Build Log.
Public.

Added

• /_vercel/insights/script.js: Web Analytics page-view tracking. No cookies, no PII, no GDPR banner needed. Tracks page paths, referrers, UTM params, device categories.
• /_vercel/speed-insights/script.js: Core Web Vitals (LCP, INP, CLS) collected on real visits. Surfaces actual performance from real devices, not lab tests.
• Included on all 29 indexable HTML pages. Excluded from offline.html (no network anyway).

Why

• Plausible would have cost $9+/mo for the same data. Google Analytics is free but adds a cookie banner and 40KB of script weight. Vercel Analytics delivers conversion attribution + Core Web Vitals at zero cost and zero privacy tax.

Changed

• community.html: meta description, OG description, body copy "Not another passive Slack", section heading "Slack Channels".
• pricing.html: Crew Pass tier checklist now reads "Full Slack community" (was "Full Discord community"). Tier perk description swapped.
• docs.html: "Community access (Slack)" and "Full Slack community" in tier breakdowns.

Removed

• roadmap.html: "Discord invite URL wired in" blocker item dropped entirely. Discord is no longer a planned platform.

Why

• The Schema.org Product descriptions and tier deliverables already named Slack ("Slack workspace" in Crew Pass). The Discord references were stragglers from an earlier iteration. The site now tells one consistent story: Crew Pass gives you the Slack workspace.

Added

• apple-mobile-web-app-capable + mobile-web-app-capable: iOS and Android treat the home-screen icon as a full app launch.
• apple-mobile-web-app-status-bar-style: black-translucent so the iOS status bar matches the brand-dark hero.
• apple-mobile-web-app-title: Express Intent shows under the icon on the home screen instead of the URL.
• Coverage: all 30 HTML pages including offline.html and intake-router.html.

Fixed

• booking/index.html, booking/schedule.html: #err got role="alert" aria-live="assertive" so payment errors are announced immediately. #ok got role="status" aria-live="polite" for "Redirecting to Stripe" messages.

Why

• Without live-region attributes, screen reader users hit "Pay", saw nothing happen, and didn't know an error message had appeared below the button. Now both error and success states are announced in real time.

Added

• offline.html: branded "Lost Signal" fallback page with auto-reconnect logic. Polls navigator.onLine every 5 seconds and reloads when connectivity returns.
• sw.js: network-first service worker. Caches only /offline.html. Returns offline page on fetch failure for navigation requests. No precaching of dynamic content (avoids stale-content bugs).
• sw-register.js: safe-by-default registration. Skips on non-secure contexts. Silent on failure (SW is non-critical, never blocks page load).
• vercel.json: /sw.js served with Cache-Control: no-cache, no-store + Service-Worker-Allowed: /. SW updates apply on next page load.

Why

• PWA install ("Add to Home Screen") works without a service worker, but visitors who lose network mid-session get a generic browser error. With this SW, they get a branded offline page that auto-recovers when the connection comes back.
• Risk minimization: the SW does NOT precache CSS/JS/HTML beyond offline.html. If we ship a broken site, users don't have to clear their service worker to recover. The next page load fetches fresh content.

Fixed

• booking/index.html, booking/schedule.html, booking/success.html: now load preconnect for cdn.tailwindcss.com and link the site-wide /a11y.css for visible focus rings.
• The earlier batch-insert waves used *.html at the project root and missed the subdirectory.

Added

• og:image:width="1200" + og:image:height="630" + og:image:type="image/png" on all 28 public pages with og:image.
• All /api/og output is 1200x630 PNG; dimension hints let consumers reserve the correct aspect-ratio box before the image loads.

Why

• Slack, Discord, Threads, and LinkedIn all rebuild the link preview when an image arrives at a different size than they expected. Declaring dimensions upfront kills the relayout flash.

Added

• feed.json: JSON Feed 1.1 spec. Same content as the RSS and Atom feeds, but in flat JSON (no XML parsing required by consumers).
• Site-wide auto-discovery: <link rel="alternate" type="application/feed+json"> on all 29 pages.
• Edge cache + content-type: 1-hour cache, application/feed+json; charset=utf-8.
• Sitemap: /feed.json at priority 0.4.

Why

• NetNewsWire 6+, Reeder 5+, FeedLand all prefer JSON Feed. More importantly, an AI agent can consume the entire build log with a single fetch and one JSON.parse call. The XML feeds remain for backward compat.

Added

• og:site_name="Express Intent" on all public pages. Facebook, LinkedIn, Threads display this above the link preview headline.
• og:locale="en_US" for content-language signaling. Helps locale-aware indexers and translation tools.
• Only dashboard.html (auth-gated) lacks these; it's not for indexing.

Fixed

• community.html: hero and footer CTAs labeled "Join Discord" but their href pointed to pricing.html. Clicking it took visitors to the pricing page, not to Discord (the invite URL is still pending). Renamed to "Get Crew Pass to Join". Same destination, accurate label.
• Audited every page for similar mismatches. No other bait-and-switch CTAs on index, pricing, operator, workshops, or anywhere else.

Why

• A button labeled "Join Discord" promises a Discord invite. Landing on a pricing page instead damages trust on the first click. The new copy "Get Crew Pass to Join" tells the truth: Discord access is a Crew Pass perk, and the pricing page is where you buy it.

Added

• LearningResource on docs.html: educationalLevel, audience, EducationalRole, isAccessibleForFree. Tells search engines docs.html is documentation, not a sales page.
• CollectionPage on tools.html: 787 items, ItemList mainEntity. Eligible for Google's CollectionPage carousel.
• CollectionPage on prompts.html: 203 items, CC0 license declared, isAccessibleForFree. Discoverable as a free prompt directory.
• CollectionPage on skills.html: ItemList mainEntity. Plug-and-play workflows.

Why

• BreadcrumbList alone tells Google where a page sits in the hierarchy. CollectionPage and LearningResource tell Google what the page actually IS. The distinction matters for catalog/documentation rich results.

Fixed

• VERCEL_GIT_COMMIT_SHA was unset on CLI deploys. /api/health was returning sha: unknown. Now bin/deploy writes build-info.json at deploy time with git rev-parse HEAD, and /api/health reads from it as a fallback.

Added

• /api/build-info: dedicated endpoint returning {sha, branch, deployedAt, subject}. Cached 60s. HEAD-supported.
• bin/deploy: wraps vercel --prod --yes. Writes git SHA, branch, commit subject, and ISO timestamp to build-info.json before the upload.
• /status.html now shows full deploy line: region, timestamp, SHA, env, and shipped-at.

Fixed

• HEAD on /api/health: was returning 405 (Method Not Allowed). Now returns 200 with empty body. Sets Allow: GET, HEAD header on other methods. Most uptime monitoring services (UptimeRobot, BetterStack, Hyperping) probe with HEAD by default.

Added

• deploy.sha + deploy.env fields in /api/health JSON. Lets me verify which commit is live without checking Vercel UI.
• /status.html now renders the deploy SHA inline: region iad1 / 2026-05-16T03:00:00Z / deploy 504e06f (production).

Added

• shortcuts array: 4 quick actions accessible from long-press of the home screen icon (Pricing, Book a Build Call, AI Tools Directory, Prompt Library). Each tags utm_source=pwa_shortcut for attribution.
• categories: ["education", "productivity", "business"]. PWA discovery on Edge, Chrome app stores.
• scope: / explicit. start_url now tags utm_source=pwa so I can measure install-driven traffic.
• orientation: portrait-primary for mobile install.
• lang + dir: en-US + ltr declared explicitly.

Why

• "Add Express Intent to home screen" already worked, but the install prompt looked thin. Shortcuts let installers jump straight to a tier or the tool directory, which matches how returning visitors actually use the site.

Added

• PNG favicon set rasterized from favicon.svg via rsvg-convert: 16x16, 32x32, 48x48.
• Apple-touch PNG: 180x180 PNG from apple-touch-icon.svg. Older iOS versions and Android Chrome's "Add to Home" prefer PNG for the homescreen tile.
• Android Chrome PWA icons: 192x192 and 512x512 PNG. Required by PWA spec for splash screens and the Add-to-Home-Screen prompt.
• manifest.json now lists all 7 icon variants. SVG first (sharper, scalable), PNG fallbacks for non-SVG-favicon browsers.
• Site-wide link tags on all 29 pages: PNG <link rel="icon"> entries at 32/16/48 plus 180 apple-touch.

Why

• Safari 14 and earlier, plus some Windows browsers, silently fail to render SVG favicons. They show the default globe instead. PNG fallbacks recover those impressions, and the SVG keeps being used everywhere it's supported (sharper on retina).

Added

• og:title + og:description + og:image + twitter:card on: 404, credits, privacy, refunds, terms, sitemap-human.
• Each og:image points to /api/og (Edge runtime) with unique title, subtitle, and label. Generated on-demand, edge-cached.
• Coverage now 28 of 29. Only dashboard.html (auth-gated, low share value) is excluded.

Why

• Without og:image, social platforms render a default text-only preview or pluck a random image from the page. With branded /api/og output, every share looks like Express Intent shipped it.

Fixed

• intake-router.html: had no <meta name="description"> and no Open Graph tags at all. Added description, og:title, og:description, og:url, og:image (via /api/og), and twitter:card.
• terms.html: 36 → 149 chars. Now covers purchase, refund, content licensing, and IP.
• sitemap-human.html: 42 → 153 chars. Says it's the human-readable index and lists the six organization buckets.
• changelog.html: 56 → 138 chars. Mentions RSS and Atom for feed-reader discoverability.
• refunds.html: 67 → 178 chars. Distinguishes one-time vs subscription refund logic; matches the actual policy text on the page.

Why

• Google truncates around 155-160 chars. Anything shorter wastes the SERP listing surface; anything bare drops the snippet entirely. These five pages were leaving CTR on the table.

Added

• atom.xml: Atom 1.0 feed with the same entries as /feed.xml. Some readers prefer Atom for its stricter spec (proper datetime format, unambiguous entry IDs via tag: URI scheme).
• Site-wide alternate links: every page now advertises both application/rss+xml (/feed.xml) and application/atom+xml (/atom.xml). Readers pick whichever they support best.
• Cache + content-type headers: atom.xml mirrors feed.xml policy. 1-hour public cache, application/atom+xml; charset=utf-8.
• Sitemap entry: /atom.xml at priority 0.4. Sitemap dates bumped to 2026-05-16.

Added

• BreadcrumbList JSON-LD on: about, changelog, community, credits, docs, lead-magnet, privacy, prompts, refunds, resources, roadmap, sitemap-human, skills, status, terms, tools, workshops.
• Total coverage now: 25 of 29 pages. The 4 without are 404 (error page), index (root), intake-router (one-off router), and dashboard (auth-gated).

Why

• BreadcrumbList is one of the simplest rich results Google supports. Cost is 4 lines per page. Returns "Home › Page" in SERP listings, which lifts CTR.

Added

• nav-current.js: 45-line module included site-wide. Scans nav a[href], normalizes paths, marks the link matching location.pathname. Sets aria-current="page" (a11y) and adds .ei-current class (visual underline).
• a11y.css rule: nav a[aria-current="page"]::after draws a 2px accent underline. Reduced-motion safe, no animation.
• Normalization handles: trailing-slash stripping, /index.html equivalence with /, hash-only and mailto/tel skipping.

Why

• Screen-reader users can hear which page they're on without inspecting the URL. Sighted users get a visual anchor in nav. Both audiences ship the same accessibility tax for free.

Added

• Preconnect for cdn.tailwindcss.com on all 28 pages that load Tailwind. Warm TLS handshake during HTML parse cuts first-paint latency by 50 to 200ms on cold loads.
• Organization ContactPoint: customer support email, areaServed, availableLanguage. Makes the Organization JSON-LD eligible for Google knowledge panel features.
• Course schema for the CAIAO 12-week cohort on pricing.html. courseCode, educationalLevel, CourseInstance with courseMode=Online and courseWorkload=PT60H. Eligible for Google Course rich results.
• founder.jobTitle and founder.sameAs inside Organization JSON-LD. Better entity linking between Express Intent and Enoch Odu Studios.

Fixed

• OpenAI logo on index: missing loading="lazy" and decoding="async". Added explicit width="20" height="20" attributes to lock CLS at zero.

Changed

• RSS auto-discovery on all 29 HTML pages: <link rel="alternate" type="application/rss+xml"> in every <head>. Any feed reader subscribing to any Express Intent URL will find the changelog feed automatically. Before this, only the changelog page itself advertised it.
• Cache-Control for /feed.xml: public, max-age=3600, s-maxage=3600. Feed readers poll politely; the CDN absorbs the load.
• Cache-Control for /sitemap.xml: public, max-age=21600 (6 hours). Crawlers re-fetch on their own cadence anyway.
• Explicit Content-Type for feed.xml: application/rss+xml; charset=utf-8. Strict feed readers (NetNewsWire on older macOS) reject text/xml.

Added

• feed.xml: RSS 2.0 with every wave to date. Standard channel metadata, per-item guid, pubDate, link, description. Lives at /feed.xml.
• Auto-discovery: <link rel="alternate" type="application/rss+xml"> in the changelog head. Paste this page URL into a feed reader and it subscribes to the RSS automatically.
• Visible subscribe link: the changelog footer now shows a Subscribe via RSS action for people who already use a reader.
• Sitemap: /feed.xml listed at priority 0.4 so crawlers see the canonical syndication URL.

Why

• Developer audiences live in feed readers. Forcing repeat page visits to track build progress is friction nobody asked for.

Changed

• robots.txt: now explicitly allows GPTBot, ChatGPT-User, ClaudeBot, anthropic-ai, PerplexityBot, Google-Extended (with the same /admin /booking /dashboard /api exclusions). The site is public learning content; we want it findable by AI assistants when someone asks "how do I direct an AI agent."
• rel=me on index and about: IndieWeb identity verification linking the site to threads.com/@enochodustudios and enochodustudios.com. Lets Mastodon/Threads/IndieWeb tools verify the identity chain.
• generator meta tag: "Express Intent, directed by Enoch Odu and 4 AI agents." Honest about how the site is built.

Added

• Schema.org BreadcrumbList added to first-steps, faq, vs, case-studies, pricing. Combined with Wave 23's three (glossary, how-agents-work, operator), 8 content pages now have breadcrumb schema for Google search results.

Added

• /.well-known/security.txt: RFC 9116 security disclosure policy. Tells researchers how to report vulnerabilities. Expires 2027-05-15.
• /humans.txt: the friendly file. Names the founder, the 4 AI agent operators, the open-source dependencies, and the stack.
• Schema.org BreadcrumbList on glossary, how-agents-work, operator. Helps Google show breadcrumb navigation under search results.
• ARIA labels on the two outbound action buttons on booking/success.html so screen readers announce intent (back to home vs. DM on Threads opens in new tab).

Changed

• a11y.css now loaded on every published HTML page (24 pages total). Tab navigation now shows a visible 2px green focus ring on every link, button, and form field. prefers-reduced-motion users get instant transitions instead of fade-ups.

Added

• /a11y.css: site-wide focus-visible rings (2px green outline with 2-3px offset on links/buttons, inset on form fields), prefers-reduced-motion media query that disables all CSS animations and smooth scrolling. Wired into the 4 highest-traffic pages.
• defer attribute on prompts-library.js (374 KB) and tools-data.js (302 KB) so they no longer render-block their pages.
• Lead-magnet OG meta: was missing entirely; now uses the dynamic /api/og endpoint with custom copy.

Changed

• 13 more pages now use /api/og with page-specific copy: home, about, glossary, faq, workshops, community, tools, prompts, skills, lead-magnet, case-studies, changelog, roadmap, status. Combined with Wave 19's 5 pages, all 18 high-traffic sharable pages have custom social cards.
• Every share preview on Twitter, LinkedIn, Threads, Facebook, Discord, Slack now shows the page title and subtitle in brand styling instead of the generic site logo.

Added

• /api/og: Vercel Edge function using @vercel/og. Accepts title, subtitle, label query params. Returns a 1200x630 PNG with the brand stack (green accent, dark background, monospace label). No image assets to maintain.
• Per-page dynamic OG meta on 5 high-traffic pages: pricing, operator, how-agents-work, vs, first-steps. Each share now shows page-specific copy instead of the generic site image.
• @vercel/og + react added to package.json deps.

Fixed

• Welcome modal on index.html now has role=dialog, aria-modal, aria-labelledby on the heading, and aria-label on the close button. Screen readers announce it as a modal dialog now.
• loading=lazy + decoding=async added to the supported-stack logo images on index.html (7 images at 20x20, served via CDN). Saves first-paint network on mobile where they are below the fold.

Changed

• Meta descriptions tightened on docs.html, resources.html, skills.html. The previous descriptions had a stray comma left over from the em-dash purge and were generic. Now they describe the actual page contents and audience.

Added

• /faq.html: 20 consolidated FAQ entries with full-text search and 6 tag filters (pricing, refunds, program, audience, tools, data). Each card is keyboard-toggleable. Includes the deep Wave 6 objection-handling entries plus the original pricing FAQ plus several new identity-and-data questions.

Changed

• /robots.txt now explicitly disallows /api/ and /dashboard.html in addition to /admin/ and /booking/. Adds Crawl-delay: 1 to be polite.
• /faq.html added to sitemap.xml at priority 0.8.

Fixed

• Hamburger menus on workshops, community, tools, prompts, skills converted from div to button with full ARIA (aria-label, aria-expanded, aria-controls). All hamburger menus on the site now keyboard accessible (waves 15 + 16 combined).

Added

• /sitemap-human.html, human-readable site index grouped by intent (Start Here / Buy / Learn / Libraries / After You Buy / Transparency / Legal). Complements the existing /sitemap.xml for crawlers.
• Schema.org Article markup on /changelog.html so the build log is eligible for Google news / article rich results.

Added

• /exit-intent.js: shows a one-time-per-session "Take the 10 prompts with you" modal when the cursor leaves the viewport from the top (desktop) or scrolls back to near the top after a meaningful scroll (mobile). Includes a 10-second desktop arming delay and 15-second mobile delay. Escape closes. Click outside closes. Stored in sessionStorage so it does not nag.
• Wired exit-intent into index.html and pricing.html.

Fixed

• Hamburger menu buttons on index and pricing are now real <button> elements with aria-label, aria-expanded, aria-controls, and dynamic label switching ("Open menu" / "Close menu"). Was a plain div before; keyboard-inaccessible.

Added

• /roadmap.html, 3-column kanban-style public roadmap (Shipped / In Progress / Queued). Each in-progress card includes its blocker. Visitors can email to push items up the queue; paid customer requests jump.
• Glossary anchor IDs on key terms (Agent, CLAUDE.md, MCP, EPEV, RAG) so other pages can deep-link via /glossary.html#term-mcp instead of scrolling.
• Start link in operator and about nav rows pointing to /first-steps for new visitors landing on those pages first.

Added

• /api/leads endpoint: validates email, CSRF-protected, idempotent Stripe Customer pre-creation so leads land in the Stripe dashboard alongside paid customers. Source-tagged for attribution.
• Homepage lead magnet form now POSTs to /api/leads in addition to writing to localStorage. When Resend lands, swap the console-log step for a Resend Audiences subscribe call.
• First Steps link propagated to Resources dropdowns on pricing, community, workshops, tools, prompts.

Added

• /first-steps.html, a 5-step starter path. Read explainer (5 min) -> skim glossary (3 min) -> copy a prompt that maps to a real problem (7 min) -> pick a tool (5 min) -> book the build call. Schema.org HowTo markup with totalTime PT30M for rich-result eligibility.
• First Steps link added to the home page Resources dropdown (top of the list).

Added

• "Recently Shipped" widget on the homepage: 3-card grid showing the most recent waves, each linking to the full changelog. Build-in-public proof visible without leaving the home page.
• vs Alternatives + Status links added to Resources dropdowns on index, pricing, community, workshops, tools, prompts.
• vs link in operator.html and about.html nav rows.

Added

• /vs.html, 5 honest comparisons: Express Intent vs YouTube, vs Maven cohorts, vs traditional bootcamps, vs hiring a dev team, vs "wait until AI is better." Each comparison ends with "pick the other one if..." rather than always recommending us.
• 14-day money-back guarantee badge visible above the Final CTA on pricing.html and the hero on vs.html.
• Mobile hero CTAs above the fold on community.html (Join Crew Pass + Book Call buttons that appear only on small screens).
• /vs.html added to sitemap.xml.

Added

• /status.html, live service status page consuming /api/health. Shows configured vs pending for Stripe, Resend, Zoom, Twilio, Telegram, Slack, admin auth. Updates on every page load. No third-party uptime service required.
• Schema.org WebSite + SearchAction on home page so Google can show a site search box in branded search results.
• /status.html and /how-agents-work.html added to sitemap.xml.

Added

• Schema.org ItemList on /workshops.html with 18 Course entries, each name + description. Eligible for Google rich-result presentation.
• How It Works + Glossary nav links on operator.html and about.html (these pages have no Resources dropdown).
• Changelog catchup for Wave 6 + Wave 7 entries.

Added

• How Agents Work, Glossary, Changelog now show in the Resources dropdown on pricing, community, workshops, tools, prompts (in addition to index).
• /api/health uptime probe. Returns 200 with timestamp + boolean integration status. Safe to expose publicly; no secret values leak.
• Schema.org DefinedTermSet on /glossary.html for Google rich-result eligibility.
• Schema.org HowTo on /how-agents-work.html with the 4-step agent loop (reason, act, observe, decide).

Added

• /how-agents-work.html: plain-English explainer of the agent loop, chatbot-vs-agent comparison, tools table, what to learn in order, what this is not.
• 8 deeper FAQ entries on pricing.html closing real objections: production-agent definition, terminal-free starting point, vs YouTube/Maven, seat-limit honesty, tool obsolescence, identity reassurance, installments, data handling.

Fixed

• FAQ accordion max-height doubled so the longer answers do not clip.
• Placeholder testimonials on index.html no longer say "[Founder name]"; now read "Operator, name on request" as an honest pending state.
• Resources dropdown trigger has aria-label + tabindex + aria-hidden on the chevron SVG for keyboard and screen-reader users.

Added

• /glossary.html, plain-English definitions for 22 AI agent terms (CLAUDE.md, MCP, RAG, EPEV, tool calling, more). Designed to keep non-technical visitors from bouncing on jargon.
• /changelog.html, this page. Public build log updated after every production deploy.

Added

• Favicon set: favicon.svg, apple-touch-icon.svg, manifest.json, theme-color meta. Site is now installable as a PWA.
• Favicon links on 23 HTML pages. Every page was generating a 404 on browser-requested favicons before.
• Mobile hero CTAs above the fold on / and /pricing.html. Mobile visitors no longer have to scroll to see a buy button.
• Skip-to-content link on index.html for keyboard and screen-reader users.
• /credits.html, open-source acknowledgments + trademark attributions.
• Project-local git repo. Site went from "Vercel deploys are the only history" to a real commit tree.

Changed

• sitemap.xml expanded from 12 URLs to 18 (added case-studies, lead-magnet, credits, privacy, terms, refunds, intake-router).

Added

• /mobile-nav.js, self-contained module that injects hamburger + drawer with 48x48 touch target into pages that did not have one.
• Mobile nav now works on operator.html, about.html, booking/index.html, and dashboard.html. These pages had no way to navigate from mobile before.

Changed

• Hamburger touch target enlarged from 28x23 to 48x48 across 8 pages (meets Apple/WCAG AA).
• Pricing comparison table wrapped in overflow-x-auto so mobile users swipe inside the table instead of triggering page-level horizontal scroll.

Added

• /lead-magnet.html, a 10-prompt printable PDF that the homepage form now actually delivers (previously the form promised a PDF that never sent).
• Privacy, Terms, Refunds links in the footer of all 11 root pages.

Fixed

• Homepage lead-magnet form copy now matches reality. The "PDF arrives in 60 seconds" promise was replaced with honest "page opens in new tab, save as PDF" language.

Added

• /dashboard.html, customer self-service booking lookup. Stripe session ID in URL or pasted manually. Shows tier, status, meeting URL, call time, reschedule path.
• /privacy.html, /terms.html, /refunds.html, baseline legal pages. Visible draft banners on the first two pending formal legal review.
• /case-studies.html, 3 placeholder case studies pending operator permission to publish real names.
• Schema.org JSON-LD on / (Organization + FAQ), /pricing.html (8-tier Product ItemList), /operator.html (Course), /about.html (Person). Rich-result eligible.
• Sticky build-call CTA on long pages (pricing, operator, workshops). Dismissible per session.
• Cookie consent banner, lightweight, stores acceptance in localStorage. No third-party tracking pixels.
• 404 fuzzy match on the styled 404 page suggests likely-meant pages.

Fixed

• Course-delivery copy in welcome emails rewritten to honest "I'll send within 24 hours" pattern. Previous copy promised "your course access link arrives within 5 minutes" while the codebase did not send it.
• HTML injection vector in admin emails closed. escapeHtml now used on every customer-controlled field that lands in an email body.
• Admin token comparison now uses crypto.timingSafeEqual. Timing-attack resistant.
• CSRF protection added to /api/book-slot via Origin header check.
• Error messages no longer leak internal Stripe error details to API responses.
• Slot picker timezone fixed: was approximating UTC-5 (off by 1 hour during DST). Now uses proper America/Chicago timezone math.
• Past-slot guard changed from 6 hours to 24 hours to match the documented buffer.

Added

• HSTS, CSP, and Cache-Control headers in vercel.json.
• 301 redirect from expressyourintent.com apex to express-intent.com (was serving duplicate content before).
• robots.txt and sitemap.xml (both were 404 before).
• Styled /404.html page replacing the default plain-text Vercel 404.
• Canonical tags on 5 pages that were missing them.
• twitter:creator meta site-wide.
• 203 CC0 public-domain prompts added to /prompts.html. Library grew from 12 to 215.
• "Built by Enoch Odu Studios" footer attribution on every page (fusion plan).

Fixed

• Foundations CTA bait-and-switch: the Foundations $97 tier button was routing customers to the $150 Direct Call. Now routes correctly.
• Checkmark glyphs on pricing tiers were rendering as literal "--" text. Replaced with inline SVG checkmarks and X marks.
• BUILDER25 promo banner markup was missing from the pricing page DOM (CSS shipped, HTML did not). Restored.
• "Zoom link" copy on booking/success.html updated to tool-neutral "meeting link" (was misleading when ZOOM_PERSONAL_URL was unset).
• Tools count on tools.html aligned to actual count (787) instead of marketing claim (820+).
• 243 em-dashes purged across HTML, JS, README per writing-style preference.

Pre-existing

• 12 HTML pages, 6 Vercel serverless API endpoints, Stripe checkout flow, 8 pricing tiers, slot booking flow, admin dashboard. Foundation that the above waves all build on.