; });
+    rs.sort(function(a,b){
+      var k=sortK==='price'?'pricePerCall':(sortK==='rev'?'revenueUsd':sortK);
+      var av=a[k], bv=b[k];
+      if(typeof av==='string') return sortDir*av.localeCompare(bv);
+      return sortDir*((av||0)-(bv||0));
+    });
+    var html = rs.length ? rs.map(function(r){
+      var b = r.walletOnly
+        ? '<span class="op-badge op-badge-wallet" title="USDC only">USDC-ONLY</span>'
+        : '<span class="op-badge op-badge-pow" title="Also payable with proof-of-work">FREE-W/POW</span>';
+      return '<tr><td><a href="/tools/'+esc(r.slug)+'">'+esc(r.slug)+'</a> '+b+'</td>'+
+        '<td class="num">'+esc(r.calls)+'</td>'+
+        '<td class="num op-paid">'+esc(r.paid)+'</td>'+
+        '<td class="num op-pow">'+esc(r.pow)+'</td>'+
+        '<td class="num op-hb">'+esc(r.heartbeat||0)+'</td>'+
+        '<td class="num op-rev">$'+esc(r.revenueUsd.toFixed(4))+'</td>'+
+        '<td class="num op-muted">$'+esc(r.pricePerCall.toFixed(4))+'</td></tr>';
+    }).join('') : '<tr><td colspan="7" class="op-muted" style="padding:24px;text-align:center;">No matches.</td></tr>';
+    tbody.innerHTML = html; /* eslint-disable-line -- pre-existing AJAX table refresh; all values esc()-d */
+  }
+  document.getElementById('filter').addEventListener('input', renderRows);
+  document.querySelectorAll('th[data-k]').forEach(function(th){
+    th.addEventListener('click', function(){
+      var k=th.getAttribute('data-k');
+      if(sortK===k) sortDir=-sortDir; else { sortK=k; sortDir=-1; }
+      renderRows();
+    });
+  });
+
+  async function tick(){
+    try {
+      var r=await fetch('/__operator/stats',{cache:'no-store'});
+      if(!r.ok) return;
+      var d=await r.json();
+      var tt=d.totals||{};
+      document.getElementById('t-total').textContent=tt.total||0;
+      document.getElementById('t-usdc').textContent=tt.viaUSDC||0;
+      document.getElementById('t-pow').textContent=tt.viaProofOfWork||0;
+      document.getElementById('t-hb').textContent=tt.viaHeartbeat||0;
+      document.getElementById('t-rev').textContent='$'+((tt.estimatedRevenueUsd||0).toFixed(4));
+      document.getElementById('t-tools').textContent=tt.toolsServed||0;
+      document.getElementById('t-up').textContent=Math.floor((d.processUptimeSeconds||0)/3600)+'h';
+      rowsCache=d.tools||[]; renderRows();
+      var feedHtml=(d.recentCalls||[]).map(function(x){
+        var m=x.paidWith==='proof-of-work'?'PoW':x.paidWith==='heartbeat'?'HB':'$ USDC';
+        return '<li><span class="op-rs">'+esc(x.slug)+'</span><span class="op-rm">'+m+'</span><span class="op-ra">'+esc(x.at)+'</span></li>';
+      }).join('') || '<li style="text-align:center;color:var(--dk-muted);padding:16px;">No recent activity.</li>';
+      feed.innerHTML = feedHtml; /* eslint-disable-line -- pre-existing AJAX feed refresh; all values esc()-d */
+    } catch(e) { /* ignore */ }
+  }
+  setInterval(tick, 10000);
+})();
diff --git a/assets/js/operator-login.js b/assets/js/operator-login.js
new file mode 100644
index 00000000..267ffd26
--- /dev/null
+++ b/assets/js/operator-login.js
@@ -0,0 +1,9 @@
+(function(){
+  var f=document.getElementById('f'), t=document.getElementById('t'), e=document.getElementById('e');
+  f.addEventListener('submit', function(ev){
+    ev.preventDefault(); e.textContent='';
+    fetch('/__operator/login',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({token:t.value})})
+      .then(function(r){ if(r.ok){ location.href='/__operator'; } else { e.textContent='Invalid token.'; } })
+      .catch(function(){ e.textContent='Sign-in failed.'; });
+  });
+})();
diff --git a/assets/js/pages-tool-search.js b/assets/js/pages-tool-search.js
new file mode 100644
index 00000000..0d42e647
--- /dev/null
+++ b/assets/js/pages-tool-search.js
@@ -0,0 +1,38 @@
+(function(){
+  var input=document.getElementById('tool-search'), count=document.getElementById('tool-search-count');
+  if(!input) return;
+  // Moved off inline onfocus/onblur attributes (CSP hardening, 2026-08-16) -
+  // same visual behavior, just wired via addEventListener instead.
+  input.addEventListener('focus', function(){ input.style.borderColor = '#4ade80'; });
+  input.addEventListener('blur', function(){ input.style.borderColor = '#1e2638'; });
+  input.addEventListener('input', function(){
+    var q = this.value.toLowerCase().trim();
+    var cards = document.querySelectorAll('.card');
+    var sections = document.querySelectorAll('h2');
+    var shown = 0;
+    cards.forEach(function(c){
+      var text = (c.textContent || '').toLowerCase();
+      var match = !q || text.indexOf(q) !== -1;
+      c.style.display = match ? '' : 'none';
+      if (match) shown++;
+    });
+    sections.forEach(function(s){
+      if (!q) { s.style.display = ''; return; }
+      var next = s.nextElementSibling;
+      while (next && !next.matches('h2')) {
+        if (next.classList && next.classList.contains('grid')) {
+          var vis = next.querySelectorAll('.card:not([style*="display: none"])');
+          s.style.display = vis.length ? '' : 'none';
+          break;
+        }
+        if (next.classList && next.classList.contains('cat-blurb')) {
+          next.style.display = s.style.display;
+          next = next.nextElementSibling;
+          continue;
+        }
+        next = next.nextElementSibling;
+      }
+    });
+    count.textContent = q ? shown + ' match' + (shown === 1 ? '' : 'es') : '';
+  });
+})();
diff --git a/assets/js/playground.js b/assets/js/playground.js
new file mode 100644
index 00000000..b5251e1e
--- /dev/null
+++ b/assets/js/playground.js
@@ -0,0 +1,347 @@
+(function(){
+  var wrapEl=document.querySelector('.pg-wrap');
+  var BASE=wrapEl?(wrapEl.getAttribute('data-base')||''):'';
+  var tools=[];
+  var toolMap={};
+  var selEl=document.getElementById('pgSelect');
+  var searchEl=document.getElementById('pgSearch');
+  var formEl=document.getElementById('pgForm');
+  var resultEl=document.getElementById('pgResult');
+
+  function escH(s){
+    return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
+  }
+
+  /* --- load catalog (embedded at render time via the pg-tools-data JSON
+     island; see playgroundPage) --- */
+  (function loadCatalog(){
+    var dataEl=document.getElementById('pg-tools-data');
+    var data=dataEl?JSON.parse(dataEl.textContent):[];
+    tools=(data||[]).slice().sort(function(a,b){
+      if(a.category<b.category)return -1;
+      if(a.category>b.category)return 1;
+      var an=(a.name||a.slug||'');
+      var bn=(b.name||b.slug||'');
+      return an<bn?-1:1;
+    });
+    tools.forEach(function(t){toolMap[t.slug]=t});
+    renderSelect(tools);
+    var want=null;
+    try{
+      var params=new URLSearchParams(window.location.search);
+      want=params.get('slug');
+    }catch(e){}
+    var def=(want&&toolMap[want])||toolMap['hash']||tools[0];
+    if(def){selEl.value=def.slug;showTool(def.slug,true)}
+  })();
+
+  function renderSelect(list){
+    var cats={};
+    list.forEach(function(t){
+      if(!cats[t.category])cats[t.category]=[];
+      cats[t.category].push(t);
+    });
+    while(selEl.firstChild)selEl.removeChild(selEl.firstChild);
+    var placeholder=document.createElement('option');
+    placeholder.value='';
+    placeholder.textContent='-- select a tool --';
+    selEl.appendChild(placeholder);
+    Object.keys(cats).sort().forEach(function(c){
+      var grp=document.createElement('optgroup');
+      grp.label=c;
+      cats[c].forEach(function(t){
+        var opt=document.createElement('option');
+        opt.value=t.slug;
+        opt.textContent=t.name||t.slug;
+        grp.appendChild(opt);
+      });
+      selEl.appendChild(grp);
+    });
+  }
+
+  /* --- search filter --- */
+  searchEl.addEventListener('input',function(){
+    var q=searchEl.value.toLowerCase().trim();
+    if(!q){renderSelect(tools);return}
+    var filtered=tools.filter(function(t){
+      return (t.name||'').toLowerCase().indexOf(q)!==-1||
+             t.slug.toLowerCase().indexOf(q)!==-1||
+             (t.description||'').toLowerCase().indexOf(q)!==-1||
+             (t.category||'').toLowerCase().indexOf(q)!==-1;
+    });
+    renderSelect(filtered);
+  });
+
+  selEl.addEventListener('change',function(){showTool(selEl.value)});
+
+  /* --- show tool form --- */
+  function showTool(slug, skipUrl){
+    var t=toolMap[slug];
+    if(!t){while(formEl.firstChild)formEl.removeChild(formEl.firstChild);return}
+
+    if(!skipUrl){
+      try{
+        var u=new URL(window.location.href);
+        u.searchParams.set('slug',slug);
+        history.replaceState(null,'',u.pathname+u.search+(u.hash||''));
+      }catch(e){}
+    }
+
+    var schema=(t.discovery&&t.discovery.inputSchema&&t.discovery.inputSchema.properties)||{};
+    var example=(t.discovery&&t.discovery.input)||{};
+    var keys=Object.keys(schema);
+
+    /* build form with safe DOM methods */
+    while(formEl.firstChild)formEl.removeChild(formEl.firstChild);
+    var info=document.createElement('div');
+    info.className='pg-info';
+
+    var nameEl=document.createElement('div');
+    nameEl.className='tool-name';
+    nameEl.textContent=t.name||t.slug;
+    info.appendChild(nameEl);
+
+    var descEl=document.createElement('div');
+    descEl.className='tool-desc';
+    descEl.textContent=t.description||'';
+    info.appendChild(descEl);
+
+    var metaEl=document.createElement('div');
+    metaEl.className='tool-meta';
+    var mSpan1=document.createElement('span');
+    mSpan1.textContent=t.method+' '+t.path;
+    metaEl.appendChild(mSpan1);
+    var mSpan2=document.createElement('span');
+    // price is already a "$X.XXX" display string from the catalog
+    mSpan2.textContent=t.price||'';
+    metaEl.appendChild(mSpan2);
+    info.appendChild(metaEl);
+
+    var fieldsDiv=document.createElement('div');
+    fieldsDiv.className='pg-fields';
+    keys.forEach(function(k){
+      var prop=schema[k];
+      var val=example[k]!==undefined?example[k]:'';
+      var field=document.createElement('div');
+      field.className='pg-field';
+
+      var lbl=document.createElement('label');
+      lbl.textContent=k;
+      if(prop.description){
+        var descSpan=document.createElement('span');
+        descSpan.style.cssText='font-weight:400;color:var(--faint);font-family:inherit;font-size:.8rem';
+        descSpan.textContent=' - '+prop.description;
+        lbl.appendChild(descSpan);
+      }
+      field.appendChild(lbl);
+
+      if(prop.type==='boolean'){
+        var wrap=document.createElement('div');
+        wrap.className='chk-wrap';
+        var cb=document.createElement('input');
+        cb.type='checkbox';
+        cb.setAttribute('data-key',k);
+        cb.setAttribute('data-type','boolean');
+        if(val)cb.checked=true;
+        wrap.appendChild(cb);
+        var cbLabel=document.createElement('span');
+        cbLabel.textContent=String(val);
+        wrap.appendChild(cbLabel);
+        field.appendChild(wrap);
+      }else if(prop.type==='number'||prop.type==='integer'){
+        var numIn=document.createElement('input');
+        numIn.type='number';
+        numIn.setAttribute('data-key',k);
+        numIn.setAttribute('data-type','number');
+        numIn.value=String(val);
+        field.appendChild(numIn);
+      }else{
+        var txtIn=document.createElement('input');
+        txtIn.type='text';
+        txtIn.setAttribute('data-key',k);
+        txtIn.setAttribute('data-type','string');
+        txtIn.value=String(val);
+        field.appendChild(txtIn);
+      }
+      fieldsDiv.appendChild(field);
+    });
+    info.appendChild(fieldsDiv);
+
+    if(t.computePayable){
+      var btn=document.createElement('button');
+      btn.className='pg-btn run';
+      btn.id='pgRun';
+      btn.textContent='Run free (proof-of-work)';
+      btn.addEventListener('click',function(){runTool(t)});
+      info.appendChild(btn);
+    }else{
+      var dbtn=document.createElement('button');
+      dbtn.className='pg-btn disabled-info';
+      dbtn.disabled=true;
+      dbtn.textContent='Requires USDC wallet ';
+      var lnk=document.createElement('a');
+      lnk.href='/integrations';
+      lnk.textContent='Setup →';
+      dbtn.appendChild(lnk);
+      info.appendChild(dbtn);
+    }
+
+    var statusDiv=document.createElement('div');
+    statusDiv.className='pg-status';
+    statusDiv.id='pgStatus';
+    info.appendChild(statusDiv);
+
+    formEl.appendChild(info);
+  }
+
+  /* --- PoW helpers --- */
+  async function sha256(msg){
+    var buf=await crypto.subtle.digest('SHA-256',new TextEncoder().encode(msg));
+    return new Uint8Array(buf);
+  }
+  function leadingZeroBits(buf){
+    var n=0;
+    for(var i=0;i<buf.length;i++){
+      var b=buf[i];
+      if(b===0){n+=8;continue}
+      n+=Math.clz32(b)-24;
+      break;
+    }
+    return n;
+  }
+  async function solvePow(challenge,difficulty){
+    var nonce=0;
+    while(true){
+      var hash=await sha256(challenge+':'+nonce);
+      if(leadingZeroBits(hash)>=difficulty) return nonce;
+      nonce++;
+      if(nonce%5000===0) await new Promise(function(r){setTimeout(r,0)});
+    }
+  }
+
+  /* --- JSON syntax highlight (operates on pre-serialized, HTML-escaped JSON) --- */
+  function highlightJson(str){
+    var safe=escH(str);
+    return safe
+      .replace(/(&quot;(?:[^&]|&(?!quot;))*?&quot;)\s*:/g,
+        '<span class="json-key">$1</span>:')
+      .replace(/:\s*(&quot;(?:[^&]|&(?!quot;))*?&quot;)/g,
+        ': <span class="json-str">$1</span>')
+      .replace(/:\s*(-?\d+\.?\d*(?:[eE][+-]?\d+)?)/g,
+        ': <span class="json-num">$1</span>')
+      .replace(/:\s*(true|false)/g,
+        ': <span class="json-bool">$1</span>')
+      .replace(/:\s*(null)/g,
+        ': <span class="json-null">$1</span>');
+  }
+
+  /* --- run tool --- */
+  async function runTool(t){
+    var btn=document.getElementById('pgRun');
+    var status=document.getElementById('pgStatus');
+    btn.disabled=true;
+
+    /* status: solving */
+    while(status.firstChild)status.removeChild(status.firstChild);
+    var spinSpan=document.createElement('span');
+    spinSpan.className='spin';
+    status.appendChild(spinSpan);
+    status.appendChild(document.createTextNode(' Solving proof-of-work...'));
+
+    /* result: running */
+    while(resultEl.firstChild)resultEl.removeChild(resultEl.firstChild);
+    var runPlaceholder=document.createElement('div');
+    runPlaceholder.className='placeholder';
+    runPlaceholder.textContent='Running...';
+    resultEl.appendChild(runPlaceholder);
+
+    try{
+      /* gather params */
+      var params={};
+      var inputs=formEl.querySelectorAll('[data-key]');
+      for(var i=0;i<inputs.length;i++){
+        var el=inputs[i];
+        var k=el.getAttribute('data-key');
+        var tp=el.getAttribute('data-type');
+        if(tp==='boolean') params[k]=el.checked;
+        else if(tp==='number') params[k]=el.value===''?0:Number(el.value);
+        else params[k]=el.value;
+      }
+
+      /* get challenge */
+      var powStart=performance.now();
+      var cRes=await fetch(BASE+'/api/pow/challenge?slug='+encodeURIComponent(t.slug));
+      if(!cRes.ok) throw new Error('Challenge request failed: '+cRes.status);
+      var cData=await cRes.json();
+      var challenge=cData.challenge,difficulty=cData.difficulty,token=cData.token;
+
+      /* solve */
+      var nonce=await solvePow(challenge,difficulty);
+      var powMs=Math.round(performance.now()-powStart);
+
+      /* status: calling */
+      while(status.firstChild)status.removeChild(status.firstChild);
+      var spinSpan2=document.createElement('span');
+      spinSpan2.className='spin';
+      status.appendChild(spinSpan2);
+      status.appendChild(document.createTextNode(' Calling tool...'));
+
+      /* call tool */
+      var callStart=performance.now();
+      var headers={'X-Pow-Solution':token+':'+nonce};
+      var resp;
+      if(t.method==='GET'){
+        resp=await fetch(BASE+t.path+'?'+new URLSearchParams(params),{headers:headers});
+      }else{
+        headers['Content-Type']='application/json';
+        resp=await fetch(BASE+t.path,{method:'POST',headers:headers,body:JSON.stringify(params)});
+      }
+      var callMs=Math.round(performance.now()-callStart);
+
+      var body;
+      var ct=resp.headers.get('content-type')||'';
+      if(ct.indexOf('json')!==-1){
+        body=await resp.json();
+      }else{
+        body=await resp.text();
+      }
+
+      /* render result */
+      while(resultEl.firstChild)resultEl.removeChild(resultEl.firstChild);
+
+      var timingDiv=document.createElement('div');
+      timingDiv.className='timing';
+      timingDiv.textContent='PoW solved in '+powMs+'ms, tool responded in '+callMs+'ms';
+      resultEl.appendChild(timingDiv);
+
+      var pre=document.createElement('pre');
+      if(!resp.ok) pre.className='err';
+      if(typeof body==='string'){
+        pre.textContent=(!resp.ok?'HTTP '+resp.status+'\n':'')+body;
+      }else{
+        var jsonStr=JSON.stringify(body,null,2);
+        if(!resp.ok){
+          var errPrefix=document.createElement('span');
+          errPrefix.textContent='HTTP '+resp.status+'\n';
+          pre.appendChild(errPrefix);
+        }
+        /* highlightJson returns HTML-escaped + highlighted string */
+        var codeSpan=document.createElement('span');
+        codeSpan.innerHTML=highlightJson(jsonStr);
+        pre.appendChild(codeSpan);
+      }
+      resultEl.appendChild(pre);
+
+      status.textContent='Done - PoW '+powMs+'ms, response '+callMs+'ms';
+    }catch(e){
+      while(resultEl.firstChild)resultEl.removeChild(resultEl.firstChild);
+      var errPre=document.createElement('pre');
+      errPre.className='err';
+      errPre.textContent=e.message||String(e);
+      resultEl.appendChild(errPre);
+      status.textContent='Error';
+    }finally{
+      btn.disabled=false;
+    }
+  }
+})();
diff --git a/assets/js/posthog-loader.js b/assets/js/posthog-loader.js
new file mode 100644
index 00000000..0220b6d6
--- /dev/null
+++ b/assets/js/posthog-loader.js
@@ -0,0 +1,17 @@
+(function(){
+  // Reads the {key, cfg} JSON island ledger-chrome.js's posthogSnippet()
+  // emits right before this script tag (CSP hardening, 2026-08-16 - the
+  // vendor loader below is static, but the API key + config it initializes
+  // with are per-deployment values, so they ride as data instead of being
+  // baked into this file's text). No island = analytics not configured for
+  // this deployment (POSTHOG_API_KEY unset), so this is a silent no-op.
+  var cfgEl = document.getElementById('posthog-config');
+  if (!cfgEl) return;
+  var data;
+  try { data = JSON.parse(cfgEl.textContent); } catch (e) { return; }
+  if (!data || !data.key) return;
+
+  !function(t,e){var o,n,p,r;e.__SV||(window.posthog=e,e._i=[],e.init=function(i,s,a){function g(t,e){var o=e.split(".");2==o.length&&(t=t[o[0]],e=o[1]),t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}}(p=t.createElement("script")).type="text/javascript",p.crossOrigin="anonymous",p.async=!0,p.src=s.api_host+"/static/array.js",(r=t.getElementsByTagName("script")[0]).parentNode.insertBefore(p,r);var u=e;for(void 0!==a?u=e[a]=[]:a="posthog",u.people=u.people||[],u.toString=function(t){var e="posthog";return"posthog"!==a&&(e+="."+a),t||(e+=" (stub)"),e},u.people.toString=function(){return u.toString(1)+".people (stub)"},o="init capture register register_once register_for_session unregister unregister_for_session getFeatureFlag getFeatureFlagPayload isFeatureEnabled reloadFeatureFlags updateEarlyAccessFeatureEnrollment getEarlyAccessFeatures on onFeatureFlags onSessionId getSurveys getActiveMatchingSurveys renderSurvey canRenderSurvey identify setPersonProperties group resetGroups setPersonPropertiesForFlags resetPersonPropertiesForFlags setGroupPropertiesForFlags resetGroupPropertiesForFlags reset get_distinct_id getGroups get_session_id get_session_replay_url alias set_config startSessionRecording stopSessionRecording sessionRecordingStarted captureException loadToolbar get_property getSessionProperty createPersonProfile opt_in_capturing opt_out_capturing has_opted_in_capturing has_opted_out_capturing clear_opt_in_out_capturing debug getPageViewId captureTraceFeedback captureTraceMetric".split(" "),n=0;n<o.length;n++)g(u,o[n]);e._i.push([i,s,a])},e.__SV=1)}(document,window.posthog||[]);
+
+  posthog.init(data.key, data.cfg);
+})();
diff --git a/assets/js/quickstart-tabs.js b/assets/js/quickstart-tabs.js
new file mode 100644
index 00000000..9e77ac14
--- /dev/null
+++ b/assets/js/quickstart-tabs.js
@@ -0,0 +1,14 @@
+(function(){
+  var tabs=document.querySelectorAll(".qs-tab");
+  var panels=document.querySelectorAll(".qs-panel");
+  tabs.forEach(function(t){
+    t.addEventListener("click",function(){
+      tabs.forEach(function(b){b.classList.remove("active");b.setAttribute("aria-selected","false")});
+      panels.forEach(function(p){p.classList.remove("active")});
+      t.classList.add("active");
+      t.setAttribute("aria-selected","true");
+      var id="panel-"+t.getAttribute("data-tab");
+      document.getElementById(id).classList.add("active");
+    });
+  });
+})();
diff --git a/assets/js/reg-form.js b/assets/js/reg-form.js
new file mode 100644
index 00000000..777e0831
--- /dev/null
+++ b/assets/js/reg-form.js
@@ -0,0 +1,34 @@
+(function(){
+  // Shared self-serve seller registration handler - was duplicated
+  // byte-for-byte-ish between sell.js and market-page.js's per-chain pages
+  // (CSP hardening, 2026-08-16). The two copies had drifted slightly: only
+  // the market-page.js version pluralized "tool"/"tools" correctly, so that
+  // behavior now applies everywhere rather than only on chain pages. The
+  // trailing "appears on..." sentence differs by page (a chain page names
+  // itself, /sell doesn't), so it rides a data-listed-note attribute on
+  // #reg-out instead of being baked into the script per page.
+  var btn = document.getElementById("reg-go");
+  if (!btn) return;
+  var out = document.getElementById("reg-out");
+  btn.addEventListener("click", async function(){
+    if (btn.disabled) return;
+    btn.disabled = true;
+    out.style.color = "var(--muted)";
+    out.textContent = "probing…";
+    var note = out.getAttribute("data-listed-note") || "Appears on /marketplace and any chain page it advertises.";
+    try {
+      var r = await fetch("/api/index/register", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ origin: document.getElementById("reg-origin").value }) });
+      var j = await r.json();
+      var n = (j.seller && j.seller.toolCount) || 0;
+      out.style.color = j.listed ? "var(--green)" : "var(--accent-lit)";
+      out.textContent = j.listed
+        ? ("Listed - " + ((j.seller && j.seller.displayName) || j.origin) + " (" + n + " tool" + (n === 1 ? "" : "s") + "). " + note)
+        : ("Not listed: " + (j.error || "unknown error"));
+    } catch (e) {
+      out.style.color = "var(--accent-lit)";
+      out.textContent = "submission failed - try again";
+    } finally {
+      btn.disabled = false;
+    }
+  });
+})();
diff --git a/assets/js/revenue-chart.js b/assets/js/revenue-chart.js
new file mode 100644
index 00000000..c797b92d
--- /dev/null
+++ b/assets/js/revenue-chart.js
@@ -0,0 +1,248 @@
+  (function(){
+    var SLOTS={base:1,algorand:2,solana:3,polygon:4,stellar:5,arbitrum:6,celo:7};
+    var NAMES={1:"Base",2:"Algorand",3:"Solana",4:"Polygon",5:"Stellar",6:"Arbitrum",7:"Celo",8:"Other",free:"Free tier (PoW)",newbuyers:"New buyers",retbuyers:"Returning buyers",cumbuyers:"Distinct buyers to date"};
+    // Draw order. "free" is a lane, not a chain - free calls settle nowhere,
+    // so it never takes a chain colour and never folds into "Other".
+    var CHAIN_ORDER=[1,2,3,4,5,6,7,8,"free"];
+    // Buyers are people, not chains: a distinct-buyer count cannot be split by
+    // rail without double counting anyone who paid on two. So the buyers view
+    // swaps the whole lane set rather than adding to it.
+    function ORDERS(){
+      if(state.metric!=="buyers")return CHAIN_ORDER;
+      return state.mode==="cum"?["cumbuyers"]:["newbuyers","retbuyers"];
+    }
+    var state={mode:"cum",metric:"usd",scope:"ext",wire:"all",traffic:"paid",settle:"all",rows:[],free:[],freeSince:null,buyers:[],conc:null};
+    var css=function(n){return getComputedStyle(document.getElementById("rvz")).getPropertyValue("--s"+n).trim()};
+    function slotOf(chain){return SLOTS[chain]||8}
+    function chainName(c){return c==="robinhood"?"Robinhood":c.charAt(0).toUpperCase()+c.slice(1)}
+    // Wire filter: MPP and x402 settle identically on-chain, so the MPP subset
+    // is joined in by tx hash server-side. x402 is the remainder, never a
+    // separate count - that keeps All === x402 + MPP exactly.
+    function val(r){
+      var usd=state.metric==="usd";
+      var e=usd?r.extUsd:r.extTx, i=usd?r.intUsd:r.intTx;
+      var em=(usd?r.extMppUsd:r.extMppTx)||0, im=(usd?r.intMppUsd:r.intMppTx)||0;
+      if(state.wire==="mpp"){e=em;i=im}
+      else if(state.wire==="x402"){e=Math.max(0,e-em);i=Math.max(0,i-im)}
+      // Settled-to lane: SOR is the subset received by the spending wallet;
+      // Direct is the remainder, never a separate count - All === SOR + Direct
+      // exactly. Only meaningful at wire="all" (the seg handlers enforce that).
+      var es=(usd?r.extSorUsd:r.extSorTx)||0, is2=(usd?r.intSorUsd:r.intSorTx)||0;
+      if(state.settle==="sor"){e=es;i=is2}
+      else if(state.settle==="direct"){e=Math.max(0,e-es);i=Math.max(0,i-is2)}
+      return state.scope==="ext"?e:state.scope==="int"?i:e+i}
+    function setSeg(id,v){var el=document.getElementById(id);
+      [].slice.call(el.querySelectorAll("button")).forEach(function(b){b.classList.toggle("on",b.dataset.v===v)})}
+    function seg(id,cb){var el=document.getElementById(id);el.addEventListener("click",function(ev){var b=ev.target.closest("button");if(!b)return;
+      [].slice.call(el.querySelectorAll("button")).forEach(function(x){x.classList.toggle("on",x===b)});cb(b.dataset.v);render();})}
+    function build(){
+      var days={};
+      function dayOf(k){return days[k]||(days[k]={day:k,slots:{}})}
+      if(state.metric==="buyers"){
+        // Cumulative uses the server's running UNION, never an accumulation of
+        // the daily counts: summing distinct counts double counts every
+        // returning buyer and would draw a rising line over a flat reality.
+        return (state.buyers||[]).map(function(r){
+          return state.mode==="cum"
+            ? {day:r.day,slots:{cumbuyers:r.cumulative}}
+            : {day:r.day,slots:{newbuyers:r.newBuyers,retbuyers:r.returningBuyers}};
+        });
+      }
+      if(state.traffic!=="free"){
+        state.rows.forEach(function(r){var d=dayOf(r.day);
+          var s=slotOf(r.chain); d.slots[s]=(d.slots[s]||0)+val(r);
+          // Chains folded into "Other" keep their identity in a per-day
+          // breakdown - the fold is a palette constraint (8 validated hues),
+          // not a licence to hide which rails the money arrived on.
+          if(s===8){var v8=val(r);if(v8>0){d.oth=d.oth||{};d.oth[r.chain]=(d.oth[r.chain]||0)+v8}}})}
+      // Free calls are counts, never dollars - a free call earns $0 by
+      // definition, so the lane is absent under the Revenue $ metric rather
+      // than drawn as a bar pretending call count is revenue. The metric/
+      // traffic handlers already keep those two from being selected together;
+      // this is defence in depth for any future caller that sets state directly.
+      if(state.traffic!=="paid"&&state.metric==="tx"){
+        state.free.forEach(function(r){var d=dayOf(r.day);d.slots.free=(d.slots.free||0)+(r.pow||0)})}
+      var list=Object.keys(days).sort().map(function(k){return days[k]});
+      if(state.mode==="cum"){var acc={},accO={};list.forEach(function(d){var O=ORDERS();for(var k=0;k<O.length;k++){var s=O[k];
+        acc[s]=(acc[s]||0)+(d.slots[s]||0);d.slots[s]=acc[s]}
+        if(d.oth){for(var c in d.oth)accO[c]=(accO[c]||0)+d.oth[c]}
+        d.oth={};for(var c2 in accO)d.oth[c2]=accO[c2]})}
+      return list;
+    }
+    function fmt(v){return state.metric==="usd"?(v>=1?"$"+v.toFixed(2):"$"+v.toFixed(4)):String(Math.round(v))}
+    function render(){
+      var data=build(), svg=document.getElementById("rvzSvg"), tip=document.getElementById("rvzTip");
+      if(!data.length){svg.outerHTML="";document.querySelector(".rvz-wrap").innerHTML='<div class="rvz-empty">ledger backfilling - the series appears as settlements sync</div>';return}
+      var W=940,H=300,L=52,R=8,T=10,B=26,pw=W-L-R,ph=H-T-B;
+      var ORD=ORDERS();
+      var max=0;data.forEach(function(d){var t=0;for(var k=0;k<ORD.length;k++)t+=d.slots[ORD[k]]||0;if(t>max)max=t});
+      max=max||1;
+      var n=data.length, bw=Math.max(2,Math.min(34,pw/n-2));
+      var x=function(i){return L+(pw/n)*i+(pw/n-bw)/2}, y=function(v){return T+ph-(v/max)*ph};
+      var out=[];
+      for(var g=0;g<=3;g++){var gv=max*g/3,gy=y(gv);
+        out.push('<line x1="'+L+'" y1="'+gy+'" x2="'+(W-R)+'" y2="'+gy+'" stroke="var(--dash)" stroke-width="1"/>');
+        out.push('<text x="'+(L-6)+'" y="'+(gy+4)+'" text-anchor="end" font-size="10" fill="var(--faint)" font-family="var(--font-mono)">'+fmt(gv)+"</text>")}
+      var step=Math.ceil(n/8);
+      data.forEach(function(d,i){
+        if(i%step===0)out.push('<text x="'+(x(i)+bw/2)+'" y="'+(H-8)+'" text-anchor="middle" font-size="10" fill="var(--faint)" font-family="var(--font-mono)">'+d.day.slice(5)+"</text>");
+        var y0=T+ph;
+        for(var k=0;k<ORD.length;k++){var s=ORD[k];var v=d.slots[s]||0;if(v<=0)continue;var h=(v/max)*ph;y0-=h;
+          if(state.mode==="cum"){out.push('<rect x="'+x(i)+'" y="'+y0+'" width="'+bw+'" height="'+Math.max(h,0.5)+'" fill="'+css(s)+'" opacity="0.9"/>')}
+          else{out.push('<rect x="'+x(i)+'" y="'+y0+'" width="'+bw+'" height="'+Math.max(h-1,0.5)+'" fill="'+css(s)+'" stroke="var(--vsurf)" stroke-width="1" rx="1"/>')}}
+        out.push('<rect x="'+(L+(pw/n)*i)+'" y="'+T+'" width="'+(pw/n)+'" height="'+ph+'" fill="transparent" data-i="'+i+'"/>')});
+      svg.innerHTML=out.join("");
+      svg.onmousemove=function(ev){var t=ev.target.closest("rect[data-i]");if(!t){tip.style.display="none";return}
+        var d=data[+t.dataset.i],rows="",tot=0;
+        for(var k=ORD.length-1;k>=0;k--){var s=ORD[k];var v=d.slots[s]||0;if(v<=0)continue;tot+=v;
+          rows+='<div><i style="display:inline-block;width:8px;height:8px;background:'+css(s)+';margin-right:5px"></i>'+NAMES[s]+" "+fmt(v)+"</div>";
+          if(s===8&&d.oth){Object.keys(d.oth).sort().forEach(function(c){if(d.oth[c]>0)
+            rows+='<div style="padding-left:13px;color:var(--muted)">'+chainName(c)+" "+fmt(d.oth[c])+"</div>"})}}
+        tip.innerHTML="<b>"+d.day+"</b>"+rows+"<div style='border-top:1px dashed var(--dark-border2);margin-top:3px'>total "+fmt(tot)+"</div>";
+        var wr=document.querySelector(".rvz-wrap").getBoundingClientRect();
+        tip.style.display="block";tip.style.left=Math.min(ev.clientX-wr.left+14,wr.width-270)+"px";tip.style.top=(ev.clientY-wr.top+10)+"px"};
+      svg.onmouseleave=function(){tip.style.display="none"};
+      var lg="",present={},othChains={};data.forEach(function(d){for(var k=0;k<ORD.length;k++)if(d.slots[ORD[k]])present[ORD[k]]=1;
+        if(d.oth)Object.keys(d.oth).forEach(function(c){if(d.oth[c]>0)othChains[c]=1})});
+      Object.keys(present).forEach(function(s){
+        var label=NAMES[s];
+        // Name what "Other" holds - the fold is visual, never informational.
+        if(String(s)==="8"&&Object.keys(othChains).length)label+=" ("+Object.keys(othChains).sort().map(chainName).join(", ")+")";
+        lg+='<span><i style="background:'+css(s)+'"></i>'+label+"</span>"});
+      // An empty series under a wire filter is a real answer, not a broken
+      // chart - say which filter emptied it rather than showing a blank grid.
+      if(!Object.keys(present).length){
+        lg='<span>no '+(state.metric==="buyers"?"buyers":state.traffic==="free"?"free-tier calls":
+          (state.wire==="all"?"":state.wire==="mpp"?"MPP-wire ":"x402-wire ")+
+          (state.scope==="ext"?"external":state.scope==="int"?"internal":"")+" settlements")+' in this window</span>'}
+      document.getElementById("rvzLegend").innerHTML=lg;
+      // The chart defaults to External, which is right - the canary is our own
+      // money recycling and must never inflate revenue. But that makes "no
+      // canary today" and "canary hidden by the current filter" look identical,
+      // and someone reading the default view reasonably concluded the canary
+      // had stopped running when it had settled on 11 of 12 rails that day.
+      //
+      // So when internal settlements EXIST in the window and are filtered out,
+      // say so and name the control that shows them. The number on the chart
+      // does not change; only the reader's ability to tell absence from
+      // concealment does.
+      (function(){
+        var el=document.getElementById("rvzScopeNote");
+        if(!el)return;
+        if(state.scope!=="ext"){el.style.display="none";return}
+        var days={},chains={};
+        state.rows.forEach(function(r){
+          if((r.intTx||0)>0){days[r.day]=1;chains[r.chain]=1}
+        });
+        var nd=Object.keys(days).length, nc=Object.keys(chains).length;
+        if(!nd){el.style.display="none";return}
+        el.style.display="";
+        el.textContent="Showing external settlements only. "+nc+" chain"+(nc===1?"":"s")+
+          " also settled internal (canary) transactions on "+nd+" day"+(nd===1?"":"s")+
+          " in this window - select \u201cInternal (canary)\u201d or \u201cBoth\u201d to see them. "+
+          "They are excluded from revenue on purpose: the canary buys from us with our own wallet.";
+      })();
+      // "Other" gets one muted sub-column per folded chain (a subset of the
+      // Other column, so they never add to the row total).
+      var othList=Object.keys(othChains).sort();
+      var tb='<table><tr><th>day</th>';Object.keys(present).forEach(function(s){tb+="<th>"+NAMES[s]+"</th>";
+        if(String(s)==="8")othList.forEach(function(c){tb+='<th style="color:var(--muted)">· '+chainName(c)+"</th>"})});tb+="<th>total</th></tr>";
+      data.forEach(function(d){var tot=0;tb+="<tr><td>"+d.day+"</td>";Object.keys(present).forEach(function(s){var v=d.slots[s]||0;tot+=v;tb+="<td>"+fmt(v)+"</td>";
+        if(String(s)==="8")othList.forEach(function(c){tb+='<td style="color:var(--muted)">'+fmt((d.oth||{})[c]||0)+"</td>"})});tb+="<td>"+fmt(tot)+"</td></tr>"});
+      document.getElementById("rvzTable").innerHTML=tb+"</table>";
+    }
+    function buyersTrend(){
+      // Rolling recent-vs-prior comparison (last 14 days vs the 14 before
+      // that), not a lifetime first-half/second-half split - stays
+      // meaningful as history grows, rather than diluting toward flat as
+      // more old days accumulate. Needs 28 days of real data to say
+      // anything; thin history omits the line entirely rather than
+      // asserting a trend from a handful of points (found in an internal
+      // audit, 2026-08-16: buyer diversity fell 45% over 60 days,
+      // independent of any single wallet - this makes that visible without
+      // eyeballing the chart).
+      var rows=(state.buyers||[]).slice().sort(function(a,b){return a.day<b.day?-1:1});
+      if(rows.length<28)return null;
+      var recent=rows.slice(-14),prior=rows.slice(-28,-14);
+      var avg=function(xs){return xs.reduce(function(s,r){return s+(r.buyers||0)},0)/xs.length};
+      var ra=avg(recent),pa=avg(prior);
+      if(pa<=0)return null;
+      var pct=((ra-pa)/pa)*100;
+      return {recent:ra,prior:pa,pct:pct};
+    }
+    function buyersNote(){
+      var el=document.getElementById("rvzBuyersNote");
+      if(state.metric!=="buyers"){el.style.display="none";return}
+      el.style.display="block";
+      var c=state.conc;
+      var t=buyersTrend();
+      var trendTxt="";
+      if(t){
+        var dir=t.pct<=-5?"down":t.pct>=5?"up":"flat";
+        var arrow=dir==="down"?"↓":dir==="up"?"↑":"→";
+        trendTxt=" "+arrow+" Last 14 days averaged "+t.recent.toFixed(1)+" distinct buyers/day, "+
+          (dir==="flat"?"about the same as":dir+" "+Math.abs(t.pct).toFixed(0)+"% from")+
+          " the 14 days before that ("+t.prior.toFixed(1)+"/day).";
+      }
+      el.textContent="Distinct external wallets that settled a payment. Someone paying on two chains in one day is one buyer, and the cumulative line is a running union rather than a sum."+
+        (c&&c.buyers?" Over this window: "+c.buyers+" buyers, "+c.payments+" payments, biggest single wallet "+c.topSharePct+"% of them and the top five "+c.top5SharePct+"%.":"")+
+        trendTxt;
+    }
+    function settleNote(){
+      var el=document.getElementById("rvzSettleNote");
+      el.style.display=state.settle==="all"?"none":"block";
+    }
+    function freeNote(){
+      var el=document.getElementById("rvzFreeNote");
+      if(state.traffic==="paid"){el.style.display="none";return}
+      el.style.display="block";
+      el.textContent="Free calls are served via proof-of-work and settle nowhere, so they earn $0 and appear only under Transactions."+
+        (state.freeSince?" Per-day recording of the free tier began "+state.freeSince+
+          " - earlier days have no per-day record, which is not the same as no free traffic.":
+          " Per-day recording of the free tier has not started yet.")+
+        " Internal heartbeat probes are excluded.";
+    }
+    seg("rvzMode",function(v){state.mode=v});
+    seg("rvzMetric",function(v){state.metric=v;
+      // Revenue $ is paid-only: a free call has no dollar value to chart.
+      if(v!=="tx"&&state.traffic!=="paid"){state.traffic="paid";setSeg("rvzTraffic","paid")}
+      // Buyers counts settled external wallets, so the internal/canary scope,
+      // the wire split, and the settled-to lane do not apply to it.
+      if(v==="buyers"){if(state.scope!=="ext"){state.scope="ext";setSeg("rvzScope","ext")}
+        if(state.wire!=="all"){state.wire="all";setSeg("rvzWire","all")}
+        if(state.settle!=="all"){state.settle="all";setSeg("rvzSettle","all");settleNote()}}
+      freeNote();buyersNote()});
+    seg("rvzScope",function(v){state.scope=v;
+      if(state.metric==="buyers"){state.metric="tx";setSeg("rvzMetric","tx");buyersNote()}});
+    seg("rvzTraffic",function(v){state.traffic=v;
+      if(v!=="paid"&&state.metric!=="tx"){state.metric="tx";setSeg("rvzMetric","tx")}
+      if(v!=="paid"&&state.settle!=="all"){state.settle="all";setSeg("rvzSettle","all");settleNote()}
+      freeNote();buyersNote()});
+    seg("rvzWire",function(v){state.wire=v;
+      // The MPP subset and the SOR subset are not tracked as an intersection -
+      // composing them would fabricate numbers, so they are mutually exclusive.
+      if(v!=="all"&&state.settle!=="all"){state.settle="all";setSeg("rvzSettle","all");settleNote()}
+      document.getElementById("rvzWireNote").style.display=v==="all"?"none":"block"});
+    seg("rvzSettle",function(v){state.settle=v;
+      if(v!=="all"){
+        if(state.wire!=="all"){state.wire="all";setSeg("rvzWire","all");document.getElementById("rvzWireNote").style.display="none"}
+        // The SOR lane is settled revenue - the free tier settles nowhere.
+        if(state.traffic!=="paid"){state.traffic="paid";setSeg("rvzTraffic","paid");freeNote()}
+        if(state.metric==="buyers"){state.metric="tx";setSeg("rvzMetric","tx");buyersNote()}
+      }
+      settleNote()});
+    // The free-tier series is a separate endpoint (free calls never touch the
+    // settlement ledger). A failure there must not blank the revenue chart, so
+    // it degrades to an empty free lane rather than rejecting the pair.
+    Promise.all([
+      fetch("/api/revenue/daily").then(function(r){return r.json()}),
+      fetch("/api/calls/daily").then(function(r){return r.json()}).catch(function(){return{days:[],recordingSince:null}})
+    ]).then(function(res){
+      state.rows=res[0].days||[];
+      state.free=res[1].days||[];
+      state.freeSince=res[1].recordingSince||null;
+      state.buyers=res[0].buyers||[];
+      state.conc=res[0].concentration||null;
+      render();
+    }).catch(function(){document.querySelector(".rvz-wrap").innerHTML='<div class="rvz-empty">series unavailable</div>'});
+  })();
diff --git a/assets/js/sdk-playground.js b/assets/js/sdk-playground.js
new file mode 100644
index 00000000..f4385403
--- /dev/null
+++ b/assets/js/sdk-playground.js
@@ -0,0 +1,190 @@
+(function(){
+  var EXAMPLES=[
+    {
+      label: "Hash a string",
+      code: "// Hash text with SHA-256\nconst result = await callTool(\"hash\", {\n  text: \"hello world\",\n  algo: \"sha256\"\n});\nconsole.log(result);",
+    },
+    {
+      label: "Find tools by keyword",
+      code: "// Search for tools matching a query - /api/find is free and\n// unpaywalled, so this skips the proof-of-work step entirely.\nconst result = await callTool(\"find\", {\n  q: \"geocode\"\n}, { path: \"/api/find\", method: \"GET\", free: true });\nconsole.log(result);",
+    },
+    {
+      label: "Generate a UUID",
+      code: "// Generate a v4 UUID\nconst result = await callTool(\"uuid\", {}, { path: \"/api/uuid\", method: \"GET\" });\nconsole.log(result);",
+    },
+    {
+      label: "Convert units",
+      code: "// Convert miles to kilometers\nconst result = await callTool(\"unit-convert\", {\n  value: 26.2,\n  from: \"miles\",\n  to: \"kilometers\"\n});\nconsole.log(result);",
+    },
+    {
+      label: "Base64 encode",
+      code: "// Encode text to base64\nconst result = await callTool(\"base64\", {\n  text: \"Agent402 is awesome\"\n});\nconsole.log(result);",
+    },
+  ];
+  var wrapEl=document.querySelector('.sp-wrap');
+  var BASE=wrapEl?(wrapEl.getAttribute('data-base')||''):'';
+  var codeEl=document.getElementById('spCode');
+  var resultEl=document.getElementById('spResult');
+  var runBtn=document.getElementById('spRun');
+  var statusEl=document.getElementById('spStatus');
+  var exBtns=document.querySelectorAll('.sp-example');
+
+  exBtns.forEach(function(btn){
+    btn.addEventListener('click',function(){
+      exBtns.forEach(function(b){b.classList.remove('active');});
+      btn.classList.add('active');
+      var idx=parseInt(btn.getAttribute('data-idx'),10);
+      codeEl.value=EXAMPLES[idx].code;
+      clearResult();
+    });
+  });
+
+  function clearResult(){
+    while(resultEl.firstChild)resultEl.removeChild(resultEl.firstChild);
+    resultEl.textContent='Click Run to execute';
+  }
+
+  function addLine(cls,text){
+    var line=document.createElement('div');
+    line.className=cls;
+    line.textContent=text;
+    resultEl.appendChild(line);
+  }
+
+  /* --- real PoW + tool call, run in this TRUSTED page (never inside the
+     sandbox iframe below - it has no network access at all). --- */
+  async function sha256(msg){
+    var buf=await crypto.subtle.digest('SHA-256',new TextEncoder().encode(msg));
+    return new Uint8Array(buf);
+  }
+  function leadingZeroBits(buf){
+    var n=0;
+    for(var i=0;i<buf.length;i++){
+      if(buf[i]===0){n+=8;continue;}
+      n+=Math.clz32(buf[i])-24;
+      break;
+    }
+    return n;
+  }
+  async function solvePow(challenge,difficulty){
+    var nonce=0;
+    while(true){
+      var hash=await sha256(challenge+':'+nonce);
+      if(leadingZeroBits(hash)>=difficulty)return nonce;
+      nonce++;
+      if(nonce%5000===0)await new Promise(function(r){setTimeout(r,0);});
+    }
+  }
+
+  async function callTool(slug,params,opts){
+    opts=opts||{};
+    var path=opts.path||('/api/'+slug);
+    var method=opts.method||'POST';
+    var headers={};
+
+    if(opts.free){
+      // Free, unpaywalled endpoints (e.g. /api/find) need no proof-of-work -
+      // requesting a PoW challenge for a slug outside the paid catalog 404s.
+      while(statusEl.firstChild)statusEl.removeChild(statusEl.firstChild);
+      statusEl.appendChild(document.createTextNode('Calling free endpoint...'));
+    }else{
+      while(statusEl.firstChild)statusEl.removeChild(statusEl.firstChild);
+      var spin=document.createElement('span');
+      spin.className='spin';
+      statusEl.appendChild(spin);
+      statusEl.appendChild(document.createTextNode(' Solving PoW...'));
+
+      var cRes=await fetch(BASE+'/api/pow/challenge?slug='+encodeURIComponent(slug));
+      if(!cRes.ok)throw new Error('challenge request failed: '+cRes.status);
+      var cData=await cRes.json();
+      var nonce=await solvePow(cData.challenge,cData.difficulty);
+      headers['X-Pow-Solution']=cData.token+':'+nonce;
+
+      while(statusEl.firstChild)statusEl.removeChild(statusEl.firstChild);
+      var spin2=document.createElement('span');
+      spin2.className='spin';
+      statusEl.appendChild(spin2);
+      statusEl.appendChild(document.createTextNode(' Calling tool...'));
+    }
+
+    var resp;
+    if(method==='GET'){
+      resp=await fetch(BASE+path+'?'+new URLSearchParams(params),{headers:headers});
+    }else{
+      headers['Content-Type']='application/json';
+      resp=await fetch(BASE+path,{method:'POST',headers:headers,body:JSON.stringify(params)});
+    }
+    var ct=resp.headers.get('content-type')||'';
+    if(ct.indexOf('json')!==-1)return resp.json();
+    return resp.text();
+  }
+
+  /* --- user code runs inside an isolated, network-less sandbox iframe
+     (assets/sdk-sandbox.html, served from its own route with its own
+     relaxed CSP - see /sdk-playground/sandbox in server.js). The iframe can
+     only reach the outside world by asking THIS page to run callTool on its
+     behalf via postMessage; it never gets fetch, cookies, or this origin. --- */
+  var RUN_TIMEOUT_MS=30000;
+  var active=null; // { iframe, timer, resolveReady }
+
+  function teardown(){
+    if(!active)return;
+    clearTimeout(active.timer);
+    if(active.iframe && active.iframe.parentNode)active.iframe.parentNode.removeChild(active.iframe);
+    active=null;
+  }
+
+  window.addEventListener('message',function(ev){
+    if(!active || ev.source!==active.iframe.contentWindow)return;
+    var msg=ev.data;
+    if(!msg||typeof msg!=='object')return;
+
+    if(msg.type==='ready'){
+      active.iframe.contentWindow.postMessage({type:'run',code:active.code},'*');
+      return;
+    }
+    if(msg.type==='log'){
+      addLine('log',msg.text);
+      return;
+    }
+    if(msg.type==='error'){
+      addLine('err','Error: '+msg.message);
+      return;
+    }
+    if(msg.type==='callTool'){
+      var id=msg.id;
+      callTool(msg.slug,msg.params,msg.opts).then(function(result){
+        if(active && active.iframe.contentWindow)active.iframe.contentWindow.postMessage({type:'callToolResult',id:id,result:result},'*');
+      }).catch(function(e){
+        if(active && active.iframe.contentWindow)active.iframe.contentWindow.postMessage({type:'callToolError',id:id,error:(e&&e.message)||String(e)},'*');
+      });
+      return;
+    }
+    if(msg.type==='done'){
+      statusEl.textContent='Done';
+      runBtn.disabled=false;
+      teardown();
+      return;
+    }
+  });
+
+  runBtn.addEventListener('click',function(){
+    if(active)return;
+    runBtn.disabled=true;
+    while(resultEl.firstChild)resultEl.removeChild(resultEl.firstChild);
+    statusEl.textContent='';
+
+    var iframe=document.createElement('iframe');
+    iframe.setAttribute('sandbox','allow-scripts');
+    iframe.style.display='none';
+    iframe.src='/sdk-playground/sandbox';
+    document.body.appendChild(iframe);
+
+    active={iframe:iframe,code:codeEl.value,timer:setTimeout(function(){
+      addLine('err','Error: timed out after '+(RUN_TIMEOUT_MS/1000)+'s');
+      statusEl.textContent='Error';
+      runBtn.disabled=false;
+      teardown();
+    },RUN_TIMEOUT_MS)};
+  });
+})();
diff --git a/assets/js/site-chrome.js b/assets/js/site-chrome.js
new file mode 100644
index 00000000..977dd17c
--- /dev/null
+++ b/assets/js/site-chrome.js
@@ -0,0 +1,99 @@
+// Shared, site-wide chrome behavior: the hamburger menu toggle and
+// reveal-on-scroll. Every page rendered through ledgerShell() loads this
+// (CSP hardening, 2026-08-16 - was two inline <script> blocks; the burger
+// button's onclick="a402ToggleMenu()" attribute is ALSO gone, since an
+// inline event-handler attribute is exactly as CSP-blocked as an inline
+// <script> tag - the click is now wired here instead).
+document.addEventListener('DOMContentLoaded', function(){
+  // This script tag loads in <head>, before <body> (and the burger button
+  // it wires up) has been parsed - querying for .ml-burger at top-level
+  // script-load time would find nothing and silently wire up no listener
+  // at all. DOMContentLoaded guarantees the button already exists.
+  function toggleMenu(){
+    try {
+      var open = document.documentElement.classList.toggle('ml-menu-open');
+      var b = document.querySelector('.ml-burger');
+      if (b) {
+        b.setAttribute('aria-expanded', open ? 'true' : 'false');
+        b.setAttribute('aria-label', open ? 'Close menu' : 'Open menu');
+      }
+    } catch (e) {}
+  }
+  var burger = document.querySelector('.ml-burger');
+  if (burger) burger.addEventListener('click', toggleMenu);
+});
+
+/* a402: reveal-on-scroll for every top-level header/section, site-wide. Was
+   opt-in per-page via [data-reveal] (only the homepage set it, so every
+   other page never got the effect at all); now applied here in the ONE
+   shared script every page already loads, so it needs zero duplication -
+   no per-page script block, no per-page attribute to remember to set.
+   Anonymous function expression on purpose, not a declaration - avoids a
+   leading-"function" source line, the exact shape test-theme.js's
+   markup-safety assertions guard against. Class added here (JS), never
+   baked into static CSS as a default-hidden state, so a throw/no-run leaves
+   every section fully visible instead of stuck at opacity:0. The observer's
+   own first callback decides visibility, not a separate getBoundingClientRect
+   measurement taken before the map canvas/webfonts settle layout (that
+   early-measurement bug made most sections read as already-above-the-fold
+   and never animate). ONE-SHOT: once a section reveals, it is unobserved and
+   never re-hidden. An earlier version toggled ml-reveal-in on every
+   intersection change (added AND removed), meant to let a reload deep in the
+   page still animate sections into view - but a reload doesn't need the
+   removal half, only the addition: a section already in view on the
+   observer's first callback reveals immediately either way. The removal
+   half had a real, reported bug: a tall section scrolling past the top edge
+   drops under the 8% threshold *while still partially on screen*, so it
+   visibly faded out and shifted down 18px in front of the user mid-scroll -
+   "content going off screen" on a normal scroll, not a rendering glitch.
+   Revealed content now stays revealed, matching how every other
+   scroll-reveal effect on the web works. querySelectorAll('header,section')
+   only reaches pages whose top-level blocks are actually <section>
+   elements - roughly half this site's page templates are, the rest use
+   plain <div> wrappers and get no reveal effect from this alone; converting
+   those is separate, per-template work, not something a shared script can
+   retrofit onto markup that was never semantic to begin with.
+   FIRST MATCH IS EXEMPT (2026-08-15): every page's first header/section is
+   its hero - the block already sitting in the viewport on page load, on
+   every template checked (marketplace/tools/sell/leaderboard/skills/docs/
+   status/home). Hiding it behind opacity:0 first, same as every other
+   section, meant it always had to wait on the observer's first callback -
+   measured live at 100-300ms of near-zero opacity even though the content
+   was already fully in view, a real flash-of-blank-hero on every load, not
+   a scroll-triggered effect at all. The fix is DOM-order, not a
+   getBoundingClientRect check - that's the deliberate difference from the
+   early-measurement bug described above: no layout read before webfonts/map
+   settle, so it can't misjudge a below-fold section as already visible.
+   [data-reveal-eager] OPT-IN EXEMPTION (2026-08-16): some pages have a
+   SECOND section that's also reliably above the fold on load (found on
+   /pricing - the tier cards sit directly under a short hero, both visible
+   together on an ordinary viewport) and got the same flash the hero fix
+   above already solved for index 0. Rather than guessing "how many leading
+   sections are above the fold" generically (which would need either an
+   unsafe early layout read, or a blanket exemption for e.g. the first N
+   sections that's WRONG on every page where section N+1 really is below
+   the fold), this is a deliberate, explicit, per-section opt-in a page
+   template sets only when it knows its own layout - same DOM-order safety
+   property as the hero fix (no getBoundingClientRect), just marked by the
+   page author instead of inferred by position. */
+document.addEventListener('DOMContentLoaded',function(){try{if(window.matchMedia&&window.matchMedia('(prefers-reduced-motion: reduce)').matches)return;var els=document.querySelectorAll('header,section,[data-reveal]');if(els.length<2||!window.IntersectionObserver)return;var rest=Array.prototype.slice.call(els,1).filter(function(el){return !el.hasAttribute('data-reveal-eager');});if(!rest.length)return;rest.forEach(function(el){el.classList.add('ml-reveal');});var io=new IntersectionObserver(function(entries){entries.forEach(function(e){if(e.isIntersecting){e.target.classList.add('ml-reveal-in');io.unobserve(e.target);}});},{threshold:.08});rest.forEach(function(el){io.observe(el);});
+/* SAFETY NET (2026-08-16) - a single large scroll jump (trackpad flick, End
+   key, scrollbar-track click - all ordinary user actions) can move a short
+   section from below the viewport to above it within one rendered frame, so
+   the IntersectionObserver above never sees it cross the threshold and it
+   stays at opacity:0 forever - proven live on /marketplace's "Markets by
+   chain" section, reachable on ANY page since every <section> opts in.
+   Revealed-content-stays-revealed elements are unobserve()'d, but a
+   never-intersected element stays observed with no further callbacks ever
+   firing for it, so subsequent normal scrolling does not self-heal it either.
+   This directly measures position instead of trusting IO fired: on a
+   debounced scroll (and once shortly after load, in case fonts/layout
+   settled late) reveal anything not yet revealed whose top edge has reached
+   or passed the viewport bottom - i.e. it is visible now OR already scrolled
+   past. Never force-reveals a section still below the viewport, so the
+   intended scroll-in effect for normal scrolling is untouched. */
+var revealPassed=function(){rest.forEach(function(el){if(el.classList.contains('ml-reveal-in'))return;if(el.getBoundingClientRect().top<window.innerHeight){el.classList.add('ml-reveal-in');io.unobserve(el);}});};
+var revealTimer=null;
+window.addEventListener('scroll',function(){clearTimeout(revealTimer);revealTimer=setTimeout(revealPassed,150);},{passive:true});
+setTimeout(revealPassed,500);
+}catch(e){}});
diff --git a/assets/js/tollbooth-snippet.js b/assets/js/tollbooth-snippet.js
new file mode 100644
index 00000000..b9028ae9
--- /dev/null
+++ b/assets/js/tollbooth-snippet.js
@@ -0,0 +1,41 @@
+(function(){
+  /* esc() HTML-escapes every user-controlled value before it reaches the
+     syntax-highlighted snippet. This is the same sanitisation used in the
+     pre-migration version of this page. */
+  function esc(t){ return String(t==null?'':t).replace(/[&<>"']/g,function(c){return({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'})[c];}); }
+  var w=document.getElementById('wallet'), p=document.getElementById('price'), m=document.getElementById('mode'), out=document.getElementById('snip');
+  function render(){
+    var wallet=esc((w.value||'').trim()||'0xYourWalletHere');
+    var price=esc((p.value||'').trim()||'$0.002');
+    var mode=esc(m.value);
+    var modeLine = mode==='observe'
+      ? '<span class="kw">observe</span>: <span class="num">true</span>,                       <span class="com">// no 402s yet - watch first</span>'
+      : '<span class="kw">mode</span>: <span class="str">"'+mode+'"</span>,                   <span class="com">// '+(mode==='bots'?'charge AI crawlers; humans pass':mode==='all'?'charge everything non-human':'paywall everyone')+'</span>';
+    out.innerHTML =
+      '<span class="kw">import</span> express <span class="kw">from</span> <span class="str">"express"</span>;\n' +
+      '<span class="kw">import</span> { createTollbooth } <span class="kw">from</span> <span class="str">"agent402-tollbooth"</span>;\n\n' +
+      '<span class="kw">const</span> app = <span class="kw">express</span>();\n' +
+      'app.<span class="kw">use</span>(<span class="kw">createTollbooth</span>({\n' +
+      '  <span class="kw">payTo</span>: <span class="str">"'+wallet+'"</span>,\n' +
+      '  <span class="kw">price</span>: <span class="str">"'+price+'"</span>,\n' +
+      '  ' + modeLine + '\n' +
+      '  <span class="kw">statsToken</span>: process.env.<span class="kw">TOLLBOOTH_STATS_TOKEN</span>,\n' +
+      '}));\n' +
+      'app.<span class="kw">use</span>(yourExistingRoutes);\n' +
+      'app.<span class="kw">listen</span>(<span class="num">3000</span>);';
+  }
+  w.addEventListener('input', render);
+  p.addEventListener('input', render);
+  m.addEventListener('change', render);
+  render();
+
+  document.querySelectorAll('.copy').forEach(function(btn){
+    btn.addEventListener('click', function(){
+      var el=document.getElementById(btn.getAttribute('data-target'));
+      if(!el) return;
+      var txt=el.innerText;
+      if(navigator.clipboard) navigator.clipboard.writeText(txt);
+      var old=btn.textContent; btn.textContent='copied'; setTimeout(function(){ btn.textContent=old; }, 1200);
+    });
+  });
+})();
diff --git a/assets/js/tollbooth-waitlist.js b/assets/js/tollbooth-waitlist.js
new file mode 100644
index 00000000..62e5d618
--- /dev/null
+++ b/assets/js/tollbooth-waitlist.js
@@ -0,0 +1,58 @@
+(function(){
+  var form = document.getElementById('wl');
+  var doneEl = document.getElementById('wl_done');
+  var errEl = document.getElementById('wl_err');
+  var btn = document.getElementById('wl_submit');
+  var originalBtnText = btn.textContent;
+  var kind = form.getAttribute('data-kind') || 'waitlist';
+  function fields(){
+    return {
+      kind: kind,
+      name: (document.getElementById('f_name').value||'').trim(),
+      email: (document.getElementById('f_email').value||'').trim(),
+      org: (document.getElementById('f_org').value||'').trim(),
+      sites: (document.getElementById('f_sites').value||'').trim(),
+      plan: document.getElementById('f_plan').value,
+      message: (document.getElementById('f_msg').value||'').trim(),
+      website: (document.getElementById('f_hp').value||'')
+    };
+  }
+  function showError(msg){
+    errEl.textContent = msg;
+    errEl.style.display = 'block';
+  }
+  form.addEventListener('submit', async function(e){
+    e.preventDefault();
+    errEl.style.display = 'none';
+    var f = fields();
+    if (!f.name || !f.email) { showError('Name and email are required.'); return; }
+    btn.disabled = true; btn.textContent = 'Sending…';
+    try {
+      var r = await fetch('/api/tollbooth/waitlist', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(f),
+      });
+      if (r.ok) {
+        form.style.display = 'none';
+        doneEl.style.display = 'block';
+        return;
+      }
+      // F10 (privacy): fail CLOSED. We never place the lead's name/email/org/
+      // message in a URL (GitHub issue pre-fill, or anything else) - that would
+      // leak PII into browser history, referrers, and endpoint logs and break
+      // the private-storage promise above. On any failure we show an honest
+      // retry error and keep the form so the user can resubmit; no success is
+      // shown and no data leaves the page.
+      if (r.status === 503) { showError('Our signup service is briefly unavailable. Please try again in a few minutes.'); }
+      else if (r.status === 429) { showError('Too many submissions - please try again in a minute.'); }
+      else if (r.status === 400) { showError('Please double-check your name and email.'); }
+      else { showError('Something went wrong. Please try again.'); }
+    } catch (_) {
+      showError('Could not reach the server. Please check your connection and try again.');
+    } finally {
+      btn.disabled = false;
+      btn.textContent = originalBtnText;
+    }
+  });
+})();
diff --git a/assets/sdk-sandbox.html b/assets/sdk-sandbox.html
new file mode 100644
index 00000000..5ea0411e
--- /dev/null
+++ b/assets/sdk-sandbox.html
@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+</head>
+<body>
+<script>
+(function(){
+  var pending = {};
+  var nextId = 1;
+
+  function callTool(slug, params, opts) {
+    return new Promise(function(resolve, reject) {
+      var id = nextId++;
+      pending[id] = { resolve: resolve, reject: reject };
+      window.parent.postMessage({ type: 'callTool', id: id, slug: slug, params: params, opts: opts || {} }, '*');
+    });
+  }
+
+  window.addEventListener('message', function(ev) {
+    var msg = ev.data;
+    if (!msg || typeof msg !== 'object') return;
+    if (msg.type === 'callToolResult') {
+      var p = pending[msg.id];
+      if (p) { delete pending[msg.id]; p.resolve(msg.result); }
+      return;
+    }
+    if (msg.type === 'callToolError') {
+      var p2 = pending[msg.id];
+      if (p2) { delete pending[msg.id]; p2.reject(new Error(msg.error)); }
+      return;
+    }
+    if (msg.type === 'run') {
+      runCode(msg.code);
+    }
+  });
+
+  function runCode(code) {
+    var origLog = console.log;
+    console.log = function() {
+      var args = Array.prototype.slice.call(arguments).map(function(a) {
+        return typeof a === 'object' ? JSON.stringify(a, null, 2) : String(a);
+      }).join(' ');
+      window.parent.postMessage({ type: 'log', text: args }, '*');
+    };
+    Promise.resolve()
+      .then(function() {
+        // User-authored code, run inside this opaque-origin, network-less
+        // sandbox iframe only - see /sdk-playground/sandbox in server.js.
+        // eslint-disable-next-line no-new-func
+        var fn = new Function('callTool', '"use strict";return (async function(){' + code + '})()');
+        return fn(callTool);
+      })
+      .catch(function(e) {
+        window.parent.postMessage({ type: 'error', message: (e && e.message) || String(e) }, '*');
+      })
+      .then(function() {
+        console.log = origLog;
+        window.parent.postMessage({ type: 'done' }, '*');
+      });
+  }
+
+  window.parent.postMessage({ type: 'ready' }, '*');
+})();
+</script>
+</body>
+</html>
diff --git a/package-lock.json b/package-lock.json
index 7d0a137f..9665f9f0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -15,12 +15,12 @@
         "@mozilla/readability": "^0.6.0",
         "@payai/facilitator": "^2.4.4",
         "@sentry/node": "^10.70.0",
-        "@x402/avm": "^2.18.0",
-        "@x402/evm": "^2.16.0",
-        "@x402/express": "^2.16.0",
-        "@x402/fetch": "^2.16.0",
-        "@x402/stellar": "^2.21.0",
-        "@x402/svm": "^2.16.0",
+        "@x402/avm": "^2.22.0",
+        "@x402/evm": "^2.22.0",
+        "@x402/express": "^2.22.0",
+        "@x402/fetch": "^2.22.0",
+        "@x402/stellar": "^2.22.0",
+        "@x402/svm": "^2.22.0",
         "@zxing/library": "^0.21.3",
         "algosdk": "^3.6.0",
         "better-sqlite3": "^12.11.1",
@@ -2789,55 +2789,46 @@
       "license": "MIT"
     },
     "node_modules/@x402/avm": {
-      "version": "2.18.0",
-      "resolved": "https://registry.npmjs.org/@x402/avm/-/avm-2.18.0.tgz",
-      "integrity": "sha512-vnqUzm9h+6yI9xPpd9Iu7LBO8+qKcNA4RIOvy3dAP6zGGG8ij/Cv1Vt9yLoXHAlsIpYqezFZ7m/9o7hUzlpaCw==",
+      "version": "2.22.0",
+      "resolved": "https://registry.npmjs.org/@x402/avm/-/avm-2.22.0.tgz",
+      "integrity": "sha512-LVFCkSPKA5F5/TrKHX+gsMKCznDEJnbpXD9efXENwgyhrt61Zx/AIIQObQ6aiWKkZJiF7dKrHIym6JwlEMf1hA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@algorandfoundation/algokit-utils": "10.0.0-alpha.46",
-        "@x402/core": "~2.18.0"
-      }
-    },
-    "node_modules/@x402/avm/node_modules/@x402/core": {
-      "version": "2.18.0",
-      "resolved": "https://registry.npmjs.org/@x402/core/-/core-2.18.0.tgz",
-      "integrity": "sha512-3LB5m0Yx7C38ks8jDqTGYPZ2FnLzlH9pTlGvE8er2ujS1ri12sXXvWwnmYsmh3ZkXSDbV3BKU8oRKULatPp0Hg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "zod": "^3.24.2"
+        "@x402/core": "~2.22.0"
       }
     },
     "node_modules/@x402/core": {
-      "version": "2.16.0",
-      "resolved": "https://registry.npmjs.org/@x402/core/-/core-2.16.0.tgz",
-      "integrity": "sha512-7MjwOEiE6ICAYtOsK9vQl66Ho4jERDuuoRg/No2Nc2GQ7y/M/yu4DJ65LzeBycQE+Qrg2RqQG7KR51tyT+hzjQ==",
+      "version": "2.22.0",
+      "resolved": "https://registry.npmjs.org/@x402/core/-/core-2.22.0.tgz",
+      "integrity": "sha512-hYySs/PvukqRipC2mKqrsn/jx2U/p5EGnN3clQ2CIcApwtoFuG77CqpC3Wy7Fdp/juW8t8quiPVnqGuIkfix1Q==",
       "license": "Apache-2.0",
       "dependencies": {
         "zod": "^3.24.2"
       }
     },
     "node_modules/@x402/evm": {
-      "version": "2.16.0",
-      "resolved": "https://registry.npmjs.org/@x402/evm/-/evm-2.16.0.tgz",
-      "integrity": "sha512-DGcwATWosIb3hmO/CfWASrn+xbxp7KQyzmMPcIW23XuDjo9YPVRElZWtHBur3euakdM021Hl8SPF1zR0G+W4hw==",
+      "version": "2.22.0",
+      "resolved": "https://registry.npmjs.org/@x402/evm/-/evm-2.22.0.tgz",
+      "integrity": "sha512-WzZVGVx6B2cvCAEHDCuNWfQkcwIZsOVdGcJKILmG/ySzLpBZ1/ARU2kU/8K3ekxhygAKrkarltVVznSEoO5vdQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@x402/core": "~2.16.0",
+        "@x402/core": "~2.22.0",
         "viem": "^2.48.11",
         "zod": "^3.24.2"
       }
     },
     "node_modules/@x402/express": {
-      "version": "2.16.0",
-      "resolved": "https://registry.npmjs.org/@x402/express/-/express-2.16.0.tgz",
-      "integrity": "sha512-M3kAOy1oxHEsVVMNbuLhhb3S00p+O0k5T/O4f/m1D5txQrEpL4sQUHul9iVehp3a7K8uVMstkTyCJ+LO44HTtQ==",
+      "version": "2.22.0",
+      "resolved": "https://registry.npmjs.org/@x402/express/-/express-2.22.0.tgz",
+      "integrity": "sha512-KWgFOuPYGGGL57qpeXyQ1bAvHSewOH0zBbZQ2gPbE+rkftvyf5AoVi+6vbohXnaBtyTUDgeg0VMMNN+at+rsQw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@x402/core": "~2.16.0",
-        "@x402/extensions": "~2.16.0"
+        "@x402/core": "~2.22.0",
+        "@x402/extensions": "~2.22.0"
       },
       "peerDependencies": {
-        "@x402/paywall": "^2.16.0",
+        "@x402/paywall": "^2.22.0",
         "express": "^4.0.0 || ^5.0.0"
       },
       "peerDependenciesMeta": {
@@ -2847,15 +2838,15 @@
       }
     },
     "node_modules/@x402/extensions": {
-      "version": "2.16.0",
-      "resolved": "https://registry.npmjs.org/@x402/extensions/-/extensions-2.16.0.tgz",
-      "integrity": "sha512-LHh5QrvB1QwiPr2zFqzpJonmMGxqJq1nDHifihyqNx1lJvU3DQgYGxPuHXE2l6nxGG0chF0alA/BsidDHFie/A==",
+      "version": "2.22.0",
+      "resolved": "https://registry.npmjs.org/@x402/extensions/-/extensions-2.22.0.tgz",
+      "integrity": "sha512-E5Ma1Fs1GwO/ET7KtGUI7dPuVFoINR+mwTWVoGdNi3DsJBJKDWSA7Ta7bDgSANzV3XCAMK9gvz/VSItZliApMA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/curves": "^1.9.0",
         "@scure/base": "^1.2.6",
         "@signinwithethereum/siwe": "^4.1.0",
-        "@x402/core": "~2.16.0",
+        "@x402/core": "~2.22.0",
         "ajv": "^8.17.1",
         "jose": "^5.9.6",
         "tweetnacl": "^1.0.3",
@@ -2873,46 +2864,37 @@
       }
     },
     "node_modules/@x402/fetch": {
-      "version": "2.16.0",
-      "resolved": "https://registry.npmjs.org/@x402/fetch/-/fetch-2.16.0.tgz",
-      "integrity": "sha512-skW0XsWzi4NIfqCrY6KxhO3UEJ8qh4nBIKIgwWFCXFHNqRKYWZ7qcCI/DHy7cy3jdYs1MV4PoXX24rP3Umca1Q==",
+      "version": "2.22.0",
+      "resolved": "https://registry.npmjs.org/@x402/fetch/-/fetch-2.22.0.tgz",
+      "integrity": "sha512-+uMCPGXw1h7YGjS778YnwUi7YvZ5Ny8XeFjBL8TvQuy9T+j8O5x/zDQu9nyNaOa/OppTqVh+CkpW+xs17ePyXg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@x402/core": "~2.16.0"
+        "@x402/core": "~2.22.0"
       }
     },
     "node_modules/@x402/stellar": {
-      "version": "2.21.0",
-      "resolved": "https://registry.npmjs.org/@x402/stellar/-/stellar-2.21.0.tgz",
-      "integrity": "sha512-Kuq1C0OJB+K8caDinXGRhUYQYBaJnv2flxho5swARe/8tRoDrDCckV5hz8wN0Lje/Nyc5v6O04WpZdHNZZpFTw==",
+      "version": "2.22.0",
+      "resolved": "https://registry.npmjs.org/@x402/stellar/-/stellar-2.22.0.tgz",
+      "integrity": "sha512-nih0BKl+6EaWrfaocm9/uu1YPfGS+QzmjI9ZY/nNbm05Z2las92rDqxqYWVXEeWz0QNtav3E3w45ctBpTvbakg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@stellar/stellar-sdk": "^16.0.1",
-        "@x402/core": "~2.21.0"
+        "@x402/core": "~2.22.0"
       },
       "engines": {
         "node": ">=22.0.0"
       }
     },
-    "node_modules/@x402/stellar/node_modules/@x402/core": {
-      "version": "2.21.0",
-      "resolved": "https://registry.npmjs.org/@x402/core/-/core-2.21.0.tgz",
-      "integrity": "sha512-0djKE7V5/JKDMrjRe5he3DoMFzlbVnUcvMmLAb2j6OoAJDamupkFh6fFrXeoHwjkBIxOFUzjGI4FVixz2dMxSA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "zod": "^3.24.2"
-      }
-    },
     "node_modules/@x402/svm": {
-      "version": "2.16.0",
-      "resolved": "https://registry.npmjs.org/@x402/svm/-/svm-2.16.0.tgz",
-      "integrity": "sha512-hxggK4PYjfI5CdsbDeVe9JDS70uPMlfFrpOaEPBo5aQ/wtFq/7ydkiUxKXozlhRw9KFqOue9zUGrPsHLCokTTw==",
+      "version": "2.22.0",
+      "resolved": "https://registry.npmjs.org/@x402/svm/-/svm-2.22.0.tgz",
+      "integrity": "sha512-io8JqfZncn9BonlcrVjsuLp8nhIwc97qY7ceI6gLxztxuEb2J37nNqbAOU9Z2u/2eQc/nrJCyGirfZcFL6JGeA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@solana-program/compute-budget": "^0.11.0",
         "@solana-program/token": "^0.9.0",
         "@solana-program/token-2022": "^0.6.1",
-        "@x402/core": "~2.16.0"
+        "@x402/core": "~2.22.0"
       },
       "peerDependencies": {
         "@solana/kit": ">=5.1.0"
diff --git a/package.json b/package.json
index 7170a756..5c5c2fe7 100644
--- a/package.json
+++ b/package.json
@@ -64,12 +64,12 @@
     "@mozilla/readability": "^0.6.0",
     "@payai/facilitator": "^2.4.4",
     "@sentry/node": "^10.70.0",
-    "@x402/avm": "^2.18.0",
-    "@x402/evm": "^2.16.0",
-    "@x402/express": "^2.16.0",
-    "@x402/fetch": "^2.16.0",
-    "@x402/stellar": "^2.21.0",
-    "@x402/svm": "^2.16.0",
+    "@x402/avm": "^2.22.0",
+    "@x402/evm": "^2.22.0",
+    "@x402/express": "^2.22.0",
+    "@x402/fetch": "^2.22.0",
+    "@x402/stellar": "^2.22.0",
+    "@x402/svm": "^2.22.0",
     "@zxing/library": "^0.21.3",
     "algosdk": "^3.6.0",
     "better-sqlite3": "^12.11.1",
diff --git a/scripts/mcp-find-latest-version.js b/scripts/mcp-find-latest-version.js
new file mode 100644
index 00000000..00f44ad1
--- /dev/null
+++ b/scripts/mcp-find-latest-version.js
@@ -0,0 +1,23 @@
+// Given the MCP Registry's `GET /v0/servers?search=...` response on stdin,
+// prints the version currently marked isLatest (nothing if none found or the
+// input doesn't parse). Used by the publish job in deploy.yml: right before
+// publishing a new version, it captures the version that's ABOUT to become
+// stale, so it can be deprecated immediately after the new one goes live -
+// otherwise every publish leaves its predecessor "active" forever, which is
+// exactly how 24 of 25 published versions ended up non-deprecated (found
+// 2026-08-16, first noticed via a growth/revenue audit).
+let input = "";
+process.stdin.on("data", (chunk) => { input += chunk; });
+process.stdin.on("end", () => {
+  try {
+    const data = JSON.parse(input);
+    const row = (data.servers || []).find(
+      (s) => s?._meta?.["io.modelcontextprotocol.registry/official"]?.isLatest === true
+    );
+    if (row?.server?.version) process.stdout.write(String(row.server.version));
+  } catch {
+    // Any parse/shape surprise -> empty output. The caller (deploy.yml) treats
+    // a blank result as "nothing to deprecate" and moves on - a registry
+    // hiccup here must never fail the publish job over a best-effort cleanup.
+  }
+});
diff --git a/scripts/test-algorand-page.js b/scripts/test-algorand-page.js
index 7f7d4944..432f32c9 100644
--- a/scripts/test-algorand-page.js
+++ b/scripts/test-algorand-page.js
@@ -75,8 +75,8 @@ ok(html.includes("SELLERS") && html.includes("PRICE FLOOR"), "stats strip render
 ok(html.includes("THIS HOST"), "local seller card carries the THIS HOST tag");
 ok(html.includes("ext1.example"), "seller card shows the hostname");
 
-// Self-serve form present
-ok(html.includes('id="list-api"') && html.includes("/api/index/register"), "List your API form renders");
+// Self-serve form present (submit handler is external — CSP hardening, 2026-08-16)
+ok(html.includes('id="list-api"') && html.includes('<script src="/js/reg-form.js"></script>'), "List your API form renders");
 
 // Activity section: cards + bars + honesty captions
 const buckets = Array.from({ length: 30 }, (_, i) => ({ date: "2026-06-" + String(11 + (i % 20)).padStart(2, "0"), tx: i === 29 ? 5 : 0, usd: i === 29 ? 0.05 : 0, buyers: i === 29 ? 2 : 0 }));
diff --git a/scripts/test-burger-aria-label.js b/scripts/test-burger-aria-label.js
new file mode 100644
index 00000000..79b0b171
--- /dev/null
+++ b/scripts/test-burger-aria-label.js
@@ -0,0 +1,45 @@
+// Locks the hamburger menu aria-label fix (2026-08-16 audit): a402ToggleMenu()
+// already correctly toggled aria-expanded, but never touched aria-label,
+// which stayed "Open menu" permanently even while the menu was open - a
+// screen reader user activating it never heard confirmation the menu opened,
+// and had no way to know the SAME control now closes it.
+//
+// Verified via a real browser (Playwright) clicking the actual button, not a
+// static check that both label strings exist somewhere in the source.
+//
+// Requires a booted server (same TARGET_URL convention as other page tests):
+//   FREE_MODE=true PORT=3000 node src/server.js
+//   TARGET_URL=http://localhost:3000 node scripts/test-burger-aria-label.js
+import { chromium } from "playwright";
+
+const BASE = process.env.TARGET_URL || "http://localhost:3000";
+let pass = 0, fail = 0;
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
+
+const browser = await chromium.launch();
+try {
+  const page = await browser.newPage({ viewport: { width: 390, height: 844 } }); // burger only shows below the collapse breakpoint
+  await page.goto(`${BASE}/`, { waitUntil: "domcontentloaded" });
+
+  const burger = page.locator(".ml-burger");
+  ok(await burger.count() === 1, "the hamburger button is present at mobile width");
+
+  const before = await burger.evaluate((el) => ({ label: el.getAttribute("aria-label"), expanded: el.getAttribute("aria-expanded") }));
+  ok(before.label === "Open menu", `closed state: aria-label is "Open menu" (got "${before.label}")`);
+  ok(before.expanded === "false", `closed state: aria-expanded is "false" (got "${before.expanded}")`);
+
+  await burger.click();
+  const opened = await burger.evaluate((el) => ({ label: el.getAttribute("aria-label"), expanded: el.getAttribute("aria-expanded") }));
+  ok(opened.label === "Close menu", `open state: aria-label flips to "Close menu" (got "${opened.label}")`);
+  ok(opened.expanded === "true", `open state: aria-expanded flips to "true" (got "${opened.expanded}")`);
+
+  await burger.click();
+  const closed = await burger.evaluate((el) => ({ label: el.getAttribute("aria-label"), expanded: el.getAttribute("aria-expanded") }));
+  ok(closed.label === "Open menu", `closed again: aria-label flips back to "Open menu" (got "${closed.label}")`);
+  ok(closed.expanded === "false", `closed again: aria-expanded flips back to "false" (got "${closed.expanded}")`);
+} finally {
+  await browser.close();
+}
+
+console.log(`\n${fail ? "FAILED" : "OK"}: ${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/scripts/test-buyers-trend.js b/scripts/test-buyers-trend.js
new file mode 100644
index 00000000..b259fe5b
--- /dev/null
+++ b/scripts/test-buyers-trend.js
@@ -0,0 +1,96 @@
+// Unit tests for /revenue's buyersTrend() - the rolling 14-day recent-vs-
+// prior buyer-diversity comparison added after an internal audit found
+// distinct daily buyers fell 45% over 60 days, independent of any single
+// wallet, with nothing on the page surfacing that trend directly (a viewer
+// had to eyeball the chart). Extracts the actual function source and
+// executes it for real - not a regex/string check - since this is genuine
+// arithmetic, not just DOM structure. Lives in assets/js/revenue-chart.js
+// (external file, CSP hardening, 2026-08-16) - was inline in
+// src/revenue-live.js's shared <script> block before that.
+//
+// Offline - no server, no network.
+import { readFileSync } from "node:fs";
+
+let pass = 0, fail = 0;
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
+
+const src = readFileSync(new URL("../assets/js/revenue-chart.js", import.meta.url), "utf8");
+const m = src.match(/function buyersTrend\(\)\{[\s\S]*?\n    \}/);
+ok(!!m, "found buyersTrend() source in assets/js/revenue-chart.js");
+
+// Reconstruct it standalone, injecting `state` as a parameter instead of a
+// closure variable so fixture rows can be supplied directly.
+const fnSrc = m[0].replace("function buyersTrend()", "function buyersTrend(state)");
+const buyersTrend = new Function(`return (${fnSrc})`)();
+
+function rows(counts, startDay = "2026-06-01") {
+  const start = new Date(startDay + "T00:00:00Z");
+  return counts.map((n, i) => {
+    const d = new Date(start.getTime() + i * 86400000);
+    return { day: d.toISOString().slice(0, 10), buyers: n };
+  });
+}
+
+// --- insufficient history: fewer than 28 days -> null, no trend asserted ---
+ok(buyersTrend({ buyers: rows(Array(27).fill(5)) }) === null, "27 days of history -> null (needs 28)");
+ok(buyersTrend({ buyers: [] }) === null, "no data -> null");
+ok(buyersTrend({ buyers: null }) === null, "buyers: null -> does not throw, returns null");
+ok(buyersTrend({}) === null, "missing buyers field entirely -> does not throw, returns null");
+
+// --- exactly 28 days: the boundary case must compute, not just clear it ---
+{
+  const t = buyersTrend({ buyers: rows(Array(28).fill(10)) });
+  ok(t !== null, "exactly 28 days of history -> a real trend object (boundary is inclusive)");
+}
+
+// --- real decline shape (matches the audit's own measured numbers) ---
+{
+  // 14 days at ~14/day, then 14 days at ~7/day - a genuine ~50% decline.
+  const counts = [...Array(14).fill(14), ...Array(14).fill(7)];
+  const t = buyersTrend({ buyers: rows(counts) });
+  ok(t.prior === 14, `prior-period average computed correctly (got ${t.prior})`);
+  ok(t.recent === 7, `recent-period average computed correctly (got ${t.recent})`);
+  ok(Math.abs(t.pct - -50) < 0.01, `pct correctly negative for a decline (got ${t.pct.toFixed(2)})`);
+}
+
+// --- growth shape: pct must be positive, not just "not negative" ---
+{
+  const counts = [...Array(14).fill(5), ...Array(14).fill(10)];
+  const t = buyersTrend({ buyers: rows(counts) });
+  ok(t.pct > 0, `pct is positive for real growth (got ${t.pct.toFixed(2)})`);
+}
+
+// --- flat: near-zero swing lands close to 0%, not spuriously large ---
+{
+  const counts = [...Array(14).fill(10), ...Array(14).fill(10)];
+  const t = buyersTrend({ buyers: rows(counts) });
+  ok(Math.abs(t.pct) < 0.01, `identical periods -> ~0% (got ${t.pct.toFixed(2)})`);
+}
+
+// --- prior period all zero: division-by-zero guard, not Infinity/NaN ---
+{
+  const counts = [...Array(14).fill(0), ...Array(14).fill(5)];
+  const t = buyersTrend({ buyers: rows(counts) });
+  ok(t === null, "prior-period average of 0 -> null, not Infinity/NaN (division-by-zero guard)");
+}
+
+// --- unsorted input rows: function must sort by day itself, not trust order ---
+{
+  const counts = [...Array(14).fill(14), ...Array(14).fill(7)];
+  const ordered = rows(counts);
+  const shuffled = [...ordered].reverse();
+  const t = buyersTrend({ buyers: shuffled });
+  ok(t.prior === 14 && t.recent === 7, "sorts rows by day itself - correct even when input arrives out of order");
+}
+
+// --- more than 28 days: only the trailing 28 matter, older history ignored ---
+{
+  // 40 days total: first 12 are noise (should be ignored entirely), then the
+  // same 14-at-14/14-at-7 shape in the trailing 28.
+  const counts = [...Array(12).fill(999), ...Array(14).fill(14), ...Array(14).fill(7)];
+  const t = buyersTrend({ buyers: rows(counts) });
+  ok(t.prior === 14 && t.recent === 7, `only the trailing 28 days feed the comparison, older noise ignored (got prior=${t.prior}, recent=${t.recent})`);
+}
+
+console.log(`\n${fail ? "FAILED" : "OK"}: ${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/scripts/test-catalog-page.js b/scripts/test-catalog-page.js
index 7fc3c807..5c495beb 100644
--- a/scripts/test-catalog-page.js
+++ b/scripts/test-catalog-page.js
@@ -3,10 +3,16 @@
 import { ledgerCatalogPage } from "../src/ledger-catalog.js";
 import { WALLET_ONLY_SLUGS } from "../src/pow.js";
 import { CATEGORIES } from "../src/pages.js";
+import { readFileSync } from "node:fs";
 
 let pass = 0, fail = 0;
 const ok = (cond, msg) => { if (cond) { pass++; console.log(`ok - ${msg}`); } else { fail++; console.error(`FAIL - ${msg}`); } };
 
+// The search-filter script lives in assets/js/catalog-search.js (external
+// file, CSP hardening, 2026-08-16) — was inline in the page's own <script>
+// block before that.
+const catalogSearchScript = readFileSync(new URL("../assets/js/catalog-search.js", import.meta.url), "utf8");
+
 // A fabricated slug is guaranteed NOT in WALLET_ONLY_SLUGS (a fixed set of
 // real production slugs), so isComputePayable() reliably reports it free —
 // no dependency on any real tool's current classification, which could
@@ -64,7 +70,7 @@ ok(html.includes(CATEGORIES.web.blurb.replace(/&/g, "&amp;")), "category blurb i
 // --- live client-side search filter (kept from the current page; the design
 // mockup's redirect-to-/api/find-on-submit would dump raw JSON at a human
 // visitor, so the working in-place filter is kept instead) -----------------
-ok(html.includes('id="cat-search"') && html.includes("addEventListener('input'"), "live search filter script is present and wired to the input event, not a form submit");
+ok(html.includes('id="cat-search"') && html.includes('<script src="/js/catalog-search.js"></script>') && catalogSearchScript.includes("addEventListener('input'"), "live search filter script is present and wired to the input event, not a form submit");
 ok(!html.includes("onSubmit"), "no form-submit-to-raw-JSON handler ships (the design mockup's behavior, deliberately not ported)");
 
 // --- structured data --------------------------------------------------------
diff --git a/scripts/test-compare-scroll.js b/scripts/test-compare-scroll.js
new file mode 100644
index 00000000..d08ce501
--- /dev/null
+++ b/scripts/test-compare-scroll.js
@@ -0,0 +1,55 @@
+// Locks the scroll-wrapper fix for /compare (2026-08-16 audit): its four
+// tables were the only ones site-wide with no horizontal-scroll wrapper -
+// every other table (leaderboard, status, revenue) already follows this
+// codebase's own documented pattern (<div class="X-scroll" style=
+// "overflow-x:auto"><table style="min-width:...">). At mobile widths the
+// unwrapped tables would clip content or force the WHOLE PAGE to scroll
+// sideways instead of just the table.
+//
+// Verified via a real browser (Playwright) at a genuinely narrow viewport -
+// a static check that the wrapper div/CSS rule exists in the source can't
+// prove the table actually becomes scrollABLE (min-width vs viewport width
+// is an empirical fact, not something regex can compute) or that the PAGE
+// itself stays contained rather than scrolling horizontally too.
+//
+// Requires a booted server (same TARGET_URL convention as other page tests):
+//   FREE_MODE=true PORT=3000 node src/server.js
+//   TARGET_URL=http://localhost:3000 node scripts/test-compare-scroll.js
+import { chromium } from "playwright";
+
+const BASE = process.env.TARGET_URL || "http://localhost:3000";
+let pass = 0, fail = 0;
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
+
+const browser = await chromium.launch();
+try {
+  const page = await browser.newPage({ viewport: { width: 390, height: 844 } }); // genuinely narrow mobile
+  await page.goto(`${BASE}/compare`, { waitUntil: "load" });
+
+  const wraps = await page.locator(".cmp-scroll").count();
+  ok(wraps === 4, `/compare has 4 scroll wrappers, one per table (got ${wraps})`);
+
+  for (let i = 0; i < wraps; i++) {
+    const el = page.locator(".cmp-scroll").nth(i);
+    const table = el.locator("table.cmp-table");
+    ok(await table.count() === 1, `wrapper ${i}: contains exactly one .cmp-table`);
+    const { scrollWidth, clientWidth, overflowX } = await el.evaluate((e) => ({ scrollWidth: e.scrollWidth, clientWidth: e.clientWidth, overflowX: getComputedStyle(e).overflowX }));
+    ok(scrollWidth > clientWidth, `wrapper ${i}: table is genuinely wider than its container at 390px (scrollWidth=${scrollWidth} > clientWidth=${clientWidth})`);
+    // The direct, meaningful check: scrollWidth > clientWidth alone only
+    // proves the content is bigger than the box - that's true whether or
+    // not overflow is actually enabled. overflow-x must be auto/scroll
+    // specifically, or the "wider content" fact above means nothing (the
+    // page also has a SITE-WIDE `html { overflow-x: clip }` guard -
+    // ledger-chrome.js:59 - that masks a missing wrapper rule by silently
+    // clipping the overflow instead of showing a scrollbar, so checking
+    // page-level overflow can never catch a regression in this specific
+    // wrapper; checked directly against ledger-chrome.js's source to
+    // confirm this guard is real, not assumed).
+    ok(overflowX === "auto" || overflowX === "scroll", `wrapper ${i}: overflow-x is actually auto/scroll, not just visually wide (got "${overflowX}")`);
+  }
+} finally {
+  await browser.close();
+}
+
+console.log(`\n${fail ? "FAILED" : "OK"}: ${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/scripts/test-csp-violations.js b/scripts/test-csp-violations.js
new file mode 100644
index 00000000..586913d6
--- /dev/null
+++ b/scripts/test-csp-violations.js
@@ -0,0 +1,212 @@
+// Sitewide CSP regression test — the payoff of the 2026-08-16 CSP hardening
+// pass (script-src dropped 'unsafe-inline'; every page-behavior script now
+// lives in a real file under /js/:file or a dedicated scoped-CSP route).
+// A static grep for "<script>" catches an inline block existing in the
+// TEMPLATE SOURCE; it cannot catch a real browser actually refusing to run
+// something, which is the only thing that matters to a visitor. This drives
+// a real Chromium instance (Playwright) over every distinct page template
+// on the site (deduped from the live sitemap.xml, not a hand-maintained
+// list that goes stale) and asserts ZERO CSP violations fire, on load AND
+// across a set of real user interactions on the pages known to gate
+// behavior behind a click (the playground's Run button, the SDK
+// playground's eval sandbox, docs sidebar search, market filter bar sort/
+// search, the homepage's live PoW demo, the tollbooth waitlist form,
+// api-explorer's search/expand) — page-load-only coverage would miss a
+// violation that only fires once a user actually does something.
+//
+//   FREE_MODE=true PORT=3000 node src/server.js
+//   TARGET_URL=http://localhost:3000 node scripts/test-csp-violations.js
+import { chromium } from "playwright";
+
+const BASE = process.env.TARGET_URL || "http://localhost:3000";
+let pass = 0, fail = 0;
+const ok = (cond, msg) => { if (cond) { pass++; console.log(`ok - ${msg}`); } else { fail++; console.error(`FAIL - ${msg}`); } };
+
+// Dynamic-slug route families collapse to ONE representative sample each,
+// so this test tracks the sitemap (self-maintaining) without visiting
+// hundreds of near-identical tool/skill/doc pages that share one template.
+const DYNAMIC_PREFIXES = ["/tools/category/", "/tools/", "/skills/", "/blog/", "/docs/adapters/", "/docs/", "/guides/"];
+function shapeOf(path) {
+  for (const p of DYNAMIC_PREFIXES) {
+    if (path.startsWith(p) && path.length > p.length && !path.slice(p.length).includes("/")) return p;
+  }
+  return path;
+}
+const NON_HTML_RE = /\.(svg|png|ico|json|xml|txt|rss)(\?|$)/i;
+
+const sitemapXml = await (await fetch(`${BASE}/sitemap.xml`)).text();
+const sitemapPaths = [...sitemapXml.matchAll(/<loc>([^<]+)<\/loc>/g)]
+  .map((m) => m[1].replace(/^https?:\/\/[^/]+/, ""))
+  .filter((p) => !NON_HTML_RE.test(p));
+ok(sitemapPaths.length > 30, `sitemap.xml lists a substantial HTML page set (got ${sitemapPaths.length})`);
+
+const seenShapes = new Map();
+for (const p of sitemapPaths) {
+  const shape = shapeOf(p);
+  if (!seenShapes.has(shape)) seenShapes.set(shape, p);
+}
+// Always include the homepage and every chain marketplace page explicitly —
+// the homepage is often excluded from a sitemap's <loc> list (canonical "/"
+// quirks vary by generator) and chain pages share a shape ("/base" has no
+// slash after it, so shapeOf treats each chain slug as its own unique
+// shape already - this just guarantees the set even if sitemap coverage
+// for a given chain is thin).
+seenShapes.set("/", "/");
+for (const chain of ["base", "solana", "polygon", "arbitrum", "monad", "celo", "avalanche", "sei", "optimism", "stellar", "algorand", "robinhood"]) {
+  seenShapes.set(`/${chain}`, `/${chain}`);
+}
+const pages = [...new Set(seenShapes.values())];
+ok(pages.length >= 30, `deduped to a substantial distinct-template set (got ${pages.length})`);
+console.log(`  crawling ${pages.length} distinct page templates for CSP violations...`);
+
+const browser = await chromium.launch();
+
+// Collects securitypolicyviolation events (installed via addInitScript so
+// it's live before ANY page script runs, not just after DOMContentLoaded)
+// plus console messages Chrome itself logs for a CSP refusal (a redundant
+// backstop - some violation shapes log to console without firing the DOM
+// event, e.g. a refused <script src> before the document element exists).
+async function freshPage() {
+  const page = await browser.newPage();
+  const violations = [];
+  await page.exposeFunction("__cspReport", (v) => violations.push(v));
+  await page.addInitScript(() => {
+    document.addEventListener("securitypolicyviolation", (e) => {
+      window.__cspReport({
+        directive: e.violatedDirective,
+        blockedURI: e.blockedURI,
+        sourceFile: e.sourceFile,
+        lineNumber: e.lineNumber,
+      });
+    });
+  });
+  page.on("console", (msg) => {
+    const text = msg.text();
+    if (/Content Security Policy|Refused to (execute|load|apply)/i.test(text)) {
+      violations.push({ directive: "(console)", blockedURI: text, sourceFile: page.url(), lineNumber: 0 });
+    }
+  });
+  return { page, violations };
+}
+
+const allViolations = [];
+
+for (const path of pages) {
+  const { page, violations } = await freshPage();
+  try {
+    await page.goto(`${BASE}${path}`, { waitUntil: "networkidle", timeout: 20000 });
+    await page.waitForTimeout(300); // let any deferred/polling script fire once
+  } catch (e) {
+    violations.push({ directive: "(navigation)", blockedURI: String(e && e.message || e), sourceFile: path, lineNumber: 0 });
+  }
+  for (const v of violations) allViolations.push({ path, ...v });
+  await page.close();
+}
+ok(allViolations.length === 0, `zero CSP violations across ${pages.length} page loads (got ${allViolations.length})`);
+
+// --- Interaction pass: pages whose scripts gate real behavior behind a
+// click/input, not just page load. -------------------------------------------
+const interactions = [
+  {
+    path: "/playground",
+    async run(page) {
+      await page.waitForTimeout(300);
+      await page.click("#pgRun");
+      await page.waitForFunction(() => /Done|Error/.test(document.getElementById("pgStatus")?.textContent || ""), { timeout: 15000 }).catch(() => {});
+    },
+  },
+  {
+    path: "/sdk-playground",
+    async run(page) {
+      await page.waitForTimeout(300);
+      await page.click('.sp-example[data-idx="2"]'); // Generate a UUID - fast, no PoW
+      await page.click("#spRun");
+      await page.waitForFunction(() => document.getElementById("spStatus")?.textContent === "Done", { timeout: 15000 }).catch(() => {});
+    },
+  },
+  {
+    path: "/docs",
+    async run(page) {
+      await page.waitForTimeout(300);
+      const input = await page.$("#ml-docs-search-input");
+      if (input) await input.fill("getting");
+      // The mobile sidebar toggle is display:none above the 900px
+      // breakpoint (desktop default viewport) - resize down so it's a real,
+      // clickable element instead of erroring on an invisible target.
+      await page.setViewportSize({ width: 390, height: 844 });
+      const toggle = await page.$("#ml-docs-mobile-toggle");
+      if (toggle) await toggle.click();
+    },
+  },
+  {
+    path: "/base",
+    async run(page) {
+      await page.waitForTimeout(300);
+      const sortSel = await page.$("select[data-mfb-sort]");
+      if (sortSel) await sortSel.selectOption("usd");
+      const searchIn = await page.$("input[data-mfb-search]");
+      if (searchIn) await searchIn.fill("a");
+      const sellerLink = await page.$("[data-seller-link]");
+      if (sellerLink) await sellerLink.click();
+    },
+  },
+  {
+    path: "/",
+    async run(page) {
+      await page.waitForTimeout(500);
+      const input = await page.$("#hm-demo-in");
+      if (input) await input.fill("csp regression check");
+      const runBtn = await page.$("#hm-demo-run");
+      if (runBtn) await runBtn.click();
+      await page.waitForFunction(() => {
+        const s = document.getElementById("hm-demo-status");
+        return s && /200 OK|error/.test(s.textContent || "");
+      }, { timeout: 15000 }).catch(() => {});
+    },
+  },
+  {
+    path: "/docs/api/explorer",
+    async run(page) {
+      await page.waitForTimeout(500);
+      const search = await page.$("#aeSearch");
+      if (search) await search.fill("hash");
+      const head = await page.$(".ae-ep-head");
+      if (head) await head.click();
+    },
+  },
+  {
+    path: "/tollbooth/waitlist",
+    async run(page) {
+      await page.waitForTimeout(300);
+      await page.fill("#f_name", "CSP Check");
+      await page.fill("#f_email", "csp-check@example.com");
+      await page.click("#wl_submit");
+      await page.waitForTimeout(1000);
+    },
+  },
+];
+
+for (const { path, run } of interactions) {
+  const { page, violations } = await freshPage();
+  try {
+    await page.goto(`${BASE}${path}`, { waitUntil: "networkidle", timeout: 20000 });
+    await run(page);
+  } catch (e) {
+    violations.push({ directive: "(interaction)", blockedURI: String(e && e.message || e), sourceFile: path, lineNumber: 0 });
+  }
+  for (const v of violations) allViolations.push({ path: `${path} (interaction)`, ...v });
+  await page.close();
+  ok(violations.length === 0, `${path}: zero CSP violations after interacting with the page`);
+}
+
+await browser.close();
+
+if (allViolations.length) {
+  console.error("\nCSP violations found:");
+  for (const v of allViolations) {
+    console.error(`  ${v.path}: [${v.directive}] blocked ${v.blockedURI} (${v.sourceFile}:${v.lineNumber})`);
+  }
+}
+
+console.log(`\n${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/scripts/test-css-tokens-resolve.js b/scripts/test-css-tokens-resolve.js
new file mode 100644
index 00000000..55f5824a
--- /dev/null
+++ b/scripts/test-css-tokens-resolve.js
@@ -0,0 +1,64 @@
+// Every custom property declared in ledger-chrome.js's :root must actually
+// resolve to a real value in a real browser - not just be present as text in
+// the served HTML.
+//
+// Found live 2026-08-16: a WCAG-contrast fix added a JS-style `//` comment
+// INSIDE the :root {} block (invalid CSS - comments must be /* */). The
+// browser's CSS parser silently swallowed every declaration from that point
+// to the closing brace (--green, --hairline, --dash, --on-dark, --on-dark2,
+// --dk-muted/2/3, --surface, even --font-body/--font-mono) - a site-wide
+// regression that shipped to production for one deploy cycle before being
+// caught. The prior --faint test only did static regex extraction on the
+// source text, which can never catch a CSS PARSE failure - the string
+// "--green: #3E9B6E;" is right there in the file either way, parser error or
+// not. Only an actual browser evaluating actual CSS can catch this class.
+//
+// Requires a booted server (same TARGET_URL convention as other page tests):
+//   FREE_MODE=true PORT=3000 node src/server.js
+//   TARGET_URL=http://localhost:3000 node scripts/test-css-tokens-resolve.js
+import { readFileSync } from "node:fs";
+import { chromium } from "playwright";
+
+const BASE = process.env.TARGET_URL || "http://localhost:3000";
+let pass = 0, fail = 0;
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
+
+const src = readFileSync(new URL("../src/ledger-chrome.js", import.meta.url), "utf8");
+const rootMatch = src.match(/:root\s*\{([\s\S]*?)\n\}/);
+ok(!!rootMatch, "found the :root {} block in ledger-chrome.js");
+const rootBody = rootMatch ? rootMatch[1] : "";
+const tokenNames = [...rootBody.matchAll(/--([a-z0-9-]+):/g)].map((m) => m[1]);
+ok(tokenNames.length >= 20, `extracted a substantial token list from :root (got ${tokenNames.length})`);
+// Sanity the extractor isn't blind - these are known, long-standing tokens
+// that must always be in the list if the regex is working at all.
+for (const must of ["accent", "paper", "card", "ink", "faint"]) {
+  ok(tokenNames.includes(must), `token extraction sees the known token --${must} (extractor is not blind)`);
+}
+
+const browser = await chromium.launch();
+try {
+  const page = await browser.newPage();
+  // Check on a real page, not a blank one - the homepage loads ledger-chrome
+  // the same way every other page does.
+  await page.goto(`${BASE}/`, { waitUntil: "load" });
+  const values = await page.evaluate((names) => {
+    const cs = getComputedStyle(document.documentElement);
+    const out = {};
+    for (const n of names) out[n] = cs.getPropertyValue("--" + n).trim();
+    return out;
+  }, tokenNames);
+
+  const broken = tokenNames.filter((n) => !values[n]);
+  ok(broken.length === 0, `every :root token resolves to a non-empty value in a real browser${broken.length ? ` - BROKEN: ${broken.map((n) => "--" + n).join(", ")}` : ""}`);
+
+  // font-body/font-mono resolving is itself a real, separate signal: those
+  // are the LAST two declarations before the closing brace, so if a CSS
+  // parse error anywhere earlier in the block silently swallowed the rest,
+  // these are the two most likely to still show broken.
+  ok(!!values["font-body"] && !!values["font-mono"], `--font-body and --font-mono resolve (last declarations in the block - proves the parser reached the end)`);
+} finally {
+  await browser.close();
+}
+
+console.log(`\n${fail ? "FAILED" : "OK"}: ${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/scripts/test-discovery.js b/scripts/test-discovery.js
index 96fae72a..aa47ceb8 100644
--- a/scripts/test-discovery.js
+++ b/scripts/test-discovery.js
@@ -67,12 +67,12 @@ JSON.parse(JSON.stringify(m));
 // ---- reliabilityReport ----
 const stats = {
   servingSince: "2026-01-01T00:00:00.000Z",
-  uptimeSeconds: 12345,
+  processUptimeSeconds: 12345,
   toolCallsServed: { total: 100, viaUSDC: 60, viaProofOfWork: 40 },
 };
 const r = reliabilityReport({ baseUrl: BASE, network: "base", wallet: WALLET, stats });
 ok(r.service === "Agent402.Tools" && r.status === "operational", "reliability identity/status");
-ok(r.uptimeSeconds === 12345 && r.toolCallsServed.total === 100, "reliability pulls live stats");
+ok(r.processUptimeSeconds === 12345 && r.toolCallsServed.total === 100, "reliability pulls live stats");
 ok(r.onchain.revenueProof.includes(WALLET), "reliability onchain proof");
 ok(Array.isArray(r.guarantees) && r.guarantees.length >= 5, "guarantees listed");
 ok(r.guarantees.every((g) => typeof g.claim === "string" && (g.verify || g.evidence)), "every guarantee has a claim + a verify/evidence link");
diff --git a/scripts/test-docs-gitbook.js b/scripts/test-docs-gitbook.js
index dbcc2940..a98f18a0 100644
--- a/scripts/test-docs-gitbook.js
+++ b/scripts/test-docs-gitbook.js
@@ -23,6 +23,10 @@
 //   node scripts/test-docs-gitbook.js
 import { docsPage, docNeighbors, renderSidebar, docsLayoutHtml, DOCS_SEARCH_SCRIPT, docsSlugs } from "../src/docs.js";
 import { ledgerDocsPage } from "../src/ledger-docs.js";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const docsSidebarScript = readFileSync(fileURLToPath(new URL("../assets/js/docs-sidebar.js", import.meta.url)), "utf8");
 
 let pass = 0, fail = 0;
 const ok = (cond, msg) => { if (cond) { pass++; console.log(`ok - ${msg}`); } else { fail++; console.error(`FAIL - ${msg}`); } };
@@ -87,10 +91,11 @@ ok(slugs.includes("Getting-Started"), "a known real doc slug (Getting-Started) i
 // --- an unknown slug still 404s cleanly (unchanged by this pass) --------------
 ok(docsPage(BASE_URL, "Definitely-Not-A-Real-Page") === null, "an unknown slug returns null, not a broken page");
 
-// --- the search-filter script is present exactly once per page, wired to
-// the real input id ------------------------------------------------------------
-ok(DOCS_SEARCH_SCRIPT.includes("ml-docs-search-input"), "the exported search script targets the real input id");
-ok(DOCS_SEARCH_SCRIPT.includes("ml-docs-mobile-toggle"), "the exported script also wires the mobile toggle");
+// --- the search-filter script is present exactly once per page (external
+// file — CSP hardening, 2026-08-16), wired to the real input id --------------
+ok(DOCS_SEARCH_SCRIPT.includes('<script src="/js/docs-sidebar.js"></script>'), "the page references the external sidebar script");
+ok(docsSidebarScript.includes("ml-docs-search-input"), "the sidebar script targets the real input id");
+ok(docsSidebarScript.includes("ml-docs-mobile-toggle"), "the sidebar script also wires the mobile toggle");
 
 // --- docsLayoutHtml is the single source of the wrapper markup - both
 // callers must produce byte-identical structure for the same slug -----------
diff --git a/scripts/test-faint-contrast.js b/scripts/test-faint-contrast.js
new file mode 100644
index 00000000..42eaa4ae
--- /dev/null
+++ b/scripts/test-faint-contrast.js
@@ -0,0 +1,59 @@
+// Locks the WCAG AA contrast fix for --faint (2026-08-16 audit): the token
+// was #6C6C68, 3.15-3.66:1 against the dark surfaces it's actually
+// composited on in shared nav/footer chrome (used at 10-13px - normal text
+// needs 4.5:1, not the relaxed 3:1 large-text threshold) - a sitewide
+// failure since ledger-chrome.js's :root is the ONE definition every page
+// inherits. Offline - reads the token + background hexes straight out of
+// the CSS source and computes real WCAG relative-luminance contrast, so a
+// future value change is caught by the math, not just a hardcoded string
+// compare.
+import { readFileSync } from "node:fs";
+
+let pass = 0, fail = 0;
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
+
+const src = readFileSync(new URL("../src/ledger-chrome.js", import.meta.url), "utf8");
+
+function tokenValue(name) {
+  const m = src.match(new RegExp(`--${name}:\\s*(#[0-9a-fA-F]{6})`));
+  return m ? m[1] : null;
+}
+
+function relLum(hex) {
+  const c = hex.replace("#", "");
+  const r = parseInt(c.slice(0, 2), 16) / 255, g = parseInt(c.slice(2, 4), 16) / 255, b = parseInt(c.slice(4, 6), 16) / 255;
+  const lin = (x) => (x <= 0.03928 ? x / 12.92 : Math.pow((x + 0.055) / 1.055, 2.4));
+  return 0.2126 * lin(r) + 0.7152 * lin(g) + 0.0722 * lin(b);
+}
+function contrast(hex1, hex2) {
+  const L1 = relLum(hex1), L2 = relLum(hex2);
+  const lighter = Math.max(L1, L2), darker = Math.min(L1, L2);
+  return (lighter + 0.05) / (darker + 0.05);
+}
+
+const faint = tokenValue("faint");
+ok(!!faint, `found --faint in ledger-chrome.js's :root (got ${faint})`);
+
+// Every dark surface --faint text is actually composited on across the
+// site's shared chrome + page bodies (paper/card/card-zebra/footer-bg).
+const SURFACES = { paper: "paper", card: "card", "card-zebra": "card-zebra", "footer-bg": "footer-bg" };
+for (const [label, tokenName] of Object.entries(SURFACES)) {
+  const bg = tokenValue(tokenName);
+  ok(!!bg, `found --${tokenName} token (got ${bg})`);
+  if (!bg || !faint) continue;
+  const ratio = contrast(faint, bg);
+  // WCAG AA for normal-size text (< 18pt/24px, or < 14pt/18.66px bold) is
+  // 4.5:1 - --faint is used at 10-13px throughout, well under that.
+  ok(ratio >= 4.5, `--faint (${faint}) on --${tokenName} (${bg}) clears WCAG AA 4.5:1 (got ${ratio.toFixed(2)}:1)`);
+}
+
+// Sanity: --faint must stay visually distinct from --muted (the "one level
+// up" token) - the fix should not just collapse the two into the same shade.
+const muted = tokenValue("muted");
+if (faint && muted) {
+  const distinctness = contrast(faint, muted);
+  ok(distinctness > 1.05, `--faint (${faint}) stays visually distinct from --muted (${muted}) (contrast ${distinctness.toFixed(2)}:1)`);
+}
+
+console.log(`\n${fail ? "FAILED" : "OK"}: ${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/scripts/test-focus-visible.js b/scripts/test-focus-visible.js
new file mode 100644
index 00000000..3e44a086
--- /dev/null
+++ b/scripts/test-focus-visible.js
@@ -0,0 +1,50 @@
+// Locks the focus-visible fix (2026-08-16 audit): four prominent search/demo
+// inputs stripped outline:none with no replacement, unlike 7 other inputs in
+// the same codebase that already use a :focus{border-color:var(--accent)}
+// pattern. Verified via a REAL browser (Playwright) - a lesson learned the
+// hard way earlier the same day: static regex on the source text cannot
+// prove a CSS rule actually applies (see test-css-tokens-resolve.js's own
+// header comment for the incident this guards against generalizing).
+//
+// Requires a booted server (same TARGET_URL convention as other page tests):
+//   FREE_MODE=true PORT=3000 node src/server.js
+//   TARGET_URL=http://localhost:3000 node scripts/test-focus-visible.js
+import { chromium } from "playwright";
+
+const BASE = process.env.TARGET_URL || "http://localhost:3000";
+let pass = 0, fail = 0;
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
+
+const browser = await chromium.launch();
+try {
+  const page = await browser.newPage();
+
+  // Each case: [page path, input selector, element to read the border color
+  // from (the input itself, or its focus-within wrapper)].
+  const CASES = [
+    { path: "/tools", input: "#cat-search", borderEl: ".cat-search-wrap", label: "/tools catalog search" },
+    { path: "/", input: "#hm-demo-in", borderEl: "#hm-demo-in", label: "/ homepage PoW demo input" },
+    { path: "/marketplace", input: "form.mkt-search-wrap input[name='q']", borderEl: "form.mkt-search-wrap", label: "/marketplace search" },
+    { path: "/base", input: "form.mkt-search-wrap input[name='q']", borderEl: "form.mkt-search-wrap", label: "/base (per-chain) search" },
+  ];
+
+  for (const c of CASES) {
+    await page.goto(`${BASE}${c.path}`, { waitUntil: "load" });
+    const input = page.locator(c.input).first();
+    const borderTarget = page.locator(c.borderEl).first();
+    ok(await input.count() > 0, `${c.label}: input is present`);
+    const before = await borderTarget.evaluate((el) => getComputedStyle(el).borderColor);
+    await input.focus();
+    const after = await borderTarget.evaluate((el) => getComputedStyle(el).borderColor);
+    ok(before !== after, `${c.label}: border color visibly changes on focus (${before} -> ${after})`);
+    // The accent color is #F0522E = rgb(240, 82, 46) - confirm it's THAT
+    // color specifically, not just "some change" (e.g. an unrelated hover
+    // rule coincidentally firing).
+    ok(after === "rgb(240, 82, 46)", `${c.label}: focused border is the accent color specifically (got ${after})`);
+  }
+} finally {
+  await browser.close();
+}
+
+console.log(`\n${fail ? "FAILED" : "OK"}: ${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/scripts/test-llms-mpp-header-note.js b/scripts/test-llms-mpp-header-note.js
new file mode 100644
index 00000000..dd1f97c4
--- /dev/null
+++ b/scripts/test-llms-mpp-header-note.js
@@ -0,0 +1,40 @@
+// Locks the "how to read our 402" note added to llms.txt (2026-08-16 audit,
+// prompted by issue #794): an external client hard-failed with
+// "no_supported_rail" because it only recognized the MPP `WWW-Authenticate:
+// Payment` scheme and never checked for the real x402 `PAYMENT-REQUIRED`
+// header present on the SAME response. Mike's fix in the issue thread was a
+// one-off reply; this locks the same guidance into the machine-readable
+// surface so the next client author sees it before hitting the same wall.
+//
+// Offline - calls llmsTxt() directly with a minimal fixture catalog.
+//
+//   node scripts/test-llms-mpp-header-note.js
+import { llmsTxt } from "../src/seo.js";
+
+let pass = 0, fail = 0;
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
+
+const FIXTURE_CATALOG = {
+  "POST /api/hash": {
+    slug: "hash", name: "Hash", category: "encoding", price: "$0.001",
+    description: "Compute a cryptographic hash.",
+    discovery: { inputSchema: { properties: {}, required: [] }, input: {} },
+  },
+};
+
+const text = llmsTxt("https://agent402.tools", FIXTURE_CATALOG);
+
+ok(text.includes("How to read our 402 if you only speak one dialect"), "the new section heading is present");
+ok(text.includes("PAYMENT-REQUIRED"), "names the real x402 header explicitly");
+ok(text.includes("WWW-Authenticate"), "names the MPP header explicitly");
+ok(text.includes("#794"), "cites the real incident (issue #794), not a hypothetical");
+ok(/additive, never a replacement/.test(text), "states the two headers coexist, neither replaces the other");
+// The note must land AFTER the existing MPP dual-stack paragraph, not before
+// it — a reader needs the dual-stack context first to make sense of "if you
+// only speak one dialect".
+const dualStackIdx = text.indexOf("MPP clients are first-class");
+const noteIdx = text.indexOf("How to read our 402");
+ok(dualStackIdx > 0 && noteIdx > dualStackIdx, "the note appears after the MPP dual-stack paragraph it explains");
+
+console.log(`\n${fail ? "FAILED" : "OK"}: ${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/scripts/test-llms-route-execute-tiers.js b/scripts/test-llms-route-execute-tiers.js
new file mode 100644
index 00000000..80bafb18
--- /dev/null
+++ b/scripts/test-llms-route-execute-tiers.js
@@ -0,0 +1,49 @@
+// Locks the llms.txt route-execute pricing fix (2026-08-16 audit): the
+// "Proportional tiers" sentence was a hand-typed list of 3 tiers
+// (execute/execute-plus/execute-max) that silently went stale the moment
+// route-execute-pro ($3.30, added 2026-08-04) shipped in route-execute.js -
+// nobody remembered to also update this unrelated prose file. Fixed by
+// deriving the sentence from EXEC_TIERS directly, so a future 5th tier can't
+// repeat the same silent omission.
+//
+// Also locks a bug caught while building that fix: the first draft built the
+// URL as `/api/route/${slug}` (slug is "route-execute-plus"), producing the
+// doubled path /api/route/route-execute-plus - the REAL route (registered in
+// route-execute.js's buildRouteExecuteTool) strips the "route-execute"
+// prefix and prepends "execute", giving /api/route/execute-plus. This test
+// asserts every tier URL in the sentence is a route that actually appears in
+// the live catalog, not just that some URL-shaped string is present.
+//
+// Offline - calls llmsTxt() directly and cross-checks against the real
+// EXEC_TIERS array + a live catalog fixture.
+//
+//   node scripts/test-llms-route-execute-tiers.js
+import { llmsTxt } from "../src/seo.js";
+import { EXEC_TIERS } from "../src/tools/route-execute.js";
+
+let pass = 0, fail = 0;
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
+
+const text = llmsTxt("https://agent402.tools", {});
+const sentenceMatch = text.match(/Proportional tiers:.*?fits/);
+ok(!!sentenceMatch, "the 'Proportional tiers' sentence is present");
+const sentence = sentenceMatch?.[0] || "";
+
+ok(EXEC_TIERS.length >= 4, `sanity: EXEC_TIERS has the tiers we expect to see reflected (got ${EXEC_TIERS.length})`);
+
+for (const tier of EXEC_TIERS) {
+  const priceStr = `$${tier.execPriceUsd}`; // e.g. "$3.3" - JS default toString
+  const priceStr2dp = tier.execPriceUsd.toFixed(2); // "3.30"
+  const priceMentioned = sentence.includes(priceStr) || sentence.includes(`$${priceStr2dp}`);
+  ok(priceMentioned, `every EXEC_TIERS price is mentioned in the sentence (${tier.slug}: $${tier.execPriceUsd})`);
+}
+
+// Specifically: route-execute-pro (the tier that went missing) must be named,
+// by its REAL route path, not the raw slug.
+ok(sentence.includes("execute-pro"), "route-execute-pro's price is present (this is the tier that was missing before the fix)");
+ok(!sentence.includes("/api/route/route-execute"), "no doubled '/api/route/route-execute...' path (the URL-derivation bug caught while building this fix)");
+ok(sentence.includes("/api/route/execute-plus") && sentence.includes("/api/route/execute-max") && sentence.includes("/api/route/execute-pro"),
+  "every non-base tier links its REAL route path (/api/route/execute-<suffix>)");
+
+console.log(`\n${fail ? "FAILED" : "OK"}: ${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/scripts/test-manifest-resources-dedup.js b/scripts/test-manifest-resources-dedup.js
new file mode 100644
index 00000000..772d443c
--- /dev/null
+++ b/scripts/test-manifest-resources-dedup.js
@@ -0,0 +1,39 @@
+// Locks the resources[] dedup fix (2026-08-16 audit): serviceManifest()
+// mapped Object.keys(catalog) straight to URLs with no dedup - a handful of
+// tools (e.g. /api/memory) are registered TWICE in the catalog, once per
+// HTTP method (GET read, POST write), so their URL appeared twice in
+// /.well-known/x402's resources[] with no way for a consumer to tell why.
+// x402scan's discovery format wants a flat URL list, not a method-annotated
+// one (openapi.json already carries that), so the fix is to dedupe by URL.
+//
+// Offline - calls serviceManifest() directly with a fixture catalog that
+// deliberately includes a GET+POST pair on the same path, so this is a
+// non-vacuous check (a catalog with no duplicate paths at all would pass
+// trivially and prove nothing).
+import { serviceManifest } from "../src/discovery.js";
+
+let pass = 0, fail = 0;
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
+
+const FIXTURE_CATALOG = {
+  "GET /api/memory": { slug: "memory-get", name: "Memory read" },
+  "POST /api/memory": { slug: "memory-post", name: "Memory write" },
+  "POST /api/hash": { slug: "hash", name: "Hash" },
+};
+
+const manifest = serviceManifest({
+  baseUrl: "https://agent402.tools", network: "base", networks: ["base"],
+  wallet: "0xaBF4FAbd7c416fB67202E5f9002389Fc75e2a9D0", walletName: "agent402.base.eth",
+  catalog: FIXTURE_CATALOG, toolCount: 3, powSlugs: new Set(), powDifficulty: 20, prices: {},
+});
+
+ok(Array.isArray(manifest.resources), "manifest.resources is an array");
+const memoryUrl = "https://agent402.tools/api/memory";
+const memoryCount = manifest.resources.filter((r) => r === memoryUrl).length;
+ok(memoryCount === 1, `/api/memory (registered under 2 methods in the fixture) appears exactly once in resources[] (got ${memoryCount})`);
+ok(manifest.resources.includes("https://agent402.tools/api/hash"), "a normal, single-method tool is still present");
+ok(manifest.resources.length === new Set(manifest.resources).size, "no duplicate URL anywhere in resources[] (general dedup, not just the /api/memory special case)");
+ok(manifest.resources.length === 2, `3 catalog entries (2 of which collapse to 1 URL) produce exactly 2 distinct resource URLs (got ${manifest.resources.length})`);
+
+console.log(`\n${fail ? "FAILED" : "OK"}: ${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/scripts/test-market-pages.js b/scripts/test-market-pages.js
index 9aa0fb8f..6227ff3a 100644
--- a/scripts/test-market-pages.js
+++ b/scripts/test-market-pages.js
@@ -6,6 +6,10 @@
 import { marketSellers, marketSellersAll, marketPage, marketPanelHtml, CHAIN_PAGES, marketFilterBar } from "../src/market-page.js";
 import { sitemapPages, sitemapXml, llmsTxt } from "../src/seo.js";
 import { serviceManifest } from "../src/discovery.js";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const filterBarScript = readFileSync(fileURLToPath(new URL("../assets/js/market-filter-bar.js", import.meta.url)), "utf8");
 
 let pass = 0, fail = 0;
 const ok = (cond, msg) => { if (cond) { pass++; console.log(`ok - ${msg}`); } else { fail++; console.error(`FAIL - ${msg}`); } };
@@ -219,20 +223,22 @@ for (const c of NEW_CHAINS) {
   // Sort options per the spec: most settled (default), volume, buyers, tools,
   // plus health (cheap — rows already carry routability).
   for (const v of ["calls", "usd", "buyers", "tools", "health"]) ok(all.includes(`option value="${v}"`), `filter bar: sort option '${v}' present`);
-  // The wiring script ships with the bar: consumes data-mfb-sort +
-  // data-mfb-search over [data-mfb-row] rows, reorders by moving existing
-  // nodes (appendChild) and toggles style.display — never innerHTML.
-  ok(all.includes("select[data-mfb-sort]") && all.includes("addEventListener('change'"), "filter bar: script wires the data-mfb-sort select");
-  ok(all.includes("input[data-mfb-search]") && all.includes("addEventListener('input'"), "filter bar: script wires the data-mfb-search input");
-  ok(all.includes("data-mfb-row") && all.includes("appendChild") && all.includes("style.display"), "filter bar: script sorts/filters [data-mfb-row] rows via appendChild + style.display");
-  ok(!all.includes("innerHTML"), "filter bar: script never assigns innerHTML");
-  // Execution-order guard — the bar renders ABOVE the roster, so an inline
-  // script that queries [data-mfb-row] at parse time finds ZERO rows and its
-  // early return dead-wires Sort/search on every load (the original bug). The
-  // row lookup must be deferred to DOMContentLoaded: the wrapper must exist
-  // and textually precede the row query it defers.
-  const dclIdx = all.indexOf("addEventListener('DOMContentLoaded'");
-  ok(dclIdx !== -1 && dclIdx < all.indexOf("querySelectorAll('[data-mfb-row]')"), "filter bar: row lookup is deferred to DOMContentLoaded, not run at parse time");
+  // The wiring script ships as an external file (CSP hardening, 2026-08-16):
+  // consumes data-mfb-sort + data-mfb-search over [data-mfb-row] rows,
+  // reorders by moving existing nodes (appendChild) and toggles
+  // style.display — never innerHTML.
+  ok(all.includes('<script src="/js/market-filter-bar.js"></script>'), "filter bar: references the external wiring script");
+  ok(filterBarScript.includes("select[data-mfb-sort]") && filterBarScript.includes("addEventListener('change'"), "filter bar: script wires the data-mfb-sort select");
+  ok(filterBarScript.includes("input[data-mfb-search]") && filterBarScript.includes("addEventListener('input'"), "filter bar: script wires the data-mfb-search input");
+  ok(filterBarScript.includes("data-mfb-row") && filterBarScript.includes("appendChild") && filterBarScript.includes("style.display"), "filter bar: script sorts/filters [data-mfb-row] rows via appendChild + style.display");
+  ok(!filterBarScript.includes("innerHTML"), "filter bar: script never assigns innerHTML");
+  // Execution-order guard — the bar renders ABOVE the roster, so a script
+  // that queries [data-mfb-row] at parse time finds ZERO rows and its early
+  // return dead-wires Sort/search on every load (the original bug). The row
+  // lookup must be deferred to DOMContentLoaded: the wrapper must exist and
+  // textually precede the row query it defers.
+  const dclIdx = filterBarScript.indexOf("addEventListener('DOMContentLoaded'");
+  ok(dclIdx !== -1 && dclIdx < filterBarScript.indexOf("querySelectorAll('[data-mfb-row]')"), "filter bar: row lookup is deferred to DOMContentLoaded, not run at parse time");
 }
 
 // Roster rows carry the numeric data-* payload the filter bar script sorts on
@@ -247,7 +253,7 @@ for (const c of NEW_CHAINS) {
   const many = Array.from({ length: 14 }, (_, i) => ({ origin: `https://e${i}.example`, displayName: `E${i}`, homepage: `https://e${i}.example`, local: false, toolCount: i, routable: true, networks: ["eip155:8453"], payToByNetwork: {} }));
   const chainHtml = marketPage("base", "https://agent402.tools", { snapshot: { sellers: [LOCAL, ...many] }, rail: null, activity: null, wallet: "0x1" });
   ok(/<a [^>]*data-mfb-row data-local="0" data-health="1"[^>]*data-tools="13"/.test(chainHtml), "chain view: compact roster rows carry the same data-* payload");
-  ok(chainHtml.includes("select[data-mfb-sort]"), "chain view: filter-bar wiring script is emitted on per-chain pages too");
+  ok(chainHtml.includes('<script src="/js/market-filter-bar.js"></script>'), "chain view: filter-bar wiring script is emitted on per-chain pages too");
 }
 
 // Roster row cap (speed P0) — the all-chains roster renders at most
diff --git a/scripts/test-mcp-find-latest-version.js b/scripts/test-mcp-find-latest-version.js
new file mode 100644
index 00000000..4aaaee5c
--- /dev/null
+++ b/scripts/test-mcp-find-latest-version.js
@@ -0,0 +1,59 @@
+// Offline test for scripts/mcp-find-latest-version.js — the helper the
+// publish job in deploy.yml pipes the MCP Registry's search response
+// through, right before publishing, to capture which version is ABOUT to
+// become stale so it can be deprecated right after the new one goes live.
+// Drives the real CLI script via child_process + stdin, not a re-import of
+// its logic, since the script IS the interface (deploy.yml pipes into it).
+//
+//   node scripts/test-mcp-find-latest-version.js
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+const SCRIPT = join(dirname(fileURLToPath(import.meta.url)), "mcp-find-latest-version.js");
+
+let pass = 0, fail = 0;
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
+
+function run(input) {
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, [SCRIPT]);
+    let out = "";
+    child.stdout.on("data", (d) => { out += d; });
+    child.on("close", () => resolve(out));
+    child.stdin.write(input);
+    child.stdin.end();
+  });
+}
+
+const FIXTURE = JSON.stringify({
+  servers: [
+    { server: { version: "0.10.0" }, _meta: { "io.modelcontextprotocol.registry/official": { isLatest: false } } },
+    { server: { version: "0.11.0" }, _meta: { "io.modelcontextprotocol.registry/official": { isLatest: false } } },
+    { server: { version: "0.12.5" }, _meta: { "io.modelcontextprotocol.registry/official": { isLatest: true } } },
+  ],
+});
+
+const NO_LATEST = JSON.stringify({
+  servers: [
+    { server: { version: "0.10.0" }, _meta: { "io.modelcontextprotocol.registry/official": { isLatest: false } } },
+  ],
+});
+
+const out1 = await run(FIXTURE);
+ok(out1 === "0.12.5", `finds the isLatest:true row's version (got "${out1}")`);
+
+const out2 = await run(NO_LATEST);
+ok(out2 === "", `no row is isLatest -> empty output, not a crash (got "${out2}")`);
+
+const out3 = await run("{}");
+ok(out3 === "", "empty servers list -> empty output");
+
+const out4 = await run("not json at all");
+ok(out4 === "", "unparseable input -> empty output, never a throw (the caller treats blank as 'nothing to deprecate')");
+
+const out5 = await run("");
+ok(out5 === "", "empty stdin -> empty output");
+
+console.log(`\n${fail ? "FAILED" : "OK"}: ${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/scripts/test-mpp-shim-mppx-registry.js b/scripts/test-mpp-shim-mppx-registry.js
new file mode 100644
index 00000000..5ac92410
--- /dev/null
+++ b/scripts/test-mpp-shim-mppx-registry.js
@@ -0,0 +1,46 @@
+// Locks the MPP_CHALLENGE_NETWORKS default (2026-08-16 audit) against the
+// INSTALLED mppx package rather than trusting a code comment. The claim in
+// src/mpp-shim.js is: "a stock mppx client can only natively sign assets in
+// its built-in registry (Base + Celo mainnets)" - that used to be an
+// unverified assertion. This test reads mppx's real exported Chains/Assets
+// and asserts our DEFAULT_CHALLENGE_CHAIN_IDS ({8453, 42220}) is EXACTLY the
+// set of mainnet chain ids mppx has a known USDC/USDT asset for - no more,
+// no fewer.
+//
+// This is a drift guard, not a one-time check: a future mppx version bump
+// that adds a new mainnet to its registry (their roadmap could add one) SHOULD
+// fail this test, prompting a deliberate review of whether
+// DEFAULT_CHALLENGE_CHAIN_IDS needs to grow with it - silently missing that
+// would mean stock clients on the new chain never get offered an MPP
+// challenge even though they could pay one.
+//
+//   node scripts/test-mpp-shim-mppx-registry.js
+import { Chains, Assets } from "mppx/evm";
+import { challengeEnabledForChain } from "../src/mpp-shim.js";
+
+let pass = 0, fail = 0;
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
+
+// Which of mppx's known chain ids are MAINNETS (name doesn't contain "Sepolia").
+const mppxMainnetChainIds = Object.entries(Chains)
+  .filter(([name]) => !/sepolia/i.test(name))
+  .map(([, id]) => id);
+
+ok(mppxMainnetChainIds.length > 0, "mppx exports at least one mainnet chain id");
+// Calls the REAL production function (no MPP_CHALLENGE_NETWORKS env set, so
+// this exercises the actual default, not a value duplicated in this file).
+ok(mppxMainnetChainIds.every((id) => challengeEnabledForChain(id)), `challengeEnabledForChain() (real default) is true for every mppx mainnet (${mppxMainnetChainIds.join(",")})`);
+// A chain mppx does NOT know natively (Polygon) must stay OFF by default -
+// proves the default doesn't just always return true.
+ok(!challengeEnabledForChain(137), "challengeEnabledForChain() (real default) is false for a chain mppx has no known asset for (Polygon, 137)");
+
+// Assets registry: each of those mainnets must actually have a known USDC
+// asset (a mainnet chain id with no asset would be pointless to challenge —
+// a stock client has nothing to sign against it even though the chain id exists).
+const assetGroupForChainId = (chainId) => Object.values(Assets).find((v) => v && typeof v === "object" && v.USDC?.network === `eip155:${chainId}`);
+for (const id of mppxMainnetChainIds) {
+  ok(!!assetGroupForChainId(id), `mppx has a known USDC asset for mainnet chain ${id}`);
+}
+
+console.log(`\n${fail ? "FAILED" : "OK"}: ${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/scripts/test-openapi-header-params.js b/scripts/test-openapi-header-params.js
new file mode 100644
index 00000000..526ae5be
--- /dev/null
+++ b/scripts/test-openapi-header-params.js
@@ -0,0 +1,81 @@
+// Locks the openapi.json header-parameter fix (2026-08-16 audit): every
+// operation's `parameters` only ever declared query/path params (GET) or
+// requestBody (POST) - the two headers every catalog tool actually accepts,
+// X-Pow-Solution (free-tier PoW alternative to x402 payment) and
+// Idempotency-Key (safe-retry dedup), were real and documented in prose
+// (/docs, /llms.txt, quickstart) but invisible to any OpenAPI-driven client
+// (Postman, codegen, an agent framework reading the spec instead of prose).
+//
+// This boots FREE_MODE, fetches /openapi.json, and asserts:
+//   1. Idempotency-Key is declared as `in: header` on every operation sampled.
+//   2. X-Pow-Solution is declared on PoW-eligible (non-wallet-only) tools.
+//   3. X-Pow-Solution is ABSENT on a known wallet-only tool (memory) - PoW
+//      cannot pay for it, so advertising the header there would mislead a
+//      codegen client into thinking it has a free-tier option that doesn't
+//      exist.
+//   4. Neither header is ever marked `required` (both are optional).
+//
+//   node scripts/test-openapi-header-params.js
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
+const PORT = 3097;
+const BASE = `http://localhost:${PORT}`;
+
+let pass = 0;
+const fail = (m) => { console.error("FAIL:", m); try { proc.kill("SIGKILL"); } catch {} process.exit(1); };
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else fail(m); };
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+const proc = spawn(process.execPath, [join(ROOT, "src", "server.js")], {
+  cwd: ROOT,
+  env: { ...process.env, FREE_MODE: "true", PORT: String(PORT), X402_SYNC_ON_START: "false" },
+  stdio: "ignore",
+});
+
+try {
+  for (let i = 0; i < 40; i++) { try { if ((await fetch(`${BASE}/health`)).ok) break; } catch {} await sleep(500); }
+
+  const spec = await (await fetch(`${BASE}/openapi.json`)).json();
+  const pricing = await (await fetch(`${BASE}/api/pricing`)).json();
+  const catalog = pricing.endpoints || [];
+  ok(catalog.length > 0, "catalog is non-empty");
+
+  const opFor = (path) => Object.values(spec.paths[path] || {})[0];
+  const paramNamed = (op, name) => (op?.parameters || []).find((p) => p.name === name);
+
+  let idemDeclared = 0, idemOptional = 0;
+  for (const tool of catalog.slice(0, 30)) {
+    const op = opFor(tool.path);
+    const p = paramNamed(op, "Idempotency-Key");
+    if (p && p.in === "header") idemDeclared++;
+    if (p && p.required !== true) idemOptional++;
+  }
+  ok(idemDeclared === 30, `Idempotency-Key declared as in:header on first 30 tools (got ${idemDeclared}/30)`);
+  ok(idemOptional === 30, `Idempotency-Key is never required (got ${idemOptional}/30 optional)`);
+
+  // hash is a well-known PoW-eligible (compute-payable) tool.
+  const hashOp = opFor("/api/hash");
+  const powParam = paramNamed(hashOp, "X-Pow-Solution");
+  ok(!!powParam, "X-Pow-Solution declared on a PoW-eligible tool (hash)");
+  ok(powParam?.in === "header", "X-Pow-Solution is in:header");
+  ok(powParam?.required !== true, "X-Pow-Solution is not required (x402 payment is the alternative)");
+
+  // memory is wallet-only (payment = identity) - PoW must never be advertised.
+  const memoryTool = catalog.find((t) => t.slug === "memory-get" || t.path === "/api/memory");
+  if (memoryTool) {
+    const memOp = opFor(memoryTool.path);
+    ok(!paramNamed(memOp, "X-Pow-Solution"), "X-Pow-Solution is ABSENT on a wallet-only tool (memory)");
+  } else {
+    ok(false, "found a wallet-only tool (memory) in the live catalog to check against");
+  }
+
+  proc.kill("SIGKILL");
+} catch (e) {
+  fail(e?.message || String(e));
+}
+
+console.log(`\nOK: ${pass} passed`);
+process.exit(0);
diff --git a/scripts/test-operator-revenue-visibility.js b/scripts/test-operator-revenue-visibility.js
new file mode 100644
index 00000000..378d617a
--- /dev/null
+++ b/scripts/test-operator-revenue-visibility.js
@@ -0,0 +1,83 @@
+// Locks two 2026-08-16 audit fixes to the operator dashboard, offline (calls
+// getOperatorBreakdown/operatorPage directly, no server boot):
+//
+//   1. "Ops-cost-vs-revenue visibility for rails with zero external revenue":
+//      viaUSDCByNetwork only ever carries a key for a rail that has settled
+//      at least once, so a configured-but-unused rail is invisible by
+//      omission, not flagged. getOperatorBreakdown() now takes an
+//      `offeredNetworks` list and returns `railBreakdown`, an explicit row
+//      per offered rail (settledCalls, zero or not) — cross-referencing what
+//      we're PAYING to maintain (facilitator config, canary legs, tests)
+//      against what it has ever earned.
+//   2. "Top tools by revenue view (call-volume ≠ revenue proxy)": the
+//      per-tool table already carried both `calls` and `revenueUsd`, but
+//      only ever sorted by calls by default — operatorPage() now renders a
+//      standalone top-5-by-revenue list alongside top-5-by-calls so the two
+//      leaderboards are visible without clicking a column header.
+//
+//   node scripts/test-operator-revenue-visibility.js
+import { getOperatorBreakdown } from "../src/stats.js";
+import { operatorPage } from "../src/operator.js";
+
+let pass = 0, fail = 0;
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
+
+// --- 1. railBreakdown ---
+const dataNoNetworks = getOperatorBreakdown({ prices: {}, walletOnlySet: new Set() });
+ok(Array.isArray(dataNoNetworks.railBreakdown) && dataNoNetworks.railBreakdown.length === 0,
+  "no offeredNetworks passed → railBreakdown is an empty array, not undefined");
+
+// "base"/"polygon"/"solana" are REAL production counter keys and this reads
+// the actual shared stats DB — in CI, other test steps in the same job
+// legitimately settle real USDC on "base" before this step runs, so
+// settledCalls for those cannot be asserted as exactly 0 here (that's a
+// process-shared resource, not a fixture). Use one fake network name that
+// can never collide with a real CAIP2_NAMES value for the "reports 0, never
+// undefined" behavior, and keep "robinhood" only for its name-preservation
+// check below (asserted on shape, not count).
+const offered = ["base", "polygon", "solana", "robinhood", "__test_fake_network_zzz__"];
+const dataWithNetworks = getOperatorBreakdown({ prices: {}, walletOnlySet: new Set(), offeredNetworks: offered });
+ok(dataWithNetworks.railBreakdown.length === offered.length,
+  `railBreakdown has one row per offered network (got ${dataWithNetworks.railBreakdown.length}, expected ${offered.length})`);
+ok(offered.every((n) => dataWithNetworks.railBreakdown.some((r) => r.network === n)),
+  "every offered network appears in railBreakdown by name");
+ok(dataWithNetworks.railBreakdown.every((r) => Number.isInteger(r.settledCalls) && r.settledCalls >= 0),
+  "every row's settledCalls is a non-negative integer, never absent/undefined/NaN");
+const fakeRow = dataWithNetworks.railBreakdown.find((r) => r.network === "__test_fake_network_zzz__");
+ok(fakeRow?.settledCalls === 0, "a network that has never settled anything reports settledCalls:0 exactly");
+
+// robinhood settles USDG, booked under the display name "robinhood (USDG)" in
+// viaUSDCByNetwork (see CAIP2_NAMES) — the offered-network row must still key
+// off the plain "robinhood" name a human/operator recognizes from PAYMENT_NETWORKS.
+const robRow = dataWithNetworks.railBreakdown.find((r) => r.network === "robinhood");
+ok(!!robRow && robRow.network === "robinhood", "robinhood keeps its plain PAYMENT_NETWORKS name in railBreakdown, not the display-only \"(USDG)\" suffix");
+
+// --- 2. operatorPage renders both leaderboards ---
+const sampleData = {
+  totals: { total: 10, viaUSDC: 8, viaProofOfWork: 2, viaHeartbeat: 0, viaUSDCByNetwork: {}, estimatedRevenueUsd: 3.8, toolsServed: 2 },
+  railBreakdown: [{ network: "base", settledCalls: 100 }, { network: "monad", settledCalls: 0 }],
+  tools: [
+    { slug: "route-execute-pro", calls: 1, paid: 1, pow: 0, heartbeat: 0, revenueUsd: 3.3, pricePerCall: 3.3, walletOnly: false },
+    { slug: "hash", calls: 500, paid: 500, pow: 0, heartbeat: 0, revenueUsd: 0.5, pricePerCall: 0.001, walletOnly: false },
+  ],
+  recentCalls: [],
+  processUptimeSeconds: 60,
+};
+const html = operatorPage("https://agent402.tools", sampleData);
+ok(html.includes("route-execute-pro") && html.includes("$3.3000"),
+  "the high-price low-volume tool appears with its real revenue in the by-revenue list");
+ok(html.includes("Top by revenue vs top by calls"), "the panel title is present");
+ok(html.includes("Rails offered vs settled"), "the rails panel title is present");
+ok(html.includes("ZERO REVENUE") && html.includes("monad"),
+  "a zero-settled offered rail (monad) is flagged ZERO REVENUE");
+const baseRow = html.match(/<tr><td>base<\/td>.*?<\/tr>/)?.[0] || "";
+ok(baseRow.length > 0 && !baseRow.includes("ZERO REVENUE"),
+  "a settled rail (base, 100 calls) is NOT flagged ZERO REVENUE");
+
+// Empty-state fallbacks must never crash on a cold-boot server (no calls yet).
+const coldHtml = operatorPage("https://agent402.tools", { totals: {}, railBreakdown: [], tools: [], recentCalls: [] });
+ok(coldHtml.includes("No data yet."), "cold-boot (no tool calls) renders a 'No data yet.' fallback, not a crash/blank");
+ok(coldHtml.includes("No configured rails."), "cold-boot with no offered networks renders a 'No configured rails.' fallback");
+
+console.log(`\n${fail ? "FAILED" : "OK"}: ${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/scripts/test-reliability-envelope.js b/scripts/test-reliability-envelope.js
index 64020b51..aa738c39 100644
--- a/scripts/test-reliability-envelope.js
+++ b/scripts/test-reliability-envelope.js
@@ -8,11 +8,11 @@
 // This test boots FREE_MODE and locks:
 //
 //   1. GET /api/reliability → 200 application/json.
-//   2. Envelope: { service, status, asOf, servingSince, uptimeSeconds,
+//   2. Envelope: { service, status, asOf, servingSince, processUptimeSeconds,
 //      toolCallsServed, onchain{}, guarantees[], endpoints{}, incidents }.
 //   3. service === 'Agent402.Tools', status === 'operational' (a 200 by definition
 //      means the node is serving — the field documents that contract).
-//   4. asOf parses as ISO; uptimeSeconds and toolCallsServed are numbers.
+//   4. asOf parses as ISO; processUptimeSeconds and toolCallsServed are numbers.
 //   5. onchain has revenueProof URL (or null in FREE_MODE) + a note.
 //   6. guarantees[] is non-empty AND every entry has `claim` + `verify` —
 //      the verify URL is the trustless half of every claim.
@@ -48,7 +48,7 @@ try {
   const body = await res.json();
 
   // Envelope shape.
-  for (const k of ["service", "status", "asOf", "servingSince", "uptimeSeconds", "toolCallsServed", "onchain", "guarantees", "endpoints", "incidents"]) {
+  for (const k of ["service", "status", "asOf", "servingSince", "processUptimeSeconds", "toolCallsServed", "onchain", "guarantees", "endpoints", "incidents"]) {
     ok(k in body, `envelope key '${k}' present (got: ${Object.keys(body).join(",")})`);
   }
   ok(body.service === "Agent402.Tools", `service='Agent402.Tools' (got ${body.service})`);
@@ -57,7 +57,11 @@ try {
   ok(body.status === "operational", `status='operational' (got ${body.status}) — a 200 here documents node liveness`);
   ok(typeof body.asOf === "string" && !isNaN(Date.parse(body.asOf)), `asOf is parseable ISO (got ${body.asOf})`);
   ok(typeof body.servingSince === "string", `servingSince is string (got ${typeof body.servingSince})`);
-  ok(typeof body.uptimeSeconds === "number" && body.uptimeSeconds >= 0, `uptimeSeconds is non-negative number (got ${body.uptimeSeconds})`);
+  ok(typeof body.processUptimeSeconds === "number" && body.processUptimeSeconds >= 0, `processUptimeSeconds is non-negative number (got ${body.processUptimeSeconds})`);
+  // Locks the 2026-08-16 rename: the old key name read as a reliability
+  // claim sitting right next to servingSince (a real ~2-month figure), when
+  // it actually resets to 0 on every deploy - never let it silently return.
+  ok(!("uptimeSeconds" in body), "the old 'uptimeSeconds' key name is gone (misreadable as service-availability uptime)");
   // toolCallsServed is the structured tally: total + breakdown by payment
   // path. The breakdown is what's interesting — viaUSDC vs viaProofOfWork
   // tells a portal which tier dominates traffic.
diff --git a/scripts/test-replay-guard-redis.js b/scripts/test-replay-guard-redis.js
new file mode 100644
index 00000000..fdabebaa
--- /dev/null
+++ b/scripts/test-replay-guard-redis.js
@@ -0,0 +1,138 @@
+#!/usr/bin/env node
+// Exercise the REAL Redis-backed replay guard against a REAL redis server.
+//
+//   REDIS_URL=redis://127.0.0.1:6379 node scripts/test-replay-guard-redis.js
+//
+// WHY THIS EXISTS (2026-08-16). test-replay-guard.js proves the guard's STATE
+// MACHINE (concurrent/sequential replay refused, release-on-failure, TTL,
+// eviction) entirely against the per-process fallback - it never sets
+// REDIS_URL, so it can never prove the property the Redis backing exists for:
+// that TWO SEPARATE createReplayGuard() instances (standing in for two app
+// replicas) sharing one Redis actually behave like ONE shared guard. A stub
+// client would only prove "the code calls set/get/del", the same shallow
+// coverage this repo has been burned by before (see test-redis-integration.js's
+// own header) - this drives the real client against a real server instead.
+//
+// Deliberately does not skip when REDIS_URL is unset: a skipped integration
+// test is how the cross-replica gap this guard now closes went uncaught for
+// as long as it did.
+if (!process.env.REDIS_URL) {
+  console.error("FAIL: REDIS_URL is not set. This test needs a real redis (CI provides a service container).");
+  console.error("      It deliberately does not skip - see the header comment.");
+  process.exit(1);
+}
+
+const { createReplayGuard, paymentReplayKey } = await import("../src/replay-guard.js");
+const { getSharedRedisClient, __setTestClient } = await import("../src/shared-limit.js");
+
+let pass = 0, fail = 0;
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
+
+const client = await getSharedRedisClient();
+if (!client) { console.error("FAIL: could not reach redis at", process.env.REDIS_URL); process.exit(1); }
+
+// Unique key prefix per run so repeated local runs never collide with leftover state.
+const runId = `t${Date.now()}${Math.floor(Math.random() * 1e6) || 1}`;
+const key = (suffix) => `replay-guard-redis-test:${runId}:${suffix}`;
+
+// --- 1. Two independent guard instances = two "replicas" -------------------
+// Neither instance's local Map/Set is shared - if the guard were still
+// per-process, guardB would see nothing guardA claimed. It must, because
+// both share the SAME Redis connection under the hood.
+{
+  const guardA = createReplayGuard();
+  const guardB = createReplayGuard();
+  const k = key("cross-replica");
+
+  const first = await guardA.begin(k);
+  ok(first === "ok", `replica A claims a fresh nonce (got "${first}")`);
+
+  const second = await guardB.begin(k);
+  ok(second === "inflight", `replica B sees it as in-flight, NOT "ok" (got "${second}") — proves cross-replica sharing`);
+
+  await guardA.settle(k);
+  const third = await guardB.begin(k);
+  ok(third === "consumed", `after A settles, B sees it as consumed (got "${third}") — settlement is visible cross-replica`);
+}
+
+// --- 2. Release is also cross-replica visible -------------------------------
+{
+  const guardA = createReplayGuard();
+  const guardB = createReplayGuard();
+  const k = key("cross-release");
+
+  await guardA.begin(k);
+  await guardA.release(k); // e.g. facilitator rejected settlement
+  const retried = await guardB.begin(k);
+  ok(retried === "ok", `after A releases, B can claim the SAME nonce fresh (got "${retried}") — release-on-failure works cross-replica`);
+}
+
+// --- 3. The in-flight claim carries a real TTL (self-heals a crashed replica) ---
+{
+  const k = key("ttl-check");
+  const guard = createReplayGuard();
+  await guard.begin(k);
+  const ttl = await client.ttl(`replay:f:${k}`);
+  ok(ttl > 0 && ttl <= 120, `the in-flight Redis key carries a bounded TTL (got ${ttl}s, expect 0 < ttl <= 120)`);
+  await guard.release(k);
+}
+
+// --- 4. The consumed marker's TTL matches the guard's configured ttlMs -------
+{
+  const k = key("consumed-ttl");
+  const guard = createReplayGuard({ ttlMs: 5000 }); // 5s
+  await guard.begin(k);
+  await guard.settle(k);
+  const ttl = await client.ttl(`replay:c:${k}`);
+  ok(ttl > 0 && ttl <= 5, `the consumed Redis key's TTL matches ttlMs (got ${ttl}s, expect 0 < ttl <= 5)`);
+}
+
+// --- 5. Full paymentReplayKey() -> guard round trip, matching server.js's
+// real usage shape (not a synthetic string key). ----------------------------
+{
+  const guardA = createReplayGuard();
+  const guardB = createReplayGuard();
+  const fakeReq = (cred) => ({ header: (n) => (String(n).toLowerCase() === "x-payment" ? cred : undefined) });
+  const cred = Buffer.from(JSON.stringify({
+    network: "eip155:8453",
+    payload: { authorization: { nonce: `0x${runId}`, from: "0x" + "1".repeat(40) } },
+  })).toString("base64");
+  const rk = paymentReplayKey(fakeReq(cred));
+  ok(typeof rk === "string" && rk.startsWith("n:"), "paymentReplayKey() extracts a real nonce-scoped key from an x402 credential");
+
+  ok(await guardA.begin(rk) === "ok", "real payment-credential key: replica A claims it");
+  ok(await guardB.begin(rk) === "inflight", "real payment-credential key: replica B sees inflight");
+  await guardA.settle(rk);
+}
+
+// --- 6. Fails OPEN to local state when Redis throws (not closed, not a crash) --
+// A rejected paid call over an optimization layer going dark would be the
+// wrong direction for THIS guard (see the fail-open rationale in
+// replay-guard.js's header) - the real chain-level nonce protection holds
+// regardless. Injects a broken client via shared-limit.js's own test seam
+// (the same one test-shared-limit.js uses) so this doesn't need a second,
+// duplicate connection-mocking mechanism.
+{
+  const broken = {
+    get: async () => { throw new Error("simulated redis outage"); },
+    set: async () => { throw new Error("simulated redis outage"); },
+    del: async () => { throw new Error("simulated redis outage"); },
+  };
+  __setTestClient(broken);
+  try {
+    const g = createReplayGuard();
+    const k = "outage-test";
+    const r1 = await g.begin(k);
+    ok(r1 === "ok", `begin() during a redis outage still resolves (not a throw/hang) — falls back to local state (got "${r1}")`);
+    const r2 = await g.begin(k);
+    ok(r2 === "inflight", `local-state fallback still enforces the concurrent-replay rule during the outage (got "${r2}")`);
+    await g.settle(k);
+    const r3 = await g.begin(k);
+    ok(r3 === "consumed", `local-state fallback still enforces sequential-replay after settle during the outage (got "${r3}")`);
+  } finally {
+    __setTestClient(null); // restore the real client for anything after this
+  }
+}
+
+console.log(`\n${fail ? "FAILED" : "OK"}: ${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/scripts/test-replay-guard.js b/scripts/test-replay-guard.js
index 0c192f23..7daa75df 100644
--- a/scripts/test-replay-guard.js
+++ b/scripts/test-replay-guard.js
@@ -54,37 +54,38 @@ function evmCred({ network = "eip155:8453", nonce = "0xabc", from = "0x" + "1".r
   ok(o1 && o1 === o2 && o1.startsWith("c:"), "unparseable credential → stable raw-hash identity");
 }
 
-// ---- A2. Guard state machine -------------------------------------------------
+// ---- A2. Guard state machine (local fallback path — no REDIS_URL in this
+// process, so every call below exercises the per-process Map/Set) -----------
 {
   const g = createReplayGuard();
   const k = "n:test";
-  ok(g.begin(k) === "ok", "first use → ok");
-  ok(g.begin(k) === "inflight", "concurrent duplicate (still in flight) → inflight");
-  g.settle(k);
-  ok(g.begin(k) === "consumed", "after settle, replay → consumed");
+  ok(await g.begin(k) === "ok", "first use → ok");
+  ok(await g.begin(k) === "inflight", "concurrent duplicate (still in flight) → inflight");
+  await g.settle(k);
+  ok(await g.begin(k) === "consumed", "after settle, replay → consumed");
   ok(g._state().consumed === 1 && g._state().inFlight === 0, "state: 1 consumed, 0 in flight");
 }
 {
   const g = createReplayGuard();
   const k = "n:retry";
-  ok(g.begin(k) === "ok", "first attempt → ok");
-  g.release(k); // gated call was NOT granted (e.g. settle failed)
-  ok(g.begin(k) === "ok", "release-on-failure → same authorization may retry");
+  ok(await g.begin(k) === "ok", "first attempt → ok");
+  await g.release(k); // gated call was NOT granted (e.g. settle failed)
+  ok(await g.begin(k) === "ok", "release-on-failure → same authorization may retry");
   ok(g._state().inFlight === 1 && g._state().consumed === 0, "retry is in flight, nothing consumed yet");
 }
 {
   // TTL expiry: a consumed nonce older than ttl is pruned, freeing the key.
   const g = createReplayGuard({ ttlMs: 1000 });
   const k = "n:ttl";
-  g.begin(k, 0);
-  g.settle(k, 0);
-  ok(g.begin(k, 500) === "consumed", "within TTL → still consumed");
-  ok(g.begin(k, 5000) === "ok", "past TTL → pruned, key reusable (safe: on-chain nonce still dead)");
+  await g.begin(k, 0);
+  await g.settle(k, 0);
+  ok(await g.begin(k, 500) === "consumed", "within TTL → still consumed");
+  ok(await g.begin(k, 5000) === "ok", "past TTL → pruned, key reusable (safe: on-chain nonce still dead)");
 }
 {
   // FIFO eviction keeps memory bounded; eviction is always safe.
   const g = createReplayGuard({ maxEntries: 3 });
-  for (let i = 0; i < 5; i++) { g.begin(`k${i}`); g.settle(`k${i}`); }
+  for (let i = 0; i < 5; i++) { await g.begin(`k${i}`); await g.settle(`k${i}`); }
   ok(g._state().consumed <= 3, `consumed capped at maxEntries (got ${g._state().consumed})`);
 }
 
@@ -95,16 +96,16 @@ function buildApp({ grant }) {
   const app = express();
   const guard = createReplayGuard();
   let handlerCalls = 0;
-  app.use((req, res, next) => {
+  app.use(async (req, res, next) => {
     const key = paymentReplayKey(req);
     if (key) {
-      const verdict = guard.begin(key);
+      const verdict = await guard.begin(key);
       if (verdict !== "ok") {
         res.setHeader("X-Payment-Replay", verdict);
         return res.status(409).json({ error: "replay", reason: verdict });
       }
       let resolved = false;
-      const fin = () => { if (resolved) return; resolved = true; if (res.statusCode === 200) guard.settle(key); else guard.release(key); };
+      const fin = () => { if (resolved) return; resolved = true; if (res.statusCode === 200) guard.settle(key).catch(() => {}); else guard.release(key).catch(() => {}); };
       res.on("finish", fin);
       res.on("close", fin);
     }
diff --git a/scripts/test-reveal-coverage.js b/scripts/test-reveal-coverage.js
index d35ddfae..f756dcf3 100644
--- a/scripts/test-reveal-coverage.js
+++ b/scripts/test-reveal-coverage.js
@@ -30,7 +30,10 @@ let pass = 0, fail = 0;
 const ok = (cond, msg) => { if (cond) { pass++; console.log(`ok - ${msg}`); } else { fail++; console.error(`FAIL - ${msg}`); } };
 
 // --- the shared script's selector must stay broad, not opt-in-only --------
-const chromeSrc = readFileSync(join(ROOT, "src", "ledger-chrome.js"), "utf8");
+// Lives in assets/js/site-chrome.js (external file, CSP hardening,
+// 2026-08-16) - was inline in src/ledger-chrome.js's shared <head> script
+// before that.
+const chromeSrc = readFileSync(join(ROOT, "assets", "js", "site-chrome.js"), "utf8");
 ok(/querySelectorAll\('header,section,\[data-reveal\]'\)/.test(chromeSrc),
   "shared reveal-on-scroll observer selects header/section site-wide, not just [data-reveal] opt-ins");
 
@@ -39,19 +42,28 @@ ok(/querySelectorAll\('header,section,\[data-reveal\]'\)/.test(chromeSrc),
 // a partial regression (one section quietly reverting to a <div>, not the
 // whole page) still fails instead of hiding behind the sections that
 // weren't touched. Bumping a number here is expected and fine when a page
-// legitimately gains/loses a section; a silent drop is what this catches. */
+// legitimately gains/loses a section; a silent drop is what this catches.
+//
+// Script tags are stripped before counting: this reveal-on-scroll script's
+// OWN explanatory comments used to mention the literal substrings
+// "<section>" and "<header " while it was inline on every page (via
+// ledger-chrome.js's shared <head> script), which the naive regex below
+// counted as real elements - inflating every single page's count by
+// exactly 2 and hiding behind it since the floors were calibrated against
+// that inflated number. Externalizing the script (CSP hardening,
+// 2026-08-16) correctly dropped those two per-page phantom matches, and the
+// floors below are recalibrated against the TRUE element count so this
+// test measures the same "real elements" it always claimed to. */
 const MIN_SECTIONS = {
-  "/": 10, "/base": 5, "/marketplace": 8, "/pricing": 7, "/leaderboard": 6, "/skills": 7, "/tools": 5, "/what-is-x402": 11, "/sell": 10,
-  // Extended 2026-08-15: these 18 pages were <div>-only (zero real sections,
-  // zero reveal-on-scroll effect) until this pass gave each one real
-  // <section>/<header> markup for the shared observer to reach.
-  "/docs": 7, "/status": 5, "/faq": 3, "/revenue": 5, "/playground": 3, "/badges": 4, "/compare": 7, "/community": 7,
-  "/changelog": 3, "/blog": 3, "/transparency": 3, "/privacy": 3, "/terms": 3, "/contact": 4, "/analytics": 4,
-  "/workflows": 4, "/quickstart": 4, "/guides": 3,
+  "/": 9, "/base": 4, "/marketplace": 7, "/pricing": 6, "/leaderboard": 5, "/skills": 6, "/tools": 4, "/what-is-x402": 10, "/sell": 9,
+  "/docs": 6, "/status": 4, "/faq": 2, "/revenue": 4, "/playground": 2, "/badges": 3, "/compare": 6, "/community": 6,
+  "/changelog": 2, "/blog": 2, "/transparency": 2, "/privacy": 2, "/terms": 2, "/contact": 3, "/analytics": 3,
+  "/workflows": 3, "/quickstart": 3, "/guides": 2,
 };
 for (const [path, min] of Object.entries(MIN_SECTIONS)) {
   const html = await (await fetch(`${BASE}${path}`)).text();
-  const realSectionCount = (html.match(/<section[ >]/g) || []).length + (html.match(/<header[ >]/g) || []).length;
+  const stripped = html.replace(/<script[\s\S]*?<\/script>/gi, "");
+  const realSectionCount = (stripped.match(/<section[ >]/g) || []).length + (stripped.match(/<header[ >]/g) || []).length;
   ok(realSectionCount >= min, `${path}: has at least ${min} real <section>/<header> elements to reveal (got ${realSectionCount})`);
 }
 
diff --git a/scripts/test-reveal-eager.js b/scripts/test-reveal-eager.js
new file mode 100644
index 00000000..c505be80
--- /dev/null
+++ b/scripts/test-reveal-eager.js
@@ -0,0 +1,73 @@
+// Locks the data-reveal-eager opt-in (2026-08-16 audit): the hero-flash fix
+// only ever exempted the FIRST matched header/section from the reveal-on-
+// scroll hide-then-observe cycle. Some pages have a SECOND section that's
+// also reliably above the fold (found on /pricing - the tier cards sit
+// directly under a short hero) and got the same flash the hero fix already
+// solved for index 0. Rather than guessing "how many leading sections are
+// above the fold" generically - unsafe without a getBoundingClientRect read
+// before webfonts/map settle, and wrong on every page where the second
+// section really IS below the fold - this is an explicit, opt-in
+// [data-reveal-eager] marker a page sets on a specific section it knows is
+// always visible on load.
+//
+// Verified via a real browser (Playwright), not static source inspection -
+// the whole point is client-side class-application behavior at
+// DOMContentLoaded time.
+//
+// Requires a booted server (same TARGET_URL convention as other page tests):
+//   FREE_MODE=true PORT=3000 node src/server.js
+//   TARGET_URL=http://localhost:3000 node scripts/test-reveal-eager.js
+import { chromium } from "playwright";
+
+const BASE = process.env.TARGET_URL || "http://localhost:3000";
+let pass = 0, fail = 0;
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
+
+const browser = await chromium.launch();
+try {
+  const page = await browser.newPage();
+
+  // /pricing's second section is marked data-reveal-eager - must never get
+  // the hiding class at all, must render fully visible immediately.
+  await page.goto(`${BASE}/pricing`, { waitUntil: "domcontentloaded" });
+  const eager = await page.evaluate(() => {
+    const els = document.querySelectorAll("header,section,[data-reveal]");
+    const el = els[1];
+    return el ? { present: true, hasEagerAttr: el.hasAttribute("data-reveal-eager"), hasRevealClass: el.classList.contains("ml-reveal"), opacity: getComputedStyle(el).opacity } : { present: false };
+  });
+  ok(eager.present, "/pricing has a second header/section element to check");
+  ok(eager.hasEagerAttr, "/pricing's second section actually carries the data-reveal-eager marker (test isn't checking the wrong element)");
+  ok(!eager.hasRevealClass, "the eager-marked section never gets the ml-reveal hiding class");
+  ok(eager.opacity === "1", `the eager-marked section renders at full opacity immediately (got ${eager.opacity})`);
+
+  // A page whose second section is NOT marked eager must be completely
+  // unaffected - still gets the hiding class, still fades in on scroll.
+  // This is the regression this fix could most easily cause: exempting too
+  // much and quietly breaking the reveal effect for genuinely below-fold
+  // content everywhere else.
+  await page.goto(`${BASE}/marketplace`, { waitUntil: "domcontentloaded" });
+  const notMarked = await page.evaluate(() => {
+    const els = document.querySelectorAll("header,section,[data-reveal]");
+    const el = els[1];
+    return el ? { present: true, hasEagerAttr: el.hasAttribute("data-reveal-eager"), hasRevealClass: el.classList.contains("ml-reveal") } : { present: false };
+  });
+  ok(notMarked.present, "/marketplace has a second header/section element to check");
+  ok(!notMarked.hasEagerAttr, "/marketplace's second section is genuinely unmarked (test isn't accidentally checking a marked page)");
+  ok(notMarked.hasRevealClass, "an UNMARKED second section still gets the hiding class - the opt-in doesn't leak to pages that never asked for it");
+
+  // The hero (first match) must still be exempt exactly as before on both
+  // pages - this fix must not have disturbed the original hero-flash fix.
+  for (const path of ["/pricing", "/marketplace"]) {
+    await page.goto(`${BASE}${path}`, { waitUntil: "domcontentloaded" });
+    const hero = await page.evaluate(() => {
+      const el = document.querySelectorAll("header,section,[data-reveal]")[0];
+      return el ? el.classList.contains("ml-reveal") : null;
+    });
+    ok(hero === false, `${path}: the hero (first match) still never gets the hiding class`);
+  }
+} finally {
+  await browser.close();
+}
+
+console.log(`\n${fail ? "FAILED" : "OK"}: ${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/scripts/test-reveal-no-hero-flash.js b/scripts/test-reveal-no-hero-flash.js
index d605282f..e3acd10f 100644
--- a/scripts/test-reveal-no-hero-flash.js
+++ b/scripts/test-reveal-no-hero-flash.js
@@ -10,14 +10,16 @@
 // script in src/ledger-chrome.js for the full history and the deliberate
 // choice to key off DOM order rather than a getBoundingClientRect check.
 //
-// Offline - reads the source directly, no server needed.
+// Offline - reads the source directly, no server needed. CSP hardening
+// (2026-08-16) moved this script from an inline ledgerShell <script> into
+// assets/js/site-chrome.js.
 import { readFileSync } from "node:fs";
 
 let pass = 0, fail = 0;
 const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
 
-const src = readFileSync(new URL("../src/ledger-chrome.js", import.meta.url), "utf8");
-const scriptMatch = src.match(/document\.addEventListener\('DOMContentLoaded'[\s\S]*?<\/script>/);
+const src = readFileSync(new URL("../assets/js/site-chrome.js", import.meta.url), "utf8");
+const scriptMatch = src.match(/document\.addEventListener\('DOMContentLoaded'[\s\S]*?\}catch\(e\)\{\}\}\);/);
 ok(!!scriptMatch, "found the shared reveal-on-scroll DOMContentLoaded script block");
 const script = scriptMatch ? scriptMatch[0] : "";
 
diff --git a/scripts/test-reveal-on-scroll.js b/scripts/test-reveal-on-scroll.js
index be68d1f2..d0c67182 100644
--- a/scripts/test-reveal-on-scroll.js
+++ b/scripts/test-reveal-on-scroll.js
@@ -1,7 +1,11 @@
 // Reveal-on-scroll ([data-reveal] sections) — offline unit tests. No network,
-// no browser: string assertions on the inline script ledgerShell emits,
-// matching this repo's established pattern for validating inline-script
-// correctness structurally (see test-theme.js's a402ToggleMenu checks).
+// no browser: string assertions on the reveal-on-scroll script, matching
+// this repo's established pattern for validating script correctness
+// structurally (see test-theme.js's site-chrome.js checks). CSP hardening
+// (2026-08-16) moved this script out of ledgerShell's inline <script> into
+// assets/js/site-chrome.js - the CSS-hidden-state assertions still check the
+// page HTML (that part didn't move), but the script-behavior assertions now
+// read the external file directly.
 //
 // Real bug this locks in (found 2026-08-14 from a live mobile report - "some
 // screens go off screen while scrolling"): the observer used to TOGGLE
@@ -18,6 +22,7 @@
 // first callback reveals immediately regardless of whether removal exists).
 //
 //   node scripts/test-reveal-on-scroll.js
+import { readFileSync } from "node:fs";
 import { ledgerShell } from "../src/ledger-chrome.js";
 
 let pass = 0, fail = 0;
@@ -28,9 +33,11 @@ const html = ledgerShell({
   baseUrl: "https://agent402.tools", body: "<main>hi</main>",
 });
 
-const scriptMatch = html.match(/document\.addEventListener\('DOMContentLoaded',function\(\)\{try\{if\(window\.matchMedia[\s\S]*?data-reveal[\s\S]*?\}catch\(e\)\{\}\}\);/);
-ok(scriptMatch != null, "the reveal-on-scroll bootstrap script is present in every ledgerShell page");
-const src = scriptMatch ? scriptMatch[0] : "";
+ok(html.includes('<script src="/js/site-chrome.js">'),
+  "every ledgerShell page references the external site-chrome script carrying reveal-on-scroll");
+const src = readFileSync(new URL("../assets/js/site-chrome.js", import.meta.url), "utf8");
+const scriptMatch = /document\.addEventListener\('DOMContentLoaded',function\(\)\{try\{if\(window\.matchMedia[\s\S]*?data-reveal[\s\S]*?\}catch\(e\)\{\}\}\);/.test(src);
+ok(scriptMatch, "the reveal-on-scroll bootstrap script is present in site-chrome.js");
 
 // The exact regression: toggling ml-reveal-in with isIntersecting as the
 // second argument removes the class again once a section stops intersecting.
diff --git a/scripts/test-reveal-scroll-skip.js b/scripts/test-reveal-scroll-skip.js
new file mode 100644
index 00000000..7cdec0ac
--- /dev/null
+++ b/scripts/test-reveal-scroll-skip.js
@@ -0,0 +1,68 @@
+// Locks a real bug found live on /marketplace (2026-08-16, reported as "the
+// bottom part is missing the chain to select"): a single large scroll jump
+// (trackpad flick, End key, clicking the scrollbar track - all ordinary user
+// actions, not edge cases) can move a short <section> from below the
+// viewport to above it within one rendered frame. The IntersectionObserver
+// in ledger-chrome.js's reveal-on-scroll script never sees such a section
+// cross its 8% threshold, so it never gets .ml-reveal-in and stays at
+// opacity:0 FOREVER - proven by this test to be unrecoverable by further
+// normal scrolling too, since a never-intersected element is never
+// unobserved but also never re-checked.
+//
+// This can only be proven with a REAL browser reproducing the REAL scroll
+// behavior - a static regex check on the script source (see
+// test-reveal-on-scroll.js) can confirm the fix code exists but cannot prove
+// it actually un-sticks a skipped section, the same class of gap the CSS
+// `//`-comment bug taught this repo to distrust (source presence != runtime
+// correctness).
+//
+// Requires a booted server:
+//   FREE_MODE=true PORT=3000 node src/server.js
+//   TARGET_URL=http://localhost:3000 node scripts/test-reveal-scroll-skip.js
+import { chromium } from "playwright";
+
+const BASE = process.env.TARGET_URL || "http://localhost:3000";
+let pass = 0, fail = 0;
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
+
+const browser = await chromium.launch();
+try {
+  const page = await browser.newPage({ viewport: { width: 1440, height: 900 } });
+  await page.goto(`${BASE}/marketplace`, { waitUntil: "networkidle" });
+
+  const sectionCount = await page.locator("header,section,[data-reveal]").count();
+  ok(sectionCount >= 5, `/marketplace has enough sections to meaningfully test skip-over (got ${sectionCount})`);
+
+  // Reproduce the exact failure: one instant jump straight to the bottom,
+  // the same motion a trackpad flick or the End key produces.
+  await page.evaluate(() => window.scrollTo(0, document.body.scrollHeight));
+  await page.waitForTimeout(1000); // past the 150ms debounce and the 500ms fallback timer
+
+  const afterJump = await page.evaluate(() => {
+    const els = Array.from(document.querySelectorAll("header,section,[data-reveal]"));
+    return els.map((el) => getComputedStyle(el).opacity);
+  });
+  const stuckCount = afterJump.filter((o) => o !== "1").length;
+  ok(stuckCount === 0, `every section is visible after a single instant scroll-to-bottom (${stuckCount}/${afterJump.length} stuck at opacity!=1)`);
+
+  // The animation intent must survive the fix: a fresh load with NO scroll at
+  // all must still leave below-the-fold sections hidden, or the "safety net"
+  // would have degenerated into "reveal everything immediately," defeating
+  // the whole feature.
+  const page2 = await browser.newPage({ viewport: { width: 1440, height: 900 } });
+  await page2.goto(`${BASE}/marketplace`, { waitUntil: "networkidle" });
+  await page2.waitForTimeout(700); // past the 500ms fallback timer, still zero scroll
+  const noScrollState = await page2.evaluate(() => {
+    const els = Array.from(document.querySelectorAll("header,section,[data-reveal]"));
+    return els.map((el) => ({ top: el.getBoundingClientRect().top, revealed: getComputedStyle(el).opacity === "1" }));
+  });
+  const belowFold = noScrollState.filter((s) => s.top > 900);
+  ok(belowFold.length > 0, "sanity: /marketplace has sections genuinely below an ordinary fold to check");
+  ok(belowFold.every((s) => !s.revealed), `sections still below the fold with zero scrolling stay hidden - the fix must not force-reveal everything immediately (${belowFold.filter((s) => s.revealed).length}/${belowFold.length} prematurely revealed)`);
+  await page2.close();
+} finally {
+  await browser.close();
+}
+
+console.log(`\n${fail ? "FAILED" : "OK"}: ${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/scripts/test-revenue-chart.js b/scripts/test-revenue-chart.js
index a2299b7a..030725e0 100644
--- a/scripts/test-revenue-chart.js
+++ b/scripts/test-revenue-chart.js
@@ -14,9 +14,24 @@
 //
 // Runs the real page script in jsdom against stubbed endpoints.
 import { strict as assert } from "node:assert";
+import { readFileSync } from "node:fs";
 import { JSDOM } from "jsdom";
 import { revenueChartSection } from "../src/revenue-live.js";
 
+// CSP hardening (2026-08-16) moved the chart's IIFE out of an inline <script>
+// into assets/js/revenue-chart.js, referenced via <script src>. jsdom does
+// not fetch external script resources in this offline test (no server, no
+// resourceLoader configured) - so the real file's content is inlined back in
+// before parsing, exactly simulating what a browser does when it loads that
+// src. This keeps testing the REAL file (no drift risk from a copy) while
+// still running fully offline.
+const REVENUE_CHART_JS = readFileSync(new URL("../assets/js/revenue-chart.js", import.meta.url), "utf8");
+function inlineRevenueChartScript(html) {
+  const tag = '<script src="/js/revenue-chart.js"></script>';
+  if (!html.includes(tag)) throw new Error("revenueChartSection() no longer references /js/revenue-chart.js - did the src path change?");
+  return html.replace(tag, `<script>${REVENUE_CHART_JS}</script>`);
+}
+
 const REV_DAYS = [
   // Base day carries a SOR (spending-wallet-settled) subset: $0.50 of the $1.50.
   { day: "2026-06-20", chain: "base", extUsd: 1.5, intUsd: 0.2, extTx: 3, intTx: 1, extMppUsd: 0, intMppUsd: 0, extMppTx: 0, intMppTx: 0, extSorUsd: 0.5, extSorTx: 1, intSorUsd: 0, intSorTx: 0 },
@@ -43,7 +58,7 @@ const check = (name, fn) => {
 };
 
 async function boot({ freeFails = false } = {}) {
-  const html = `<!doctype html><html><body>${revenueChartSection()}</body></html>`;
+  const html = `<!doctype html><html><body>${inlineRevenueChartScript(revenueChartSection())}</body></html>`;
   // fetch must exist BEFORE the inline script runs, so the chart's own IIFE is
   // the one under test — re-evaluating it afterwards would double every
   // listener and make the segmented controls toggle twice per click.
diff --git a/scripts/test-sell-page.js b/scripts/test-sell-page.js
index 69f671b4..886f27ab 100644
--- a/scripts/test-sell-page.js
+++ b/scripts/test-sell-page.js
@@ -3,6 +3,7 @@
 // new design surfaces no free aggregate numbers on this page at all, only
 // static "what it costs you" copy and a lane-level teaser for the paid
 // /api/bestsellers + /api/demand-radar reads).
+import { readFileSync } from "node:fs";
 import { sellPage } from "../src/sell.js";
 
 let pass = 0, fail = 0;
@@ -31,8 +32,12 @@ ok(!/\b\d{1,3}(,\d{3})*\s*(purchases|sales|buyers)\b/i.test(html.replace(/\/tool
 
 // --- register form: same id/posture as market-page.js ---------------------
 ok(html.includes('id="list-api"') && html.includes('id="reg-origin"') && html.includes('id="reg-go"') && html.includes('id="reg-out"'), "register form present with market-page.js's ids");
-ok(html.includes("/api/index/register"), "register form posts to /api/index/register");
-ok(html.includes("out.textContent") && !html.includes("innerHTML"), "register-result rendering is textContent-only, never innerHTML");
+ok(html.includes('<script src="/js/reg-form.js">'), "register form's behavior is externalized (CSP hardening) — the page references the shared script, not an inline one");
+// CSP hardening (2026-08-16) moved this handler to assets/js/reg-form.js -
+// the textContent-only invariant now lives there, not in the page HTML.
+const regFormJs = readFileSync(new URL("../assets/js/reg-form.js", import.meta.url), "utf8");
+ok(regFormJs.includes("/api/index/register"), "the shared script posts to /api/index/register");
+ok(regFormJs.includes("out.textContent") && !regFormJs.includes("innerHTML"), "register-result rendering is textContent-only, never innerHTML");
 
 // --- how-we-earn / commitments --------------------------------------------
 ok(html.includes("HOW WE MAKE MONEY") && html.includes("THE COMMITMENTS") || html.includes("The commitments"), "how-we-earn and commitments sections render");
diff --git a/scripts/test-seller-registrations.js b/scripts/test-seller-registrations.js
new file mode 100644
index 00000000..f4b73f1e
--- /dev/null
+++ b/scripts/test-seller-registrations.js
@@ -0,0 +1,75 @@
+// Locks the self-serve seller conversion/churn table (2026-08-16 audit).
+// Before this, submittedSeeds (POST /api/index/register) was a bare
+// Set<origin> with no timestamps at all - no way to answer "of everyone who
+// registered via /sell, how many are still live, and how many ever actually
+// settled a payment" without hand-diffing crawl-cache JSON snapshots.
+//
+// Two layers tested:
+//   1. stats.js's seller_registrations table directly: first_seen is set once
+//      and never moves, last_routable_seen always advances, last_settled_seen
+//      is sticky (a later "not settled this cycle" call must never erase a
+//      previously-observed settlement).
+//   2. x402-index.js's registerOrigin() wiring: a fresh self-serve
+//      registration creates a row; re-registering an already-known origin
+//      (the early-return cache-hit path) still records an observation.
+//
+// Offline - no network, no server boot. registerOrigin uses an injected fake
+// crawler (same pattern as test-index-register.js); getLeaderboardSnapshot()
+// naturally returns its cold "warming, empty leaderboard" shape with no
+// server boot, so originHasSettled() is exercised (returns false) without
+// needing a real on-chain snapshot.
+//
+//   node scripts/test-seller-registrations.js
+import { registerOrigin, __testResetSubmitted } from "../src/x402-index.js";
+import { recordSellerRegistrationSeen, getSellerRegistrations } from "../src/stats.js";
+
+let pass = 0, fail = 0;
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
+const wait = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// --- 1. stats.js layer, directly ---
+const origin1 = `https://seller-reg-test-1-${Date.now()}.example`;
+recordSellerRegistrationSeen(origin1, { settled: false });
+let row = getSellerRegistrations().find((r) => r.origin === origin1);
+ok(!!row, "a fresh origin gets a seller_registrations row");
+ok(typeof row.first_seen === "number" && row.first_seen > 0, "first_seen is stamped");
+ok(row.last_routable_seen === row.first_seen, "last_routable_seen matches first_seen on first observation");
+ok(row.last_settled_seen === null, "last_settled_seen stays null when not settled");
+
+const firstSeenOriginal = row.first_seen;
+await wait(5);
+recordSellerRegistrationSeen(origin1, { settled: true });
+row = getSellerRegistrations().find((r) => r.origin === origin1);
+ok(row.first_seen === firstSeenOriginal, "first_seen is immutable across repeated observations");
+ok(row.last_routable_seen > firstSeenOriginal, "last_routable_seen advances on a later observation");
+ok(typeof row.last_settled_seen === "number" && row.last_settled_seen > firstSeenOriginal, "last_settled_seen is stamped once a settlement is observed");
+
+const settledAt = row.last_settled_seen;
+await wait(5);
+recordSellerRegistrationSeen(origin1, { settled: false }); // this cycle saw no settlement
+row = getSellerRegistrations().find((r) => r.origin === origin1);
+ok(row.last_settled_seen === settledAt, "last_settled_seen is STICKY - a later non-settled observation never erases a prior settlement");
+ok(row.last_routable_seen > settledAt, "last_routable_seen still advances even when settled is false this cycle");
+
+// --- 2. x402-index.js registerOrigin() wiring ---
+__testResetSubmitted();
+const origin2 = `https://seller-reg-test-2-${Date.now()}.example`;
+const goodCrawl = async (o) => ({ manifest: { name: "Ext" }, tools: [{ slug: "a" }], error: null, history: [true] });
+
+let r = await registerOrigin(origin2, { crawl: goodCrawl });
+ok(r.listed === true, "sanity: the injected registration succeeds");
+row = getSellerRegistrations().find((x) => x.origin === origin2);
+ok(!!row, "a real self-serve registration via registerOrigin() creates a seller_registrations row");
+ok(row.last_settled_seen === null, "no leaderboard match in this offline run -> never recorded as settled");
+
+const firstSeen2 = row.first_seen;
+await wait(5);
+r = await registerOrigin(origin2, { crawl: goodCrawl }); // cache hit - the early-return path
+ok(r.listed === true, "re-registering an already-known origin still succeeds (cache-hit path)");
+row = getSellerRegistrations().find((x) => x.origin === origin2);
+ok(row.first_seen === firstSeen2, "re-registration does not reset first_seen");
+ok(row.last_routable_seen > firstSeen2, "re-registration (cache-hit path) still advances last_routable_seen");
+
+__testResetSubmitted();
+console.log(`\n${fail ? "FAILED" : "OK"}: ${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/scripts/test-single-main-landmark.js b/scripts/test-single-main-landmark.js
new file mode 100644
index 00000000..9a9afbdf
--- /dev/null
+++ b/scripts/test-single-main-landmark.js
@@ -0,0 +1,41 @@
+// Every page must have exactly one <main> landmark. ledgerShell() (the
+// shared chrome every page-serving module imports) already wraps every
+// page's body in its own <main>...</main> - a page-level renderer that ALSO
+// emits its own inner <main> creates an invalid nested-landmark structure
+// (screen readers/assistive tech expect at most one <main> per document).
+//
+// Found in an internal audit (2026-08-16): /docs/:slug and /revenue both did
+// this. Grepping the whole src/ tree for the same shape while fixing it
+// turned up two more instances the audit's own spot-check missed
+// (/docs/adapters/:slug via adapter-docs.js, /docs/webhooks via
+// webhooks.js) - both fixed the same way. integrations.js also has its own
+// <main>, but it renders through the OLDER src/chrome.js shell, which never
+// wraps in <main> at all, so that one is not nested and is correctly left
+// alone (checked directly, not assumed).
+//
+// Requires a booted server (same TARGET_URL convention as other page tests):
+//   FREE_MODE=true PORT=3000 node src/server.js
+//   TARGET_URL=http://localhost:3000 node scripts/test-single-main-landmark.js
+const BASE = process.env.TARGET_URL || "http://localhost:3000";
+let pass = 0, fail = 0;
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
+
+// The two pages the audit named, the two more found while fixing this class,
+// plus a handful of other page types as a sanity sweep against a regression
+// introduced elsewhere.
+const PATHS = [
+  "/docs/Architecture", "/revenue", "/docs/adapters/openai", "/docs/webhooks",
+  "/", "/marketplace", "/tools", "/sell", "/leaderboard", "/skills", "/what-is-x402",
+  "/status", "/pricing", "/playground", "/integrations",
+];
+
+for (const path of PATHS) {
+  const res = await fetch(`${BASE}${path}`);
+  if (res.status !== 200) { console.log(`skip - ${path} returned ${res.status}, not 200 (may not exist as a static slug)`); continue; }
+  const html = await res.text();
+  const count = (html.match(/<main[\s>]/g) || []).length;
+  ok(count === 1, `${path}: exactly one <main> landmark (got ${count})`);
+}
+
+console.log(`\n${fail ? "FAILED" : "OK"}: ${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/scripts/test-stats-envelope.js b/scripts/test-stats-envelope.js
index b294faa6..294a8fb2 100644
--- a/scripts/test-stats-envelope.js
+++ b/scripts/test-stats-envelope.js
@@ -17,15 +17,15 @@
 //   2. Envelope keys: service, summary, tools, payment, walletName,
 //      onchainRevenueProof, onchainNote, toolCallsServed, chargedButFailed,
 //      topTools, estimatedRevenueUsd, recentCalls, servingSince,
-//      uptimeSeconds.
+//      processUptimeSeconds.
 //   3. toolCallsServed has total + viaUSDC + viaProofOfWork + viaHeartbeat,
 //      all non-negative integers (`total === viaUSDC + viaProofOfWork +
 //      viaHeartbeat` would be tempting but the chargedButFailed path drops
 //      the failure out of total without crediting a rail — so we lock the
 //      four keys exist + are numbers, not the sum identity).
 //   4. tools is a positive integer (the catalog size — must stay >= 400).
-//   5. estimatedRevenueUsd is a number, uptimeSeconds is a non-negative
-//      number, servingSince is a parseable ISO string.
+//   5. estimatedRevenueUsd is a number, processUptimeSeconds is a
+//      non-negative number, servingSince is a parseable ISO string.
 //   6. topTools / recentCalls are arrays.
 //   7. topPaidTools is ABSENT (found live 2026-08-14: a purchase-count
 //      bestsellers ranking was public here, and since /api/pricing is also
@@ -61,7 +61,7 @@ try {
   ok((res.headers.get("content-type") || "").includes("application/json"), `content-type is application/json`);
   const body = await res.json();
 
-  for (const k of ["service", "summary", "tools", "payment", "walletName", "onchainRevenueProof", "onchainNote", "toolCallsServed", "chargedButFailed", "topTools", "estimatedRevenueUsd", "recentCalls", "servingSince", "uptimeSeconds"]) {
+  for (const k of ["service", "summary", "tools", "payment", "walletName", "onchainRevenueProof", "onchainNote", "toolCallsServed", "chargedButFailed", "topTools", "estimatedRevenueUsd", "recentCalls", "servingSince", "processUptimeSeconds"]) {
     ok(k in body, `envelope key '${k}' present (got: ${Object.keys(body).join(",")})`);
   }
   ok(!("topPaidTools" in body), `topPaidTools is NOT in the public envelope (purchase-count bestsellers ranking - reconstructs exact revenue via public /api/pricing, stays operator-only)`);
@@ -98,7 +98,8 @@ try {
 
   // Liveness.
   ok(typeof body.servingSince === "string" && !isNaN(Date.parse(body.servingSince)), `servingSince is parseable ISO (got ${body.servingSince})`);
-  ok(typeof body.uptimeSeconds === "number" && body.uptimeSeconds >= 0, `uptimeSeconds is non-negative number (got ${body.uptimeSeconds})`);
+  ok(typeof body.processUptimeSeconds === "number" && body.processUptimeSeconds >= 0, `processUptimeSeconds is non-negative number (got ${body.processUptimeSeconds})`);
+  ok(!("uptimeSeconds" in body), "the old 'uptimeSeconds' key name is gone (misreadable as service-availability uptime, see /api/reliability's sibling fix)");
 
   // payment + walletName — the wallet info block. In FREE_MODE walletName
   // may be null; lock that the key exists with one of the legal types.
diff --git a/scripts/test-stellar-page.js b/scripts/test-stellar-page.js
index 60d4c2fa..c62c74bf 100644
--- a/scripts/test-stellar-page.js
+++ b/scripts/test-stellar-page.js
@@ -74,8 +74,8 @@ ok(html.includes("SELLERS") && html.includes("PRICE FLOOR"), "stats strip render
 ok(html.includes("THIS HOST"), "local seller card carries the THIS HOST tag");
 ok(html.includes("ext1.example"), "seller card shows the hostname");
 
-// Self-serve form present
-ok(html.includes('id="list-api"') && html.includes("/api/index/register"), "List your API form renders");
+// Self-serve form present (submit handler is external — CSP hardening, 2026-08-16)
+ok(html.includes('id="list-api"') && html.includes('<script src="/js/reg-form.js"></script>'), "List your API form renders");
 
 // Activity section: cards + bars + honesty captions
 const buckets = Array.from({ length: 30 }, (_, i) => ({ date: "2026-06-" + String(11 + (i % 20)).padStart(2, "0"), tx: i === 29 ? 5 : 0, usd: i === 29 ? 0.05 : 0, buyers: i === 29 ? 2 : 0 }));
diff --git a/scripts/test-theme.js b/scripts/test-theme.js
index ed5fac6e..60afbf0d 100644
--- a/scripts/test-theme.js
+++ b/scripts/test-theme.js
@@ -87,9 +87,22 @@ ok((html.match(/<script[\s>]/gi) || []).length === (html.match(/<\/script>/gi) |
 const headOnly = html.slice(html.indexOf("<head>"), html.indexOf("</head>"));
 ok(!/\n\s*function\s+\w+\s*\(/.test(headOnly),
   "no bare function declaration sitting outside a <script> in <head>");
-ok(/<script>[^<]*function a402ToggleMenu/.test(html),
-  "a402ToggleMenu is defined INSIDE a script element, so the burger menu works");
-ok(html.includes('onclick="a402ToggleMenu()"'), "the burger button is still wired to it");
+// CSP hardening (2026-08-16) moved the toggle function + its wiring out of
+// an inline <script> into assets/js/site-chrome.js (an inline
+// onclick="..." attribute is exactly as CSP-blocked as an inline <script>
+// tag, so it's gone too) - the burger menu now works via addEventListener
+// in that external file instead. The original historical-incident risk
+// this test guards (a stripped opening <script> tag stranding a function as
+// bare head text) is still fully covered by the two assertions above this
+// one, which apply to the page's OWN script tags regardless of what's in
+// them.
+ok(html.includes('<script src="/js/site-chrome.js">'),
+  "the page references the external site-chrome script that defines the burger toggle");
+ok(!html.includes('onclick="a402ToggleMenu()"') && !/\bonclick\s*=/.test(html),
+  "no inline onclick attribute anywhere - CSP-blocked, must be wired via addEventListener instead");
+const siteChromeJs = readFileSync(new URL("../assets/js/site-chrome.js", import.meta.url), "utf8");
+ok(/function\s+toggleMenu\s*\(/.test(siteChromeJs) && siteChromeJs.includes(".ml-burger") && siteChromeJs.includes("addEventListener('click'"),
+  "site-chrome.js defines the toggle and wires it to the burger button via addEventListener");
 
 // --- the revenue chart palette had to follow the theme ----------------------
 // Its dark series colours were keyed on [data-theme="dark"]. With the attribute
diff --git a/scripts/test-wallet-blocklist.js b/scripts/test-wallet-blocklist.js
index e27816ea..2459aca9 100644
--- a/scripts/test-wallet-blocklist.js
+++ b/scripts/test-wallet-blocklist.js
@@ -1,7 +1,7 @@
 // Unit tests for the WALLET_BLOCKLIST payer matcher — the pure function behind
 // the beforeSettle abort that refuses service to blocked wallets WITHOUT
 // charging them. Env is read at call time, so each case just sets the var.
-import { blockedPayerFromPayload } from "../src/payments.js";
+import { blockedPayerFromPayload, registerWalletBlocklistPayerEnrichment } from "../src/payments.js";
 
 let pass = 0, fail = 0;
 const ok = (cond, msg) => { if (cond) { pass++; console.log(`ok - ${msg}`); } else { fail++; console.error(`FAIL - ${msg}`); } };
@@ -23,10 +23,18 @@ ok(blockedPayerFromPayload({ payload: { authorization: { from: EVM.toLowerCase()
 ok(blockedPayerFromPayload(evmPayload) === EVM.toLowerCase(), "EVM blocked: checksum payload vs checksum env");
 ok(blockedPayerFromPayload({ payload: { authorization: { from: "0x" + "1".repeat(40) } } }) === null, "different EVM wallet → null");
 
-// Non-EVM payers match from the payload's payer field, case preserved.
+// Non-EVM (SVM/Stellar/AVM): the raw client payload NEVER carries a payer
+// field - real wire shapes are { payload: { transaction: "<base64>" } } for
+// SVM/Stellar and { payload: { paymentGroup: [...], paymentIndex } } for AVM.
+// The payer only exists on the verify() RESULT, enriched onto the payload via
+// registerWalletBlocklistPayerEnrichment's onAfterVerify hook (__verifiedPayer)
+// - the earlier version of this test used a fabricated { payload: { payer } }
+// shape that no real SDK ever produces, which is exactly what let the
+// non-EVM-payer gap ship unnoticed (see payments.js's doc comment).
 process.env.WALLET_BLOCKLIST = `${SOL},${ALGO}`;
-ok(blockedPayerFromPayload({ payload: { payer: SOL } }) === SOL, "Solana base58 payer blocked (payload.payload.payer)");
-ok(blockedPayerFromPayload({ payer: ALGO }) === ALGO, "Algorand base32 payer blocked (payload.payer)");
+ok(blockedPayerFromPayload({ payload: { transaction: "AAAA..." }, __verifiedPayer: SOL }) === SOL, "Solana payer blocked via __verifiedPayer (post-enrichment)");
+ok(blockedPayerFromPayload({ payload: { paymentGroup: ["AAAA"], paymentIndex: 0 }, __verifiedPayer: ALGO }) === ALGO, "Algorand payer blocked via __verifiedPayer (post-enrichment)");
+ok(blockedPayerFromPayload({ payload: { transaction: "AAAA..." } }) === null, "Solana payload with NO enrichment (pre-fix behavior) → null, not a false negative on a wallet that isn't actually blocked");
 ok(blockedPayerFromPayload(evmPayload) === null, "EVM wallet not in the non-EVM list → null");
 
 // Defensive: shapes that carry no payer never match, never throw.
@@ -36,5 +44,57 @@ ok(blockedPayerFromPayload(undefined) === null, "missing payload → null");
 ok(blockedPayerFromPayload({ payload: { authorization: { from: 42 } } }) === null, "non-string from → null");
 
 delete process.env.WALLET_BLOCKLIST;
+
+// ---- registerWalletBlocklistPayerEnrichment: the onAfterVerify hook itself ----
+// Fake server stub that just captures the registered hook, matching the real
+// @x402/core server's onAfterVerify(hook) signature.
+function fakeServer() {
+  let hook;
+  return { onAfterVerify: (h) => { hook = h; }, run: (ctx) => hook(ctx) };
+}
+
+{
+  const server = fakeServer();
+  registerWalletBlocklistPayerEnrichment(server);
+  const payload = { payload: { transaction: "AAAA..." } };
+  server.run({ result: { isValid: true, payer: SOL }, paymentPayload: payload });
+  ok(payload.__verifiedPayer === SOL, "enrichment hook stashes verify()'s payer onto the SAME payload object");
+}
+
+{
+  // EVM payloads already carry a real, signature-covered payer
+  // (authorization.from) - the enrichment must not touch them at all, since
+  // overwriting with a facilitator-reported value would trade a
+  // signature-covered field for an unauthenticated one.
+  const server = fakeServer();
+  registerWalletBlocklistPayerEnrichment(server);
+  const payload = { payload: { authorization: { from: EVM } } };
+  server.run({ result: { isValid: true, payer: "some-other-address" }, paymentPayload: payload });
+  ok(payload.__verifiedPayer === undefined, "enrichment hook never touches an EVM payload (authorization.from already present)");
+}
+
+{
+  // No payer on the verify result (e.g. isValid:false, or a scheme this
+  // hook doesn't know about) - must not throw, must not attach anything.
+  const server = fakeServer();
+  registerWalletBlocklistPayerEnrichment(server);
+  const payload = { payload: { transaction: "AAAA..." } };
+  server.run({ result: { isValid: false, invalidReason: "expired" }, paymentPayload: payload });
+  ok(payload.__verifiedPayer === undefined, "enrichment hook is a no-op when the verify result carries no payer");
+}
+
+{
+  // End-to-end shape: enrichment runs at afterVerify, blockedPayerFromPayload
+  // runs at beforeSettle - same payload object, same request, matching the
+  // real @x402/core request lifecycle where both hooks share one paymentPayload reference.
+  const server = fakeServer();
+  registerWalletBlocklistPayerEnrichment(server);
+  process.env.WALLET_BLOCKLIST = SOL;
+  const payload = { payload: { transaction: "AAAA..." } };
+  server.run({ result: { isValid: true, payer: SOL }, paymentPayload: payload });
+  ok(blockedPayerFromPayload(payload) === SOL, "end-to-end: afterVerify enrichment + beforeSettle matcher together block a non-EVM wallet");
+  delete process.env.WALLET_BLOCKLIST;
+}
+
 console.log(`\n${pass} passed, ${fail} failed`);
 process.exit(fail ? 1 : 0);
diff --git a/scripts/test-wildcard-route-bypass.js b/scripts/test-wildcard-route-bypass.js
new file mode 100644
index 00000000..1f81698f
--- /dev/null
+++ b/scripts/test-wildcard-route-bypass.js
@@ -0,0 +1,84 @@
+// Locks the fix for a real, upstream-disclosed payment bypass
+// (x402-foundation/x402 CHANGELOG, @x402/core 2.21.0, commit 5192e50):
+// the compiled wildcard-route regex used `.*?` without the dotAll flag, so a
+// percent-encoded ECMAScript line terminator (U+2028, LF, CR) surviving path
+// normalization would fail to match, causing requiresPayment() to return
+// false and the middleware to skip payment verification and settlement
+// entirely - a request to a paid wildcard route landed on the handler for
+// free.
+//
+// This is not theoretical for us: /api/convert/* and /api/convert-* (the
+// retired pairwise unit-converter compatibility shim, ~970 legacy paths,
+// server.js's extraRoutes) are real, currently-registered wildcard routes.
+// Found in an internal audit 2026-08-16 while investigating whether the
+// @x402/express pin (was 2.16.0, before this fix) needed bumping - it did,
+// not just for hygiene but because this exact bug was live in production.
+//
+// Requires the real (non-FREE_MODE) paywall path with a stub facilitator,
+// same pattern as test-head-paywall.js.
+import { createServer } from "node:http";
+import { spawn } from "node:child_process";
+
+const PORT = 3091, FAC_PORT = 3092;
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+const facilitator = createServer((req, res) => {
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ kinds: [{ x402Version: 2, scheme: "exact", network: "eip155:8453" }], extensions: [], signers: {} }));
+});
+await new Promise((r) => facilitator.listen(FAC_PORT, r));
+
+const proc = spawn("node", ["src/server.js"], {
+  env: {
+    ...process.env, PORT: String(PORT), FREE_MODE: "",
+    WALLET_ADDRESS: "0x000000000000000000000000000000000000dEaD", NETWORK: "base",
+    FACILITATOR_URL: `http://127.0.0.1:${FAC_PORT}`,
+    MPP_SECRET_KEY: "test-mpp-secret",
+    CDP_API_KEY_ID: "", CDP_API_KEY_SECRET: "", PAYMENT_NETWORKS: "base",
+  },
+  stdio: "ignore",
+});
+
+let pass = 0, fail = 0;
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
+
+try {
+  const BASE = `http://localhost:${PORT}`;
+  for (let i = 0; i < 40; i++) { try { if ((await fetch(`${BASE}/health`)).ok) break; } catch {} await sleep(500); }
+
+  // Baseline: an ordinary request to the wildcard-matched legacy route must
+  // require payment (402) - proves the route is actually paywall-gated,
+  // so the payloads below are testing a real gate, not an already-open door.
+  const normal = await fetch(`${BASE}/api/convert-miles-to-kilometers`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ value: 1 }) });
+  ok(normal.status === 402, `ordinary /api/convert-* request requires payment (got ${normal.status})`);
+
+  // The actual disclosed bypass shape: a percent-encoded ECMAScript line
+  // terminator inside the wildcard-matched segment. The only failure mode
+  // is a free 200 that actually performed the conversion (the bypass) -
+  // a 402 (still gated) or a clean 404/400 (path doesn't resolve) are both
+  // fine outcomes.
+  const payloads = [
+    { name: "LINE SEPARATOR U+2028 (%E2%80%A8)", path: "/api/convert-miles-to-kilometers%E2%80%A8x" },
+    { name: "LF (%0A)", path: "/api/convert-miles-to-kilometers%0Ax" },
+    { name: "CR (%0D)", path: "/api/convert-miles-to-kilometers%0Dx" },
+    { name: "PARAGRAPH SEPARATOR U+2029 (%E2%80%A9)", path: "/api/convert-miles-to-kilometers%E2%80%A9x" },
+  ];
+  for (const p of payloads) {
+    const res = await fetch(`${BASE}${p.path}`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ value: 1 }) });
+    // Exactly 402, not merely "not 200": this route also has its own strict
+    // downstream unit-pair parser, which independently 404s a mangled path
+    // regardless of the x402-level gate - so "not 200" alone would pass even
+    // if the payment gate itself silently stopped firing (a real regression
+    // that would still bite any route whose downstream handler is more
+    // permissive about what it accepts). Requiring exactly 402 proves the
+    // gate itself is still active, not just that this particular route
+    // happens to have a second line of defense.
+    ok(res.status === 402, `${p.name}: still requires payment on the wildcard route (got ${res.status})`);
+  }
+
+  console.log(`\n${fail ? "FAILED" : "OK"}: ${pass} passed, ${fail} failed`);
+  process.exitCode = fail ? 1 : 0;
+} finally {
+  try { proc.kill("SIGKILL"); } catch {}
+  try { facilitator.close(); } catch {}
+}
diff --git a/scripts/test-wrong-method-405.js b/scripts/test-wrong-method-405.js
new file mode 100644
index 00000000..62d9ae60
--- /dev/null
+++ b/scripts/test-wrong-method-405.js
@@ -0,0 +1,49 @@
+// Locks the wrong-method-405 fix (2026-08-16 audit): 408 of 531 POST-only
+// catalog routes returned a bare, generic HTML 404 on a wrong-method GET -
+// indistinguishable from "this route doesn't exist at all" to a naive
+// client, when the real answer is "you used the wrong HTTP method". Express
+// registers each tool on exactly one verb (app[lowerMethod](path, ...)), so
+// a mismatched method never matched any route and fell straight through to
+// Express's default 404.
+//
+// Requires a booted server (same TARGET_URL convention as other page tests):
+//   FREE_MODE=true PORT=3000 node src/server.js
+//   TARGET_URL=http://localhost:3000 node scripts/test-wrong-method-405.js
+const BASE = process.env.TARGET_URL || "http://localhost:3000";
+let pass = 0, fail = 0;
+const ok = (c, m) => { if (c) { pass++; console.log(`ok - ${m}`); } else { fail++; console.error(`FAIL - ${m}`); } };
+
+// A POST-only catalog route hit with GET must 405, carry an Allow header
+// naming the real method, and a JSON body - not Express's bare HTML 404.
+{
+  const res = await fetch(`${BASE}/api/hash`, { method: "GET" });
+  ok(res.status === 405, `GET on POST-only /api/hash -> 405 (got ${res.status})`);
+  ok(res.headers.get("allow") === "POST", `Allow header names the real method (got "${res.headers.get("allow")}")`);
+  ok((res.headers.get("content-type") || "").includes("application/json"), "405 response is JSON, not Express's default HTML 404 page");
+  const body = await res.json();
+  ok(Array.isArray(body.allow) && body.allow.includes("POST"), `JSON body's allow[] also names the method (got ${JSON.stringify(body.allow)})`);
+}
+
+// The correct method on the same route must be completely unaffected.
+{
+  const res = await fetch(`${BASE}/api/hash`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ text: "hi" }) });
+  ok(res.status !== 405, `POST (the real method) on /api/hash is never 405'd (got ${res.status})`);
+}
+
+// A path that isn't in the catalog AT ALL must fall through to the
+// existing 404 behavior unchanged - the fix must not swallow every 404.
+{
+  const res = await fetch(`${BASE}/api/this-route-genuinely-does-not-exist-xyz`, { method: "GET" });
+  ok(res.status === 404, `a path outside the catalog entirely still 404s normally (got ${res.status})`);
+  ok(res.headers.get("allow") === null, "no spurious Allow header on a genuinely unmatched path");
+}
+
+// A non-catalog page (marketing/HTML surface, not an /api tool) must be
+// completely unaffected by this catalog-scoped check.
+{
+  const res = await fetch(`${BASE}/marketplace`, { method: "GET" });
+  ok(res.status === 200, `a non-catalog page renders normally, untouched by the catalog-scoped 405 check (got ${res.status})`);
+}
+
+console.log(`\n${fail ? "FAILED" : "OK"}: ${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/src/adapter-docs.js b/src/adapter-docs.js
index 29eefbb9..b760e0e8 100644
--- a/src/adapter-docs.js
+++ b/src/adapter-docs.js
@@ -342,7 +342,7 @@ export function adapterDocPage(baseUrl, slug) {
     </aside>
 
     <!-- CONTENT -->
-    <main>
+    <div>
       <p style="font-size:.85rem;color:var(--faint);margin:0 0 20px;"><a href="/" style="color:var(--faint);text-decoration:none;">Home</a> &rsaquo; <a href="/docs" style="color:var(--faint);text-decoration:none;">Docs</a> &rsaquo; <a href="/docs/adapters" style="color:var(--faint);text-decoration:none;">Adapters</a> &rsaquo; ${esc(adapter.name)}</p>
       <h1 style="font-family:var(--font-body);font-weight:800;font-size:42px;line-height:1;letter-spacing:-.02em;margin:0 0 10px;">${esc(adapter.name)} Adapter</h1>
       <span style="display:inline-block;font-family:var(--font-mono);font-size:.85rem;color:var(--accent);margin-bottom:18px;">${esc(adapter.pkg)}</span>
@@ -397,25 +397,11 @@ ${configRows}
         <a href="/integrations" style="color:var(--accent);text-decoration:none;font-size:.92rem;font-weight:600;">Integrations overview</a>
         <a href="${esc(adapter.github)}" target="_blank" rel="noopener" style="color:var(--accent);text-decoration:none;font-size:.92rem;font-weight:600;">GitHub source &rarr;</a>
       </div>
-    </main>
+    </div>
   </div>
   ${ledgerFooterCompact()}
 
-  <script>
-  (function(){
-    document.querySelectorAll(".ml-adp-copy").forEach(function(btn){
-      btn.addEventListener("click",function(){
-        var code=btn.parentElement.querySelector("code");
-        var text=code.textContent;
-        navigator.clipboard.writeText(text).then(function(){
-          btn.textContent="Copied!";
-          btn.style.color="var(--accent)";
-          setTimeout(function(){btn.textContent="Copy";btn.style.color="";},1500);
-        });
-      });
-    });
-  })();
-  </script>`;
+  <script src="/js/copy-buttons.js"></script>`;
 
   return ledgerShell({
     title,
diff --git a/src/api-explorer.js b/src/api-explorer.js
index c95afeec..afec0cb3 100644
--- a/src/api-explorer.js
+++ b/src/api-explorer.js
@@ -43,8 +43,7 @@ export function apiExplorerPage(baseUrl) {
 `;
 
   const body = `
-<script>var BASE='${baseUrl.replace(/'/g, "\\'")}';</script>
-<div class="ae-wrap">
+<div class="ae-wrap" data-base="${esc(baseUrl)}">
 <p class="ae-crumb"><a href="/">Home</a> &rsaquo; <a href="/docs">Docs</a> &rsaquo; API Explorer</p>
 <div style="font-family:var(--font-mono);font-size:13px;color:var(--accent);margin-bottom:14px;">$ GET /docs/api/explorer</div>
 <h1 style="font-family:var(--font-body);font-weight:800;font-size:58px;line-height:.96;letter-spacing:-.03em;margin:0 0 14px;">API Explorer.</h1>
@@ -58,134 +57,7 @@ export function apiExplorerPage(baseUrl) {
 </section>
 
 ${ledgerFooterCompact()}
-<script>
-(function(){
-  var list=document.getElementById('aeList');
-  var search=document.getElementById('aeSearch');
-  var countEl=document.getElementById('aeCount');
-  var catsEl=document.getElementById('aeCats');
-  var endpoints=[];
-  var activeCategory='all';
-
-  function el(tag,cls,text){
-    var e=document.createElement(tag);
-    if(cls)e.className=cls;
-    if(text)e.textContent=text;
-    return e;
-  }
-
-  fetch(BASE+'/openapi.json').then(function(r){return r.json()}).then(function(spec){
-    var paths=spec.paths||{};
-    Object.keys(paths).sort().forEach(function(p){
-      var methods=paths[p];
-      ['get','post','put','delete','patch'].forEach(function(m){
-        if(!methods[m])return;
-        var op=methods[m];
-        endpoints.push({method:m.toUpperCase(),path:p,name:op.summary||op.operationId||'',desc:op.description||'',category:(op.tags&&op.tags[0])||'other',schema:op.requestBody&&op.requestBody.content&&op.requestBody.content['application/json']&&op.requestBody.content['application/json'].schema||null,params:op.parameters||[]});
-      });
-    });
-    renderCats();
-    renderList();
-  }).catch(function(){list.textContent='Failed to load API spec.';});
-
-  function renderCats(){
-    while(catsEl.firstChild)catsEl.removeChild(catsEl.firstChild);
-    var cats={};
-    endpoints.forEach(function(e){cats[e.category]=true;});
-    var allBtn=el('button','ae-cat-btn active','All');
-    allBtn.setAttribute('data-cat','all');
-    catsEl.appendChild(allBtn);
-    Object.keys(cats).sort().forEach(function(c){
-      var btn=el('button','ae-cat-btn',c);
-      btn.setAttribute('data-cat',c);
-      catsEl.appendChild(btn);
-    });
-    catsEl.addEventListener('click',function(ev){
-      var btn=ev.target.closest('.ae-cat-btn');
-      if(!btn)return;
-      activeCategory=btn.getAttribute('data-cat');
-      catsEl.querySelectorAll('.ae-cat-btn').forEach(function(x){x.classList.remove('active');});
-      btn.classList.add('active');
-      renderList();
-    });
-  }
-
-  function renderList(){
-    var q=search.value.toLowerCase().trim();
-    while(list.firstChild)list.removeChild(list.firstChild);
-    var shown=0;
-    endpoints.forEach(function(ep){
-      if(activeCategory!=='all'&&ep.category!==activeCategory)return;
-      if(q&&ep.method.toLowerCase().indexOf(q)===-1&&ep.path.toLowerCase().indexOf(q)===-1&&ep.name.toLowerCase().indexOf(q)===-1&&ep.desc.toLowerCase().indexOf(q)===-1)return;
-      shown++;
-
-      var div=el('div','ae-endpoint');
-      var head=el('div','ae-ep-head');
-      head.appendChild(el('span','ae-method '+ep.method,ep.method));
-      head.appendChild(el('span','ae-path',ep.path));
-      head.appendChild(el('span','ae-ep-name',ep.name));
-      head.addEventListener('click',function(){div.classList.toggle('open');});
-      div.appendChild(head);
-
-      var body=el('div','ae-ep-body');
-
-      if(ep.desc){
-        var sec=el('div','ae-section');
-        sec.appendChild(el('div','ae-section-title','Description'));
-        var p=el('p','',ep.desc);
-        p.style.cssText='font-size:.9rem;color:var(--muted);margin:0';
-        sec.appendChild(p);
-        body.appendChild(sec);
-      }
-
-      if(ep.params.length){
-        var sec2=el('div','ae-section');
-        sec2.appendChild(el('div','ae-section-title','Parameters'));
-        var schema=el('div','ae-schema');
-        ep.params.forEach(function(pm){
-          var row=el('div','ae-prop');
-          row.appendChild(el('span','ae-prop-name',pm.name));
-          row.appendChild(document.createTextNode(' '));
-          row.appendChild(el('span','ae-prop-type',pm.in||'query'));
-          if(pm.description){row.appendChild(document.createTextNode(' '));row.appendChild(el('span','ae-prop-desc',pm.description));}
-          schema.appendChild(row);
-        });
-        sec2.appendChild(schema);
-        body.appendChild(sec2);
-      }
-
-      if(ep.schema&&ep.schema.properties){
-        var sec3=el('div','ae-section');
-        sec3.appendChild(el('div','ae-section-title','Request Body'));
-        var schema2=el('div','ae-schema');
-        Object.keys(ep.schema.properties).forEach(function(k){
-          var prop=ep.schema.properties[k];
-          var row=el('div','ae-prop');
-          row.appendChild(el('span','ae-prop-name',k));
-          row.appendChild(document.createTextNode(' '));
-          row.appendChild(el('span','ae-prop-type',prop.type||'any'));
-          if(prop.description){row.appendChild(document.createTextNode(' '));row.appendChild(el('span','ae-prop-desc',prop.description));}
-          schema2.appendChild(row);
-        });
-        sec3.appendChild(schema2);
-        body.appendChild(sec3);
-      }
-
-      var sec4=el('div','ae-section');
-      var tryBtn=el('a','ae-try-btn','Try in Playground \u2192');
-      tryBtn.href='/playground';
-      sec4.appendChild(tryBtn);
-      body.appendChild(sec4);
-
-      div.appendChild(body);
-      list.appendChild(div);
-    });
-    countEl.textContent=shown+' endpoint'+(shown===1?'':'s');
-  }
-
-  search.addEventListener('input',renderList);
-})();
-</script>`;
+<script src="/js/api-explorer.js"></script>`;
 
   return ledgerShell({ title, description, canonical, baseUrl, activePath: "/docs", extraCss, body });
 }
diff --git a/src/badges.js b/src/badges.js
index b17e1689..c0cfecb0 100644
--- a/src/badges.js
+++ b/src/badges.js
@@ -169,21 +169,7 @@ ${badgeSections}
 </div>
 ${ledgerFooterCompact()}
 
-<script>
-(function(){
-  document.querySelectorAll(".bdg-copy").forEach(function(btn){
-    btn.addEventListener("click",function(){
-      var code=btn.parentElement.querySelector("code");
-      var text=code.textContent;
-      navigator.clipboard.writeText(text).then(function(){
-        btn.textContent="Copied!";
-        btn.classList.add("copied");
-        setTimeout(function(){btn.textContent="Copy";btn.classList.remove("copied")},1500);
-      });
-    });
-  });
-})();
-</script>`;
+<script src="/js/copy-buttons.js"></script>`;
 
   return ledgerShell({ title, description, canonical, baseUrl, activePath: "/badges", extraCss, body });
 }
diff --git a/src/compare.js b/src/compare.js
index 1664cf8e..8b630903 100644
--- a/src/compare.js
+++ b/src/compare.js
@@ -21,7 +21,8 @@ export function comparePage(baseUrl) {
 .cmp-section{margin-bottom:48px}
 .cmp-section h2{font-family:var(--font-body);font-weight:800;font-size:34px;line-height:1;letter-spacing:-.02em;margin:0 0 10px;color:var(--ink)}
 .cmp-section p.cmp-desc{color:var(--muted);font-size:15px;line-height:1.55;margin:0 0 20px;max-width:760px}
-.cmp-table{width:100%;border-collapse:collapse;background:var(--card);border:1.5px solid var(--ink);overflow:hidden;font-size:14px}
+.cmp-scroll{overflow-x:auto}
+.cmp-table{width:100%;min-width:520px;border-collapse:collapse;background:var(--card);border:1.5px solid var(--ink);overflow:hidden;font-size:14px}
 .cmp-table th,.cmp-table td{padding:14px 18px;text-align:left;border-bottom:1px solid var(--hairline)}
 .cmp-table thead th{background:var(--surface);color:var(--on-dark);font-family:var(--font-mono);font-weight:700;font-size:13px;text-transform:uppercase;letter-spacing:.04em}
 .cmp-table thead th:first-child{color:var(--dk-muted2);font-weight:500;text-transform:none;letter-spacing:normal}
@@ -53,7 +54,7 @@ export function comparePage(baseUrl) {
 <div class="cmp-section">
 <h2>Agent402 vs. building your own tool server</h2>
 <p class="cmp-desc">Standing up a custom tool server means writing handlers, managing uptime, handling payments, and keeping up with upstream API changes. Agent402 ships all of that out of the box.</p>
-<table class="cmp-table">
+<div class="cmp-scroll"><table class="cmp-table">
 <thead><tr><th>Dimension</th><th class="col-a402">Agent402</th><th>Build your own</th></tr></thead>
 <tbody>
 <tr><td>Setup time</td><td class="cmp-win"><span class="check">&#10003;</span> One npm install or HTTP call</td><td class="cmp-lose">Weeks of engineering</td></tr>
@@ -63,7 +64,7 @@ export function comparePage(baseUrl) {
 <tr><td>MCP support</td><td class="cmp-win"><span class="check">&#10003;</span> Native MCP endpoint</td><td class="cmp-lose">Implement yourself</td></tr>
 <tr><td>Cost</td><td class="cmp-win"><span class="check">&#10003;</span> Pay per call, free tier via PoW</td><td class="cmp-lose">Server + engineer time</td></tr>
 </tbody>
-</table>
+</table></div>
 </div>
 </section>
 
@@ -71,7 +72,7 @@ export function comparePage(baseUrl) {
 <div class="cmp-section">
 <h2>Agent402 vs. raw API calls</h2>
 <p class="cmp-desc">Wiring an agent directly to upstream APIs means juggling API keys, reading per-provider docs, and building error handling for each service individually.</p>
-<table class="cmp-table">
+<div class="cmp-scroll"><table class="cmp-table">
 <thead><tr><th>Dimension</th><th class="col-a402">Agent402</th><th>Raw API calls</th></tr></thead>
 <tbody>
 <tr><td>Authentication</td><td class="cmp-win"><span class="check">&#10003;</span> x402 protocol - one wallet, all tools</td><td class="cmp-lose">Separate API key per service</td></tr>
@@ -80,7 +81,7 @@ export function comparePage(baseUrl) {
 <tr><td>Payment</td><td class="cmp-win"><span class="check">&#10003;</span> Per-call, pay only for what you use</td><td class="cmp-lose">Monthly subscriptions per provider</td></tr>
 <tr><td>Retries</td><td class="cmp-win"><span class="check">&#10003;</span> Idempotency built in</td><td class="cmp-lose">Build retry logic yourself</td></tr>
 </tbody>
-</table>
+</table></div>
 </div>
 </section>
 
@@ -88,7 +89,7 @@ export function comparePage(baseUrl) {
 <div class="cmp-section">
 <h2>Agent402 vs. hosted AI tool platforms</h2>
 <p class="cmp-desc">Hosted platforms can get you started fast, but they typically lock you in with proprietary APIs, monthly fees, and opaque LLM-dependent tool logic.</p>
-<table class="cmp-table">
+<div class="cmp-scroll"><table class="cmp-table">
 <thead><tr><th>Dimension</th><th class="col-a402">Agent402</th><th>Hosted platforms</th></tr></thead>
 <tbody>
 <tr><td>Open source</td><td class="cmp-win"><span class="check">&#10003;</span> Fully open source</td><td class="cmp-lose"><span class="cross">&#10007;</span> Proprietary</td></tr>
@@ -97,7 +98,7 @@ export function comparePage(baseUrl) {
 <tr><td>Lock-in</td><td class="cmp-win"><span class="check">&#10003;</span> None - standard protocols</td><td class="cmp-lose">Vendor lock-in</td></tr>
 <tr><td>Deterministic</td><td class="cmp-win"><span class="check">&#10003;</span> Every tool is deterministic</td><td class="cmp-lose">LLM-dependent, non-reproducible</td></tr>
 </tbody>
-</table>
+</table></div>
 </div>
 </section>
 
@@ -105,7 +106,7 @@ export function comparePage(baseUrl) {
 <div class="cmp-section">
 <h2>agent402-tollbooth vs. platform monetization gateways</h2>
 <p class="cmp-desc">The other side of the protocol: charging AI crawlers and agents for <em>your</em> content. Cloudflare's announced Monetization Gateway (waitlist at the time of writing) brings x402 charging to sites behind Cloudflare - strong validation that pay-per-request is the business model of the agentic web. <a href="/tollbooth">agent402-tollbooth</a> is the open-source take on the same idea: self-hostable, in front of any origin.</p>
-<table class="cmp-table">
+<div class="cmp-scroll"><table class="cmp-table">
 <thead><tr><th>Dimension</th><th class="col-a402">agent402-tollbooth</th><th>Platform gateways (e.g. Cloudflare)</th></tr></thead>
 <tbody>
 <tr><td>Availability</td><td class="cmp-win"><span class="check">&#10003;</span> Live today - <code>npm i agent402-tollbooth</code></td><td class="cmp-lose">Waitlist / beta</td></tr>
@@ -116,7 +117,7 @@ export function comparePage(baseUrl) {
 <tr><td>Charge rules</td><td class="cmp-win"><span class="check">&#10003;</span> Your code - modes (bots/all/strict), adaptive PoW, per-path pricing</td><td class="cmp-lose">Platform rules API</td></tr>
 <tr><td>Analytics</td><td class="cmp-win"><span class="check">&#10003;</span> Built-in dashboard + stats endpoint, self-hosted</td><td class="cmp-lose">Platform dashboard</td></tr>
 </tbody>
-</table>
+</table></div>
 </div>
 </section>
 
diff --git a/src/contact.js b/src/contact.js
index c74cbea9..c81c1887 100644
--- a/src/contact.js
+++ b/src/contact.js
@@ -45,7 +45,8 @@ export function contactPage(baseUrl) {
 .ct-field textarea{min-height:120px;resize:vertical}
 .ct-submit{background:var(--surface);color:var(--on-dark);font-family:var(--font-mono);font-weight:700;font-size:14px;border:none;padding:12px 24px;cursor:pointer}
 .ct-submit:hover{opacity:.85}
-.ct-sent{display:none;background:var(--card);border:1.5px solid var(--green);padding:18px 22px;margin-bottom:44px;color:var(--ink);font-size:15px}
+.ct-fallback{color:var(--faint);font-size:12.5px;margin:14px 0 0;line-height:1.5}
+.ct-fallback a{color:var(--muted)}
 `;
 
   const body = `
@@ -82,11 +83,9 @@ export function contactPage(baseUrl) {
   </section>
 
   <section>
-  <div class="ct-sent" id="ctSent">Thanks for reaching out! I'll get back to you soon.</div>
-
   <div class="ct-form" id="ctForm">
     <h2>Send a message.</h2>
-    <p>I'll get back to you as soon as I can.</p>
+    <p>Opens in your email app, pre-filled and ready to send.</p>
     <form id="contactForm" action="mailto:mike@agent402.tools" method="POST" enctype="text/plain">
       <div class="ct-field">
         <label for="ct-name">Name</label>
@@ -102,6 +101,7 @@ export function contactPage(baseUrl) {
       </div>
       <button type="submit" class="ct-submit">Send message &rarr;</button>
     </form>
+    <p class="ct-fallback">No email app configured on this device? Copy the address instead: <a href="mailto:mike@agent402.tools">mike@agent402.tools</a></p>
   </div>
   </section>
 </div>
diff --git a/src/contribute.js b/src/contribute.js
index 1d26038f..8e4ca22e 100644
--- a/src/contribute.js
+++ b/src/contribute.js
@@ -282,21 +282,7 @@ TARGET_URL=http://localhost:3000 node scripts/test-mcp-all.js</code></pre>
 </div>
 ${ledgerFooterCompact()}
 
-<script>
-(function(){
-  document.querySelectorAll(".ct-copy").forEach(function(btn){
-    btn.addEventListener("click",function(){
-      var code=btn.parentElement.querySelector("code");
-      var text=code.textContent;
-      navigator.clipboard.writeText(text).then(function(){
-        btn.textContent="Copied!";
-        btn.classList.add("copied");
-        setTimeout(function(){btn.textContent="Copy";btn.classList.remove("copied")},1500);
-      });
-    });
-  });
-})();
-</script>`;
+<script src="/js/copy-buttons.js"></script>`;
 
   return ledgerShell({ title, description, canonical, baseUrl, activePath: "/contribute", extraCss, body });
 }
diff --git a/src/discovery.js b/src/discovery.js
index 99439f9f..3bdb6a44 100644
--- a/src/discovery.js
+++ b/src/discovery.js
@@ -63,7 +63,13 @@ export function serviceManifest({ baseUrl, network, networks, wallet, walletName
     // /.well-known/x402 fan-out wants `version: 1` + a `resources` URL array.
     // Additive — everything below remains the richer agent-facing manifest.
     version: 1,
-    resources: Object.keys(catalog).map((route) => `${baseUrl}${route.split(" ")[1] || route}`),
+    // Dedupe by URL, not by catalog key: a handful of tools (e.g. /api/memory)
+    // are registered twice in the catalog, once per HTTP method (GET read,
+    // POST write) - x402scan's discovery format wants a flat resource-URL
+    // list, not a method-annotated one (openapi.json already carries that),
+    // so the honest fix here is "list the URL once" rather than emitting the
+    // same address twice with no way for a consumer to tell why.
+    resources: [...new Set(Object.keys(catalog).map((route) => `${baseUrl}${route.split(" ")[1] || route}`))],
     about: `${REPO}#agent402-in-the-x402-ecosystem`,
     name: "Agent402.Tools",
     summary:
@@ -251,7 +257,7 @@ export function reliabilityReport({ baseUrl, network, wallet, stats }) {
     status: "operational",
     asOf: new Date().toISOString(),
     servingSince: stats.servingSince,
-    uptimeSeconds: stats.uptimeSeconds,
+    processUptimeSeconds: stats.processUptimeSeconds,
     toolCallsServed: stats.toolCallsServed,
     onchain: {
       revenueProof: wallet ? `${explorer}/address/${wallet}#tokentxns` : null,
diff --git a/src/docs.js b/src/docs.js
index fc004f5e..1b6775e7 100644
--- a/src/docs.js
+++ b/src/docs.js
@@ -207,7 +207,7 @@ export function docsLayoutHtml(currentSlug, mainHtml) {
   return `<div class="ml-docs-layout">
     <button type="button" class="ml-docs-mobile-toggle" id="ml-docs-mobile-toggle" aria-expanded="false" aria-controls="ml-docs-side">Browse docs &#9776;</button>
     <aside class="ml-docs-side" id="ml-docs-side">${renderSidebar(currentSlug)}</aside>
-    <main class="ml-docs-main">${mainHtml}</main>
+    <div class="ml-docs-main">${mainHtml}</div>
   </div>`;
 }
 
@@ -292,47 +292,11 @@ export const DOCS_LAYOUT_CSS = `
   }
   @media (max-width:640px) { .ml-docs-pn { grid-template-columns:1fr; } }`;
 
-// Mobile sidebar toggle: below 900px the sidebar is display:none by default
-// (CSS), with no other way to reach it - this opens/closes it in place
-// above the main content. Desktop never sees the button (CSS hides it at
-// the same breakpoint the sidebar itself becomes permanently visible), so
-// there's nothing to wire up there.
-const DOCS_MOBILE_TOGGLE_SCRIPT = `(function(){
-  var toggle=document.getElementById('ml-docs-mobile-toggle');
-  var side=document.getElementById('ml-docs-side');
-  if(!toggle||!side)return;
-  toggle.addEventListener('click',function(){
-    var open=side.classList.toggle('ml-docs-side-open');
-    toggle.setAttribute('aria-expanded',open?'true':'false');
-  });
-})();`;
-
-// Sidebar filter: hides non-matching <li> items as you type. No network, no
-// fetch - the sidebar is already fully rendered, this just toggles
-// visibility client-side. Group headers with zero visible items also hide,
-// so a filter doesn't leave an empty "Reference" label floating above
-// nothing.
-export const DOCS_SEARCH_SCRIPT = `<script>${DOCS_MOBILE_TOGGLE_SCRIPT}(function(){
-  var input=document.getElementById('ml-docs-search-input');
-  if(!input)return;
-  var side=input.closest('.ml-docs-side');
-  if(!side)return;
-  input.addEventListener('input',function(){
-    var q=input.value.trim().toLowerCase();
-    var lists=side.querySelectorAll('.ml-docs-side-ul');
-    lists.forEach(function(ul){
-      var anyVisible=false;
-      ul.querySelectorAll('li').forEach(function(li){
-        var match=!q||(li.textContent||'').toLowerCase().indexOf(q)>-1;
-        li.classList.toggle('ml-docs-side-hidden',!match);
-        if(match)anyVisible=true;
-      });
-      var h=ul.previousElementSibling;
-      if(h&&h.classList.contains('ml-docs-side-h'))h.classList.toggle('ml-docs-side-hidden',!anyVisible);
-      ul.classList.toggle('ml-docs-side-hidden',!anyVisible);
-    });
-  });
-})();</script>`;
+// Mobile sidebar toggle (below 900px the sidebar is display:none by default,
+// with no other way to reach it) + sidebar filter (hides non-matching <li>
+// items as you type, group headers with zero visible items also hide) —
+// externalized to assets/js/docs-sidebar.js (CSP hardening, 2026-08-16).
+export const DOCS_SEARCH_SCRIPT = `<script src="/js/docs-sidebar.js"></script>`;
 
 function shell(baseUrl, title, description, path, body, currentSlug) {
   const extraCss = DOCS_LAYOUT_CSS;
diff --git a/src/ledger-catalog.js b/src/ledger-catalog.js
index 7ca0b309..cb62f171 100644
--- a/src/ledger-catalog.js
+++ b/src/ledger-catalog.js
@@ -62,6 +62,8 @@ export function ledgerCatalogPage(baseUrl, catalog, skillPacks) {
 .cat-scroll table{min-width:780px}
 table{border-collapse:collapse;width:100%}
 @media (max-width:900px){.cat-2col{grid-template-columns:minmax(0,1fr)!important}}
+.cat-search-wrap{border:1.5px solid var(--ink)}
+.cat-search-wrap:focus-within{border-color:var(--accent)}
 `;
 
   const tabsHtml = TABS.map(([label, href]) =>
@@ -87,7 +89,7 @@ table{border-collapse:collapse;width:100%}
     <h1 style="font-weight:800;font-size:46px;line-height:1;letter-spacing:-.03em;margin:0 0 12px;color:var(--ink);">Our tools</h1>
     <p style="font-size:16.5px;line-height:1.55;color:var(--muted);margin:0;max-width:640px;">${fmtNum(count)} deterministic tools an agent can call and pay for per request. Around ${fmtNum(freeCount)} of them run free on proof-of-work. This is <em style="color:var(--on-dark2);">our own</em> catalog - for every tool in the index, ours and other sellers', see <a href="/marketplace/tools" style="color:var(--ink);border-bottom:1px solid var(--accent);text-decoration:none;">all indexed tools</a>.</p>
 
-    <div style="display:flex;gap:0;border:1.5px solid var(--ink);background:var(--card);max-width:760px;margin:22px 0 0;">
+    <div class="cat-search-wrap" style="display:flex;gap:0;background:var(--card);max-width:760px;margin:22px 0 0;">
       <label for="cat-search" style="position:absolute;width:1px;height:1px;overflow:hidden;clip:rect(0 0 0 0);">Search tools</label>
       <span style="font-family:var(--font-mono);color:var(--accent);padding:0 12px;display:flex;align-items:center;font-weight:700;">⌕</span>
       <input id="cat-search" type="text" placeholder="Describe a task: decode a JWT, OCR an image, verify a settlement…" style="flex:1;min-width:0;background:transparent;border:none;outline:none;color:var(--ink);font-family:var(--font-mono);font-size:14px;padding:15px 0;">
@@ -166,33 +168,7 @@ table{border-collapse:collapse;width:100%}
 </section>
 ${ledgerFooterCompact()}
 
-<script>
-(function() {
-  var search = document.getElementById('cat-search');
-  var rows = document.querySelectorAll('.cat-row');
-  var empty = document.getElementById('cat-empty');
-  var emptyQ = document.getElementById('cat-empty-q');
-  function applyFilter() {
-    var q = (search.value || '').toLowerCase().trim();
-    var visible = 0;
-    rows.forEach(function(row) {
-      var label = row.querySelector('th a').textContent.toLowerCase();
-      var blurb = row.querySelector('.cat-blurb').textContent.toLowerCase();
-      var match = !q || label.indexOf(q) !== -1 || blurb.indexOf(q) !== -1;
-      row.style.display = match ? '' : 'none';
-      if (match) visible++;
-    });
-    empty.style.display = visible === 0 ? 'block' : 'none';
-    if (visible === 0) emptyQ.textContent = search.value;
-  }
-  search.addEventListener('input', applyFilter);
-  try {
-    var params = new URLSearchParams(window.location.search);
-    var q0 = params.get('q');
-    if (q0) { search.value = q0; applyFilter(); }
-  } catch (e) {}
-})();
-</script>`;
+<script src="/js/catalog-search.js"></script>`;
 
   return ledgerShell({ title, description, canonical, baseUrl, activePath: "/tools", jsonLd: [orgLd, breadcrumbLd, pageLd, listLd, appLd], extraCss, body });
 }
diff --git a/src/ledger-chrome.js b/src/ledger-chrome.js
index 24d1d5a3..f947a71b 100644
--- a/src/ledger-chrome.js
+++ b/src/ledger-chrome.js
@@ -9,6 +9,25 @@ import { RAILS, RAILS_AMP, RAILS_OS } from "./rails.js";
 export const esc = (s) =>
   String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 
+// Safely embeds a JSON-serializable value into a page for a same-origin
+// external script to read (the CSP-hardening replacement for baking
+// per-request server data directly into inline JS text - see the 2026-08-16
+// migration). MUST escape every "<" in the JSON output: JSON.stringify never
+// escapes it, so a string field containing the literal text "</script>"
+// (however that got in there - a crawled seller's tool description is
+// exactly this kind of untrusted field) would prematurely close the tag and
+// let whatever follows execute as HTML/script, a well-known JSON-in-HTML
+// pitfall. < is valid inside a JSON string and round-trips through
+// JSON.parse to the same "<" character, so this is lossless, not just safe.
+// id must be a simple token (enforced) - it becomes a literal attribute
+// value, never interpolated from anything that could carry a quote.
+const SAFE_ISLAND_ID = /^[a-zA-Z][a-zA-Z0-9_-]*$/;
+export function jsonScriptTag(id, value) {
+  if (!SAFE_ISLAND_ID.test(id)) throw new Error(`jsonScriptTag: unsafe id "${id}"`);
+  const json = JSON.stringify(value).replace(/</g, "\\u003c");
+  return `<script type="application/json" id="${id}">${json}</script>`;
+}
+
 // Official GitHub mark (the "Octocat" silhouette) - fill:currentColor so it
 // tracks the surrounding text color (var(--muted), hover states) exactly
 // like the plain-text "github" link it replaces used to, with no separate
@@ -73,7 +92,14 @@ html { overflow-x: clip; }
   --ink: #ECECEA;
   --ink-panel: #171719;
   --muted: #9E9E98;
-  --faint: #6C6C68;
+  /* Was #6C6C68 (3.15-3.66:1 against paper/card/card-zebra/footer-bg -
+     fails WCAG AA's 4.5:1 for normal text) - --faint is used at 10-13px in
+     shared nav/footer chrome that reaches every page. Raised to clear
+     4.5:1 with margin (4.86-5.64:1) against every dark surface it actually
+     appears on, keeping the original warm tint (R=G, B slightly lower) and
+     staying visually distinct from --muted (found in an internal audit,
+     2026-08-16). */
+  --faint: #8B8B87;
   --hairline: #2A2A30;
   --dash: #35353B;
   --dark-border: #262626;
@@ -530,7 +556,7 @@ function nav(activePath) {
       <a class="ml-nav-gh" href="https://github.com/MikeyPetrillo/Agent402" rel="noopener" aria-label="GitHub" title="GitHub" style="display:flex;align-items:center;color:var(--muted);text-decoration:none;">${GITHUB_ICON_SVG}</a>
 
       ${activePath === "" || activePath === "/sell" ? "" : `<a class="ml-nav-cta" href="/sell" style="background:var(--accent);color:#fff;font-family:var(--font-mono);font-weight:700;font-size:13px;text-decoration:none;padding:9px 15px;white-space:nowrap;">LIST YOUR API →</a>`}
-      <button type="button" onclick="a402ToggleMenu()" class="ml-burger" aria-label="Open menu" aria-expanded="false">
+      <button type="button" class="ml-burger" aria-label="Open menu" aria-expanded="false">
         <svg class="ml-burger-open" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" aria-hidden="true"><path d="M3 6h18M3 12h18M3 18h18"/></svg>
         <svg class="ml-burger-close" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" aria-hidden="true"><path d="M6 6l12 12M18 6L6 18"/></svg>
       </button>
@@ -666,7 +692,7 @@ export function setOgImageVersion(v) { ogImageVersion = String(v || ""); }
 function posthogSnippet(baseUrl) {
   const key = process.env.POSTHOG_API_KEY || "";
   if (!key) return "";
-  const cfg = JSON.stringify({
+  const cfg = {
     api_host: `${baseUrl}/e`,
     ui_host: "https://us.posthog.com",
     persistence: "sessionStorage",
@@ -676,8 +702,12 @@ function posthogSnippet(baseUrl) {
     capture_performance: { web_vitals: true, network_timing: false },
     disable_session_recording: true,
     disable_surveys: true,
-  });
-  return `<script>!function(t,e){var o,n,p,r;e.__SV||(window.posthog=e,e._i=[],e.init=function(i,s,a){function g(t,e){var o=e.split(".");2==o.length&&(t=t[o[0]],e=o[1]),t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}}(p=t.createElement("script")).type="text/javascript",p.crossOrigin="anonymous",p.async=!0,p.src=s.api_host+"/static/array.js",(r=t.getElementsByTagName("script")[0]).parentNode.insertBefore(p,r);var u=e;for(void 0!==a?u=e[a]=[]:a="posthog",u.people=u.people||[],u.toString=function(t){var e="posthog";return"posthog"!==a&&(e+="."+a),t||(e+=" (stub)"),e},u.people.toString=function(){return u.toString(1)+".people (stub)"},o="init capture register register_once register_for_session unregister unregister_for_session getFeatureFlag getFeatureFlagPayload isFeatureEnabled reloadFeatureFlags updateEarlyAccessFeatureEnrollment getEarlyAccessFeatures on onFeatureFlags onSessionId getSurveys getActiveMatchingSurveys renderSurvey canRenderSurvey identify setPersonProperties group resetGroups setPersonPropertiesForFlags resetPersonPropertiesForFlags setGroupPropertiesForFlags resetGroupPropertiesForFlags reset get_distinct_id getGroups get_session_id get_session_replay_url alias set_config startSessionRecording stopSessionRecording sessionRecordingStarted captureException loadToolbar get_property getSessionProperty createPersonProfile opt_in_capturing opt_out_capturing has_opted_in_capturing has_opted_out_capturing clear_opt_in_out_capturing debug getPageViewId captureTraceFeedback captureTraceMetric".split(" "),n=0;n<o.length;n++)g(u,o[n]);e._i.push([i,s,a])},e.__SV=1)}(document,window.posthog||[]);posthog.init(${JSON.stringify(key)},${cfg});</script>`;
+  };
+  // The vendor loader itself is 100% static (assets/js/posthog-loader.js);
+  // only the API key and per-deployment config vary, so they ride as a JSON
+  // island the loader reads at runtime instead of being templated into JS
+  // text (CSP hardening, 2026-08-16).
+  return jsonScriptTag("posthog-config", { key, cfg }) + '<script src="/js/posthog-loader.js"></script>';
 }
 export function ledgerShell({ title, description, canonical, baseUrl, activePath = "", ogImage, jsonLd, extraCss = "", body }) {
   const og = ogImage || (baseUrl + "/card.png" + (ogImageVersion ? `?v=${ogImageVersion}` : ""));
@@ -702,49 +732,7 @@ export function ledgerShell({ title, description, canonical, baseUrl, activePath
 <html lang="en">
 <head>
 <meta charset="utf-8">
-<script>function a402ToggleMenu(){try{var o=document.documentElement.classList.toggle('ml-menu-open');var b=document.querySelector('.ml-burger');if(b)b.setAttribute('aria-expanded',o?'true':'false');}catch(e){}}
-/* a402: reveal-on-scroll for every top-level header/section, site-wide. Was
-   opt-in per-page via [data-reveal] (only the homepage set it, so every
-   other page never got the effect at all); now applied here in the ONE
-   shared script every page already loads, so it needs zero duplication -
-   no per-page script block, no per-page attribute to remember to set.
-   Anonymous function expression on purpose, not a declaration - avoids a
-   leading-"function" source line, the exact shape test-theme.js's
-   markup-safety assertions guard against. Class added here (JS), never
-   baked into static CSS as a default-hidden state, so a throw/no-run leaves
-   every section fully visible instead of stuck at opacity:0. The observer's
-   own first callback decides visibility, not a separate getBoundingClientRect
-   measurement taken before the map canvas/webfonts settle layout (that
-   early-measurement bug made most sections read as already-above-the-fold
-   and never animate). ONE-SHOT: once a section reveals, it is unobserved and
-   never re-hidden. An earlier version toggled ml-reveal-in on every
-   intersection change (added AND removed), meant to let a reload deep in the
-   page still animate sections into view - but a reload doesn't need the
-   removal half, only the addition: a section already in view on the
-   observer's first callback reveals immediately either way. The removal
-   half had a real, reported bug: a tall section scrolling past the top edge
-   drops under the 8% threshold *while still partially on screen*, so it
-   visibly faded out and shifted down 18px in front of the user mid-scroll -
-   "content going off screen" on a normal scroll, not a rendering glitch.
-   Revealed content now stays revealed, matching how every other
-   scroll-reveal effect on the web works. querySelectorAll('header,section')
-   only reaches pages whose top-level blocks are actually <section>
-   elements - roughly half this site's page templates are, the rest use
-   plain <div> wrappers and get no reveal effect from this alone; converting
-   those is separate, per-template work, not something a shared script can
-   retrofit onto markup that was never semantic to begin with.
-   FIRST MATCH IS EXEMPT (2026-08-15): every page's first header/section is
-   its hero - the block already sitting in the viewport on page load, on
-   every template checked (marketplace/tools/sell/leaderboard/skills/docs/
-   status/home). Hiding it behind opacity:0 first, same as every other
-   section, meant it always had to wait on the observer's first callback -
-   measured live at 100-300ms of near-zero opacity even though the content
-   was already fully in view, a real flash-of-blank-hero on every load, not
-   a scroll-triggered effect at all. The fix is DOM-order, not a
-   getBoundingClientRect check - that's the deliberate difference from the
-   early-measurement bug described above: no layout read before webfonts/map
-   settle, so it can't misjudge a below-fold section as already visible. */
-document.addEventListener('DOMContentLoaded',function(){try{if(window.matchMedia&&window.matchMedia('(prefers-reduced-motion: reduce)').matches)return;var els=document.querySelectorAll('header,section,[data-reveal]');if(els.length<2||!window.IntersectionObserver)return;var rest=Array.prototype.slice.call(els,1);rest.forEach(function(el){el.classList.add('ml-reveal');});var io=new IntersectionObserver(function(entries){entries.forEach(function(e){if(e.isIntersecting){e.target.classList.add('ml-reveal-in');io.unobserve(e.target);}});},{threshold:.08});rest.forEach(function(el){io.observe(el);});}catch(e){}});</script>
+<script src="/js/site-chrome.js"></script>
 <meta name="viewport" content="width=device-width,initial-scale=1">
 <title>${esc(title)}</title>
 <meta name="description" content="${esc(description)}">
diff --git a/src/ledger-home.js b/src/ledger-home.js
index f5da6892..bc5a573e 100644
--- a/src/ledger-home.js
+++ b/src/ledger-home.js
@@ -104,6 +104,8 @@ export function ledgerHomePage(baseUrl, catalog, stats, leaderboardSnapshot, ski
 .hm-2col { display: grid; grid-template-columns: 1fr 1fr; }
 @media (max-width: 900px) { .hm-2col, .hm-3col, .hm-hero { grid-template-columns: minmax(0,1fr) !important; } }
 @media (max-width: 480px) { .hm-reg-row { flex-direction: column !important; } .hm-reg-row button { width: 100%; } }
+#hm-demo-in { border: 1.5px solid var(--hairline); }
+#hm-demo-in:focus { border-color: var(--accent); }
 `;
 
   const railLinksHtml = CHAIN_ORDER.map(([slug, name]) =>
@@ -166,7 +168,7 @@ export function ledgerHomePage(baseUrl, catalog, stats, leaderboardSnapshot, ski
           <canvas id="hm-map" role="img" aria-label="World map showing agent payment settlements moving between regions" style="display:block;width:100%;"></canvas>
         </div>
         <div style="padding:16px 22px 20px;background:var(--footer-bg);border-bottom:1px solid var(--dark-border2);">
-          <div id="hm-counter" style="font-family:var(--font-body);font-weight:800;font-size:66px;line-height:.9;letter-spacing:-.035em;color:var(--on-dark);font-variant-numeric:tabular-nums;">${viaUsdc ? fmtNum(viaUsdc) : ""}</div>
+          <div id="hm-counter" data-via-usdc="${esc(viaUsdc)}" style="font-family:var(--font-body);font-weight:800;font-size:66px;line-height:.9;letter-spacing:-.035em;color:var(--on-dark);font-variant-numeric:tabular-nums;">${viaUsdc ? fmtNum(viaUsdc) : ""}</div>
           <div id="hm-counter-empty" style="display:${viaUsdc ? "none" : "flex"};align-items:center;gap:11px;">
             <span style="width:8px;height:8px;border-radius:50%;background:var(--accent-lit);flex:none;animation:ml-pulse 1.6s ease-in-out infinite;"></span>
             <span style="font-family:var(--font-mono);font-size:15.5px;color:var(--on-dark2);">Listening for on-chain payments…</span>
@@ -268,7 +270,7 @@ export function ledgerHomePage(baseUrl, catalog, stats, leaderboardSnapshot, ski
   <div class="hm-2col" style="display:grid;grid-template-columns:1fr 1fr;gap:0;border:1.5px solid var(--ink);">
     <div style="padding:26px;border-right:1.5px solid var(--ink);background:var(--card);">
       <label for="hm-demo-in" style="display:block;font-family:var(--font-mono);font-size:11px;letter-spacing:.14em;text-transform:uppercase;color:var(--faint);margin-bottom:10px;">Text to hash</label>
-      <input id="hm-demo-in" type="text" value="hello" placeholder="anything at all" style="width:100%;background:var(--paper);border:1.5px solid var(--hairline);color:var(--on-dark);font-family:var(--font-mono);font-size:14px;padding:13px 14px;margin-bottom:14px;outline:none;box-sizing:border-box;" />
+      <input id="hm-demo-in" type="text" value="hello" placeholder="anything at all" style="width:100%;background:var(--paper);color:var(--on-dark);font-family:var(--font-mono);font-size:14px;padding:13px 14px;margin-bottom:14px;outline:none;box-sizing:border-box;" />
       <button type="button" id="hm-demo-run" style="background:var(--accent);color:#fff;border:none;font-family:var(--font-mono);font-weight:700;font-size:13.5px;padding:13px 20px;cursor:pointer;width:100%;">RUN IT FREE →</button>
       <ol style="margin:20px 0 0;padding:0;list-style:none;display:flex;flex-direction:column;gap:0;border-top:1px solid var(--hairline);">
         <li style="display:grid;grid-template-columns:22px 1fr;gap:12px;padding:13px 0;border-bottom:1px solid var(--hairline);"><span id="hm-step1-mark" style="font-family:var(--font-mono);font-size:12px;color:var(--accent);">·</span><span><span style="font-size:14px;color:var(--ink);font-weight:700;">Request a challenge</span><br><span id="hm-step1" style="font-family:var(--font-mono);font-size:11.5px;color:var(--faint);">signed, single-use, scoped to one tool</span></span></li>
@@ -428,257 +430,7 @@ curl -X POST /api/hash \
 
 ${ledgerFooterFull()}
 
-<script>
-(function() {
-  // --- live counter + rails/leaderboard poll (seeds from server-rendered
-  // values above so the number is real and SEO-visible even with JS off;
-  // polling every 30s is a pure enhancement on top). ---
-  var counterEl = document.getElementById('hm-counter');
-  var counterEmptyEl = document.getElementById('hm-counter-empty');
-  var freePowEl = document.getElementById('hm-freepow');
-  var shownN = ${viaUsdc};
-  function animateTo(target, dur) {
-    var from = shownN, t0 = performance.now();
-    function step(t) {
-      var p = Math.min(1, (t - t0) / dur);
-      var eased = 1 - Math.pow(1 - p, 3);
-      var n = Math.round(from + (target - from) * eased);
-      counterEl.textContent = n.toLocaleString('en-US');
-      if (n > 0) { counterEl.style.display = ''; counterEmptyEl.style.display = 'none'; }
-      if (p < 1) requestAnimationFrame(step);
-    }
-    requestAnimationFrame(step);
-  }
-  function pollStats() {
-    fetch('/api/stats', { headers: { accept: 'application/json' } }).then(function(r) { return r.ok ? r.json() : null; }).then(function(j) {
-      if (!j || !j.toolCallsServed) return;
-      var paid = Number(j.toolCallsServed.viaUSDC) || 0;
-      var pow = Number(j.toolCallsServed.viaProofOfWork) || 0;
-      if (freePowEl) freePowEl.textContent = pow.toLocaleString('en-US');
-      if (paid && paid !== shownN) { animateTo(paid, shownN ? 1000 : 1500); shownN = paid; }
-    }).catch(function() {});
-  }
-  setInterval(pollStats, 30000);
-
-  // --- real, live proof-of-work demo: fetch a real challenge, solve it in
-  // this tab, submit it, exactly matching src/pow.js's own semantics
-  // (hash the "challenge" field, submit the "token" field). ---
-  var input = document.getElementById('hm-demo-in');
-  var runBtn = document.getElementById('hm-demo-run');
-  var statusEl = document.getElementById('hm-demo-status');
-  var outEl = document.getElementById('hm-demo-out');
-  var receiptEl = document.getElementById('hm-demo-receipt');
-  var step1 = document.getElementById('hm-step1'), step1m = document.getElementById('hm-step1-mark');
-  var step2 = document.getElementById('hm-step2'), step2m = document.getElementById('hm-step2-mark');
-  var step3 = document.getElementById('hm-step3'), step3m = document.getElementById('hm-step3-mark');
-  var busy = false;
-
-  function lzOf(buf) {
-    var bits = 0, arr = new Uint8Array(buf);
-    for (var i = 0; i < arr.length; i++) {
-      if (arr[i] === 0) { bits += 8; continue; }
-      bits += Math.clz32(arr[i]) - 24;
-      break;
-    }
-    return bits;
-  }
-
-  runBtn.addEventListener('click', function() {
-    if (busy) return;
-    var text = (input.value || 'hello').slice(0, 200);
-    busy = true;
-    runBtn.textContent = 'WORKING…';
-    statusEl.textContent = 'challenge';
-    outEl.textContent = 'requesting a signed challenge…';
-    receiptEl.textContent = 'waiting on the live server';
-    step1m.textContent = '·'; step2m.textContent = '·'; step3m.textContent = '·';
-
-    fetch('/api/pow/challenge?slug=hash', { headers: { accept: 'application/json' } })
-      .then(function(r) { if (!r.ok) throw new Error('challenge returned ' + r.status); return r.json(); })
-      .then(function(c) {
-        if (!c || !c.challenge || !c.token) throw new Error('challenge response missing challenge/token');
-        statusEl.textContent = c.difficulty + '-bit puzzle';
-        step1m.textContent = '✓';
-        step1.textContent = c.difficulty + '-bit sha256 puzzle issued';
-        outEl.textContent = 'solving…';
-
-        var t0 = performance.now();
-        var enc = new TextEncoder();
-        var BATCH = 512, CAP = 4000000, base = 0, nonce = null;
-
-        function solveBatch() {
-          var jobs = [];
-          for (var i = 0; i < BATCH; i++) jobs.push(crypto.subtle.digest('SHA-256', enc.encode(c.challenge + ':' + (base + i))));
-          return Promise.all(jobs).then(function(digests) {
-            for (var i = 0; i < BATCH; i++) {
-              if (lzOf(digests[i]) >= c.difficulty) { nonce = base + i; return; }
-            }
-            base += BATCH;
-            outEl.textContent = 'solving… ' + base.toLocaleString('en-US') + ' hashes tried';
-            step2.textContent = base.toLocaleString('en-US') + ' hashes…';
-            if (base > CAP) throw new Error('gave up after 4M hashes');
-            return solveBatch();
-          });
-        }
-
-        return solveBatch().then(function() {
-          var ms = Math.round(performance.now() - t0);
-          step2m.textContent = '✓';
-          step2.textContent = 'nonce ' + nonce.toLocaleString('en-US') + ' found in ' + ms + 'ms';
-          statusEl.textContent = 'X-Pow-Solution sent';
-          outEl.textContent = 'solution accepted locally - calling the tool…';
-          receiptEl.textContent = 'solved in ' + ms + 'ms';
-          return fetch('/api/hash', {
-            method: 'POST',
-            headers: { 'content-type': 'application/json', 'X-Pow-Solution': c.token + ':' + nonce },
-            body: JSON.stringify({ text: text, algo: 'sha256' }),
-          }).then(function(rr) {
-            return rr.text().then(function(body) {
-              if (!rr.ok) throw new Error('tool returned ' + rr.status + ' - ' + body.slice(0, 160));
-              var out = body;
-              try { out = JSON.stringify(JSON.parse(body), null, 2); } catch (e) {}
-              step3m.textContent = '✓';
-              step3.textContent = 'served free - no payment, no key';
-              statusEl.textContent = '200 OK';
-              outEl.textContent = out;
-              receiptEl.textContent = 'paid with ' + (nonce + 1).toLocaleString('en-US') + ' hashes · ' + ms + 'ms of your CPU · $0.00 · nonce ' + nonce.toLocaleString('en-US');
-            });
-          });
-        });
-      })
-      .catch(function(e) {
-        statusEl.textContent = 'error';
-        outEl.textContent = "couldn't complete the live call: " + (e && e.message ? e.message : 'unknown error');
-        receiptEl.textContent = 'try again, or see the curl example above';
-      })
-      .then(function() {
-        busy = false;
-        runBtn.textContent = 'RUN IT AGAIN';
-      });
-  });
-
-  // --- inline seller registration (same POST /api/index/register the /sell
-  // page's own form uses - listing an API shouldn't require a click-through
-  // to a second page just to paste one URL). ---
-  var regBtn = document.getElementById('hm-reg-go');
-  var regIn = document.getElementById('hm-reg-origin');
-  var regOut = document.getElementById('hm-reg-out');
-  // The two hero-style "LIST YOUR API" buttons jump here via #sell instead of
-  // navigating to /sell - focus the input so the jump visibly lands on
-  // something typeable, not just a scroll position.
-  document.querySelectorAll('a[href="#sell"]').forEach(function(a) {
-    a.addEventListener('click', function() { setTimeout(function() { if (regIn) regIn.focus(); }, 400); });
-  });
-  if (regBtn) {
-    function submitReg() {
-      regOut.textContent = 'probing...';
-      fetch('/api/index/register', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ origin: regIn.value }) })
-        .then(function(r) { return r.json(); })
-        .then(function(j) {
-          regOut.textContent = j.listed
-            ? ('Listed - ' + (j.seller && j.seller.displayName ? j.seller.displayName : j.origin) + ' (' + (j.seller && j.seller.toolCount ? j.seller.toolCount : 0) + ' tools). Appears on /marketplace and any chain page it advertises.')
-            : ('Not listed: ' + (j.error || 'unknown error'));
-        })
-        .catch(function() { regOut.textContent = 'submission failed - try again'; });
-    }
-    regBtn.addEventListener('click', submitReg);
-    regIn.addEventListener('keydown', function(e) { if (e.key === 'Enter') submitReg(); });
-  }
-
-  // --- reveal-on-scroll: the shared script in ledger-chrome.js now applies
-  // this to every header/section site-wide on its own; no per-page opt-in
-  // needed here anymore. ---
-
-  // --- dot world map: real Natural Earth geometry (world-atlas 110m, public
-  // domain), rasterised to a land mask, sampled into a dot grid, with
-  // animated settlement arcs. Waits for the pinned d3/topojson tags above. ---
-  (function() {
-    var c = document.getElementById('hm-map');
-    if (!c) return;
-    function waitForLibs(timeoutMs) {
-      return new Promise(function(resolve, reject) {
-        var t0 = Date.now();
-        (function tick() {
-          if (window.d3 && window.topojson) return resolve();
-          if (Date.now() - t0 > (timeoutMs || 8000)) return reject(new Error('d3/topojson did not load'));
-          setTimeout(tick, 60);
-        })();
-      });
-    }
-    waitForLibs().then(function() {
-      return fetch('https://cdn.jsdelivr.net/npm/world-atlas@2.0.2/countries-110m.json').then(function(r) { return r.json(); });
-    }).then(function(topo) {
-      var all = window.topojson.feature(topo, topo.objects.countries);
-      var land = { type: 'FeatureCollection', features: all.features.filter(function(f) { return String(f.id) !== '010'; }) };
-      var reduce = window.matchMedia && window.matchMedia('(prefers-reduced-motion: reduce)').matches;
-      var dpr = Math.min(2, window.devicePixelRatio || 1);
-      var ctx = c.getContext('2d');
-      var W = 0, H = 0, dots = [], arcs = [], raf = null;
-
-      function build() {
-        W = Math.max(300, c.parentElement.clientWidth);
-        H = Math.round(W / 2.05);
-        c.width = W * dpr; c.height = H * dpr;
-        c.style.height = H + 'px';
-        ctx.setTransform(dpr, 0, 0, dpr, 0, 0);
-        var proj = window.d3.geoEquirectangular().fitExtent([[8, 8], [W - 8, H - 8]], land);
-        var off = document.createElement('canvas');
-        off.width = W; off.height = H;
-        var octx = off.getContext('2d');
-        octx.fillStyle = '#fff';
-        octx.beginPath();
-        window.d3.geoPath(proj, octx)(land);
-        octx.fill();
-        var px = octx.getImageData(0, 0, W, H).data;
-        dots = [];
-        var step = W > 460 ? 4 : 5;
-        for (var y = 0; y < H; y += step) for (var x = 0; x < W; x += step) if (px[(y * W + x) * 4 + 3] > 140) dots.push([x + 0.5, y + 0.5]);
-        arcs = [];
-        var minSpan = W * 0.24;
-        for (var i = 0; i < 9 && dots.length > 40; i++) {
-          var a = null, b = null;
-          for (var tries = 0; tries < 60; tries++) {
-            var p = dots[(Math.random() * dots.length) | 0];
-            var q = dots[(Math.random() * dots.length) | 0];
-            if (Math.hypot(p[0] - q[0], p[1] - q[1]) >= minSpan) { a = p; b = q; break; }
-          }
-          if (a && b) arcs.push({ a: a, b: b, phase: Math.random() });
-        }
-      }
-
-      function draw(t) {
-        ctx.clearRect(0, 0, W, H);
-        ctx.fillStyle = '#8C8C88';
-        ctx.globalAlpha = 0.44;
-        for (var i = 0; i < dots.length; i++) { ctx.beginPath(); ctx.arc(dots[i][0], dots[i][1], 1.05, 0, 6.2832); ctx.fill(); }
-        for (var j = 0; j < arcs.length; j++) {
-          var arc = arcs[j], a = arc.a, b = arc.b;
-          var span = Math.hypot(a[0] - b[0], a[1] - b[1]);
-          var mx = (a[0] + b[0]) / 2, my = (a[1] + b[1]) / 2 - span * 0.34;
-          ctx.globalAlpha = 0.2; ctx.strokeStyle = '#F0522E'; ctx.lineWidth = 1;
-          ctx.beginPath(); ctx.moveTo(a[0], a[1]); ctx.quadraticCurveTo(mx, my, b[0], b[1]); ctx.stroke();
-          ctx.fillStyle = '#F0522E'; ctx.globalAlpha = 0.7;
-          ctx.beginPath(); ctx.arc(a[0], a[1], 2, 0, 6.2832); ctx.fill();
-          ctx.beginPath(); ctx.arc(b[0], b[1], 2, 0, 6.2832); ctx.fill();
-          if (!reduce) {
-            var tt = (t * 0.00014 + arc.phase) % 1, u = 1 - tt;
-            var qx = u * u * a[0] + 2 * u * tt * mx + tt * tt * b[0];
-            var qy = u * u * a[1] + 2 * u * tt * my + tt * tt * b[1];
-            ctx.globalAlpha = 0.22; ctx.beginPath(); ctx.arc(qx, qy, 6.5, 0, 6.2832); ctx.fill();
-            ctx.globalAlpha = 1; ctx.beginPath(); ctx.arc(qx, qy, 2.6, 0, 6.2832); ctx.fill();
-          }
-        }
-        ctx.globalAlpha = 1;
-        if (!reduce) raf = requestAnimationFrame(draw);
-      }
-
-      build();
-      window.addEventListener('resize', function() { build(); if (reduce) draw(0); });
-      if (reduce) draw(0); else raf = requestAnimationFrame(draw);
-    }).catch(function() { /* map is decorative - silently fall back to the panel without it */ });
-  })();
-})();
-</script>`;
+<script src="/js/home-hero.js"></script>`;
 
   return ledgerShell({ title, description, canonical, baseUrl, activePath: "", jsonLd: [orgLd, websiteLd, appLd, datasetLd, surfacesLd, faqLd], extraCss, body });
 }
diff --git a/src/ledger-pricing.js b/src/ledger-pricing.js
index 8b9e353a..92db93c6 100644
--- a/src/ledger-pricing.js
+++ b/src/ledger-pricing.js
@@ -74,7 +74,7 @@ export function ledgerPricingPage(baseUrl, catalog) {
   </section>
 
   <!-- TWO PLANS -->
-  <section style="max-width:1180px;margin:0 auto;padding:0 30px;">
+  <section data-reveal-eager style="max-width:1180px;margin:0 auto;padding:0 30px;">
     <div class="ml-pricing-plans" style="display:grid;grid-template-columns:1fr 1fr;gap:0;border:1.5px solid var(--ink);">
       <!-- FREE -->
       <div style="padding:30px;border-right:1.5px solid var(--ink);background:var(--card);">
diff --git a/src/market-page.js b/src/market-page.js
index db65cb56..ef4e992d 100644
--- a/src/market-page.js
+++ b/src/market-page.js
@@ -35,7 +35,9 @@ const ROSTER_CSS = `
 .mlr-badge{background:var(--accent);color:#fff;font-family:var(--font-mono);font-size:10px;font-weight:700;padding:1px 5px}
 .mlr-mpp{border:1px solid var(--green);color:var(--green);font-family:var(--font-mono);font-size:10px;font-weight:700;padding:0 4px;margin-left:4px}
 .ml-chain-h1-wrap{min-height:80px}
-@media (max-width: 900px) { .ml-chain-h1-wrap{min-height:120px} }`;
+@media (max-width: 900px) { .ml-chain-h1-wrap{min-height:120px} }
+.mkt-search-wrap{border:1.5px solid var(--ink)}
+.mkt-search-wrap:focus-within{border-color:var(--accent)}`;
 
 const esc = (s) => String(s ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 // Crawled manifests are third-party input: only http(s) may become an href.
@@ -371,26 +373,7 @@ export function marketFilterBar(chainKey, _baseUrl) {
     <select class="mfb-sel" data-mfb-sort><option value="calls">most settled</option><option value="usd">volume</option><option value="buyers">buyers</option><option value="tools">tools</option><option value="health">health</option></select>
     <input class="mfb-search" data-mfb-search placeholder="search sellers">
   </div>
-  <script>document.addEventListener('DOMContentLoaded',function(){
-  var rows=Array.prototype.slice.call(document.querySelectorAll('[data-mfb-row]'));
-  if(!rows.length)return;
-  var parent=rows[0].parentNode;
-  var num=function(el,k){var v=Number(el.getAttribute('data-'+k));return isFinite(v)?v:0;};
-  var sortSel=document.querySelector('select[data-mfb-sort]');
-  if(sortSel)sortSel.addEventListener('change',function(){
-    var k=sortSel.value;
-    rows.slice().sort(function(a,b){
-      if(k==='health'&&num(a,'health')!==num(b,'health'))return num(b,'health')-num(a,'health');
-      var m=k==='health'?'calls':k;
-      return num(b,m)-num(a,m);
-    }).forEach(function(r){parent.appendChild(r);});
-  });
-  var searchIn=document.querySelector('input[data-mfb-search]');
-  if(searchIn)searchIn.addEventListener('input',function(){
-    var q=searchIn.value.trim().toLowerCase();
-    rows.forEach(function(r){r.style.display=!q||(r.textContent||'').toLowerCase().indexOf(q)>-1?'':'none';});
-  });
-});</script>`;
+  <script src="/js/market-filter-bar.js"></script>`;
 }
 
 function categoryGroups(tools, { maxCategories = 12, maxPerCategory = 6 } = {}) {
@@ -773,24 +756,14 @@ export function marketPage(chainKey, baseUrl, opts = {}) {
   const formHtml = `
   <div id="list-api" style="border:1.5px solid var(--ink);background:var(--card);padding:18px 20px;margin-top:16px;">
     <div style="font-weight:800;font-size:15px;margin-bottom:8px;">List your API</div>
+    <label for="reg-origin" style="display:block;font-family:var(--font-mono);font-size:11px;color:var(--faint);text-transform:uppercase;letter-spacing:.08em;margin-bottom:6px;">Your API's origin</label>
     <div style="display:flex;gap:10px;">
       <input id="reg-origin" type="url" placeholder="https://api.yourdomain.com" style="flex:1;font-family:var(--font-mono);font-size:13px;padding:9px 12px;border:1.5px solid var(--ink);background:var(--paper);color:var(--ink);">
       <button id="reg-go" style="background:var(--surface);color:var(--on-dark);font-family:var(--font-mono);font-weight:700;font-size:13px;border:none;padding:9px 16px;cursor:pointer;">SUBMIT</button>
     </div>
-    <div id="reg-out" style="font-family:var(--font-mono);font-size:12.5px;color:var(--muted);margin-top:8px;">Free, no account - we probe your origin's x402 surface and list you if it answers. Ranking is health-based.</div>
+    <div id="reg-out" role="status" aria-live="polite" data-listed-note="${esc(C.chainName)} sellers appear on this page; all sellers appear on /index." style="font-family:var(--font-mono);font-size:12.5px;color:var(--muted);margin-top:8px;">Free, no account - we probe your origin's x402 surface and list you if it answers. Ranking is health-based.</div>
   </div>
-  <script>
-  document.getElementById("reg-go").addEventListener("click", async () => {
-    const out = document.getElementById("reg-out");
-    out.textContent = "probing…";
-    try {
-      const r = await fetch("/api/index/register", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ origin: document.getElementById("reg-origin").value }) });
-      const j = await r.json();
-      const n = j.seller?.toolCount || 0;
-      out.textContent = j.listed ? ("Listed - " + (j.seller?.displayName || j.origin) + " (" + n + " tool" + (n === 1 ? "" : "s") + "). ${C.chainName} sellers appear on this page; all sellers appear on /index.") : ("Not listed: " + (j.error || "unknown error"));
-    } catch { out.textContent = "submission failed - try again"; }
-  });
-  </script>`;
+  <script src="/js/reg-form.js"></script>`;
 
   const canary = canaryManifestStatus(rail);
   const manifestRow = (label, value) => `<div style="display:flex;align-items:baseline;gap:8px;"><span style="color:var(--muted);flex:none;">${label}</span><span style="flex:1;border-bottom:1.5px dotted var(--dash);transform:translateY(-4px);"></span><span style="font-weight:700;min-width:0;overflow-wrap:anywhere;text-align:right;">${value}</span></div>`;
@@ -830,7 +803,7 @@ export function marketPage(chainKey, baseUrl, opts = {}) {
       <p style="font-size:16.5px;color:var(--muted);margin:0;max-width:640px;">${subheadHtml}</p>
       <div style="margin:16px 0 0;padding:16px 18px;border:1.5px solid var(--ink);background:var(--card);">
         <div style="font-family:var(--font-mono);font-size:11px;letter-spacing:.1em;color:var(--faint);margin-bottom:10px;">START HERE · BUYER PATH</div>
-        <form action="/tools" method="get" style="display:flex;gap:0;border:1.5px solid var(--ink);background:var(--paper);max-width:520px;margin-bottom:12px;">
+        <form action="/tools" method="get" class="mkt-search-wrap" style="display:flex;gap:0;background:var(--paper);max-width:520px;margin-bottom:12px;">
           <input name="q" type="search" placeholder="what do you need? e.g. pdf ocr, web search" style="flex:1;border:none;background:transparent;font-family:var(--font-mono);font-size:13px;color:var(--ink);padding:11px 14px;outline:none;" />
           <button type="submit" style="border:none;border-left:1.5px solid var(--ink);background:var(--surface);color:var(--on-dark);font-family:var(--font-mono);font-weight:700;font-size:12px;padding:0 16px;cursor:pointer;">FIND →</button>
         </form>
@@ -880,7 +853,7 @@ export function marketPage(chainKey, baseUrl, opts = {}) {
 <div style="max-width:1080px;margin:0 auto;padding:36px 24px;">
   <section>${headerHtml}</section>
   <section>
-    <div id="market-panel">${marketPanelHtml(chainKey, { snapshot, activity, selectedSeller, leaderboardSnap })}</div>
+    <div id="market-panel" data-chain="${esc(chainKey)}">${marketPanelHtml(chainKey, { snapshot, activity, selectedSeller, leaderboardSnap })}</div>
 
     ${rosterHtml}
   </section>
@@ -895,33 +868,7 @@ export function marketPage(chainKey, baseUrl, opts = {}) {
 
   <p style="font-family:var(--font-mono);font-size:12px;color:var(--faint);margin-top:28px;">machine-readable: <a href="/api/route?q=hash&amp;network=${esc(C.networkParam)}">/api/route?network=${esc(C.networkParam)}</a> · <a href="/.well-known/x402">/.well-known/x402</a> · <a href="/openapi.json">/openapi.json</a> · <a href="/api/reliability">/api/reliability</a></p>
 </div>
-<script>(function(){
-  // In-place seller switching: fetch the same-origin, server-rendered (and fully
-  // escaped) market panel and swap it without a full reload. Progressive
-  // enhancement - the roster links are real hrefs, so this whole block is a
-  // no-op fallback to normal navigation when JS/fetch/history are unavailable
-  // or a request fails. Content is parsed with createContextualFragment +
-  // replaceChildren (not innerHTML); it is our own output, never user input.
-  var CHAIN=${JSON.stringify(chainKey)}, panel=document.getElementById('market-panel');
-  if(!panel||!window.fetch||!window.history||!history.pushState||!document.createRange().createContextualFragment)return;
-  function loading(on){panel.style.transition='opacity .15s';panel.style.opacity=on?'.5':'';}
-  function mark(host){document.querySelectorAll('[data-seller-link]').forEach(function(a){var h=a.getAttribute('data-seller-host')||'';a.classList.toggle('sel',host?(h===host):(a.getAttribute('data-seller-local')==='1'));});}
-  function swap(html){panel.replaceChildren(document.createRange().createContextualFragment(html));}
-  function load(host,push){
-    loading(true);
-    return fetch('/api/market/'+CHAIN+'/panel'+(host?('?seller='+encodeURIComponent(host)):''),{headers:{accept:'application/json'}})
-      .then(function(r){if(!r.ok)throw 0;return r.json();})
-      .then(function(j){swap(j.html);mark(host);loading(false);
-        if(push){var u=host?(location.pathname.split('?')[0]+'?seller='+encodeURIComponent(host)):location.pathname.split('?')[0];history.pushState({s:host},'',u+'#activity');var el=document.getElementById('activity');if(el)el.scrollIntoView({behavior:'smooth',block:'start'});}
-        return true;});
-  }
-  document.addEventListener('click',function(e){
-    var a=e.target.closest&&e.target.closest('[data-seller-link]');if(!a)return;
-    e.preventDefault();var host=a.getAttribute('data-seller-host')||'';
-    load(host,true).catch(function(){window.location.href=a.getAttribute('href');});
-  });
-  window.addEventListener('popstate',function(){var m=location.search.match(/[?&]seller=([^&#]+)/);load(m?decodeURIComponent(m[1]):'',false).catch(function(){location.reload();});});
-})();</script>
+<script src="/js/market-seller-switch.js"></script>
 ${ledgerFooterCompact()}`;
 
   return ledgerShell({
@@ -1166,7 +1113,7 @@ function marketPageAll(baseUrl, { snapshot, leaderboardSnap, economySnap, all =
     <p style="font-size:16.5px;color:var(--muted);margin:0;max-width:640px;">The open index of paid APIs for agentic commerce - ${baseSellerCount.toLocaleString("en-US")} sellers on Base alone, theirs as well as ours, with what they charge and what they have actually settled.</p>
     <div style="margin:18px 0 0;padding:16px 18px;border:1.5px solid var(--ink);background:var(--card);max-width:640px;">
       <div style="font-family:var(--font-mono);font-size:11px;letter-spacing:.1em;color:var(--faint);margin-bottom:10px;">START HERE · BUYER PATH</div>
-      <form action="/tools" method="get" style="display:flex;gap:0;border:1.5px solid var(--ink);background:var(--paper);margin-bottom:12px;">
+      <form action="/tools" method="get" class="mkt-search-wrap" style="display:flex;gap:0;background:var(--paper);margin-bottom:12px;">
         <span aria-hidden="true" style="display:flex;align-items:center;padding:0 0 0 13px;color:var(--faint);"><svg width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" style="display:block;"><circle cx="11" cy="11" r="7"></circle><path d="M20 20l-4.5-4.5"></path></svg></span>
         <input name="q" type="search" placeholder="what do you need? e.g. pdf ocr, web search" style="flex:1;min-width:0;border:none;background:transparent;font-family:var(--font-mono);font-size:13px;color:var(--ink);padding:11px 12px;outline:none;" />
         <button type="submit" style="border:none;border-left:1.5px solid var(--ink);background:var(--surface);color:var(--on-dark);font-family:var(--font-mono);font-weight:700;font-size:12px;padding:0 16px;cursor:pointer;white-space:nowrap;">FIND →</button>
diff --git a/src/mpp-shim.js b/src/mpp-shim.js
index 34b42f34..ca1243b0 100644
--- a/src/mpp-shim.js
+++ b/src/mpp-shim.js
@@ -51,10 +51,22 @@ const STABLECOIN_DECIMALS = 6;
 // crawler-swept response) — so the default covers exactly what stock clients
 // can pay. MPP_CHALLENGE_NETWORKS overrides: "all" (every eip155 accepts
 // entry) or a CSV of chain ids. Call-time read, like other rollout knobs.
+//
+// VERIFIED against the installed mppx@0.8.17 source (2026-08-16, previously
+// an unconfirmed in-code claim): `mppx/evm`'s Chains.ts defines exactly four
+// chain ids (base 8453, baseSepolia 84532, celo 42220, celoSepolia
+// 11142220), and Assets.ts's known-USDC registry covers only those same four
+// - a stock client's Charge.ts resolves an accepted currency via
+// Assets.matches() against ONLY this registry, so a challenge for any other
+// chain has nothing for it to auto-sign without the caller manually passing
+// a raw address + explicit network override. Mainnets only, hence {8453,
+// 42220}. scripts/test-mpp-shim-mppx-registry.js locks this against the
+// installed package so a future mppx bump that adds a mainnet fails loudly
+// here instead of silently leaving that chain's challenge unoffered.
 const DEFAULT_CHALLENGE_CHAIN_IDS = new Set([8453, 42220]);
 
 /** @param {number} chainId */
-function challengeEnabledForChain(chainId) {
+export function challengeEnabledForChain(chainId) {
   const raw = (process.env.MPP_CHALLENGE_NETWORKS || "").trim();
   if (!raw) return DEFAULT_CHALLENGE_CHAIN_IDS.has(chainId);
   if (raw.toLowerCase() === "all") return true;
diff --git a/src/operator.js b/src/operator.js
index 05bad11e..86d056f5 100644
--- a/src/operator.js
+++ b/src/operator.js
@@ -3,7 +3,7 @@
 // AGENT402_OPERATOR_TOKEN via a Secure/HttpOnly/SameSite session cookie set at
 // POST /__operator/login (never a ?token= URL — security audit A402-07).
 // Nothing here is shown publicly; /api/stats remains the safe public surface.
-import { ledgerShell, ledgerFooterCompact, esc } from "./ledger-chrome.js";
+import { ledgerShell, ledgerFooterCompact, esc, jsonScriptTag } from "./ledger-chrome.js";
 
 // Minimal, unauthenticated login form. The operator pastes the token; it is
 // POSTed as JSON to /__operator/login (body, not URL) which validates it and
@@ -29,17 +29,7 @@ export function operatorLoginPage(baseUrl) {
     <div class="opl-err" id="e"></div>
   </form>
 </div>
-<script>
-(function(){
-  var f=document.getElementById('f'), t=document.getElementById('t'), e=document.getElementById('e');
-  f.addEventListener('submit', function(ev){
-    ev.preventDefault(); e.textContent='';
-    fetch('/__operator/login',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({token:t.value})})
-      .then(function(r){ if(r.ok){ location.href='/__operator'; } else { e.textContent='Invalid token.'; } })
-      .catch(function(){ e.textContent='Sign-in failed.'; });
-  });
-})();
-</script>
+<script src="/js/operator-login.js"></script>
 ${ledgerFooterCompact()}`;
   return ledgerShell({
     title: "Operator sign-in - Agent402",
@@ -56,6 +46,13 @@ export function operatorPage(baseUrl, data) {
   const t = data?.totals || {};
   const tools = Array.isArray(data?.tools) ? data.tools : [];
   const recent = Array.isArray(data?.recentCalls) ? data.recentCalls : [];
+  // Call-volume and revenue are different leaderboards - the per-tool table
+  // below defaults to sorting by calls, which silently doubles as a revenue
+  // proxy unless someone thinks to click the Revenue header. Surfacing both
+  // top-5s side by side makes the divergence visible at a glance.
+  const topByRevenue = [...tools].sort((a, b) => b.revenueUsd - a.revenueUsd).slice(0, 5);
+  const topByCalls = [...tools].sort((a, b) => b.calls - a.calls).slice(0, 5);
+  const railBreakdown = Array.isArray(data?.railBreakdown) ? data.railBreakdown : [];
   const badge = (r) => r.walletOnly
     ? `<span class="op-badge op-badge-wallet" title="USDC only - no proof-of-work path">USDC-ONLY</span>`
     : `<span class="op-badge op-badge-pow" title="Also payable with proof-of-work (free tier)">FREE-W/POW</span>`;
@@ -130,9 +127,9 @@ td a:hover{color:var(--accent)}
   <div class="op-stat"><div class="op-k">USDC settled</div><div class="op-v" id="t-usdc">${esc(t.viaUSDC ?? 0)}</div><div class="op-s">on-chain proof at wallet</div></div>
   <div class="op-stat"><div class="op-k">PoW (external)</div><div class="op-v" id="t-pow">${esc(t.viaProofOfWork ?? 0)}</div><div class="op-s">real free-tier adoption</div></div>
   <div class="op-stat"><div class="op-k">Heartbeat probes</div><div class="op-v" id="t-hb">${esc(t.viaHeartbeat ?? 0)}</div><div class="op-s">internal /api/hash probe</div></div>
-  <div class="op-stat"><div class="op-k">Estimated revenue</div><div class="op-v" id="t-rev">$${esc((t.estimatedRevenueUsd ?? 0).toFixed ? t.estimatedRevenueUsd.toFixed(4) : t.estimatedRevenueUsd)}</div><div class="op-s">counter; chain is truth</div></div>
+  <div class="op-stat"><div class="op-k">Estimated revenue</div><div class="op-v" id="t-rev">$${esc((t.estimatedRevenueUsd ?? 0).toFixed(4))}</div><div class="op-s">counter; chain is truth</div></div>
   <div class="op-stat"><div class="op-k">Tools served</div><div class="op-v" id="t-tools">${esc(t.toolsServed ?? 0)}</div><div class="op-s">distinct slugs</div></div>
-  <div class="op-stat"><div class="op-k">Uptime</div><div class="op-v" id="t-up">${esc(Math.floor((data?.uptimeSeconds ?? 0) / 3600))}h</div><div class="op-s">since process boot</div></div>
+  <div class="op-stat"><div class="op-k">Uptime</div><div class="op-v" id="t-up">${esc(Math.floor((data?.processUptimeSeconds ?? 0) / 3600))}h</div><div class="op-s">since process boot</div></div>
 </div>
 
 <div class="op-layout">
@@ -150,71 +147,35 @@ td a:hover{color:var(--accent)}
   </div>
 </div>
 
-<script>
-(function(){
-  // The session cookie authenticates same-origin requests automatically; nav is
-  // plain links and the refresh below needs no token handling.
-  function esc(t){ return String(t==null?'':t).replace(/[&<>"']/g,function(c){return({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'})[c];}); }
-  var tbody=document.getElementById('tbody');
-  var feed=document.getElementById('feed');
-  var sortK='calls', sortDir=-1, rowsCache=${JSON.stringify(tools)};
+<div class="op-layout" style="margin-top:18px">
+  <div class="op-panel">
+    <div class="op-ph"><h2>Top by revenue vs top by calls</h2></div>
+    <div style="display:grid;grid-template-columns:1fr 1fr;gap:0">
+      <div style="border-right:1px solid var(--dark-border)">
+        <div style="padding:8px 14px;color:var(--dk-muted);font-family:var(--font-mono);font-size:11px;text-transform:uppercase;letter-spacing:.04em;border-bottom:1px solid var(--dark-border)">By revenue</div>
+        <ol style="list-style:none;margin:0;padding:0">${topByRevenue.length ? topByRevenue.map((r) => `<li style="padding:8px 14px;border-bottom:1px solid var(--dark-border);font-family:var(--font-mono);font-size:13px;display:flex;justify-content:space-between;gap:8px"><a href="/tools/${esc(r.slug)}" style="color:var(--on-dark);text-decoration:none">${esc(r.slug)}</a><span class="op-rev">$${esc(r.revenueUsd.toFixed(4))}</span></li>`).join("") : `<li style="padding:16px;text-align:center;color:var(--dk-muted)">No data yet.</li>`}</ol>
+      </div>
+      <div>
+        <div style="padding:8px 14px;color:var(--dk-muted);font-family:var(--font-mono);font-size:11px;text-transform:uppercase;letter-spacing:.04em;border-bottom:1px solid var(--dark-border)">By calls</div>
+        <ol style="list-style:none;margin:0;padding:0">${topByCalls.length ? topByCalls.map((r) => `<li style="padding:8px 14px;border-bottom:1px solid var(--dark-border);font-family:var(--font-mono);font-size:13px;display:flex;justify-content:space-between;gap:8px"><a href="/tools/${esc(r.slug)}" style="color:var(--on-dark);text-decoration:none">${esc(r.slug)}</a><span class="op-muted">${esc(r.calls)}</span></li>`).join("") : `<li style="padding:16px;text-align:center;color:var(--dk-muted)">No data yet.</li>`}</ol>
+      </div>
+    </div>
+  </div>
 
-  function renderRows(){
-    var q=(document.getElementById('filter').value||'').toLowerCase();
-    var rs=rowsCache.filter(function(r){ return !q || r.slug.toLowerCase().indexOf(q)>=0; });
-    rs.sort(function(a,b){
-      var k=sortK==='price'?'pricePerCall':(sortK==='rev'?'revenueUsd':sortK);
-      var av=a[k], bv=b[k];
-      if(typeof av==='string') return sortDir*av.localeCompare(bv);
-      return sortDir*((av||0)-(bv||0));
-    });
-    var html = rs.length ? rs.map(function(r){
-      var b = r.walletOnly
-        ? '<span class="op-badge op-badge-wallet" title="USDC only">USDC-ONLY</span>'
-        : '<span class="op-badge op-badge-pow" title="Also payable with proof-of-work">FREE-W/POW</span>';
-      return '<tr><td><a href="/tools/'+esc(r.slug)+'">'+esc(r.slug)+'</a> '+b+'</td>'+
-        '<td class="num">'+esc(r.calls)+'</td>'+
-        '<td class="num op-paid">'+esc(r.paid)+'</td>'+
-        '<td class="num op-pow">'+esc(r.pow)+'</td>'+
-        '<td class="num op-hb">'+esc(r.heartbeat||0)+'</td>'+
-        '<td class="num op-rev">$'+esc(r.revenueUsd.toFixed(4))+'</td>'+
-        '<td class="num op-muted">$'+esc(r.pricePerCall.toFixed(4))+'</td></tr>';
-    }).join('') : '<tr><td colspan="7" class="op-muted" style="padding:24px;text-align:center;">No matches.</td></tr>';
-    tbody.innerHTML = html; /* eslint-disable-line -- pre-existing AJAX table refresh; all values esc()-d */
-  }
-  document.getElementById('filter').addEventListener('input', renderRows);
-  document.querySelectorAll('th[data-k]').forEach(function(th){
-    th.addEventListener('click', function(){
-      var k=th.getAttribute('data-k');
-      if(sortK===k) sortDir=-sortDir; else { sortK=k; sortDir=-1; }
-      renderRows();
-    });
-  });
+  <div class="op-panel">
+    <div class="op-ph"><h2>Rails offered vs settled</h2></div>
+    <div style="max-height:280px;overflow:auto">
+      <table>
+        <thead><tr><th>Rail</th><th class="num">Settled calls</th></tr></thead>
+        <tbody>${railBreakdown.length ? railBreakdown.map((r) => `<tr><td>${esc(r.network)}${r.settledCalls === 0 ? ` <span class="op-badge" style="background:rgba(184,132,46,.14);color:#b8842e;border:1px solid rgba(184,132,46,.35)">ZERO REVENUE</span>` : ""}</td><td class="num${r.settledCalls === 0 ? " op-muted" : " op-paid"}">${esc(r.settledCalls)}</td></tr>`).join("") : `<tr><td colspan="2" class="op-muted" style="padding:16px;text-align:center">No configured rails.</td></tr>`}</tbody>
+      </table>
+    </div>
+    <p style="padding:10px 14px;margin:0;color:var(--dk-muted);font-size:12px;border-top:1px solid var(--dark-border)">Rails currently in PAYMENT_NETWORKS with zero lifetime settled calls still carry facilitator config, canary legs, and test maintenance for zero return.</p>
+  </div>
+</div>
 
-  async function tick(){
-    try {
-      var r=await fetch('/__operator/stats',{cache:'no-store'});
-      if(!r.ok) return;
-      var d=await r.json();
-      var tt=d.totals||{};
-      document.getElementById('t-total').textContent=tt.total||0;
-      document.getElementById('t-usdc').textContent=tt.viaUSDC||0;
-      document.getElementById('t-pow').textContent=tt.viaProofOfWork||0;
-      document.getElementById('t-hb').textContent=tt.viaHeartbeat||0;
-      document.getElementById('t-rev').textContent='$'+((tt.estimatedRevenueUsd||0).toFixed(4));
-      document.getElementById('t-tools').textContent=tt.toolsServed||0;
-      document.getElementById('t-up').textContent=Math.floor((d.uptimeSeconds||0)/3600)+'h';
-      rowsCache=d.tools||[]; renderRows();
-      var feedHtml=(d.recentCalls||[]).map(function(x){
-        var m=x.paidWith==='proof-of-work'?'PoW':x.paidWith==='heartbeat'?'HB':'$ USDC';
-        return '<li><span class="op-rs">'+esc(x.slug)+'</span><span class="op-rm">'+m+'</span><span class="op-ra">'+esc(x.at)+'</span></li>';
-      }).join('') || '<li style="text-align:center;color:var(--dk-muted);padding:16px;">No recent activity.</li>';
-      feed.innerHTML = feedHtml; /* eslint-disable-line -- pre-existing AJAX feed refresh; all values esc()-d */
-    } catch(e) { /* ignore */ }
-  }
-  setInterval(tick, 10000);
-})();
-</script>
+${jsonScriptTag("op-rows-data", tools)}
+<script src="/js/operator-dashboard.js"></script>
 
 </div>
 ${ledgerFooterCompact()}`;
diff --git a/src/pages.js b/src/pages.js
index a39f91dc..bf9c729b 100644
--- a/src/pages.js
+++ b/src/pages.js
@@ -385,10 +385,10 @@ ${renderHeader("/tools")}
   <div class="crumb"><a href="/">Agent402</a> / tools</div>
   <h1>${tools.length} tools, one base URL, zero API keys</h1>
   <p class="sub">Call any endpoint, get an <code>HTTP 402</code> quote, and either pay a fraction of a cent in ${RAILS_PAREN} via <a href="https://x402.org" rel="noopener">x402</a> - or, on the <span class="free">FREE</span> tools, skip the wallet entirely. The catalog is capped - every tool here earns its place and answers its own example on every deploy. Machine-readable: <a href="/api/pricing">/api/pricing</a> · <a href="/openapi.json">/openapi.json</a> · <a href="/llms.txt">/llms.txt</a>.</p>
-  <div style="margin:18px 0"><input id="tool-search" type="text" placeholder="Search ${tools.length} tools\u2026" style="width:100%;max-width:480px;padding:10px 16px;background:#0d1220;border:1px solid #1e2638;border-radius:10px;color:#e6e9f0;font-size:.95rem;outline:none;" onfocus="this.style.borderColor='#4ade80'" onblur="this.style.borderColor='#1e2638'"><span id="tool-search-count" style="margin-left:12px;color:#8b93a7;font-size:.85rem"></span></div>
+  <div style="margin:18px 0"><input id="tool-search" type="text" placeholder="Search ${tools.length} tools\u2026" style="width:100%;max-width:480px;padding:10px 16px;background:#0d1220;border:1px solid #1e2638;border-radius:10px;color:#e6e9f0;font-size:.95rem;outline:none;"><span id="tool-search-count" style="margin-left:12px;color:#8b93a7;font-size:.85rem"></span></div>
   <div class="callout"><b>${freeCount} of ${tools.length} tools are free</b> - no wallet needed. Pay with a few seconds of <a href="/api/pow">proof-of-work</a> (CPU) instead of USDC. The other ${tools.length - freeCount} (browser, network, memory) settle in USDC because they cost real infrastructure to run. Look for the <span class="free">FREE</span> badge below.</div>
   ${sections}
-  <script>(function(){var input=document.getElementById('tool-search'),count=document.getElementById('tool-search-count');if(!input)return;input.addEventListener('input',function(){var q=this.value.toLowerCase().trim();var cards=document.querySelectorAll('.card');var sections=document.querySelectorAll('h2');var shown=0;cards.forEach(function(c){var text=(c.textContent||'').toLowerCase();var match=!q||text.indexOf(q)!==-1;c.style.display=match?'':'none';if(match)shown++;});sections.forEach(function(s){if(!q){s.style.display='';return;}var next=s.nextElementSibling;while(next&&!next.matches('h2')){if(next.classList&&next.classList.contains('grid')){var vis=next.querySelectorAll('.card:not([style*="display: none"])');s.style.display=vis.length?'':'none';break;}if(next.classList&&next.classList.contains('cat-blurb')){next.style.display=s.style.display;next=next.nextElementSibling;continue;}next=next.nextElementSibling;}});count.textContent=q?shown+' match'+(shown===1?'':'es'):'';});})();</script>
+  <script src="/js/pages-tool-search.js"></script>
 </div>
 ${renderFooter()}
 </body>
@@ -588,15 +588,38 @@ export function openapiSpec(baseUrl, catalog) {
     };
     const props = discovery?.inputSchema?.properties ?? {};
     const required = discovery?.inputSchema?.required ?? [];
+    // Every route accepts Idempotency-Key; only PoW-eligible (non-wallet-only)
+    // routes accept X-Pow-Solution as an alternative to x402 payment. Neither
+    // was declared as a parameter before - a caller had to already know these
+    // headers exist from prose docs, not from the machine-readable spec.
+    const headerParams = [
+      {
+        name: "Idempotency-Key",
+        in: "header",
+        required: false,
+        description: "Optional client-supplied key. Replaying the same key with the same payment/PoW credential and request body returns the original result instead of charging again.",
+        schema: { type: "string" },
+      },
+      ...(isComputePayable(tool) ? [{
+        name: "X-Pow-Solution",
+        in: "header",
+        required: false,
+        description: `Free-tier alternative to x402 payment: "<token>:<nonce>" from a solved proof-of-work challenge (GET /api/pow/challenge). Omit when paying via x402.`,
+        schema: { type: "string" },
+      }] : []),
+    ];
     if (method === "GET") {
-      op.parameters = Object.entries(props).map(([name, schema]) => ({
-        name,
-        in: "query",
-        required: required.includes(name),
-        description: schema.description,
-        schema: { type: schema.type === "number" ? "number" : "string" },
-        ...(discovery?.input?.[name] !== undefined ? { example: discovery.input[name] } : {}),
-      }));
+      op.parameters = [
+        ...Object.entries(props).map(([name, schema]) => ({
+          name,
+          in: "query",
+          required: required.includes(name),
+          description: schema.description,
+          schema: { type: schema.type === "number" ? "number" : "string" },
+          ...(discovery?.input?.[name] !== undefined ? { example: discovery.input[name] } : {}),
+        })),
+        ...headerParams,
+      ];
     } else {
       op.requestBody = {
         required: true,
@@ -607,6 +630,7 @@ export function openapiSpec(baseUrl, catalog) {
           },
         },
       };
+      op.parameters = headerParams;
     }
     paths[path] = paths[path] ?? {};
     paths[path][method.toLowerCase()] = op;
diff --git a/src/payments.js b/src/payments.js
index b792e3a1..6ecba8a1 100644
--- a/src/payments.js
+++ b/src/payments.js
@@ -1156,9 +1156,28 @@ export async function buildPaymentMiddleware({ walletAddress, network, baseUrl,
  * BEFORE the facilitator settles, so a blocked wallet is never charged — the
  * buyer gets the standard settle-failure 402 whose receipt carries
  * errorReason "wallet_blocked" (which the tally middleware records as a
- * settle_failed event, so blocks are visible in PostHog). EVM payers are
- * matched from the signature-covered EIP-3009 authorization.from; other
- * schemes match when their payload carries a recognizable payer field.
+ * settle_failed event, so blocks are visible in PostHog).
+ *
+ * NON-EVM PAYER ENRICHMENT (2026-08-16): beforeSettle only ever receives the
+ * raw, UNVERIFIED client payload (@x402/core's settlePayment() builds its own
+ * { paymentPayload, ... } context straight from the caller's argument — it
+ * never carries the verify() result). For SVM/Stellar/AVM's exact schemes the
+ * payer is never on that raw payload at all — it's derived by decoding the
+ * signed transaction, and only appears as a `payer` field on the verify
+ * RESULT (confirmed directly against the installed SDKs: @x402/svm, /stellar
+ * and /avm's facilitator verify() all return `{ isValid: true, payer }`).
+ * Before this fix, blockedPayerFromPayload only ever matched EVM's
+ * signature-covered authorization.from — a blocked wallet trivially evaded
+ * the ban by paying on Solana, Stellar, or Algorand instead.
+ * registerWalletBlocklistPayerEnrichment below closes that gap the only way
+ * @x402/core's hook API allows: onAfterVerify DOES receive the verify result,
+ * but can't itself abort settlement (a thrown/rejecting hook there is caught
+ * and only logged - see runAfterVerifyHooks). So it stashes the verified
+ * payer directly onto the SAME paymentPayload object instance that
+ * beforeSettle will receive moments later in the same request (verifyPayment
+ * and settlePayment both build their context from the exact object reference
+ * passed in by the caller - never a clone - so this is safe, request-scoped,
+ * and needs no external cache/keying).
  */
 export function blockedPayerFromPayload(paymentPayload) {
   const raw = (process.env.WALLET_BLOCKLIST || "").trim();
@@ -1171,6 +1190,7 @@ export function blockedPayerFromPayload(paymentPayload) {
     paymentPayload?.payload?.authorization?.from, // EVM exact scheme (signature-covered)
     paymentPayload?.payload?.payer,
     paymentPayload?.payer,
+    paymentPayload?.__verifiedPayer, // SVM/Stellar/AVM — see registerWalletBlocklistPayerEnrichment
   ];
   for (const c of candidates) {
     const normalized = normalizePayerAddress(c);
@@ -1179,7 +1199,22 @@ export function blockedPayerFromPayload(paymentPayload) {
   return null;
 }
 
+export function registerWalletBlocklistPayerEnrichment(server) {
+  server.onAfterVerify((ctx) => {
+    const payer = ctx?.result?.payer;
+    const payload = ctx?.paymentPayload;
+    if (payer && payload && !payload.payload?.authorization?.from) {
+      try {
+        payload.__verifiedPayer = payer;
+      } catch {
+        /* non-extensible payload object — blocklist just won't cover this one payment */
+      }
+    }
+  });
+}
+
 function registerWalletBlocklistHook(server) {
+  registerWalletBlocklistPayerEnrichment(server);
   server.onBeforeSettle((ctx) => {
     const blocked = blockedPayerFromPayload(ctx?.paymentPayload);
     if (!blocked) return;
diff --git a/src/playground.js b/src/playground.js
index 41be3333..51532d52 100644
--- a/src/playground.js
+++ b/src/playground.js
@@ -9,7 +9,7 @@
 // user-controlled values never reach the DOM un-escaped. This pattern is
 // carried over from the original pre-migration code.
 
-import { ledgerShell, ledgerFooterCompact, esc } from "./ledger-chrome.js";
+import { ledgerShell, ledgerFooterCompact, esc, jsonScriptTag } from "./ledger-chrome.js";
 import { toolList } from "./pages.js";
 import { isComputePayable } from "./pow.js";
 
@@ -43,10 +43,6 @@ export function playgroundPage(baseUrl, catalog) {
         : undefined,
     };
   });
-  // Neutralize </script> so a tool description cannot break out of the inline
-  // script tag. JSON.stringify already escapes quotes; this is the HTML trap.
-  const toolsJson = JSON.stringify(toolsPayload).replace(/</g, "\\u003c");
-
   const extraCss = `
   .crumb{max-width:1180px;margin:0 auto;padding:18px 30px 0;font-family:var(--font-mono);font-size:.85rem;color:var(--faint)}
   .crumb a{color:var(--faint);text-decoration:none}
@@ -99,7 +95,6 @@ export function playgroundPage(baseUrl, catalog) {
   `;
 
   const pageBody = `
-<script>var BASE=${JSON.stringify(baseUrl)};</script>
 <section>
 <div class="crumb"><a href="/">Agent402</a> / playground</div>
 <div class="pg-title">
@@ -108,7 +103,7 @@ export function playgroundPage(baseUrl, catalog) {
 </div>
 </section>
 <section>
-<div class="pg-wrap">
+<div class="pg-wrap" data-base="${esc(baseUrl)}">
   <div class="pg-left">
     <input class="pg-search" id="pgSearch" type="text" placeholder="Search tools..." autocomplete="off">
     <select class="pg-select" id="pgSelect"><option value="">Loading tools...</option></select>
@@ -122,351 +117,8 @@ export function playgroundPage(baseUrl, catalog) {
 </div>
 </section>
 ${ledgerFooterCompact()}
-<script>
-(function(){
-  var tools=[];
-  var toolMap={};
-  var selEl=document.getElementById('pgSelect');
-  var searchEl=document.getElementById('pgSearch');
-  var formEl=document.getElementById('pgForm');
-  var resultEl=document.getElementById('pgResult');
-
-  function escH(s){
-    return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
-  }
-
-  /* --- load catalog (embedded at render time; see playgroundPage) --- */
-  (function loadCatalog(){
-    var data = ${toolsJson};
-    tools=(data||[]).slice().sort(function(a,b){
-      if(a.category<b.category)return -1;
-      if(a.category>b.category)return 1;
-      var an=(a.name||a.slug||'');
-      var bn=(b.name||b.slug||'');
-      return an<bn?-1:1;
-    });
-    tools.forEach(function(t){toolMap[t.slug]=t});
-    renderSelect(tools);
-    var want=null;
-    try{
-      var params=new URLSearchParams(window.location.search);
-      want=params.get('slug');
-    }catch(e){}
-    var def=(want&&toolMap[want])||toolMap['hash']||tools[0];
-    if(def){selEl.value=def.slug;showTool(def.slug,true)}
-  })();
-
-  function renderSelect(list){
-    var cats={};
-    list.forEach(function(t){
-      if(!cats[t.category])cats[t.category]=[];
-      cats[t.category].push(t);
-    });
-    while(selEl.firstChild)selEl.removeChild(selEl.firstChild);
-    var placeholder=document.createElement('option');
-    placeholder.value='';
-    placeholder.textContent='-- select a tool --';
-    selEl.appendChild(placeholder);
-    Object.keys(cats).sort().forEach(function(c){
-      var grp=document.createElement('optgroup');
-      grp.label=c;
-      cats[c].forEach(function(t){
-        var opt=document.createElement('option');
-        opt.value=t.slug;
-        opt.textContent=t.name||t.slug;
-        grp.appendChild(opt);
-      });
-      selEl.appendChild(grp);
-    });
-  }
-
-  /* --- search filter --- */
-  searchEl.addEventListener('input',function(){
-    var q=searchEl.value.toLowerCase().trim();
-    if(!q){renderSelect(tools);return}
-    var filtered=tools.filter(function(t){
-      return (t.name||'').toLowerCase().indexOf(q)!==-1||
-             t.slug.toLowerCase().indexOf(q)!==-1||
-             (t.description||'').toLowerCase().indexOf(q)!==-1||
-             (t.category||'').toLowerCase().indexOf(q)!==-1;
-    });
-    renderSelect(filtered);
-  });
-
-  selEl.addEventListener('change',function(){showTool(selEl.value)});
-
-  /* --- show tool form --- */
-  function showTool(slug, skipUrl){
-    var t=toolMap[slug];
-    if(!t){while(formEl.firstChild)formEl.removeChild(formEl.firstChild);return}
-
-    if(!skipUrl){
-      try{
-        var u=new URL(window.location.href);
-        u.searchParams.set('slug',slug);
-        history.replaceState(null,'',u.pathname+u.search+(u.hash||''));
-      }catch(e){}
-    }
-
-    var schema=(t.discovery&&t.discovery.inputSchema&&t.discovery.inputSchema.properties)||{};
-    var example=(t.discovery&&t.discovery.input)||{};
-    var keys=Object.keys(schema);
-
-    /* build form with safe DOM methods */
-    while(formEl.firstChild)formEl.removeChild(formEl.firstChild);
-    var info=document.createElement('div');
-    info.className='pg-info';
-
-    var nameEl=document.createElement('div');
-    nameEl.className='tool-name';
-    nameEl.textContent=t.name||t.slug;
-    info.appendChild(nameEl);
-
-    var descEl=document.createElement('div');
-    descEl.className='tool-desc';
-    descEl.textContent=t.description||'';
-    info.appendChild(descEl);
-
-    var metaEl=document.createElement('div');
-    metaEl.className='tool-meta';
-    var mSpan1=document.createElement('span');
-    mSpan1.textContent=t.method+' '+t.path;
-    metaEl.appendChild(mSpan1);
-    var mSpan2=document.createElement('span');
-    // price is already a "$X.XXX" display string from the catalog
-    mSpan2.textContent=t.price||'';
-    metaEl.appendChild(mSpan2);
-    info.appendChild(metaEl);
-
-    var fieldsDiv=document.createElement('div');
-    fieldsDiv.className='pg-fields';
-    keys.forEach(function(k){
-      var prop=schema[k];
-      var val=example[k]!==undefined?example[k]:'';
-      var field=document.createElement('div');
-      field.className='pg-field';
-
-      var lbl=document.createElement('label');
-      lbl.textContent=k;
-      if(prop.description){
-        var descSpan=document.createElement('span');
-        descSpan.style.cssText='font-weight:400;color:var(--faint);font-family:inherit;font-size:.8rem';
-        descSpan.textContent=' \- '+prop.description;
-        lbl.appendChild(descSpan);
-      }
-      field.appendChild(lbl);
-
-      if(prop.type==='boolean'){
-        var wrap=document.createElement('div');
-        wrap.className='chk-wrap';
-        var cb=document.createElement('input');
-        cb.type='checkbox';
-        cb.setAttribute('data-key',k);
-        cb.setAttribute('data-type','boolean');
-        if(val)cb.checked=true;
-        wrap.appendChild(cb);
-        var cbLabel=document.createElement('span');
-        cbLabel.textContent=String(val);
-        wrap.appendChild(cbLabel);
-        field.appendChild(wrap);
-      }else if(prop.type==='number'||prop.type==='integer'){
-        var numIn=document.createElement('input');
-        numIn.type='number';
-        numIn.setAttribute('data-key',k);
-        numIn.setAttribute('data-type','number');
-        numIn.value=String(val);
-        field.appendChild(numIn);
-      }else{
-        var txtIn=document.createElement('input');
-        txtIn.type='text';
-        txtIn.setAttribute('data-key',k);
-        txtIn.setAttribute('data-type','string');
-        txtIn.value=String(val);
-        field.appendChild(txtIn);
-      }
-      fieldsDiv.appendChild(field);
-    });
-    info.appendChild(fieldsDiv);
-
-    if(t.computePayable){
-      var btn=document.createElement('button');
-      btn.className='pg-btn run';
-      btn.id='pgRun';
-      btn.textContent='Run free (proof-of-work)';
-      btn.addEventListener('click',function(){runTool(t)});
-      info.appendChild(btn);
-    }else{
-      var dbtn=document.createElement('button');
-      dbtn.className='pg-btn disabled-info';
-      dbtn.disabled=true;
-      dbtn.textContent='Requires USDC wallet ';
-      var lnk=document.createElement('a');
-      lnk.href='/integrations';
-      lnk.textContent='Setup \\u2192';
-      dbtn.appendChild(lnk);
-      info.appendChild(dbtn);
-    }
-
-    var statusDiv=document.createElement('div');
-    statusDiv.className='pg-status';
-    statusDiv.id='pgStatus';
-    info.appendChild(statusDiv);
-
-    formEl.appendChild(info);
-  }
-
-  /* --- PoW helpers --- */
-  async function sha256(msg){
-    var buf=await crypto.subtle.digest('SHA-256',new TextEncoder().encode(msg));
-    return new Uint8Array(buf);
-  }
-  function leadingZeroBits(buf){
-    var n=0;
-    for(var i=0;i<buf.length;i++){
-      var b=buf[i];
-      if(b===0){n+=8;continue}
-      n+=Math.clz32(b)-24;
-      break;
-    }
-    return n;
-  }
-  async function solvePow(challenge,difficulty){
-    var nonce=0;
-    while(true){
-      var hash=await sha256(challenge+':'+nonce);
-      if(leadingZeroBits(hash)>=difficulty) return nonce;
-      nonce++;
-      if(nonce%5000===0) await new Promise(function(r){setTimeout(r,0)});
-    }
-  }
-
-  /* --- JSON syntax highlight (operates on pre-serialized, HTML-escaped JSON) --- */
-  function highlightJson(str){
-    var safe=escH(str);
-    return safe
-      .replace(/(&quot;(?:[^&]|&(?!quot;))*?&quot;)\\s*:/g,
-        '<span class="json-key">$1</span>:')
-      .replace(/:\\s*(&quot;(?:[^&]|&(?!quot;))*?&quot;)/g,
-        ': <span class="json-str">$1</span>')
-      .replace(/:\\s*(-?\\d+\\.?\\d*(?:[eE][+-]?\\d+)?)/g,
-        ': <span class="json-num">$1</span>')
-      .replace(/:\\s*(true|false)/g,
-        ': <span class="json-bool">$1</span>')
-      .replace(/:\\s*(null)/g,
-        ': <span class="json-null">$1</span>');
-  }
-
-  /* --- run tool --- */
-  async function runTool(t){
-    var btn=document.getElementById('pgRun');
-    var status=document.getElementById('pgStatus');
-    btn.disabled=true;
-
-    /* status: solving */
-    while(status.firstChild)status.removeChild(status.firstChild);
-    var spinSpan=document.createElement('span');
-    spinSpan.className='spin';
-    status.appendChild(spinSpan);
-    status.appendChild(document.createTextNode(' Solving proof-of-work...'));
-
-    /* result: running */
-    while(resultEl.firstChild)resultEl.removeChild(resultEl.firstChild);
-    var runPlaceholder=document.createElement('div');
-    runPlaceholder.className='placeholder';
-    runPlaceholder.textContent='Running...';
-    resultEl.appendChild(runPlaceholder);
-
-    try{
-      /* gather params */
-      var params={};
-      var inputs=formEl.querySelectorAll('[data-key]');
-      for(var i=0;i<inputs.length;i++){
-        var el=inputs[i];
-        var k=el.getAttribute('data-key');
-        var tp=el.getAttribute('data-type');
-        if(tp==='boolean') params[k]=el.checked;
-        else if(tp==='number') params[k]=el.value===''?0:Number(el.value);
-        else params[k]=el.value;
-      }
-
-      /* get challenge */
-      var powStart=performance.now();
-      var cRes=await fetch(BASE+'/api/pow/challenge?slug='+encodeURIComponent(t.slug));
-      if(!cRes.ok) throw new Error('Challenge request failed: '+cRes.status);
-      var cData=await cRes.json();
-      var challenge=cData.challenge,difficulty=cData.difficulty,token=cData.token;
-
-      /* solve */
-      var nonce=await solvePow(challenge,difficulty);
-      var powMs=Math.round(performance.now()-powStart);
-
-      /* status: calling */
-      while(status.firstChild)status.removeChild(status.firstChild);
-      var spinSpan2=document.createElement('span');
-      spinSpan2.className='spin';
-      status.appendChild(spinSpan2);
-      status.appendChild(document.createTextNode(' Calling tool...'));
-
-      /* call tool */
-      var callStart=performance.now();
-      var headers={'X-Pow-Solution':token+':'+nonce};
-      var resp;
-      if(t.method==='GET'){
-        resp=await fetch(BASE+t.path+'?'+new URLSearchParams(params),{headers:headers});
-      }else{
-        headers['Content-Type']='application/json';
-        resp=await fetch(BASE+t.path,{method:'POST',headers:headers,body:JSON.stringify(params)});
-      }
-      var callMs=Math.round(performance.now()-callStart);
-
-      var body;
-      var ct=resp.headers.get('content-type')||'';
-      if(ct.indexOf('json')!==-1){
-        body=await resp.json();
-      }else{
-        body=await resp.text();
-      }
-
-      /* render result */
-      while(resultEl.firstChild)resultEl.removeChild(resultEl.firstChild);
-
-      var timingDiv=document.createElement('div');
-      timingDiv.className='timing';
-      timingDiv.textContent='PoW solved in '+powMs+'ms, tool responded in '+callMs+'ms';
-      resultEl.appendChild(timingDiv);
-
-      var pre=document.createElement('pre');
-      if(!resp.ok) pre.className='err';
-      if(typeof body==='string'){
-        pre.textContent=(!resp.ok?'HTTP '+resp.status+'\\n':'')+body;
-      }else{
-        var jsonStr=JSON.stringify(body,null,2);
-        if(!resp.ok){
-          var errPrefix=document.createElement('span');
-          errPrefix.textContent='HTTP '+resp.status+'\\n';
-          pre.appendChild(errPrefix);
-        }
-        /* highlightJson returns HTML-escaped + highlighted string */
-        var codeSpan=document.createElement('span');
-        codeSpan.innerHTML=highlightJson(jsonStr);
-        pre.appendChild(codeSpan);
-      }
-      resultEl.appendChild(pre);
-
-      status.textContent='Done \- PoW '+powMs+'ms, response '+callMs+'ms';
-    }catch(e){
-      while(resultEl.firstChild)resultEl.removeChild(resultEl.firstChild);
-      var errPre=document.createElement('pre');
-      errPre.className='err';
-      errPre.textContent=e.message||String(e);
-      resultEl.appendChild(errPre);
-      status.textContent='Error';
-    }finally{
-      btn.disabled=false;
-    }
-  }
-})();
-</script>`;
+${jsonScriptTag("pg-tools-data", toolsPayload)}
+<script src="/js/playground.js"></script>`;
 
   return ledgerShell({
     title,
diff --git a/src/quickstart.js b/src/quickstart.js
index 6a4b33e9..4148f5c8 100644
--- a/src/quickstart.js
+++ b/src/quickstart.js
@@ -280,34 +280,8 @@ const res = await payFetch("https://agent402.tools/api/extract", {
 </div>
 ${ledgerFooterCompact()}
 
-<script>
-(function(){
-  var tabs=document.querySelectorAll(".qs-tab");
-  var panels=document.querySelectorAll(".qs-panel");
-  tabs.forEach(function(t){
-    t.addEventListener("click",function(){
-      tabs.forEach(function(b){b.classList.remove("active");b.setAttribute("aria-selected","false")});
-      panels.forEach(function(p){p.classList.remove("active")});
-      t.classList.add("active");
-      t.setAttribute("aria-selected","true");
-      var id="panel-"+t.getAttribute("data-tab");
-      document.getElementById(id).classList.add("active");
-    });
-  });
-
-  document.querySelectorAll(".qs-copy").forEach(function(btn){
-    btn.addEventListener("click",function(){
-      var code=btn.parentElement.querySelector("code");
-      var text=code.textContent;
-      navigator.clipboard.writeText(text).then(function(){
-        btn.textContent="Copied!";
-        btn.classList.add("copied");
-        setTimeout(function(){btn.textContent="Copy";btn.classList.remove("copied")},1500);
-      });
-    });
-  });
-})();
-</script>`;
+<script src="/js/quickstart-tabs.js"></script>
+<script src="/js/copy-buttons.js"></script>`;
 
   return ledgerShell({ title, description, canonical, baseUrl, activePath: "/quickstart", extraCss, body });
 }
diff --git a/src/replay-guard.js b/src/replay-guard.js
index a88d103e..9a8b50db 100644
--- a/src/replay-guard.js
+++ b/src/replay-guard.js
@@ -20,10 +20,39 @@
  * retry of the still-valid authorization can succeed. It never blocks a payer
  * from re-using an authorization the chain hasn't consumed.
  *
- * Pure, offline, no network — unit-testable in isolation.
+ * CROSS-REPLICA (2026-08-16): prod runs multiple replicas (RATE_LIMIT_REPLICAS),
+ * and the guard below was per-process only - a concurrent replay landing on
+ * TWO DIFFERENT replicas within the same request window was invisible to it
+ * (each replica's inFlight Set only sees its own traffic). The chain's own
+ * nonce single-use property still prevented a double-CHARGE, but the HANDLER
+ * ran twice - for a tool that makes a real paid upstream call, that is a real
+ * cost duplication bounded only by how fast an attacker can fire one
+ * authorization at two replicas.
+ *
+ * Now backed by the SAME Redis connection shared-limit.js already maintains
+ * (via getSharedRedisClient - one connection per process, not a second one to
+ * the same server) when REDIS_URL is configured and reachable. FAILS OPEN to
+ * the original per-process Map/Set on any Redis absence or failure - this is
+ * the opposite fail-direction from shared-limit.js's rate limiter, and
+ * deliberately so: that limiter protects a metered FREE-TIER budget, where
+ * failing open means unmetered free access (a direct loss). This guard is
+ * documented defense-in-depth on top of a chain-enforced guarantee that holds
+ * with or without it, so degrading to "exactly today's per-process guarantee"
+ * during a Redis blip is strictly better than refusing every paid call over
+ * an optimization layer going dark.
  */
 import { createHash } from "node:crypto";
 import { paymentHeaderOf } from "./payer.js";
+import { getSharedRedisClient } from "./shared-limit.js";
+
+// Generous vs. any realistic single-request duration (the STT margin cap's
+// 60s upstream timeout is the longest known handler in this catalog) - long
+// enough that a healthy request always clears it via settle()/release()
+// before it matters, short enough that a replica that crashes mid-request
+// without ever releasing its claim self-heals well within a minute rather
+// than leaving that nonce artificially blocked.
+const INFLIGHT_TTL_SECONDS = 120;
+const REDIS_PREFIX = "replay:";
 
 /**
  * Stable replay identity for the x402 payment credential on this request, or
@@ -54,24 +83,34 @@ export function paymentReplayKey(req) {
 }
 
 /**
- * In-memory replay guard. `consumed` maps a settled nonce → the time it settled;
- * `inFlight` is the set of nonces whose gated call is currently mid-settle.
+ * Replay guard. Redis-backed (shared across replicas) when configured and
+ * reachable; otherwise the original per-process fallback below. `consumed`
+ * maps a settled nonce → the time it settled; `inFlight` is the set of nonces
+ * whose gated call is currently mid-settle. All three methods are now async
+ * (a Redis round trip on the common path) - the server.js call site already
+ * runs inside an async middleware.
  *
  * Bounded: entries expire after `ttlMs` (well past any realistic authorization
- * validity window) and total consumed entries are capped at `maxEntries` with
- * FIFO eviction. Eviction is always safe — once a nonce has settled on-chain it
- * is permanently dead there, so forgetting it in memory cannot enable a replay
+ * validity window) and total LOCAL consumed entries are capped at `maxEntries`
+ * with FIFO eviction (Redis expires its own keys via TTL, no separate cap
+ * needed). Eviction is always safe — once a nonce has settled on-chain it
+ * is permanently dead there, so forgetting it cannot enable a replay
  * (the facilitator would reject it anyway); this guard only makes the rejection
  * earlier and cheaper.
  */
 export function createReplayGuard({ ttlMs = 60 * 60 * 1000, maxEntries = 50_000 } = {}) {
+  // Local (per-process) fallback state — used whenever Redis is unset or a
+  // call to it fails, so a single replica or a Redis outage degrades to
+  // exactly the pre-Redis guarantee, never to zero protection.
   const consumed = new Map(); // key -> settledAt (ms)
   const inFlight = new Set();
+  const ttlSeconds = Math.max(1, Math.ceil(ttlMs / 1000));
 
-  // Prune expired consumed entries. Keys are inserted in non-decreasing settle
-  // time (each key is consumed at most once, always with the current clock), so
-  // the oldest sit at the head of the Map and we can stop at the first live one.
-  function prune(now) {
+  // Prune expired local consumed entries. Keys are inserted in non-decreasing
+  // settle time (each key is consumed at most once, always with the current
+  // clock), so the oldest sit at the head of the Map and we can stop at the
+  // first live one.
+  function pruneLocal(now) {
     const cutoff = now - ttlMs;
     for (const [k, at] of consumed) {
       if (at < cutoff) consumed.delete(k);
@@ -86,15 +125,39 @@ export function createReplayGuard({ ttlMs = 60 * 60 * 1000, maxEntries = 50_000
      *   "inflight" — an identical authorization is mid-settle (concurrent replay)
      *   "consumed" — this authorization already settled (sequential replay)
      */
-    begin(key, now = Date.now()) {
-      prune(now);
+    async begin(key, now = Date.now()) {
+      const c = await getSharedRedisClient();
+      if (c) {
+        try {
+          if (await c.get(REDIS_PREFIX + "c:" + key)) return "consumed";
+          // SET NX is the atomic claim: two replicas racing this same key
+          // cannot both receive a non-null reply, which is exactly the
+          // property inFlight.add() gave for free within one process.
+          const claimed = await c.set(REDIS_PREFIX + "f:" + key, String(now), { NX: true, EX: INFLIGHT_TTL_SECONDS });
+          return claimed ? "ok" : "inflight";
+        } catch (e) {
+          console.error("[replay-guard] redis begin failed, falling back to local state:", e.message);
+          // fall through to the local path below
+        }
+      }
+      pruneLocal(now);
       if (consumed.has(key)) return "consumed";
       if (inFlight.has(key)) return "inflight";
       inFlight.add(key);
       return "ok";
     },
     /** Mark the nonce consumed — call only when the gated call was granted (200). */
-    settle(key, now = Date.now()) {
+    async settle(key, now = Date.now()) {
+      const c = await getSharedRedisClient();
+      if (c) {
+        try {
+          await c.del(REDIS_PREFIX + "f:" + key);
+          await c.set(REDIS_PREFIX + "c:" + key, String(now), { EX: ttlSeconds });
+          return;
+        } catch (e) {
+          console.error("[replay-guard] redis settle failed, falling back to local state:", e.message);
+        }
+      }
       inFlight.delete(key);
       while (consumed.size >= maxEntries) {
         const oldest = consumed.keys().next().value;
@@ -105,10 +168,20 @@ export function createReplayGuard({ ttlMs = 60 * 60 * 1000, maxEntries = 50_000
     },
     /** Release the nonce — call when the gated call was NOT granted, so a
      *  legitimate retry of the still-valid authorization can proceed. */
-    release(key) {
+    async release(key) {
+      const c = await getSharedRedisClient();
+      if (c) {
+        try {
+          await c.del(REDIS_PREFIX + "f:" + key);
+          return;
+        } catch (e) {
+          console.error("[replay-guard] redis release failed, falling back to local state:", e.message);
+        }
+      }
       inFlight.delete(key);
     },
-    /** Introspection for tests / stats. */
+    /** Introspection for tests / stats — LOCAL fallback state only; Redis
+     *  state is shared and has no single-process notion of "size". */
     _state() {
       return { consumed: consumed.size, inFlight: inFlight.size };
     },
diff --git a/src/revenue-live.js b/src/revenue-live.js
index 2d80bf2e..6ef353d0 100644
--- a/src/revenue-live.js
+++ b/src/revenue-live.js
@@ -1330,227 +1330,7 @@ export function revenueChartSection() {
     <div class="rvz-legend" id="rvzLegend"></div>
     <details><summary>view as table</summary><div id="rvzTable" style="overflow-x:auto"></div></details>
   </div>
-  <script>
-  (function(){
-    var SLOTS={base:1,algorand:2,solana:3,polygon:4,stellar:5,arbitrum:6,celo:7};
-    var NAMES={1:"Base",2:"Algorand",3:"Solana",4:"Polygon",5:"Stellar",6:"Arbitrum",7:"Celo",8:"Other",free:"Free tier (PoW)",newbuyers:"New buyers",retbuyers:"Returning buyers",cumbuyers:"Distinct buyers to date"};
-    // Draw order. "free" is a lane, not a chain - free calls settle nowhere,
-    // so it never takes a chain colour and never folds into "Other".
-    var CHAIN_ORDER=[1,2,3,4,5,6,7,8,"free"];
-    // Buyers are people, not chains: a distinct-buyer count cannot be split by
-    // rail without double counting anyone who paid on two. So the buyers view
-    // swaps the whole lane set rather than adding to it.
-    function ORDERS(){
-      if(state.metric!=="buyers")return CHAIN_ORDER;
-      return state.mode==="cum"?["cumbuyers"]:["newbuyers","retbuyers"];
-    }
-    var state={mode:"cum",metric:"usd",scope:"ext",wire:"all",traffic:"paid",settle:"all",rows:[],free:[],freeSince:null,buyers:[],conc:null};
-    var css=function(n){return getComputedStyle(document.getElementById("rvz")).getPropertyValue("--s"+n).trim()};
-    function slotOf(chain){return SLOTS[chain]||8}
-    function chainName(c){return c==="robinhood"?"Robinhood":c.charAt(0).toUpperCase()+c.slice(1)}
-    // Wire filter: MPP and x402 settle identically on-chain, so the MPP subset
-    // is joined in by tx hash server-side. x402 is the remainder, never a
-    // separate count - that keeps All === x402 + MPP exactly.
-    function val(r){
-      var usd=state.metric==="usd";
-      var e=usd?r.extUsd:r.extTx, i=usd?r.intUsd:r.intTx;
-      var em=(usd?r.extMppUsd:r.extMppTx)||0, im=(usd?r.intMppUsd:r.intMppTx)||0;
-      if(state.wire==="mpp"){e=em;i=im}
-      else if(state.wire==="x402"){e=Math.max(0,e-em);i=Math.max(0,i-im)}
-      // Settled-to lane: SOR is the subset received by the spending wallet;
-      // Direct is the remainder, never a separate count - All === SOR + Direct
-      // exactly. Only meaningful at wire="all" (the seg handlers enforce that).
-      var es=(usd?r.extSorUsd:r.extSorTx)||0, is2=(usd?r.intSorUsd:r.intSorTx)||0;
-      if(state.settle==="sor"){e=es;i=is2}
-      else if(state.settle==="direct"){e=Math.max(0,e-es);i=Math.max(0,i-is2)}
-      return state.scope==="ext"?e:state.scope==="int"?i:e+i}
-    function setSeg(id,v){var el=document.getElementById(id);
-      [].slice.call(el.querySelectorAll("button")).forEach(function(b){b.classList.toggle("on",b.dataset.v===v)})}
-    function seg(id,cb){var el=document.getElementById(id);el.addEventListener("click",function(ev){var b=ev.target.closest("button");if(!b)return;
-      [].slice.call(el.querySelectorAll("button")).forEach(function(x){x.classList.toggle("on",x===b)});cb(b.dataset.v);render();})}
-    function build(){
-      var days={};
-      function dayOf(k){return days[k]||(days[k]={day:k,slots:{}})}
-      if(state.metric==="buyers"){
-        // Cumulative uses the server's running UNION, never an accumulation of
-        // the daily counts: summing distinct counts double counts every
-        // returning buyer and would draw a rising line over a flat reality.
-        return (state.buyers||[]).map(function(r){
-          return state.mode==="cum"
-            ? {day:r.day,slots:{cumbuyers:r.cumulative}}
-            : {day:r.day,slots:{newbuyers:r.newBuyers,retbuyers:r.returningBuyers}};
-        });
-      }
-      if(state.traffic!=="free"){
-        state.rows.forEach(function(r){var d=dayOf(r.day);
-          var s=slotOf(r.chain); d.slots[s]=(d.slots[s]||0)+val(r);
-          // Chains folded into "Other" keep their identity in a per-day
-          // breakdown - the fold is a palette constraint (8 validated hues),
-          // not a licence to hide which rails the money arrived on.
-          if(s===8){var v8=val(r);if(v8>0){d.oth=d.oth||{};d.oth[r.chain]=(d.oth[r.chain]||0)+v8}}})}
-      // Free calls are counts, never dollars - a free call earns $0 by
-      // definition, so the lane is absent under the Revenue $ metric rather
-      // than drawn as a bar pretending call count is revenue. The metric/
-      // traffic handlers already keep those two from being selected together;
-      // this is defence in depth for any future caller that sets state directly.
-      if(state.traffic!=="paid"&&state.metric==="tx"){
-        state.free.forEach(function(r){var d=dayOf(r.day);d.slots.free=(d.slots.free||0)+(r.pow||0)})}
-      var list=Object.keys(days).sort().map(function(k){return days[k]});
-      if(state.mode==="cum"){var acc={},accO={};list.forEach(function(d){var O=ORDERS();for(var k=0;k<O.length;k++){var s=O[k];
-        acc[s]=(acc[s]||0)+(d.slots[s]||0);d.slots[s]=acc[s]}
-        if(d.oth){for(var c in d.oth)accO[c]=(accO[c]||0)+d.oth[c]}
-        d.oth={};for(var c2 in accO)d.oth[c2]=accO[c2]})}
-      return list;
-    }
-    function fmt(v){return state.metric==="usd"?(v>=1?"$"+v.toFixed(2):"$"+v.toFixed(4)):String(Math.round(v))}
-    function render(){
-      var data=build(), svg=document.getElementById("rvzSvg"), tip=document.getElementById("rvzTip");
-      if(!data.length){svg.outerHTML="";document.querySelector(".rvz-wrap").innerHTML='<div class="rvz-empty">ledger backfilling - the series appears as settlements sync</div>';return}
-      var W=940,H=300,L=52,R=8,T=10,B=26,pw=W-L-R,ph=H-T-B;
-      var ORD=ORDERS();
-      var max=0;data.forEach(function(d){var t=0;for(var k=0;k<ORD.length;k++)t+=d.slots[ORD[k]]||0;if(t>max)max=t});
-      max=max||1;
-      var n=data.length, bw=Math.max(2,Math.min(34,pw/n-2));
-      var x=function(i){return L+(pw/n)*i+(pw/n-bw)/2}, y=function(v){return T+ph-(v/max)*ph};
-      var out=[];
-      for(var g=0;g<=3;g++){var gv=max*g/3,gy=y(gv);
-        out.push('<line x1="'+L+'" y1="'+gy+'" x2="'+(W-R)+'" y2="'+gy+'" stroke="var(--dash)" stroke-width="1"/>');
-        out.push('<text x="'+(L-6)+'" y="'+(gy+4)+'" text-anchor="end" font-size="10" fill="var(--faint)" font-family="var(--font-mono)">'+fmt(gv)+"</text>")}
-      var step=Math.ceil(n/8);
-      data.forEach(function(d,i){
-        if(i%step===0)out.push('<text x="'+(x(i)+bw/2)+'" y="'+(H-8)+'" text-anchor="middle" font-size="10" fill="var(--faint)" font-family="var(--font-mono)">'+d.day.slice(5)+"</text>");
-        var y0=T+ph;
-        for(var k=0;k<ORD.length;k++){var s=ORD[k];var v=d.slots[s]||0;if(v<=0)continue;var h=(v/max)*ph;y0-=h;
-          if(state.mode==="cum"){out.push('<rect x="'+x(i)+'" y="'+y0+'" width="'+bw+'" height="'+Math.max(h,0.5)+'" fill="'+css(s)+'" opacity="0.9"/>')}
-          else{out.push('<rect x="'+x(i)+'" y="'+y0+'" width="'+bw+'" height="'+Math.max(h-1,0.5)+'" fill="'+css(s)+'" stroke="var(--vsurf)" stroke-width="1" rx="1"/>')}}
-        out.push('<rect x="'+(L+(pw/n)*i)+'" y="'+T+'" width="'+(pw/n)+'" height="'+ph+'" fill="transparent" data-i="'+i+'"/>')});
-      svg.innerHTML=out.join("");
-      svg.onmousemove=function(ev){var t=ev.target.closest("rect[data-i]");if(!t){tip.style.display="none";return}
-        var d=data[+t.dataset.i],rows="",tot=0;
-        for(var k=ORD.length-1;k>=0;k--){var s=ORD[k];var v=d.slots[s]||0;if(v<=0)continue;tot+=v;
-          rows+='<div><i style="display:inline-block;width:8px;height:8px;background:'+css(s)+';margin-right:5px"></i>'+NAMES[s]+" "+fmt(v)+"</div>";
-          if(s===8&&d.oth){Object.keys(d.oth).sort().forEach(function(c){if(d.oth[c]>0)
-            rows+='<div style="padding-left:13px;color:var(--muted)">'+chainName(c)+" "+fmt(d.oth[c])+"</div>"})}}
-        tip.innerHTML="<b>"+d.day+"</b>"+rows+"<div style='border-top:1px dashed var(--dark-border2);margin-top:3px'>total "+fmt(tot)+"</div>";
-        var wr=document.querySelector(".rvz-wrap").getBoundingClientRect();
-        tip.style.display="block";tip.style.left=Math.min(ev.clientX-wr.left+14,wr.width-270)+"px";tip.style.top=(ev.clientY-wr.top+10)+"px"};
-      svg.onmouseleave=function(){tip.style.display="none"};
-      var lg="",present={},othChains={};data.forEach(function(d){for(var k=0;k<ORD.length;k++)if(d.slots[ORD[k]])present[ORD[k]]=1;
-        if(d.oth)Object.keys(d.oth).forEach(function(c){if(d.oth[c]>0)othChains[c]=1})});
-      Object.keys(present).forEach(function(s){
-        var label=NAMES[s];
-        // Name what "Other" holds - the fold is visual, never informational.
-        if(String(s)==="8"&&Object.keys(othChains).length)label+=" ("+Object.keys(othChains).sort().map(chainName).join(", ")+")";
-        lg+='<span><i style="background:'+css(s)+'"></i>'+label+"</span>"});
-      // An empty series under a wire filter is a real answer, not a broken
-      // chart - say which filter emptied it rather than showing a blank grid.
-      if(!Object.keys(present).length){
-        lg='<span>no '+(state.metric==="buyers"?"buyers":state.traffic==="free"?"free-tier calls":
-          (state.wire==="all"?"":state.wire==="mpp"?"MPP-wire ":"x402-wire ")+
-          (state.scope==="ext"?"external":state.scope==="int"?"internal":"")+" settlements")+' in this window</span>'}
-      document.getElementById("rvzLegend").innerHTML=lg;
-      // The chart defaults to External, which is right - the canary is our own
-      // money recycling and must never inflate revenue. But that makes "no
-      // canary today" and "canary hidden by the current filter" look identical,
-      // and someone reading the default view reasonably concluded the canary
-      // had stopped running when it had settled on 11 of 12 rails that day.
-      //
-      // So when internal settlements EXIST in the window and are filtered out,
-      // say so and name the control that shows them. The number on the chart
-      // does not change; only the reader's ability to tell absence from
-      // concealment does.
-      (function(){
-        var el=document.getElementById("rvzScopeNote");
-        if(!el)return;
-        if(state.scope!=="ext"){el.style.display="none";return}
-        var days={},chains={};
-        state.rows.forEach(function(r){
-          if((r.intTx||0)>0){days[r.day]=1;chains[r.chain]=1}
-        });
-        var nd=Object.keys(days).length, nc=Object.keys(chains).length;
-        if(!nd){el.style.display="none";return}
-        el.style.display="";
-        el.textContent="Showing external settlements only. "+nc+" chain"+(nc===1?"":"s")+
-          " also settled internal (canary) transactions on "+nd+" day"+(nd===1?"":"s")+
-          " in this window - select \u201cInternal (canary)\u201d or \u201cBoth\u201d to see them. "+
-          "They are excluded from revenue on purpose: the canary buys from us with our own wallet.";
-      })();
-      // "Other" gets one muted sub-column per folded chain (a subset of the
-      // Other column, so they never add to the row total).
-      var othList=Object.keys(othChains).sort();
-      var tb='<table><tr><th>day</th>';Object.keys(present).forEach(function(s){tb+="<th>"+NAMES[s]+"</th>";
-        if(String(s)==="8")othList.forEach(function(c){tb+='<th style="color:var(--muted)">· '+chainName(c)+"</th>"})});tb+="<th>total</th></tr>";
-      data.forEach(function(d){var tot=0;tb+="<tr><td>"+d.day+"</td>";Object.keys(present).forEach(function(s){var v=d.slots[s]||0;tot+=v;tb+="<td>"+fmt(v)+"</td>";
-        if(String(s)==="8")othList.forEach(function(c){tb+='<td style="color:var(--muted)">'+fmt((d.oth||{})[c]||0)+"</td>"})});tb+="<td>"+fmt(tot)+"</td></tr>"});
-      document.getElementById("rvzTable").innerHTML=tb+"</table>";
-    }
-    function buyersNote(){
-      var el=document.getElementById("rvzBuyersNote");
-      if(state.metric!=="buyers"){el.style.display="none";return}
-      el.style.display="block";
-      var c=state.conc;
-      el.textContent="Distinct external wallets that settled a payment. Someone paying on two chains in one day is one buyer, and the cumulative line is a running union rather than a sum."+
-        (c&&c.buyers?" Over this window: "+c.buyers+" buyers, "+c.payments+" payments, biggest single wallet "+c.topSharePct+"% of them and the top five "+c.top5SharePct+"%.":"");
-    }
-    function settleNote(){
-      var el=document.getElementById("rvzSettleNote");
-      el.style.display=state.settle==="all"?"none":"block";
-    }
-    function freeNote(){
-      var el=document.getElementById("rvzFreeNote");
-      if(state.traffic==="paid"){el.style.display="none";return}
-      el.style.display="block";
-      el.textContent="Free calls are served via proof-of-work and settle nowhere, so they earn $0 and appear only under Transactions."+
-        (state.freeSince?" Per-day recording of the free tier began "+state.freeSince+
-          " - earlier days have no per-day record, which is not the same as no free traffic.":
-          " Per-day recording of the free tier has not started yet.")+
-        " Internal heartbeat probes are excluded.";
-    }
-    seg("rvzMode",function(v){state.mode=v});
-    seg("rvzMetric",function(v){state.metric=v;
-      // Revenue $ is paid-only: a free call has no dollar value to chart.
-      if(v!=="tx"&&state.traffic!=="paid"){state.traffic="paid";setSeg("rvzTraffic","paid")}
-      // Buyers counts settled external wallets, so the internal/canary scope,
-      // the wire split, and the settled-to lane do not apply to it.
-      if(v==="buyers"){if(state.scope!=="ext"){state.scope="ext";setSeg("rvzScope","ext")}
-        if(state.wire!=="all"){state.wire="all";setSeg("rvzWire","all")}
-        if(state.settle!=="all"){state.settle="all";setSeg("rvzSettle","all");settleNote()}}
-      freeNote();buyersNote()});
-    seg("rvzScope",function(v){state.scope=v;
-      if(state.metric==="buyers"){state.metric="tx";setSeg("rvzMetric","tx");buyersNote()}});
-    seg("rvzTraffic",function(v){state.traffic=v;
-      if(v!=="paid"&&state.metric!=="tx"){state.metric="tx";setSeg("rvzMetric","tx")}
-      if(v!=="paid"&&state.settle!=="all"){state.settle="all";setSeg("rvzSettle","all");settleNote()}
-      freeNote();buyersNote()});
-    seg("rvzWire",function(v){state.wire=v;
-      // The MPP subset and the SOR subset are not tracked as an intersection -
-      // composing them would fabricate numbers, so they are mutually exclusive.
-      if(v!=="all"&&state.settle!=="all"){state.settle="all";setSeg("rvzSettle","all");settleNote()}
-      document.getElementById("rvzWireNote").style.display=v==="all"?"none":"block"});
-    seg("rvzSettle",function(v){state.settle=v;
-      if(v!=="all"){
-        if(state.wire!=="all"){state.wire="all";setSeg("rvzWire","all");document.getElementById("rvzWireNote").style.display="none"}
-        // The SOR lane is settled revenue - the free tier settles nowhere.
-        if(state.traffic!=="paid"){state.traffic="paid";setSeg("rvzTraffic","paid");freeNote()}
-        if(state.metric==="buyers"){state.metric="tx";setSeg("rvzMetric","tx");buyersNote()}
-      }
-      settleNote()});
-    // The free-tier series is a separate endpoint (free calls never touch the
-    // settlement ledger). A failure there must not blank the revenue chart, so
-    // it degrades to an empty free lane rather than rejecting the pair.
-    Promise.all([
-      fetch("/api/revenue/daily").then(function(r){return r.json()}),
-      fetch("/api/calls/daily").then(function(r){return r.json()}).catch(function(){return{days:[],recordingSince:null}})
-    ]).then(function(res){
-      state.rows=res[0].days||[];
-      state.free=res[1].days||[];
-      state.freeSince=res[1].recordingSince||null;
-      state.buyers=res[0].buyers||[];
-      state.conc=res[0].concentration||null;
-      render();
-    }).catch(function(){document.querySelector(".rvz-wrap").innerHTML='<div class="rvz-empty">series unavailable</div>'});
-  })();
-  </script>`;
+  <script src="/js/revenue-chart.js"></script>`;
 }
 
 export function revenuePage(baseUrl, snap) {
@@ -1608,7 +1388,7 @@ export function revenuePage(baseUrl, snap) {
     </div>`;
   };
   const body = `
-  <main style="max-width:1100px;margin:0 auto;padding:56px 30px;">
+  <div style="max-width:1100px;margin:0 auto;padding:56px 30px;">
     <section>
     <div style="font-family:var(--font-mono);font-size:13px;color:var(--accent);margin-bottom:12px;">$ GET /api/revenue</div>
     <h1 style="font-family:var(--font-body);font-weight:800;font-size:44px;line-height:1.05;letter-spacing:-.02em;margin:0 0 8px;color:var(--ink);">Live revenue.</h1>
@@ -1632,7 +1412,7 @@ export function revenuePage(baseUrl, snap) {
     <p style="font-size:13.5px;color:var(--muted);margin-top:10px;">Don't take our word for it: <a href="https://www.x402scan.com/server/07eb3020-932a-436d-a739-557b6e47101d" rel="noopener">x402scan indexes our on-chain settlements independently →</a> Their totals count <em>all</em> traffic to our wallets - including our own canary and test buys - so they read higher than the external-only figures above. Their seller row also groups our upstream <strong>spending</strong> wallet in with the treasury, and that wallet receives the revenue from the tools that fund external purchases, so part of what appears there as demand is our own self-funding loop rather than a third party paying us. Both figures are correct; they measure different things, and the external-only series above is the one that answers "did someone else pay for this".</p>
     ${mppSection(snap.mpp)}
     </section>
-  </main>
+  </div>
   ${ledgerFooterCompact(baseUrl)}`;
   return ledgerShell({
     title, description, canonical, baseUrl, activePath: "/revenue",
diff --git a/src/sdk-playground.js b/src/sdk-playground.js
index f1805bc0..fbaff8a7 100644
--- a/src/sdk-playground.js
+++ b/src/sdk-playground.js
@@ -20,16 +20,17 @@ console.log(result);`,
   },
   {
     label: "Find tools by keyword",
-    code: `// Search for tools matching a query
+    code: `// Search for tools matching a query - /api/find is free and
+// unpaywalled, so this skips the proof-of-work step entirely.
 const result = await callTool("find", {
   q: "geocode"
-}, { path: "/api/find", method: "GET" });
+}, { path: "/api/find", method: "GET", free: true });
 console.log(result);`,
   },
   {
     label: "Generate a UUID",
     code: `// Generate a v4 UUID
-const result = await callTool("uuid", {});
+const result = await callTool("uuid", {}, { path: "/api/uuid", method: "GET" });
 console.log(result);`,
   },
   {
@@ -45,7 +46,7 @@ console.log(result);`,
   {
     label: "Base64 encode",
     code: `// Encode text to base64
-const result = await callTool("base64-encode", {
+const result = await callTool("base64", {
   text: "Agent402 is awesome"
 });
 console.log(result);`,
@@ -95,8 +96,7 @@ export function sdkPlaygroundPage(baseUrl) {
   `;
 
   const pageBody = `
-<script>var BASE='${baseUrl.replace(/'/g, "\\'")}';</script>
-<div class="sp-wrap">
+<div class="sp-wrap" data-base="${esc(baseUrl)}">
 <p class="sp-crumb"><a href="/">Home</a> &rsaquo; <a href="/playground">Playground</a> &rsaquo; SDK</p>
 <h1 class="sp-title">SDK Playground</h1>
 <p class="sp-sub">Write code and run it against the live API. Proof-of-work handles payment automatically. Based on <a href="/docs/adapters">agent402-client</a>.</p>
@@ -126,119 +126,7 @@ export function sdkPlaygroundPage(baseUrl) {
 </div>
 </div>
 ${ledgerFooterCompact()}
-<script>
-(function(){
-  var EXAMPLES=${JSON.stringify(EXAMPLES.map(function(e){ return {label:e.label,code:e.code}; }))};
-  var codeEl=document.getElementById('spCode');
-  var resultEl=document.getElementById('spResult');
-  var runBtn=document.getElementById('spRun');
-  var statusEl=document.getElementById('spStatus');
-  var exBtns=document.querySelectorAll('.sp-example');
-
-  exBtns.forEach(function(btn){
-    btn.addEventListener('click',function(){
-      exBtns.forEach(function(b){b.classList.remove('active');});
-      btn.classList.add('active');
-      var idx=parseInt(btn.getAttribute('data-idx'),10);
-      codeEl.value=EXAMPLES[idx].code;
-      clearResult();
-    });
-  });
-
-  function clearResult(){
-    while(resultEl.firstChild)resultEl.removeChild(resultEl.firstChild);
-    resultEl.textContent='Click Run to execute';
-  }
-
-  function addLine(cls,text){
-    var line=document.createElement('div');
-    line.className=cls;
-    line.textContent=text;
-    resultEl.appendChild(line);
-  }
-
-  async function sha256(msg){
-    var buf=await crypto.subtle.digest('SHA-256',new TextEncoder().encode(msg));
-    return new Uint8Array(buf);
-  }
-  function leadingZeroBits(buf){
-    var n=0;
-    for(var i=0;i<buf.length;i++){
-      if(buf[i]===0){n+=8;continue;}
-      n+=Math.clz32(buf[i])-24;
-      break;
-    }
-    return n;
-  }
-  async function solvePow(challenge,difficulty){
-    var nonce=0;
-    while(true){
-      var hash=await sha256(challenge+':'+nonce);
-      if(leadingZeroBits(hash)>=difficulty)return nonce;
-      nonce++;
-      if(nonce%5000===0)await new Promise(function(r){setTimeout(r,0);});
-    }
-  }
-
-  async function callTool(slug,params,opts){
-    opts=opts||{};
-    var path=opts.path||('/api/'+slug);
-    var method=opts.method||'POST';
-
-    while(statusEl.firstChild)statusEl.removeChild(statusEl.firstChild);
-    var spin=document.createElement('span');
-    spin.className='spin';
-    statusEl.appendChild(spin);
-    statusEl.appendChild(document.createTextNode(' Solving PoW...'));
-
-    var cRes=await fetch(BASE+'/api/pow/challenge?slug='+encodeURIComponent(slug));
-    var cData=await cRes.json();
-    var nonce=await solvePow(cData.challenge,cData.difficulty);
-
-    while(statusEl.firstChild)statusEl.removeChild(statusEl.firstChild);
-    var spin2=document.createElement('span');
-    spin2.className='spin';
-    statusEl.appendChild(spin2);
-    statusEl.appendChild(document.createTextNode(' Calling tool...'));
-
-    var headers={'X-Pow-Solution':cData.token+':'+nonce};
-    var resp;
-    if(method==='GET'){
-      resp=await fetch(BASE+path+'?'+new URLSearchParams(params),{headers:headers});
-    }else{
-      headers['Content-Type']='application/json';
-      resp=await fetch(BASE+path,{method:'POST',headers:headers,body:JSON.stringify(params)});
-    }
-    statusEl.textContent='Done';
-    var ct=resp.headers.get('content-type')||'';
-    if(ct.indexOf('json')!==-1)return resp.json();
-    return resp.text();
-  }
-
-  /* User code runs entirely client-side via Function() - same sandbox model as
-     CodePen/JSFiddle. callTool is injected as a parameter so user code can
-     await it without importing anything. */
-  runBtn.addEventListener('click',async function(){
-    runBtn.disabled=true;
-    while(resultEl.firstChild)resultEl.removeChild(resultEl.firstChild);
-    var code=codeEl.value;
-    var origConsoleLog=console.log;
-    console.log=function(){
-      var args=Array.from(arguments).map(function(a){return typeof a==='object'?JSON.stringify(a,null,2):String(a);}).join(' ');
-      addLine('log',args);
-    };
-    try{
-      var fn=new Function('callTool','"use strict";return (async function(){'+code+'})()'); // eslint-disable-line no-new-func
-      await fn(callTool);
-    }catch(e){
-      addLine('err','Error: '+(e.message||String(e)));
-    }finally{
-      console.log=origConsoleLog;
-      runBtn.disabled=false;
-    }
-  });
-})();
-</script>`;
+<script src="/js/sdk-playground.js"></script>`;
 
   return ledgerShell({
     title,
diff --git a/src/sell.js b/src/sell.js
index cf2ee087..189ba342 100644
--- a/src/sell.js
+++ b/src/sell.js
@@ -89,23 +89,14 @@ function costRow([label, value, tone]) {
 const formHtml = `
   <div id="list-api" style="border:1.5px solid var(--ink);border-top:none;background:var(--paper);padding:18px 20px;">
     <div style="font-weight:800;font-size:15px;margin-bottom:8px;color:var(--ink);">Register in one call</div>
+    <label for="reg-origin" style="display:block;font-family:var(--font-mono);font-size:11px;color:var(--faint);text-transform:uppercase;letter-spacing:.08em;margin-bottom:6px;">Your API's origin</label>
     <div style="display:flex;gap:10px;">
       <input id="reg-origin" type="url" placeholder="https://api.yourdomain.com" style="flex:1;font-family:var(--font-mono);font-size:13px;padding:9px 12px;border:1.5px solid var(--ink);background:var(--paper);color:var(--ink);">
       <button id="reg-go" style="background:var(--accent);color:#fff;font-family:var(--font-mono);font-weight:700;font-size:13px;border:none;padding:9px 16px;cursor:pointer;">SUBMIT</button>
     </div>
-    <div id="reg-out" style="font-family:var(--font-mono);font-size:12.5px;color:var(--muted);margin-top:8px;">Free, no account - we probe your origin's x402 surface and list you if it answers. Unreachable sellers drop out of routing (never off the roster) until they recover.</div>
+    <div id="reg-out" role="status" aria-live="polite" style="font-family:var(--font-mono);font-size:12.5px;color:var(--muted);margin-top:8px;">Free, no account - we probe your origin's x402 surface and list you if it answers. Unreachable sellers drop out of routing (never off the roster) until they recover.</div>
   </div>
-  <script>
-  document.getElementById("reg-go").addEventListener("click", async () => {
-    const out = document.getElementById("reg-out");
-    out.textContent = "probing...";
-    try {
-      const r = await fetch("/api/index/register", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ origin: document.getElementById("reg-origin").value }) });
-      const j = await r.json();
-      out.textContent = j.listed ? ("Listed - " + (j.seller?.displayName || j.origin) + " (" + (j.seller?.toolCount || 0) + " tools). Appears on /marketplace and any chain page it advertises.") : ("Not listed: " + (j.error || "unknown error"));
-    } catch { out.textContent = "submission failed - try again"; }
-  });
-  </script>`;
+  <script src="/js/reg-form.js"></script>`;
 
 export function sellPage(baseUrl) {
   const canonical = `${baseUrl}/sell`;
diff --git a/src/seo.js b/src/seo.js
index 7a88d470..5cc49e19 100644
--- a/src/seo.js
+++ b/src/seo.js
@@ -6,6 +6,7 @@ import { BLOG_POSTS } from "./blog.js";
 import { ADAPTERS } from "./adapter-docs.js";
 import { RAILS, RAILS_OR } from "./rails.js";
 import { CHAIN_PAGES } from "./market-page.js";
+import { EXEC_TIERS } from "./tools/route-execute.js";
 
 // Computed ONCE when this module loads (i.e. once per deploy, since Railway
 // restarts the process), not per-request. Every sitemap lastmod below reuses
@@ -213,9 +214,30 @@ export function sitemapSkills(baseUrl) {
   return subSitemap([{ loc: `${baseUrl}/skills`, priority: "0.8" }, ...skillSlugs().map((s) => ({ loc: `${baseUrl}/skills/${s}`, priority: "0.8" }))], lastmod);
 }
 
+// Trims a tier dollar amount to the shortest exact representation (2 decimals
+// when that's exact, else 3) so $0.01/$0.005/$3.30/$3.00 all read naturally.
+const fmtExecTierUsd = (n) => {
+  const s3 = n.toFixed(3);
+  return s3.endsWith("0") ? n.toFixed(2) : s3;
+};
+
 export function llmsTxt(baseUrl, catalog) {
   const tools = toolList(catalog);
   const powCount = tools.filter(isComputePayable).length;
+  // Derived from EXEC_TIERS, not hand-typed - a hardcoded list here is exactly
+  // how the $3.30 route-execute-pro tier (added 2026-08-04) went missing from
+  // this summary for weeks: a new tier landed in route-execute.js and nobody
+  // remembered to touch this unrelated prose file too. Deriving it means a
+  // future 5th tier can't repeat the same silent omission.
+  const execTierSentence = EXEC_TIERS.map((t, i) => {
+    // Real route path, same derivation as buildRouteExecuteTool() itself
+    // (route-execute.js): "route-execute-plus" -> suffix "-plus" ->
+    // /api/route/execute-plus, never /api/route/route-execute-plus.
+    const routeSuffix = t.slug.replace("route-execute", "");
+    return i === 0
+      ? `$${fmtExecTierUsd(t.execPriceUsd)} covers tools <= $${fmtExecTierUsd(t.underlyingMaxUsd)}`
+      : `\`/api/route/execute${routeSuffix}\` at $${fmtExecTierUsd(t.execPriceUsd)} covers <= $${fmtExecTierUsd(t.underlyingMaxUsd)}`;
+  }).join(", ");
 
   // The llms.txt spec (llmstxt.org) wants: an H1, one summary blockquote, then
   // free-form "info" prose (NO headings), then H2 sections whose bodies are
@@ -291,13 +313,15 @@ We state it this way deliberately: the honest guarantee is "settlement ordering
 
 **MPP clients are first-class (dual-stack).** Every paid endpoint also speaks MPP (Machine Payments Protocol, the IETF-track \`Payment\` HTTP auth scheme): the same 402 carries a \`WWW-Authenticate: Payment\` challenge (evm charge, EIP-3009 USDC), \`Authorization: Payment\` credentials settle on-chain identically to x402, and settled responses return a signed \`Payment-Receipt\` header. An \`mppx\` client (\`Fetch.from\` with \`evm.charge\`) works out of the box - same URL, same price, same settlement as x402, whichever dialect your client speaks.
 
+**How to read our 402 if you only speak one dialect.** The same response carries BOTH headers, always - \`WWW-Authenticate: Payment\` is additive, never a replacement for the real x402 \`PAYMENT-REQUIRED\` header (full \`accepts\` array, \`exact\` scheme, EIP-3009). A client that hard-fails on an unrecognized \`WWW-Authenticate\` scheme instead of also checking for \`PAYMENT-REQUIRED\` will bail with something like "no supported rail" on a 402 it could have paid - this has happened at least once (see issue #794). If your parser only understands one of the two dialects, check for the header it understands FIRST rather than trusting whichever header happens to be read first; do not treat an unrecognized \`WWW-Authenticate\` scheme as "this server has no payment option for me."
+
 ## Key machine surfaces
 - [/api/search](${baseUrl}/api/search): **front door** - live web search (title, URL, snippet). Start here to discover pages; follow with extract or answer
 - [/api/answer](${baseUrl}/api/answer): **front door** - cited answer grounded in live web search results
 - [/api/search-news](${baseUrl}/api/search-news): live news search for current events / headlines
 - [/api/find](${baseUrl}/api/find): resolve a plain-language task to the best-matching tools with route, price, input schema, and a ready example (GET \`?q={task}\` or POST \`{"task":"..."}\`) - long-tail discovery behind the flagships
 - [/api/route](${baseUrl}/api/route): Smart Order Router - rank tools across every x402 seller crawled from public registries; \`include:"external"\` excludes Agent402 for neutral cross-seller discovery
-- [/api/route/execute](${baseUrl}/api/route/execute): the SOR that also PAYS. Send a task, and Agent402 resolves the best-matching tool, pays the seller over x402 on your behalf (any proven seller in the open index, not just ours), and relays the result with a receipt - one payment, one request, one wallet. You never hold a wallet on their chain or sign up with them. \`{"task":"...","include":"external"}\`. Proportional tiers: $0.01 covers tools <= $0.005, \`/api/route/execute-plus\` at $0.05 covers <= $0.04, \`/api/route/execute-max\` at $0.55 covers <= $0.50 - an over-cap task gets a self-correcting 409 naming the tier that fits
+- [/api/route/execute](${baseUrl}/api/route/execute): the SOR that also PAYS. Send a task, and Agent402 resolves the best-matching tool, pays the seller over x402 on your behalf (any proven seller in the open index, not just ours), and relays the result with a receipt - one payment, one request, one wallet. You never hold a wallet on their chain or sign up with them. \`{"task":"...","include":"external"}\`. Proportional tiers: ${execTierSentence} - an over-cap task gets a self-correcting 409 naming the tier that fits
 - [/api/index](${baseUrl}/api/index): JSON snapshot of every seller indexed (health, routable flag, crawl history)
 - [/api/leaderboard](${baseUrl}/api/leaderboard): public on-chain ranking of x402 sellers by Base USDC settled volume (pipeline: Bazaar discovery → \`eth_getLogs\` on Base USDC → per-call ceiling filter → aggregate by payTo; params \`?sort=usd|calls\`, \`?top=N\`, \`?include=external|all\`) - same data as the MCP tool \`sellers.list\` and the \`agent402-client\` SDK method \`topSellers()\`
 - [/.well-known/x402](${baseUrl}/.well-known/x402): one-fetch service manifest (identity, payment options, capability map, MCP, trust signals)
diff --git a/src/server.js b/src/server.js
index e8a3bc8a..3b2b5dca 100644
--- a/src/server.js
+++ b/src/server.js
@@ -220,7 +220,7 @@ const trialToolLimiter = createRateLimiter("trial-tool", { perMin: TRIAL_PER_TOO
 const trialIpLimiter = createRateLimiter("trial-ip", { perMin: TRIAL_IP_MIN, perHour: TRIAL_IP_HOUR });
 const TRIAL_LIMITS_LABEL = `${TRIAL_PER_TOOL_HOUR} per tool per hour, ${TRIAL_IP_HOUR} per hour per client`;
 import { recordRefundOwed, receiptProvesCharge, listRefunds, markRefundPaid, markRefundVoid, claimRefundForSend, refundTotals } from "./refund-ledger.js";
-import { recordServedCall, recordChargedFailure, networkFromPaymentResponse, decodeSettleReceipt, getStats, getOperatorBreakdown, dbHealthy, statsPersistent, getDailyCalls, dailyCallsRecordingSince, getDailyUpstreamCalls } from "./stats.js";
+import { recordServedCall, recordChargedFailure, networkFromPaymentResponse, decodeSettleReceipt, getStats, getOperatorBreakdown, dbHealthy, statsPersistent, getDailyCalls, dailyCallsRecordingSince, getDailyUpstreamCalls, getSellerRegistrations } from "./stats.js";
 import { timingSafeEqual, createHash, randomUUID, randomBytes } from "node:crypto";
 
 const PORT = process.env.PORT || 3000;
@@ -1148,17 +1148,28 @@ app.use((_req, res, next) => {
   res.setHeader("X-Permitted-Cross-Domain-Policies", "none");
   res.setHeader(
     "Content-Security-Policy",
-    // script-src carries one narrow exception: unpkg.com, for the homepage's
-    // pinned, SRI-verified d3 + topojson-client tags (the dot-map, Aug 2026
-    // revamp - the site's first-ever third-party script, an explicit,
-    // knowing tradeoff against the "everything self-hosted" posture used
-    // everywhere else, incl. fonts). A specific host, never a wildcard or
-    // 'unsafe-eval' — SRI on the tags themselves is a second, independent
-    // layer (a compromised unpkg response with a mismatched hash is refused
-    // by the browser before it ever executes). connect-src's existing
-    // 'https:' already covers the map's runtime fetch of the world-atlas
-    // geometry from jsdelivr, so no change needed there.
-    "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; font-src 'self'; script-src 'self' 'unsafe-inline' https://unpkg.com; connect-src 'self' https:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
+    // script-src drops 'unsafe-inline' (2026-08-16): every page-behavior
+    // script site-wide now lives in a real file under /js/:file (strict
+    // filename allowlist, no path traversal - see server.js's /js/:file
+    // route) or a dedicated route with its own scoped CSP (the SDK
+    // playground's eval sandbox at /sdk-playground/sandbox). This is
+    // defense-in-depth, not a fix for a live exploit — the site already
+    // manually-escapes all third-party/user content (crawled seller names,
+    // wish-board text, etc.) rather than relying on a templating engine's
+    // automatic escaping, across hundreds of call sites; removing
+    // 'unsafe-inline' means a future missed esc() call can no longer be
+    // turned into a working <script> injection, only inert markup. One
+    // narrow exception remains: unpkg.com, for the homepage's pinned,
+    // SRI-verified d3 + topojson-client tags (the dot-map, Aug 2026 revamp -
+    // the site's first-ever third-party script, an explicit, knowing
+    // tradeoff against the "everything self-hosted" posture used everywhere
+    // else, incl. fonts). A specific host, never a wildcard or 'unsafe-eval'
+    // — SRI on the tags themselves is a second, independent layer (a
+    // compromised unpkg response with a mismatched hash is refused by the
+    // browser before it ever executes). connect-src's existing 'https:'
+    // already covers the map's runtime fetch of the world-atlas geometry
+    // from jsdelivr, so no change needed there.
+    "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; font-src 'self'; script-src 'self' https://unpkg.com; connect-src 'self' https:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
   );
   next();
 });
@@ -1787,7 +1798,7 @@ app.post("/__operator/logout", (req, res) => {
 });
 app.get("/__operator", (req, res) => {
   if (!operatorAuthed(req)) return res.status(404).type("html").send("<p>Not found.</p>");
-  res.type("html").send(operatorPage(BASE_URL, getOperatorBreakdown({ prices: TOOL_PRICES, walletOnlySet: WALLET_ONLY_SLUGS })));
+  res.type("html").send(operatorPage(BASE_URL, getOperatorBreakdown({ prices: TOOL_PRICES, walletOnlySet: WALLET_ONLY_SLUGS, offeredNetworks: enabledNetworks(NETWORK) })));
 });
 app.get("/__operator/stats", (req, res) => {
   if (!operatorAuthed(req)) return res.status(404).json({ error: "Not found" });
@@ -1797,7 +1808,7 @@ app.get("/__operator/stats", (req, res) => {
   // PostHog. This is the number to compare against a provider's own dashboard.
   // `daily` is the deploy-proof series (stats DB, UTC day buckets): the number
   // to sum over a billing month; the in-memory fields reset on every redeploy.
-  res.json({ ...getOperatorBreakdown({ prices: TOOL_PRICES, walletOnlySet: WALLET_ONLY_SLUGS }), upstreamCalls: { brave: { ...braveCallMeter(), daily: getDailyUpstreamCalls("brave") } } });
+  res.json({ ...getOperatorBreakdown({ prices: TOOL_PRICES, walletOnlySet: WALLET_ONLY_SLUGS, offeredNetworks: enabledNetworks(NETWORK) }), upstreamCalls: { brave: { ...braveCallMeter(), daily: getDailyUpstreamCalls("brave") } } });
 });
 app.get("/__operator/wishes", (req, res) => {
   if (!operatorAuthed(req)) return res.status(404).type("html").send("<p>Not found.</p>");
@@ -1950,6 +1961,26 @@ app.get("/__operator/refunds.json", (req, res) => {
     refunds: listRefunds({ status, limit: Math.min(500, parseInt(req.query.limit, 10) || 200) }),
   });
 });
+// Self-serve seller conversion/churn (2026-08-16). first_seen: when the
+// origin first registered via POST /api/index/register. last_routable_seen:
+// last crawl cycle it answered a live probe (advances only while the seller
+// stays up - a stalled value IS the churn signal). last_settled_seen: last
+// cycle its leaderboard row showed a real settled payment (conversion, not
+// just liveness) - null means it has never been observed settling.
+app.get("/__operator/seller-registrations.json", (req, res) => {
+  if (!operatorAuthed(req)) return res.status(404).json({ error: "Not found" });
+  const now = Date.now();
+  const rows = getSellerRegistrations().map((r) => ({
+    ...r,
+    everSettled: r.last_settled_seen != null,
+    daysSinceLastSeen: r.last_routable_seen != null ? Math.floor((now - r.last_routable_seen) / 86400000) : null,
+  }));
+  res.set("Cache-Control", "no-store").json({
+    total: rows.length,
+    everSettledCount: rows.filter((r) => r.everSettled).length,
+    registrations: rows,
+  });
+});
 app.post("/__operator/refunds/update", express.json({ limit: "16kb" }), (req, res) => {
   if (!operatorAuthed(req)) return res.status(404).json({ error: "Not found" });
   if (operatorHeavyLimited(req, res)) return;   // see refunds.json above
@@ -3143,6 +3174,52 @@ app.get("/fonts/:file", (req, res) => {
   res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
   res.type("font/woff2").send(buf);
 });
+// Self-hosted static JS (assets/js/), replacing what used to be inline
+// <script> content site-wide - the CSP hardening that dropped 'unsafe-inline'
+// from script-src (2026-08-16) means an inline script can no longer execute
+// at all, so every page-behavior script that has zero per-request server
+// data now lives here as a real file under script-src 'self'. Same safety
+// shape as /fonts/:file: a strict filename allowlist (no path traversal
+// possible - the regex admits only a known, closed set of names) and a
+// SHORT cache (5 min, not the fonts' 1-year immutable) because unlike a
+// font's content-addressed filename, these files keep the SAME name across
+// deploys and must not serve stale JS to a browser that cached the
+// pre-deploy version for a year.
+const JS_FILE_RE = /^[a-z][a-z0-9-]{2,60}\.js$/;
+app.get("/js/:file", (req, res) => {
+  const file = String(req.params.file || "");
+  if (!JS_FILE_RE.test(file)) return res.status(404).end();
+  let buf;
+  try { buf = readFileSync(new URL(`../assets/js/${file}`, import.meta.url)); }
+  catch { return res.status(404).end(); }
+  res.setHeader("Cache-Control", "public, max-age=300");
+  res.type("application/javascript").send(buf);
+});
+
+// Isolated eval sandbox for the SDK playground's "Run" button (2026-08-16,
+// found while converting /sdk-playground off inline scripts). A code
+// playground genuinely needs new Function()/eval to run what a visitor
+// types, but the site-wide CSP's script-src intentionally carries no
+// 'unsafe-eval' anywhere - so before this fix, every click here threw a CSP
+// violation in production with zero test coverage to catch it. Serving this
+// one document from its OWN route with its OWN response-level CSP (relaxed
+// only on this exact path) scopes the eval need to a sandbox="allow-scripts"
+// iframe (no allow-same-origin, so it gets an opaque origin and can never
+// read our real origin's cookies/localStorage) instead of loosening the
+// whole site. default-src 'none' below also means the sandboxed document
+// can never fetch/XHR anything itself - the actual network calls (PoW
+// challenge + tool call) stay in the trusted parent page, reached only via
+// postMessage RPC. A stricter sandbox than the pre-CSP-hardening inline
+// version ever had, not just a compliance shim.
+app.get("/sdk-playground/sandbox", (req, res) => {
+  let buf;
+  try { buf = readFileSync(new URL("../assets/sdk-sandbox.html", import.meta.url)); }
+  catch { return res.status(404).end(); }
+  res.setHeader("Content-Security-Policy", "default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval'");
+  res.setHeader("Cache-Control", "public, max-age=300");
+  res.type("text/html").send(buf);
+});
+
 const BRAND_FONT_STYLE = `<style>
 @font-face{font-family:'Space Mono';font-weight:400;src:url(data:font/woff2;base64,${fontB64("spacemono-400.woff2")}) format('woff2')}
 @font-face{font-family:'Space Mono';font-weight:700;src:url(data:font/woff2;base64,${fontB64("spacemono-700.woff2")}) format('woff2')}
@@ -4131,7 +4208,7 @@ if (FREE_MODE) {
     // challenges, discovery crawls) return a null key and are never guarded.
     const replayKey = paymentReplayKey(req);
     if (replayKey) {
-      const verdict = replayGuard.begin(replayKey);
+      const verdict = await replayGuard.begin(replayKey);
       if (verdict !== "ok") {
         res.setHeader("X-Payment-Replay", verdict); // "consumed" | "inflight"
         return res.status(409).json({
@@ -4141,11 +4218,15 @@ if (FREE_MODE) {
         });
       }
       let resolved = false;
+      // Fire-and-forget from an event listener (finish/close aren't awaited by
+      // Express) - settle()/release() already swallow their own Redis errors
+      // internally, so the .catch() here is only a backstop against a
+      // synchronous throw reaching an unhandled rejection.
       const finishGuard = () => {
         if (resolved) return;
         resolved = true;
-        if (res.statusCode === 200) replayGuard.settle(replayKey);
-        else replayGuard.release(replayKey); // not granted (facilitator rejected, handler errored, client aborted)
+        if (res.statusCode === 200) replayGuard.settle(replayKey).catch(() => {});
+        else replayGuard.release(replayKey).catch(() => {}); // not granted (facilitator rejected, handler errored, client aborted)
       };
       res.on("finish", finishGuard);
       res.on("close", finishGuard); // client aborted before the response finished
@@ -4593,6 +4674,35 @@ for (const tool of ALL_KIT) {
   });
 }
 
+// Wrong-method 405 for a known catalog path (audit finding, 2026-08-16):
+// each tool is registered on exactly ONE Express verb (app[lowerMethod](path,
+// ...) above), so a request to a real path with the wrong method never
+// matched any registered route and fell through to Express's bare, generic
+// HTML 404 — indistinguishable to a naive client from "this route doesn't
+// exist at all", when the real answer is "you used the wrong HTTP method".
+// Built from CATALOG (the same route strings /api/pricing and openapi.json
+// already derive from), so it can never drift from what's actually
+// registered. Runs after every real route has had a chance to match, before
+// the final error handler — an unmatched path (never in CATALOG at all)
+// just falls through unchanged to whatever 404 behavior already exists.
+const METHODS_BY_PATH = new Map();
+for (const route of Object.keys(CATALOG)) {
+  const [method, path] = route.split(" ");
+  if (!path) continue;
+  if (!METHODS_BY_PATH.has(path)) METHODS_BY_PATH.set(path, new Set());
+  METHODS_BY_PATH.get(path).add(method.toUpperCase());
+}
+app.use((req, res, next) => {
+  const methods = METHODS_BY_PATH.get(req.path);
+  if (!methods || methods.has(req.method)) return next();
+  const allow = [...methods].sort().join(", ");
+  res.set("Allow", allow);
+  res.status(405).json({
+    error: `Method ${req.method} not allowed on ${req.path}`,
+    allow: [...methods].sort(),
+  });
+});
+
 // Last-resort error handler. Express's default returns an HTML page with the
 // full stack trace, leaking absolute file paths and module structure. For API
 // routes (anything starting with /api or /__operator) return a small JSON
diff --git a/src/shared-limit.js b/src/shared-limit.js
index 98941213..98380509 100644
--- a/src/shared-limit.js
+++ b/src/shared-limit.js
@@ -61,6 +61,20 @@ function withDeadline(p, ms) {
   return Promise.race([p, new Promise((r) => setTimeout(() => r(null), ms).unref?.())]);
 }
 
+/**
+ * Shared accessor for the module's Redis client — exported so other modules
+ * that need raw Redis primitives (not the counter-shaped spend/peek/refund
+ * above) can reuse the SAME connection instead of opening a second one to
+ * the same server. First consumer: src/replay-guard.js (cross-replica
+ * payment-nonce replay protection). Same contract as the internal callers
+ * below: null means "not configured or not currently reachable," and the
+ * caller decides its own fallback — this module's fail-closed choice is
+ * specific to rate-limiting and must not be assumed by every consumer.
+ */
+export async function getSharedRedisClient() {
+  return getClient();
+}
+
 async function getClient() {
   if (testClient) return testClient;
   if (!REDIS_URL) return null;
diff --git a/src/stats.js b/src/stats.js
index 1f5775da..81f215a1 100644
--- a/src/stats.js
+++ b/src/stats.js
@@ -48,6 +48,19 @@ db.exec(`
   -- deploy-proof series that can. One row per (day, upstream, caller) -
   -- a handful of upstreams x a handful of callers x 365 days - never pruned.
   CREATE TABLE IF NOT EXISTS daily_upstream_calls (day TEXT NOT NULL, upstream TEXT NOT NULL, caller TEXT NOT NULL, n INTEGER NOT NULL, PRIMARY KEY (day, upstream, caller));
+  -- Self-serve seller conversion/churn (2026-08-16). Every previous seller
+  -- signal lives in x402-index.js's in-memory crawl cache (submittedSeeds is a
+  -- bare Set<origin> persisted with no timestamps at all), so there was no way
+  -- to answer "of everyone who registered via /sell, how many are still live,
+  -- and how many ever actually settled a payment" without hand-diffing JSON
+  -- snapshots. first_seen is stamped once, at registration. last_routable_seen
+  -- updates every crawl cycle the origin's x402 surface answers (churn signal —
+  -- stops advancing the moment a seller goes dark). last_settled_seen updates
+  -- only when that cycle's leaderboard snapshot shows the origin with
+  -- callsSettled > 0 (conversion signal — did they ever get paid, not just
+  -- stay reachable). Both nullable: a fresh registration has neither yet beyond
+  -- the initial routable stamp, and most registrations never settle at all.
+  CREATE TABLE IF NOT EXISTS seller_registrations (origin TEXT PRIMARY KEY, first_seen INTEGER NOT NULL, last_routable_seen INTEGER, last_settled_seen INTEGER);
 `);
 
 const RECENT_KEEP = 200; // rows retained
@@ -87,6 +100,40 @@ const dailyUpstream = db.prepare("SELECT day, caller, n FROM daily_upstream_call
 const insertChargedFailure = db.prepare("INSERT INTO charged_failures (slug, status, ts) VALUES (?, ?, ?)");
 const pruneChargedFailures = db.prepare("DELETE FROM charged_failures WHERE id <= (SELECT MAX(id) FROM charged_failures) - ?");
 const getChargedFailures = db.prepare("SELECT slug, status, ts FROM charged_failures ORDER BY id DESC LIMIT ?");
+const upsertSellerRegistration = db.prepare(`
+  INSERT INTO seller_registrations (origin, first_seen, last_routable_seen, last_settled_seen)
+  VALUES (?, ?, ?, ?)
+  ON CONFLICT(origin) DO UPDATE SET
+    last_routable_seen = excluded.last_routable_seen,
+    last_settled_seen = COALESCE(excluded.last_settled_seen, last_settled_seen)
+`);
+const allSellerRegistrations = db.prepare("SELECT origin, first_seen, last_routable_seen, last_settled_seen FROM seller_registrations ORDER BY first_seen DESC");
+
+/**
+ * Record that a self-serve-registered origin (from POST /api/index/register)
+ * answered a live probe this cycle — called once at registration and again on
+ * every periodic crawl tick the origin stays routable. first_seen is set only
+ * on the row's first insert (immutable); last_routable_seen always advances to
+ * now; last_settled_seen advances only when `settled` is true this call and is
+ * never erased by a later call that didn't observe a settlement.
+ */
+export function recordSellerRegistrationSeen(origin, { settled = false } = {}) {
+  const now = Date.now();
+  try {
+    upsertSellerRegistration.run(origin, now, now, settled ? now : null);
+  } catch {
+    /* best-effort — never break the crawl/registration path over telemetry */
+  }
+}
+
+/** Every self-serve registration with its conversion/churn timestamps, newest first. */
+export function getSellerRegistrations() {
+  try {
+    return allSellerRegistrations.all();
+  } catch {
+    return [];
+  }
+}
 
 setMetaIfAbsent.run("firstServed", String(Date.now()));
 const bootedAt = Date.now();
@@ -343,7 +390,13 @@ export function getStats({ wallet, walletName, network, toolCount, baseUrl, pric
       at: new Date(r.ts).toISOString(),
     })),
     servingSince: new Date(firstServed).toISOString(),
-    uptimeSeconds: Math.floor((Date.now() - bootedAt) / 1000),
+    // NOT service-availability uptime - resets to 0 on every deploy. Named
+    // processUptimeSeconds (not uptimeSeconds) specifically so it can't be
+    // misread as a reliability claim: /api/reliability sits this right next
+    // to servingSince (a real ~2-month figure), and an agent parsing field
+    // names alone would otherwise derive ~0.02% uptime from a service that's
+    // actually 99.8-100% up (found in an internal audit, 2026-08-16).
+    processUptimeSeconds: Math.floor((Date.now() - bootedAt) / 1000),
     runTheDemo: `${baseUrl}/llms.txt`,
   };
 }
@@ -401,7 +454,7 @@ export function dailyCallsRecordingSince() {
  * site so this module stays decoupled from CATALOG. Operator-only — gated by
  * AGENT402_OPERATOR_TOKEN at the route layer.
  */
-export function getOperatorBreakdown({ prices, walletOnlySet, limit = RECENT_KEEP } = {}) {
+export function getOperatorBreakdown({ prices, walletOnlySet, limit = RECENT_KEEP, offeredNetworks = [] } = {}) {
   const priceOf = (slug) => (prices && Number(prices[slug])) || 0;
   const isWalletOnly = (slug) => !!(walletOnlySet && walletOnlySet.has && walletOnlySet.has(slug));
   const paidBySlug = new Map(allPaid.all().map((r) => [r.slug, r.n]));
@@ -422,11 +475,23 @@ export function getOperatorBreakdown({ prices, walletOnlySet, limit = RECENT_KEE
       walletOnly: isWalletOnly(r.slug),
     };
   });
+  const viaUSDCByNetwork = mergeNetworkCounters(usdcNetCounters.all().map((r) => [r.k.slice("usdcNet:".length), r.n]));
+  // Offered rails vs settled rails: viaUSDCByNetwork only ever carries a key
+  // for a rail that has settled at least once — a rail with zero settlements
+  // has no key at all, so it's invisible by omission rather than flagged.
+  // offeredNetworks (the caller's enabledNetworks(NETWORK) list) turns that
+  // silence into an explicit zero-settled-revenue row an operator can act on
+  // — keep maintaining the rail's facilitator config/canary legs, or drop it.
+  const railKey = (n) => (n === "robinhood" ? "robinhood (USDG)" : n);
+  const railBreakdown = offeredNetworks.map((n) => ({
+    network: n,
+    settledCalls: viaUSDCByNetwork[railKey(n)] || 0,
+  }));
   return {
     totals: {
       total: getCounter.get("total")?.n ?? 0,
       viaUSDC: getCounter.get("viaUSDC")?.n ?? 0,
-      viaUSDCByNetwork: mergeNetworkCounters(usdcNetCounters.all().map((r) => [r.k.slice("usdcNet:".length), r.n])),
+      viaUSDCByNetwork,
       viaProofOfWork: getCounter.get("viaProofOfWork")?.n ?? 0,
       viaTrial: getCounter.get("viaTrial")?.n ?? 0,
       viaHeartbeat: getCounter.get("viaHeartbeat")?.n ?? 0,
@@ -434,6 +499,7 @@ export function getOperatorBreakdown({ prices, walletOnlySet, limit = RECENT_KEE
       toolsServed: tools.length,
       chargedButFailed: getCounter.get("chargedButFailedTotal")?.n ?? 0,
     },
+    railBreakdown,
     tools,
     recentCalls: getRecentAll.all(limit).map((r) => ({
       slug: r.slug,
@@ -446,6 +512,6 @@ export function getOperatorBreakdown({ prices, walletOnlySet, limit = RECENT_KEE
       at: new Date(r.ts).toISOString(),
     })),
     bootedAt: new Date(bootedAt).toISOString(),
-    uptimeSeconds: Math.floor((Date.now() - bootedAt) / 1000),
+    processUptimeSeconds: Math.floor((Date.now() - bootedAt) / 1000), // see the public getStats() comment above - same rename, same reason
   };
 }
diff --git a/src/tollbooth-landing.js b/src/tollbooth-landing.js
index e3026409..edd32847 100644
--- a/src/tollbooth-landing.js
+++ b/src/tollbooth-landing.js
@@ -123,49 +123,7 @@ export function tollboothLandingPage(baseUrl) {
   <a href="https://www.npmjs.com/package/agent402-tollbooth" rel="noopener">npm</a>
 </div>
 
-<script>
-(function(){
-  /* esc() HTML-escapes every user-controlled value before it reaches the
-     syntax-highlighted snippet. This is the same sanitisation used in the
-     pre-migration version of this page. */
-  function esc(t){ return String(t==null?'':t).replace(/[&<>"']/g,function(c){return({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'})[c];}); }
-  var w=document.getElementById('wallet'), p=document.getElementById('price'), m=document.getElementById('mode'), out=document.getElementById('snip');
-  function render(){
-    var wallet=esc((w.value||'').trim()||'0xYourWalletHere');
-    var price=esc((p.value||'').trim()||'$0.002');
-    var mode=esc(m.value);
-    var modeLine = mode==='observe'
-      ? '<span class="kw">observe</span>: <span class="num">true</span>,                       <span class="com">// no 402s yet - watch first</span>'
-      : '<span class="kw">mode</span>: <span class="str">"'+mode+'"</span>,                   <span class="com">// '+(mode==='bots'?'charge AI crawlers; humans pass':mode==='all'?'charge everything non-human':'paywall everyone')+'</span>';
-    out.innerHTML =
-      '<span class="kw">import</span> express <span class="kw">from</span> <span class="str">"express"</span>;\\n' +
-      '<span class="kw">import</span> { createTollbooth } <span class="kw">from</span> <span class="str">"agent402-tollbooth"</span>;\\n\\n' +
-      '<span class="kw">const</span> app = <span class="kw">express</span>();\\n' +
-      'app.<span class="kw">use</span>(<span class="kw">createTollbooth</span>({\\n' +
-      '  <span class="kw">payTo</span>: <span class="str">"'+wallet+'"</span>,\\n' +
-      '  <span class="kw">price</span>: <span class="str">"'+price+'"</span>,\\n' +
-      '  ' + modeLine + '\\n' +
-      '  <span class="kw">statsToken</span>: process.env.<span class="kw">TOLLBOOTH_STATS_TOKEN</span>,\\n' +
-      '}));\\n' +
-      'app.<span class="kw">use</span>(yourExistingRoutes);\\n' +
-      'app.<span class="kw">listen</span>(<span class="num">3000</span>);';
-  }
-  w.addEventListener('input', render);
-  p.addEventListener('input', render);
-  m.addEventListener('change', render);
-  render();
-
-  document.querySelectorAll('.copy').forEach(function(btn){
-    btn.addEventListener('click', function(){
-      var el=document.getElementById(btn.getAttribute('data-target'));
-      if(!el) return;
-      var txt=el.innerText;
-      if(navigator.clipboard) navigator.clipboard.writeText(txt);
-      var old=btn.textContent; btn.textContent='copied'; setTimeout(function(){ btn.textContent=old; }, 1200);
-    });
-  });
-})();
-</script>
+<script src="/js/tollbooth-snippet.js"></script>
 
 </div>
 ${ledgerFooterCompact()}`;
diff --git a/src/tollbooth-waitlist.js b/src/tollbooth-waitlist.js
index 2e1f1918..bc45fad4 100644
--- a/src/tollbooth-waitlist.js
+++ b/src/tollbooth-waitlist.js
@@ -76,7 +76,7 @@ export function tollboothWaitlistPage(baseUrl, { plan = "team", kind = "waitlist
 <h1>${esc(p.h)}</h1>
 <p class="lede">${esc(p.lead)}</p>
 
-<form id="wl" autocomplete="on">
+<form id="wl" autocomplete="on" data-kind="${esc(isPartner ? "partner" : isEnterprise ? "enterprise" : "waitlist")}">
   <div class="grid2">
     <label><span class="k">Your name</span><input id="f_name" name="name" type="text" required placeholder="Jane Smith"></label>
     <label><span class="k">Work email</span><input id="f_email" name="email" type="email" required placeholder="jane@agency.com"></label>
@@ -108,64 +108,7 @@ export function tollboothWaitlistPage(baseUrl, { plan = "team", kind = "waitlist
 
 <p class="note">Submissions are stored privately on our server (Postgres on Railway) and never appear in any public repo. We use them to email you about your plan and nothing else.</p>
 
-<script>
-(function(){
-  var form = document.getElementById('wl');
-  var doneEl = document.getElementById('wl_done');
-  var errEl = document.getElementById('wl_err');
-  var btn = document.getElementById('wl_submit');
-  function fields(){
-    return {
-      kind: ${JSON.stringify(isPartner ? "partner" : isEnterprise ? "enterprise" : "waitlist")},
-      name: (document.getElementById('f_name').value||'').trim(),
-      email: (document.getElementById('f_email').value||'').trim(),
-      org: (document.getElementById('f_org').value||'').trim(),
-      sites: (document.getElementById('f_sites').value||'').trim(),
-      plan: document.getElementById('f_plan').value,
-      message: (document.getElementById('f_msg').value||'').trim(),
-      website: (document.getElementById('f_hp').value||'')
-    };
-  }
-  function showError(msg){
-    errEl.textContent = msg;
-    errEl.style.display = 'block';
-  }
-  form.addEventListener('submit', async function(e){
-    e.preventDefault();
-    errEl.style.display = 'none';
-    var f = fields();
-    if (!f.name || !f.email) { showError('Name and email are required.'); return; }
-    btn.disabled = true; btn.textContent = 'Sending…';
-    try {
-      var r = await fetch('/api/tollbooth/waitlist', {
-        method: 'POST',
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify(f),
-      });
-      if (r.ok) {
-        form.style.display = 'none';
-        doneEl.style.display = 'block';
-        return;
-      }
-      // F10 (privacy): fail CLOSED. We never place the lead's name/email/org/
-      // message in a URL (GitHub issue pre-fill, or anything else) - that would
-      // leak PII into browser history, referrers, and endpoint logs and break
-      // the private-storage promise above. On any failure we show an honest
-      // retry error and keep the form so the user can resubmit; no success is
-      // shown and no data leaves the page.
-      if (r.status === 503) { showError('Our signup service is briefly unavailable. Please try again in a few minutes.'); }
-      else if (r.status === 429) { showError('Too many submissions - please try again in a minute.'); }
-      else if (r.status === 400) { showError('Please double-check your name and email.'); }
-      else { showError('Something went wrong. Please try again.'); }
-    } catch (_) {
-      showError('Could not reach the server. Please check your connection and try again.');
-    } finally {
-      btn.disabled = false;
-      btn.textContent = ${JSON.stringify(isPartner ? "Apply as partner →" : isEnterprise ? "Request a call →" : "Join waitlist →")};
-    }
-  });
-})();
-</script>
+<script src="/js/tollbooth-waitlist.js"></script>
 </div>
 ${ledgerFooterCompact()}`;
 
diff --git a/src/webhooks.js b/src/webhooks.js
index 93385e0a..9c176abe 100644
--- a/src/webhooks.js
+++ b/src/webhooks.js
@@ -31,7 +31,7 @@ export function webhooksPage(baseUrl) {
     </aside>
 
     <!-- CONTENT -->
-    <main>
+    <div>
       <p style="font-size:.85rem;color:var(--faint);margin:0 0 20px;"><a href="/" style="color:var(--faint);text-decoration:none;">Home</a> &rsaquo; <a href="/docs" style="color:var(--faint);text-decoration:none;">Docs</a> &rsaquo; Webhooks &amp; Callbacks</p>
       <h1 style="font-family:var(--font-body);font-weight:800;font-size:42px;line-height:1;letter-spacing:-.02em;margin:0 0 14px;">Webhooks &amp; Callbacks</h1>
       <p style="font-size:17px;line-height:1.55;color:var(--muted);max-width:620px;margin:0 0 36px;">How to handle async workflows, retries, and long-running tool chains with Agent402.</p>
@@ -106,7 +106,7 @@ await a.call("memory-write", {
         <a href="/quickstart" style="color:var(--accent);text-decoration:none;">Quickstart</a> - get your first call working in 60 seconds<br>
         <a href="/docs" style="color:var(--accent);text-decoration:none;">Documentation</a> - full API reference
       </p>
-    </main>
+    </div>
   </div>
   ${ledgerFooterCompact()}`;
 
diff --git a/src/x402-index.js b/src/x402-index.js
index c7201417..8da9174f 100644
--- a/src/x402-index.js
+++ b/src/x402-index.js
@@ -38,8 +38,9 @@ import { CHAIN_PAGES, marketSellers } from "./market-page.js";
 import { WELL_KNOWN_PATH, discoveryNote } from "./discovery-note.js";
 import { acceptsFromLive402, quoteFromAccepts, probeMethodsFor, isQuoteResponse } from "./x402-live-quote.js";
 import { summarize, fmtUsd, fmtPct } from "./economy.js";
-import { rankBy, canonicalHost } from "./leaderboard.js";
+import { rankBy, canonicalHost, getLeaderboardSnapshot } from "./leaderboard.js";
 import { routeExecuteHint } from "./tools/route-execute.js";
+import { recordSellerRegistrationSeen } from "./stats.js";
 
 // RAILS caip2 -> CHAIN_PAGES key, same join the homepage's by-chain strip uses
 // (see ledger-home.js) so /index's own row derives the same way: page
@@ -148,6 +149,11 @@ export function validateOriginInput(raw, { selfOrigin } = {}) {
 export async function registerOrigin(origin, { crawl } = {}) {
   const existing = cache.get(origin);
   if (existing && !existing.error) {
+    // Only a self-serve-submitted origin belongs in seller_registrations - this
+    // early-return path also serves origins already known from Bazaar/registry
+    // discovery, which never went through /sell and would misrepresent an
+    // ecosystem seller as one of ours if recorded here.
+    if (submittedSeeds.has(origin)) recordSellerRegistrationSeen(origin, { settled: originHasSettled(origin) });
     return { listed: true, origin, seller: sellerSummary(origin, existing) };
   }
   // Cap applies only to origins that would grow the submitted set. An origin
@@ -165,11 +171,32 @@ export async function registerOrigin(origin, { crawl } = {}) {
     discoveredSeeds.add(origin);
     persistSubmittedSeeds();
     if (!cache.has(origin) && crawl) cache.set(origin, { ...v, fetchedAt: Date.now() });
+    recordSellerRegistrationSeen(origin, { settled: originHasSettled(origin) });
     return { listed: true, origin, seller: sellerSummary(origin, cache.get(origin) || v) };
   }
   return { listed: false, origin, error: String(v?.error || "no x402 surface found (manifest, OpenAPI, or Bazaar entry)") };
 }
 
+// Has this origin's leaderboard row settled at least one payment? Joins on
+// canonical host (leaderboard rows carry `origins: string[]`) rather than
+// payTo address - the leaderboard already groups by host when a homepage is
+// known, and every origin here already has a URL we can hash the same way,
+// so this needs no new payTo-matching plumbing. Best-effort: any shape
+// surprise in the snapshot (still warming, scan error) reads as "not yet
+// observed settling", never a throw.
+function originHasSettled(origin) {
+  const host = canonicalHost(origin);
+  if (!host) return false;
+  try {
+    const snap = getLeaderboardSnapshot();
+    return (snap?.leaderboard || []).some(
+      (row) => (row.callsSettled || 0) > 0 && (row.origins || []).some((o) => canonicalHost(o) === host)
+    );
+  } catch {
+    return false;
+  }
+}
+
 function sellerSummary(origin, v) {
   return {
     displayName: v.manifest?.name || origin.replace(/^https?:\/\//, ""),
@@ -2056,11 +2083,26 @@ async function runCrawl() {
     crawlCycle += 1;
     const ordered = seeds.length ? [...seeds.slice(start), ...seeds.slice(0, start)] : seeds;
     await runPool(ordered, CRAWL_CONCURRENCY, crawlSeller);
+    recordSubmittedSellerObservations();
   } finally {
     crawlInFlight = false;
   }
 }
 
+// Post-cycle churn/conversion pass over ONLY self-serve-submitted origins
+// (not the operator-curated DEFAULT_SEEDS or registry-discovered sellers -
+// seller_registrations tracks /sell signups specifically). An origin whose
+// crawl failed this cycle is skipped entirely: last_routable_seen simply
+// stops advancing, which is the churn signal itself - stamping "now" on a
+// failed probe would hide the very thing this table exists to show.
+function recordSubmittedSellerObservations() {
+  for (const origin of submittedSeeds) {
+    const entry = cache.get(origin);
+    if (!entry || entry.error) continue;
+    recordSellerRegistrationSeen(origin, { settled: originHasSettled(origin) });
+  }
+}
+
 /**
  * Boot the periodic crawler. Safe to call multiple times — subsequent calls are
  * no-ops. The first crawl runs immediately (non-blocking) so the page has data