marketing: FRE-199 third pair of informational pages (drafts) + pitch narrowed to the no-figure shape

Pair 3 (internal target Thu 2026-11-12, six days early): - agent-worktree-contention — 'How do you manage worktrees when your agents end up waiting on each other?' (backlog 1xlz2bs, Scan 6 #4); git worktree + Docker Compose project-name docs fetched and read 2026-11-05. - agent-keeps-asking — 'Why does your coding agent keep stopping to ask you questions?' (handback cluster: 1xlfqmo, 1xk0ghj, 1xlxw0q); permission + hooks claims re-verified live 2026-11-05 against code.claude.com; the 1xlfqmo poster's measurement figures deliberately not cited. Pitch narrowed per CTO reopening verdict: trial→paid placeholder deleted (FRE-202 cohort too young; ratio waits for FRE-197), second breakage chosen (NOOK-815 uninvoked suite), any count named as activations, downloads never quoted.
marketing: FRE-199 CTO review fixes — B1 precedence order, B2 false git-push example dropped, N1 hooks-guide attribution
2026-11-05 22:54:53 +00:00 · 2026-11-05 21:42:26 +00:00 · 2026-11-05 20:23:03 +00:00 · 2026-11-05 20:15:30 +00:00 · 2026-11-05 19:58:59 +00:00 · 2026-11-05 19:54:45 +00:00
30 changed files with 2219 additions and 124 deletions
--- a/marketing/approved/agent-done-signal/copy.md
+++ b/marketing/approved/agent-done-signal/copy.md
@@ -0,0 +1,92 @@
 # How do you know when your coding agent is done?
 > **Status: approved — sponsor fact-check passed 2026-11-05** (FRE-199 fact-check
 > card, verdict: "Approve both — move to approved/"). Not published; a human
 > places it on nook.freno.me from `approved/`.
 > This page never names a product of ours and never names a competitor.
 > Internal target: first page of the FRE-199 pair, Thu 2026-11-06.
 > CTO review 2026-11-05: changes requested and applied — the `osascript`
 > example is attributed to the hooks guide, not the hooks reference; pair-1
 > citations standardised to code.claude.com.
 Often, you don't — not from the terminal alone. A coding agent's turn can end in
 silence: the prompt returns, the cursor blinks, and a finished turn looks exactly
 like one that stalled, is still running, or is waiting on you. The fix is to stop
 trusting silence and wire the two moments that matter — *the turn ended* and *the
 agent needs you* — to something you will actually see.
 ## Why silence is the failure mode
 A terminal coding agent ends a turn by printing a prompt. If you are in another
 window, another room, or running several agents at once, nothing in that output
 distinguishes "finished" from "blocked on a permission prompt" from "dead". The
 task being done and you finding out are two different events, and the second one
 has no default signal.
 Practitioners keep rediscovering this. One operator running a self-hosted queue
 of autonomous agent sessions described sessions that "finished their work but
 never sent the done signal, and held their slots for hours" — their fix was to
 derive "done" from git state plus an idle transcript instead of trusting the
 agent's own signal. A public service post about a code-review plugin described
 the mirror image: a green checkmark and "No findings" when the review had not
 run at all. An empty result and a successful result rendered identically.
 That is the trap in one sentence: **zero looks exactly like success.**
 ## What the turn-ending signal actually is
 Claude Code gives you two hooks that bracket the moments worth surfacing:
 - **`Stop`** fires when the agent finishes responding — the end of a turn.
 - **`Notification`** fires when Claude Code sends a notification. A permission
  prompt is one of these: the hook's payload carries a `notification_type` of
  `permission_prompt` and a message like "Claude needs your permission".
 - **`StopFailure`** fires instead of `Stop` when the turn ends on an API error —
  rate limits, authentication problems, and the like.
 All three can run a command of your choosing. The hooks reference documents the
 events; the hooks guide includes a desktop-notification example built on
 macOS's `osascript`.
 ## What to check or do
 1. **Wire turn-end to a notification you will actually notice.** A `Stop` hook
   that calls `osascript -e 'display notification …'` (or your terminal's
   notification escape) turns the silent prompt-return into a visible event.
   A terminal bell is not this — it is mute the moment you switch windows.
 2. **Route permission waits separately from completions.** The `Notification`
   hook's payload tells you which kind it is. A permission wait means the agent
   is *blocked on you*; treating it as "done" hides the one state that costs the
   most time.
 3. **Don't trust the exit signal alone.** Check the artifacts: `git status`,
   `git log`, whether the transcript has gone idle. The queue operator's rule
   generalises — a "done" that has to name what it is waiting on is a "done"
   you can act on.
 4. **Surface the failure path too.** A turn that ends on an API error fires
   `StopFailure`, not `Stop` — an alert wired to the wrong one misses exactly
   the runs that need attention.
 One next step: take the agent command you run most often and give its end-of-turn
 a notification you would notice from across the room. That single wire closes the
 most expensive silence in the workflow.
 ---
 ## Fact-check table (not part of the page)
 Every technical claim above, with its primary source. Claims about Claude Code's
 behaviour come from its own documentation, re-read 2026-11-05.
 | # | Claim in the page | Source |
 |---|---|---|
 | 1 | `Stop` fires when the agent finishes responding (end of a turn); hook cadence is "per turn: UserPromptSubmit, Stop, StopFailure" | Claude Code hooks reference — https://code.claude.com/docs/en/hooks |
 | 2 | `Notification` fires "when Claude Code sends a notification"; example payload carries `notification_type: "permission_prompt"`, message "Claude needs your permission" | same hooks reference (Notification event section) |
 | 3 | `StopFailure` "runs instead of Stop when the turn ends due to an API error" (rate limits, authentication) | same hooks reference (StopFailure section) |
 | 4 | Hooks run a command of your choosing; a desktop-notification example using `osascript` is in the hooks guide | Claude Code hooks guide — https://code.claude.com/docs/en/hooks-guide (desktop-notification example) |
 | 5 | Operator anecdote: sessions that finished work but never signalled done, holding slots for hours; fix = derive done from git + idle transcript | r/ClaudeCode thread 1xjb3j0 ("Are you running a self-hosted queue of autonomous Claude Code sessions?", 2026-10-31), quoted in `drafts/listening.md` Scan 4 addendum. Quoted as one operator's described practice, not a measurement. |
 | 6 | PSA anecdote: code-review plugin showed green check + "No findings" without running | r/ClaudeCode 1xmnz2c (2026-11-03), logged in `drafts/listening.md` Scan 6. |
 | 7 | "Zero looks exactly like success" | Verbatim buyer phrasing, three independent instances (1xm09fs, 1xmnz2c, plus HN repeats) in `drafts/listening.md` Scans 5–8. Used as the problem's name, attributed to no one. |
 **Ban compliance:** no product of ours named · no competitor named · no
 superlatives · no benchmark numbers · no invented testimonials (anecdotes are
 real threads, described without handles) · no price · no roadmap dates.
--- a/marketing/approved/agent-done-signal/rationale.md
+++ b/marketing/approved/agent-done-signal/rationale.md
@@ -0,0 +1,72 @@
 # Rationale — "How do you know when your coding agent is done?"
 FRE-199 item 1, page 1 of the first pair. Drafted 2026-11-05 by CMO.
 ## The phrase
 Primary: **"how do you know when your coding agent is done"** (variants: "agent
 finished silently", "claude code waiting for permission" overlaps on the
 blocked-half; this page owns the *done*-half).
 Chosen by the FRE-199 selection rule: strongest buying intent we can answer
 honestly without naming a product. It is on the standing phrase list
 (`drafts/listening.md` §The phrase list: "how do I know when my agent is done").
 ## Why this phrase won the slot
 - **Recurrence with independence.** The "zero looks exactly like success"
  pattern appears in at least four separate sources across Scans 5–9: 1xm09fs,
  the code-review PSA (1xmnz2c), and two HN commenters (fhub, sadilek), plus
  the queue operator's done-signal workaround (1xjb3j0). Four independent
  formulations of one pain in seven days is the strongest recurrence the
  backlog shows.
 - **Buying intent.** The people describing it are running agents unattended
  right now and are losing time to the gap — they are past curiosity.
 - **Answerable honestly, generically.** The mechanism (Stop / Notification /
  StopFailure hooks) is documented in the agent's own reference; every claim in
  the page traces to it. Nothing about our product is needed to answer it.
 - **Wedge-aligned.** "An agent blocked is the most expensive kind of idle" —
  the done-half of that sentence (idle you never learn about) is this page.
 ## Evidence trail
 | Thread | Date | What it showed |
 |---|---|---|
 | r/ClaudeCode 1xjb3j0 — "self-hosted queue of autonomous Claude Code sessions" | 2026-10-31 | Sessions "finished their work but never sent the done signal, and held their slots for hours"; operator derives done from git + idle transcript; "a waiting one has to name what it's waiting on" |
 | r/ClaudeCode 1xm09fs | 2026-11-02 | First "zero looks exactly like success" instance (verbatim buyer phrasing) |
 | r/ClaudeCode 1xmnz2c — code-review plugin PSA | 2026-11-03 | Green check + "No findings" when the review never ran; third independent instance |
 | HN comments (fhub, sadilek) | 2026-11-04/05 | Human-attention concurrency ceiling quantified twice more |
 All rows live in `drafts/listening.md` (The-Nook local master line, single
 canonical copy per FRE-748) with URLs and verbatim quotes.
 ## Gates before this page ships
 1. **Sponsor fact-check** of the claims table in `copy.md` (owner: Michael
   Freno). Page moves `pending/` → `approved/` on his read, per the marketing
   tree's hard rule.
 2. **CTO eyes on the agent-behaviour claims** — all four are sourced to the
   Claude Code hooks reference re-read 2026-11-05, but anything asserted about
   an agent's behaviour is CTO-verifyable, and the FRE-199 plan routes it to
   him.
 3. **Publish path:** `pending/` → `approved/` → a human places it on
   nook.freno.me (blog route). Nothing posts itself.
 ## Ban compliance (FRE-199 + positioning.md rule 1)
 - The Nook: not named. The notch, the island, the companion: not mentioned.
 - Competitors (notch apps, agent monitors, Remote Control–style tools): not
  named. Remote Control is not mentioned either — the page answers the done-half
  without touching the away-from-desk half.
 - Claude Code is named only as the subject whose documented behaviour the page
  explains, with its own docs as the source — the same status the listening
  phrase list already gives it. It is the agent, not a competitor.
 - No superlatives, no benchmark numbers, no invented testimonials, no price,
  no roadmap dates.
 ## Cadence note
 This page and `agent-waiting-on-permission/` are the first pair. The queue
 behind them (multiple-agents tracking, invisible-permission cluster) holds well
 above the three-candidate floor, so the two-a-week cadence holds without
 inventing phrases.
--- a/marketing/approved/agent-parallel-tracking/copy.md
+++ b/marketing/approved/agent-parallel-tracking/copy.md
@@ -0,0 +1,113 @@
 # How do you keep track of multiple coding agents?
 > **Status: approved — sponsor fact-check passed 2026-11-05** (FRE-199 pair 2
 > fact-check card, verdict: "Approve both — move to approved/"). Not published;
 > a human places it on nook.freno.me from `approved/`. Internal target:
 > Mon 2026-11-09, met four days early. This page never names a product of ours
 > and never names a competitor.
 The honest answer: not by watching them. Run three agents and the watching
 already fails — the session you are not reading is the one that finished, or
 the one sitting on a question, and both states look identical from the outside.
 The fix is not more windows; it is giving each agent a way to announce its own
 state, so checking becomes something that happens to you instead of something
 you have to remember.
 ## Why attention is the limit
 Parallel agents are cheap to start and expensive to supervise. Every running
 session can stop and wait for you — a permission prompt, a question, a finished
 turn — and from your side of the screen those are invisible until you go look.
 Operators who run agents at scale keep describing the same wall in different
 words. One practitioner running dozens of parallel threads a day put it as the
 limit moving "from tokens to my attention"; another, asked how many sessions
 they could run, got the answer from their own comment section: not compute —
 you. A developer who ran agents unattended for a month summarised the failure
 as silence: "the six hours of silence was the real problem, not the dialog
 itself." And the most common collision is the simplest — two agents waiting on
 you while you are deep in the third, and one of them idle so long you lost the
 thread of what you asked it to do.
 None of that is a speed problem. It is a visibility problem: *which* of your
 agents needs you, and *how do you find out without touring every window?*
 ## What a per-agent signal actually is
 A terminal coding agent has no shared dashboard by default — each session is
 its own process, its own window. But its state changes are events, and events
 can be wired outward. Claude Code documents the pieces:
 - **Every state you care about fires an event.** `Stop` fires when Claude
  finishes responding — the end of a turn. `Notification` fires when Claude
  Code sends a notification, and the notification's type tells you which kind
  of waiting it is: a `permission_prompt`, an `idle_prompt`, `agent_needs_input`,
  or `agent_completed`. `SessionStart` and `SessionEnd` bracket the whole
  session.
 - **The event names the session it came from.** Every hook payload carries a
  `session_id`, so one handler can serve every window and still know which
  agent fired.
 - **A hook is just a command you choose.** The events are configured in the
  settings files and run whatever command you point them at — append to a log
  file, update a status line, send a desktop notification that names the
  project.
 - **The status line can carry per-session state.** Claude Code's status line
  is a customizable bar driven by a script you write; it receives session data
  on every render, and the docs name "work across multiple sessions and need
  to distinguish them" as a reason it exists.
 The pattern in all four: stop touring windows and make each agent's
 running / waiting / finished state observable where you already are.
 ## What to check or do
 1. **Name the states before naming the tools.** For your workflow the states
   are usually three — running, waiting on you, finished — and the expensive
   one is always "waiting on you". A tracking setup that cannot distinguish a
   permission wait from a completion will quietly hide the state that costs
   the most.
 2. **Wire the waiting events first.** A `Notification` hook matched on
   `permission_prompt` and `agent_needs_input` catches the blocked cases; the
   payload's `session_id` lets one handler label each alert with the project
   it came from.
 3. **Route completions separately.** `Stop` means the turn ended — not that
   the work was right, and not that nothing is blocked elsewhere. Treating
   "finished" and "needs you" as one notification is how a waiting agent gets
   buried under a pile of done messages.
 4. **Make the state visible without switching windows.** A per-session status
   line, a log file the hook appends to, or a desktop notification that names
   the project all work — the test is whether you can answer "does anything
   need me?" without leaving the window you are in.
 5. **Expect the ceiling to be yours.** Operators consistently find the
   bottleneck before the machines do. The number of agents you can run is the
   number whose waiting state reaches you reliably — not the number your
   terminal can host.
 One next step: run two agents side by side and wire only their permission-wait
 events to a notification that names the project. The first time the second
 agent's prompt reaches you before you happen to check its window is the whole
 argument.
 ---
 ## Fact-check table (not part of the page)
 Every technical claim above, with its primary source. Claims about Claude
 Code's behaviour come from its own documentation, re-read 2026-11-05.
 | # | Claim in the page | Source |
 |---|---|---|
 | 1 | `Stop` fires when Claude finishes responding; `SessionStart`/`SessionEnd` are per-session events | Claude Code hooks reference — https://code.claude.com/docs/en/hooks (hook events table; "per session: SessionStart and SessionEnd; per turn: UserPromptSubmit, Stop, and StopFailure") |
 | 2 | `Notification` fires when Claude Code sends a notification; matcher supports notification types including `permission_prompt`, `idle_prompt`, `agent_needs_input`, `agent_completed` | same hooks reference (matcher table: "Notification | notification type") |
 | 3 | Every hook payload carries `session_id`, the current session identifier | same hooks reference (Common input fields: `session_id` — "Current session identifier") |
 | 4 | Hooks are configured in the settings files and run a command of your choosing | same hooks reference (configuration and command-hook examples) |
 | 5 | The status line is a customizable bar driven by a script, receives JSON session data, and the docs name "work across multiple sessions and need to distinguish them" as a use | Claude Code status line doc — https://code.claude.com/docs/en/statusline |
 | 6 | "The limit moved from tokens to my attention" / "fifty a day add up to something I could feel by Friday" | r/ClaudeCode 1xh5cum (2026-10-27, "Four months of 50+ parallel agent threads a day"), logged in `drafts/listening.md` Scan 3. Practitioner's own account, not a measurement. |
 | 7 | "How many sessions before you become the bottleneck" — the thread went to compute; the attention half stayed on the table | r/ClaudeCode 1xdjb2g (2026-10-23, 72 comments), logged in `drafts/listening.md` Scan 1. |
 | 8 | "The six hours of silence was the real problem, not the dialog itself" | r/ClaudeCode 1xipsk0 (2026-10-29, "~40 Claude Code agents unattended for a month"), quoted by the OP in-thread, logged in `drafts/listening.md` Scan 2. |
 | 9 | Two agents waiting while the human is in the third; idle so long the thread of the task was lost; "most of my idle time came from agents waiting on a permission prompt while I was in another window" | r/ClaudeAI 1xmzp2n (2026-11-03, "How do you keep track of multiple coding agents running in parallel?"), two independent commenters, logged in `drafts/listening.md` Scan 9. |
 | 10 | "You're the bottleneck agents were meant to eliminate" — approvals routing through one person | r/ClaudeCode 1xk0ghj (2026-10-31, "multiple agents working on multiple projects"), commenter's words, logged in `drafts/listening.md` Scan 4. |
 **Ban compliance:** no product of ours named · no competitor named (herdr,
 tmux, dashboards: none named — the page answers generically) · no handles · no
 superlatives · no benchmark numbers · no invented testimonials (anecdotes are
 real threads, described without handles) · no price · no roadmap dates.
--- a/marketing/approved/agent-parallel-tracking/rationale.md
+++ b/marketing/approved/agent-parallel-tracking/rationale.md
@@ -0,0 +1,71 @@
 # Rationale — "How do you keep track of multiple coding agents?"
 FRE-199 item 1, page 1 of the second pair. Drafted 2026-11-05 by CMO (internal
 target Mon 2026-11-09, beaten by four days — the backlog held, so drafting
 early cost nothing).
 ## The phrase
 Primary: **"how do you keep track of multiple coding agents running in
 parallel"** (variants: "how many sessions before you become the bottleneck",
 "which agent is waiting", "agent tracking dashboard").
 ## Why this phrase won the slot
 - **Strongest recurrence in the backlog.** Seven independent threads across
  nine scans state the multi-agent attention problem in their own words — more
  than any other cluster after the pair-1 phrases. It is the natural next page:
  the pair-1 pages answer *one* agent's silence (done-signal) and *one*
  permission wait (waiting-on-permission); this is the fleet-scale version of
  the same pain, and the buyers are already at fleet scale.
 - **Buying intent.** Every quoting operator is running multiple agents *now*
  and losing time to supervision, not exploring.
 - **Answerable honestly, generically.** The mechanism (per-session hook events
  with `session_id`, typed notifications, the status line) is documented in the
  agent's own reference; every claim traces to it. No product needed.
 - **Distinct from pair 1.** Done-signal owns "one agent, is it finished";
  waiting-on-permission owns "one agent, why is it blocked". This page owns
  "several agents, which one needs me" — the phrase, the evidence, and the
  mechanism (typed Notification matchers, `session_id`, status line) do not
  overlap pair 1's.
 ## Evidence trail
 | Thread | Date | What it showed |
 |---|---|---|
 | r/ClaudeAI 1xmzp2n — "How do you keep track of multiple coding agents running in parallel?" | 2026-11-03 | The exact question as a fresh thread: "How do you notice when one is waiting, done, or stuck?"; two commenters independently: agents "sat waiting on a permission prompt while I was deep in the third", idle "long enough that I lost the thread of what I had asked it to do" |
 | r/ClaudeCode 1xh5cum — "Four months of 50+ parallel agent threads a day" | 2026-10-27 | "The limit moved from tokens to my attention"; "fifty a day add up to something I could feel by Friday" |
 | r/ClaudeCode 1xdjb2g — "How many sessions can you run before you become the bottleneck?" | 2026-10-23 | 72 comments; the thread went to compute and left the attention half open |
 | r/ClaudeCode 1xipsk0 — "~40 Claude Code agents unattended for a month" | 2026-10-29 | "The six hours of silence was the real problem, not the dialog itself" |
 | r/ClaudeCode 1xk0ghj — "multiple agents working on multiple projects" | 2026-10-31 | "If every decision routes through you, you're the bottleneck agents were meant to eliminate" |
 | Hacker News 50298436 (herdr launch) | 2026-10-30 | A 30-year tmux user's stated switch reason: "visual indication which agent is working and which is waiting for an input" — used in rationale only; the page does not name any tool |
 All rows live in `drafts/listening.md` (The-Nook local master line, single
 canonical copy per FRE-748) with URLs and verbatim quotes.
 ## Gates before this page ships
 1. **Sponsor fact-check** of the claims table in `copy.md` (owner: Michael
   Freno). Page moves `drafts/` → `pending/` → `approved/` on his read, per
   the marketing tree's hard rule.
 2. **CTO eyes on the agent-behaviour claims** — five doc-sourced claims
   (hooks reference ×4, statusline doc ×1), all re-read 2026-11-05. Routed to
   the CTO per the FRE-199 plan.
 3. **Publish path:** `approved/` → a human places it on nook.freno.me.
   Nothing posts itself.
 ## Ban compliance (FRE-199 + positioning.md rule 1)
 - The Nook: not named. The notch, the island, the companion: not mentioned.
 - Competitors: not named. The herdr evidence is rationale-only; the page's
  "what to check" recommends no tool at all — states and wiring, not products.
 - Claude Code is named only as the subject whose documented behaviour the page
  explains, with its own docs as the source — same status as pair 1.
 - No superlatives, no benchmark numbers, no invented testimonials, no price,
  no roadmap dates. Anecdotes are real threads, described without handles.
 ## Cadence note
 Second pair. Queue behind it: the run-without-asking cluster (same pair), the
 fan-control phrase, and the invisible-permission variants — above the
 three-candidate floor. Two a week holds.
--- a/marketing/approved/agent-run-without-asking/copy.md
+++ b/marketing/approved/agent-run-without-asking/copy.md
@@ -0,0 +1,102 @@
 # Should you let your coding agent run without asking permission?
 > **Status: approved — sponsor fact-check passed 2026-11-05** (FRE-199 pair 2
 > fact-check card, verdict: "Approve both — move to approved/"). Not published;
 > a human places it on nook.freno.me from `approved/`. Internal target:
 > Mon 2026-11-09, met four days early. This page never names a product of ours
 > and never names a competitor.
 > CTO review 2026-11-05: changes requested and applied — the `Bash(git commit *)`
 > allowed / `Bash(git push *)` denied example removed (the docs' own
 > "What a Bash rule doesn't match" table shows a Bash rule does not stop every
 > invocation); the precedence claim stands.
 You can — and the honest answer is that "should" is not one decision but two:
 what you are letting it do, and what happens when it does the wrong thing.
 Every operator who runs agents unattended converges on the same split — a free
 hand on what git can undo, a confirmation on what it can't — and the agent's
 own permission modes exist to draw that line somewhere you choose, not
 somewhere a flag chooses for you.
 ## The mechanism: a spectrum, not a switch
 Claude Code's permission modes form a ladder from "ask for everything" to "ask
 for almost nothing", and each rung has a documented meaning:
 - **`default`** prompts on the first use of each tool.
 - **`acceptEdits`** auto-accepts file edits and common filesystem commands
  (`mkdir`, `touch`, `mv`, `cp`) inside the working directory.
 - **`plan`** reads files and runs read-only shell commands but does not edit
  your source files — the agent explores, you approve the plan.
 - **`auto`** runs without routine prompts; before actions such as shell
  commands and network requests run, a background classifier checks that they
  align with your request.
 - **`bypassPermissions`** skips permission prompts, except for actions no mode
  auto-approves.
 Two documented facts should shape where you stop on that ladder. First, the
 docs' own warning on the top rung: in `bypassPermissions` mode Claude Code
 skips prompts — including for writes to protected paths such as `.git` — and
 the mode belongs "in isolated environments like containers or VMs where Claude
 Code can't cause damage". Second, enforcement is real, not advisory: the docs
 state plainly that "permission rules are enforced by Claude Code, not by the
 model" — a `CLAUDE.md` instruction asking nicely for permission changes
 nothing.
 ## What to check or do
 1. **Decide by blast radius, not by annoyance.** The question "how do I get
   fewer prompts?" tempts a jump to the top of the ladder. The better
   question: which of this agent's actions would be *undoable* if wrong? Edits
   inside a git worktree are; `rm -rf` on the wrong path, a pushed commit, and
   a message sent to a third party are not.
 2. **Move down the ladder one rung at a time.** `acceptEdits` in a worktree
   covers most of the prompt volume with the undo still in reach. If you
   consider `auto` or `bypassPermissions`, the docs' own container-or-VM
   condition is the bar: isolation first, autonomy second.
 3. **Write the rules instead of trusting the mode.** Rules are evaluated in
   order — deny, then ask, then allow — and the first match wins, so a broad
   deny holds even against a narrower allow. (What a Bash rule cannot do is
   match every way the same binary gets invoked — see the next step.)
 4. **Know what the rules do not cover.** A Bash rule matches the command text
   Claude writes, and the docs are explicit that this "isn't a security
   boundary around the program" — the same binary invoked by another path is
   not matched. For filesystem and network enforcement that does not depend
   on command text, the docs point at sandboxing.
 5. **Use hooks as the programmable layer.** A `PreToolUse` hook sees every
   tool call before it runs and can return a `deny` decision — the reference
   builds one that blocks `rm -rf`. A silent hook does not approve anything;
   the call just continues through the normal permission flow.
 6. **Leave the failure path a way to reach you.** An unattended run that hits
   a prompt nobody sees stops silently — that is the failure mode of unattended
   work, not of permissions. Whatever mode you pick, wire the
   "waiting on you" event somewhere you will actually notice.
 One next step: write down the three actions your agent takes that you could
 not undo, and put them in `deny` or `ask` rules today. Whatever mode you run
 above them, those three now require a human — which is the whole point of the
 ladder.
 ---
 ## Fact-check table (not part of the page)
 Every technical claim above, with its primary source. Claims about Claude
 Code's behaviour come from its own documentation, re-read 2026-11-05.
 | # | Claim in the page | Source |
 |---|---|---|
 | 1 | Mode meanings: `default` prompts on first use; `acceptEdits` auto-accepts file edits and common filesystem commands (`mkdir`, `touch`, `mv`, `cp`) in the working directory; `plan` reads files and runs read-only shell commands but doesn't edit source; `auto` runs without routine prompts with a background classifier checking alignment; `bypassPermissions` skips prompts except actions no mode auto-approves | Claude Code permissions doc — https://code.claude.com/docs/en/permissions (Permission modes table) |
 | 2 | Docs' warning: in `bypassPermissions` mode Claude Code skips prompts including for writes to protected paths such as `.git`; "Only use this mode in isolated environments like containers or VMs where Claude Code can't cause damage" | same permissions doc (warning under the modes table) |
 | 3 | "Permission rules are enforced by Claude Code, not by the model" | same permissions doc (note under Manage permissions) |
 | 4 | Rules evaluated in order deny → ask → allow; first match wins; a broad deny holds against a narrower allow | same permissions doc (Manage permissions) |
 | 5 | A Bash rule matches the command text Claude writes and "isn't a security boundary around the program" (`Bash(curl *)` doesn't stop `/usr/bin/curl …`); for filesystem/network enforcement independent of command text the docs point at sandboxing | same permissions doc (What a Bash rule doesn't match) |
 | 6 | A `PreToolUse` hook fires before a tool call executes, can block it, and can return a `permissionDecision` of `"deny"`; the reference builds a hook that blocks `rm -rf`; a silent hook does not approve — the call continues through the normal permission flow | Claude Code hooks reference — https://code.claude.com/docs/en/hooks (PreToolUse decision control walkthrough) |
 | 7 | Undo-split practice ("free hand on what git can undo, confirmation on what it can't") | r/ClaudeCode 1xkoz06 (2026-10-31), commenter's described practice, logged in `drafts/listening.md` Scan 3 addendum; also r/ClaudeCode 1xexhwf commenters (VM, worktrees, blast-radius split). Described as operator practice, not a rule. |
 | 8 | An unattended run that hits a prompt nobody sees stops silently | r/ClaudeCode 1xipsk0 (2026-10-29), commenter: "A run started from launchd or a background service can hit a prompt that no one will ever see", logged in `drafts/listening.md` Scan 2. |
 | 9 | The trust asymmetry: comfortable with a model writing code, "considerably less comfortable giving an autonomous agent broad access to my development environment" | r/ClaudeCode 1xk8imc (2026-10-31, "Has anyone built a safe, autonomous coding workflow…?", 43 comments), OP's words, logged in `drafts/listening.md` Scan 4. |
 | 10 | The operator's own safety menu: "committing before every run? containers? `--dangerously-skip-permissions` and hoping?" | r/ClaudeAI 1xk277d (2026-10-31, "How often has a coding agent done something you had to undo?"), OP's words, logged in `drafts/listening.md` Scan 4. Quoted as the question's shape, not as guidance. |
 **Ban compliance:** no product of ours named · no competitor named · no
 handles · no superlatives · no benchmark numbers · no invented testimonials ·
 no price · no roadmap dates. The docs' container/VM warning is quoted as the
 agent's own documentation, not as our policy.
--- a/marketing/approved/agent-run-without-asking/rationale.md
+++ b/marketing/approved/agent-run-without-asking/rationale.md
@@ -0,0 +1,75 @@
 # Rationale — "Should you let your coding agent run without asking permission?"
 FRE-199 item 1, page 2 of the second pair. Drafted 2026-11-05 by CMO (internal
 target Mon 2026-11-09, beaten by four days).
 ## The phrase
 Primary: **"do you let your coding agent run without asking permission"**
 (variants: "safe autonomous coding workflow", "approve every step or skip
 permissions", "is dangerously-skip-permissions safe").
 On the standing phrase list (`drafts/listening.md` §The phrase list: "do you
 let claude code run without asking").
 ## Why this phrase won the slot
 - **Recurrence with independence.** Four separate threads state the autonomy
  question from four angles: the direct one (1xexhwf, 24 comments), the trust
  asymmetry (1xk8imc, 43 comments), the safety menu (1xk277d), and the
  remove-permissions ask (1xfe6eh — Desktop, recorded, not answered). The
  cluster has run continuously since Scan 1.
 - **Buying intent.** These are people configuring or rejecting autonomy right
  now — the objection vocabulary came straight out of this cluster
  ("--dangerously-skip-permissions and hoping").
 - **Answerable honestly, generically.** The mode ladder, the docs' own
  container/VM warning, the enforcement note, and `PreToolUse` deny are all
  documented; every claim traces to the agent's docs. No product needed.
 - **Distinct from pair 1's permission page.** `agent-waiting-on-permission`
  answers "why is it *blocked* and why didn't I know" — the visibility of a
  single stuck prompt. This page answers "should I *grant* autonomy and how do
  I bound it" — the mode ladder, rule precedence, sandboxing, and hooks as
  enforcement. Shared vocabulary (modes, rules) exists because the docs are
  one system; the question, the claims, and the advice do not overlap.
 ## Evidence trail
 | Thread | Date | What it showed |
 |---|---|---|
 | r/ClaudeCode 1xexhwf — "Do you let Claude Code run without asking, or approve every step?" | 2026-10-25 | The direct question, 24 comments; the thread became a safety argument (VM, worktrees, empty-variable `rm -rf`) — that argument *is* the page's subject |
 | r/ClaudeCode 1xk8imc — "Has anyone built a safe, autonomous coding workflow…?" | 2026-10-31 | "Comfortable having another model work on code. Considerably less comfortable giving an autonomous agent broad access to my development environment" — the trust asymmetry, 43 comments |
 | r/ClaudeAI 1xk277d — "How often has a coding agent done something you had to undo?" | 2026-10-31 | "What you do to stay safe today: committing before every run? containers? `--dangerously-skip-permissions` and hoping?" — the operator's own menu |
 | r/ClaudeCode 1xipsk0 — "~40 agents unattended for a month" | 2026-10-29 | "A run started from launchd or a background service can hit a prompt that no one will ever see" — the unattended failure path |
 | r/ClaudeCode 1xkoz06 | 2026-10-31 | The undo-split practice (also cited on pair 1; real thread, described without handles) |
 | r/ClaudeAI 1xfe6eh — "How can I remove Claude's need to ask me for permission…" | 2026-10-30 | Recorded, not used: Claude Desktop computer-use, not Code — a mention there would be noise. Shows the phrase's reach |
 All rows live in `drafts/listening.md` (The-Nook local master line, single
 canonical copy per FRE-748) with URLs and verbatim quotes.
 ## Gates before this page ships
 1. **Sponsor fact-check** of the claims table in `copy.md` (owner: Michael
   Freno). Page moves `drafts/` → `pending/` → `approved/` on his read.
 2. **CTO eyes on the agent-behaviour claims** — six doc-sourced claims
   (permissions doc ×5, hooks reference ×1), all re-read 2026-11-05. Routed to
   the CTO per the FRE-199 plan.
 3. **Publish path:** `approved/` → a human places it on nook.freno.me.
   Nothing posts itself.
 ## Ban compliance (FRE-199 + positioning.md rule 1)
 - The Nook: not named. The notch, the island, the companion: not mentioned.
 - Competitors: not named. Sandboxing and hooks are described as the agent's
  own documented mechanisms, not as anyone's product.
 - Claude Code is named only as the subject whose documented behaviour the page
  explains, with its own docs as the source — same status as pair 1.
 - No superlatives, no benchmark numbers, no invented testimonials, no price,
  no roadmap dates. Anecdotes are real threads, described without handles.
 ## Cadence note
 Second pair. Queue behind it: the fan-control phrase ("mac fan control
 claude", standing phrase list), the invisible-permission variants
 (dontallow/TCC cluster), and the notification-reliability thread (1xm6frp,
 held back for overlap with done-signal). Above the three-candidate floor; two
 a week holds.
--- a/marketing/approved/agent-waiting-on-permission/copy.md
+++ b/marketing/approved/agent-waiting-on-permission/copy.md
@@ -0,0 +1,86 @@
 # Why is my coding agent sitting on a permission prompt?
 > **Status: approved — sponsor fact-check passed 2026-11-05** (FRE-199 fact-check
 > card, verdict: "Approve both — move to approved/"). Not published; a human
 > places it on nook.freno.me from `approved/`.
 > This page never names a product of ours and never names a competitor.
 > Internal target: second page of the FRE-199 pair, Fri 2026-11-07.
 > CTO review 2026-11-05: changes requested and applied — rule precedence
 > corrected to deny / ask / allow (body previously read allow / ask / deny,
 > contradicting the fact-check table and the source); pair-1 citations
 > standardised to code.claude.com.
 Because it tried to do something its permission settings don't allow, and the
 default is to wait — indefinitely and quietly — for you. The prompt is not the
 expensive part; the hour you spent not knowing it was waiting is. The way out is
 not to approve faster, it's to make the prompts rare and the waiting visible.
 ## The mechanism
 Claude Code's permission system decides, per tool call, whether to run, refuse,
 or stop and ask. In its `default` mode, it prompts for permission on the first
 use of each tool. Modes are set with `defaultMode` in the settings files, and a
 session's rules come from deny / ask / allow lists evaluated in that order —
 the first match wins.
 You can see the whole rule set at any time with `/permissions`, which lists
 every permission rule and the settings file each one came from. Rules can name
 a specific use — `Bash(npm run build)` matches exactly that command — or a
 wildcard, like `Bash(git log *)`.
 So the prompt you came back to an hour later is not a malfunction. It is the
 system working as configured, on a call your rules never covered — and the
 "waiting" state being invisible is what turned ten seconds of approval into a
 lost hour.
 ## What to check or do
 1. **Read the prompt before automating it away.** It names the tool and the
   input. The right response to "it keeps asking" is usually a rule, not a
   wider mode.
 2. **Allowlist the undoable, prompt on the irreversible.** Reads, tests, and
   status commands are safe to allow — `git` is the undo for edits. Anything
   that reaches another person or another system — network calls, deletes,
   deploys — is worth keeping on ask. Rule syntax is in the permission docs;
   `/permissions` shows what you already have.
 3. **Consider `acceptEdits` before anything broader.** It auto-accepts file
   edits and common filesystem commands inside the working directory. That is
   usually the difference between ten prompts a session and two — without
   handing over network or delete.
 4. **Bound the blast radius instead of removing the gate.** If you do widen
   what runs unattended, do it where a mistake is recoverable: a worktree per
   task, commits pushed early, nothing irreversible in reach. Operators who run
   agents unattended describe exactly this split — free hand on what git can
   undo, confirmation on what it can't.
 5. **Make the wait visible.** Claude Code fires a `Notification` hook when it
   sends a notification, and a permission prompt is one — the payload carries a
   `notification_type` of `permission_prompt`. A hook on that event, wired to a
   desktop notification you'd see from another window, turns the silent wait
   back into a ten-second approval.
 One next step: run `/permissions` today and add allow rules for the three
 commands you find yourself approving most. The prompts that remain will be the
 ones that deserve a read.
 ---
 ## Fact-check table (not part of the page)
 Every technical claim above, with its primary source. Claims about Claude
 Code's behaviour come from its own documentation, re-read 2026-11-05.
 | # | Claim in the page | Source |
 |---|---|---|
 | 1 | In `default` mode Claude Code "prompts for permission on first use of each tool" | Claude Code permissions doc — https://code.claude.com/docs/en/permissions (Permission modes table) |
 | 2 | `defaultMode` in settings files sets the default mode for new sessions | same permissions doc (Permission modes section) |
 | 3 | Rules are evaluated deny → ask → allow, first match wins | same permissions doc (Permission rule syntax) |
 | 4 | `/permissions` lists all permission rules and the settings.json each comes from | same permissions doc (Manage permissions) |
 | 5 | `Bash(npm run build)` matches the exact command; `Bash(git log *)` wildcard form | same permissions doc (Use specifiers for fine-grained control) |
 | 6 | `acceptEdits` "automatically accepts file edits and common filesystem commands such as mkdir, touch, mv, cp for paths in the working directory" | same permissions doc (Permission modes table) |
 | 7 | A `Notification` hook fires when Claude Code sends a notification; permission prompts carry `notification_type: "permission_prompt"` and a message like "Claude needs your permission" | Claude Code hooks reference — https://code.claude.com/docs/en/hooks (Notification event) |
 | 8 | Undo-split practice ("free hand on what git can undo, confirmation on what it can't") | r/ClaudeCode 1xkoz06 (2026-10-31, u/tomm3hshipp thread), commenter's described practice, logged in `drafts/listening.md` Scan 3 addendum. Described as one operator's approach, not a rule. |
 | 9 | The 55-minutes-lost framing | r/ClaudeAI 1xhbc71 (2026-10-28): "coming back an hour later to find it's been sitting on a permission prompt for 55 minutes". Used as the problem's shape, not quoted as a person. |
 **Ban compliance:** no product of ours named · no competitor named · no
 superlatives · no benchmark numbers · no invented testimonials · no price · no
 roadmap dates.
--- a/marketing/approved/agent-waiting-on-permission/rationale.md
+++ b/marketing/approved/agent-waiting-on-permission/rationale.md
@@ -0,0 +1,77 @@
 # Rationale — "Why is my coding agent sitting on a permission prompt?"
 FRE-199 item 1, page 2 of the first pair. Drafted 2026-11-05 by CMO.
 ## The phrase
 Primary: **"claude code waiting for permission"** and the away-from-desk variant
 ("approvals when you're away from the computer"). First phrase on the standing
 list (`drafts/listening.md` §The phrase list).
 ## Why this phrase won the slot
 - **The strongest single thread in the backlog.** r/ClaudeAI 1xhbc71 (2026-10-28,
  47 comments and moving) asks the buying question outright: kicked off a long
  task, came back an hour later, agent had been sitting on a permission prompt
  for 55 minutes. The thread's own answers (remote control, tmux+SSH,
  skip-permissions, allowlists) prove demand; none of them makes the wait
  visible at the machine — that is the honest gap this page answers without
  naming anyone.
 - **The week's objection vocabulary.** Scans 1–9 keep returning "the model keeps
  handing control back" and "stops and waits for me" — permission friction is
  the category's core complaint, not a niche one.
 - **Recurring independent accounts.** The invisible-permission theme has three
  independent accounts in one week (1xksutq — gh used without a visible prompt;
  1xkejsp's Linux panel; the scheduled-tasks silent-stall finding), so the
  search demand is not one loud thread.
 - **Wedge-aligned.** This is the literal wedge sentence's territory — "an agent
  blocked on a permission prompt is the most expensive kind of idle" — answered
  with the agent's own documented mechanism.
 ## Deliberate scoping
 This page owns the **blocked-half** of the approval problem (why prompts happen,
 how to make them rare, how to make the wait visible at the machine). The
 **away-half** (controlling a remote agent from elsewhere) is a different phrase,
 a different page, and one where the honest answer is dominated by the agent
 vendor's own remote feature — the page deliberately does not go there
 (`drafts/listening.md` Scan 1 category intel #1).
 ## Evidence trail
 | Thread | Date | What it showed |
 |---|---|---|
 | r/ClaudeAI 1xhbc71 — "How do you handle Claude Code approvals when you're away from your computer?" | 2026-10-28 | 55-minute wait on a permission prompt; 47 comments of demand; "what's still annoying about your setup?" |
 | r/ClaudeCode 1xkoz06 — "How permissive are you with AI and for how long?" | 2026-10-31 | The undo-split: "file edits, tests and branches get a free hand, since git is the undo. Anything that reaches another person … stays on confirm" |
 | r/ClaudeCode 1xksutq — gh used without visible prompt | 2026-11-01 | Third independent invisible-permission account of the week |
 | r/ClaudeCode 1xkejsp — Linux panel app | 2026-10-31 | Per-session "Needs You" differentiation shipping elsewhere; the need is real and cross-platform |
 All rows live in `drafts/listening.md` with URLs and verbatim quotes.
 ## Gates before this page ships
 1. **Sponsor fact-check** of the claims table in `copy.md` (owner: Michael
   Freno); page moves `pending/` → `approved/` on his read.
 2. **CTO eyes on the agent-behaviour claims** — all eight doc-sourced claims
   re-read 2026-11-05; the FRE-199 plan routes anything asserted about an
   agent's behaviour to the CTO.
 3. **Publish path:** `pending/` → `approved/` → a human places it on
   nook.freno.me (blog route). Nothing posts itself.
 ## Ban compliance (FRE-199 + positioning.md rule 1)
 - The Nook: not named; notch/island/companion not mentioned.
 - Competitors: not named — including the agent vendor's remote feature, which
  the page never needs to mention because it stays on the at-the-machine half.
 - Claude Code is named only as the subject whose documented permission system
  the page explains, with its own docs as the source — same status the
  listening phrase list already gives it.
 - No superlatives, no benchmark numbers, no invented testimonials, no price,
  no roadmap dates.
 ## Cadence note
 Second page of the first pair. Queue behind it: multi-agent tracking ("How do
 you keep track of multiple coding agents running in parallel?", 1xm6frp,
 2026-11-03) and the invisible-permission cluster — the queue holds above the
 three-candidate floor, so the two-a-week cadence holds.
--- a/marketing/briefs/registry-wave-2.md
+++ b/marketing/briefs/registry-wave-2.md
@@ -0,0 +1,91 @@
 # Registry wave 2 — brief and copy (FRE-199 item 3)
 **Owner:** CMO prepares · sponsor submits · **Copy ready 2026-11-05** (target was
 Fri 2026-11-13) · **Submit:** week of 2026-11-16, after the wave-1 readback.
 **Status:** `briefs/` — nothing here has been posted; humans hold every account;
 no agent authenticates, posts or sends.
 ## What wave 2 is, and what it waits for
 Wave 1 is FRE-207's packet (`The-Nook` worktree `drafts/directory-submissions.md`
 + `drafts/click-list.md`): 8 targets, CTO claim verdict applied 2026-11-01
 (C1–C5 signed, C7 refused → relay sentence), sponsor-owned inputs G2 (price
 line), G3 (`@freno.me` mailbox), G4 (screenshots). **Wave-2 submission waits on
 the wave-1 readback** — what actually got submitted, what got listed, what was
 rejected and why — so targets can be re-ranked on evidence instead of guesswork.
 The readback lives on the FRE-207 issue; this brief is ready either way.
 **Copy rule inherited from wave 1:** paste the wave-1 blocks, do not improvise.
 Only claims signed by the CTO verdict ship:
 - C1 — works with 18 coding agents (compatibility fact, not a competitor mention).
 - C2 — answer an agent's approval from your Mac, iPhone or Watch.
 - C3 — sessions keep arriving while the Mac app is closed (widgets; fleet status only).
 - C4 — macOS 14.2+, universal.
 - C5 — iPhone/iPad and Apple Watch companions are **TestFlight beta**; no App Store link anywhere.
 - C7 — "no cloud service of its own" is refused; block D ships the relay sentence.
 - **Price line (G2):** "Free 14-day trial" only — no number — until CoS + sponsor
  clear the "$10 one-time licence" line for public listings (FRE-204 holds $10 in-app;
  the listing text is a separate publish decision).
 - Banned: superlatives, user counts, testimonials, competitor names.
 ## Targets — fetched live 2026-11-05, marked per the wave-1 legend
 | # | Target | What it is | How it ships | Fit | Verified |
 |---|---|---|---|---|---|
 | W2-1 | `iCHAIT/awesome-macOS` (19.4k ★) | Curated macOS app list; PR-based | PR adding one line to the relevant section from `contributing.md`; copy: block A + block B compressed | High — category fit, persistent link | ✅ repo + contributing rules read 2026-11-05 |
 | W2-2 | 1000.tools | Curated tool directory, self-serve categories (AI, developer tools, productivity) | Category submission form; copy: block A + B | Medium-high | ✅ fetched 2026-11-05 (categories listed on page) |
 | W2-3 | uneed.best | Daily product launch site | Launch submission (account needed, held by a human) | Medium — launch-format, needs assets | ✅ fetched 2026-11-05 |
 | W2-4 | devhunt.org | Daily dev-tool launches | Launch submission | Medium | ✅ fetched 2026-11-05 |
 | W2-5 | Product Hunt | Launch site | Maker/hunter flow, on-screen (403 to plain fetch — read live before filing) | Low-medium this wave; big-audience launch usually wants FRE-203's launch-day coordination | ⚠️ bot-walled; fields read on screen |
 Re-rank after the wave-1 readback: if directory listings (wave-1 §1/§3–5)
 produced traffic or referrers, wave 2 leads with W2-1/W2-2; if nothing was
 submittable, wave 2 waits until G3/G4 clear rather than submitting half-copy.
 ## Copy — paste-ready, inheriting the signed claims only
 **One-liner (≤60):** `Your coding agents, at the edge of the screen` (43 chars — wave-1 block A).
 **Short description (~250 chars):** wave-1 block B verbatim; if a field forces a
 price, "Free 14-day trial" and no number (G2).
 **awesome-macOS PR line (one row, section: menu-bar / status-bar apps or the
 section the maintainers route notch apps to — read the README section headers
 before filing):**
 ```
 - [The Nook](https://nook.freno.me/) - Puts every coding-agent session at the
  edge of your screen and lets you answer approvals from your Mac, iPhone or
  Watch. Works with 18 coding agents. [![Open-Source Software][OSS Icon]] — not
  open source; omit the badge row, keep the description.
 ```
 (The badge syntax is copied from the list's own rows; The Nook is not open
 source, so the OSS badge is **omitted** — the line above shows the shape only.
 No TestFlight mention needed in a one-row listing; add "Companions for iPhone
 and Apple Watch (TestFlight beta)" only if the PR reviewer asks for platform
 detail — C5 wording.)
 **Launch-site fields (W2-3/W2-4):** wave-1 blocks A, B, C (widgets — fleet
 status only), D (relay sentence, not C7's refused wording). Gallery needs G4's
 three real screenshots.
 ## Gates before anything here is submitted
 | Gate | Owner | State |
 |---|---|---|
 | Wave-1 readback recorded (what submitted/listed/rejected) | sponsor → FRE-207 issue, carried to FRE-199 | owed before submission week |
 | G2 price line for public listings | CoS + sponsor | pending (copy ships without a number either way) |
 | G3 `hello@freno.me` mailbox | sponsor | pending |
 | G4 three real screenshots + logo PNG | sponsor or CTO | pending — blocks every upload field |
 | Claim sign-off | CTO | **cleared 2026-10-31** for C1–C5; C7 ships as the relay sentence |
 ## Provenance
 - Targets fetched 2026-11-05: uneed.best, devhunt.org, 1000.tools (HTTP 200,
  content read); `iCHAIT/awesome-macOS` via GitHub API (19,441 stars,
  contributing.md linked from README); producthunt.com returns 403 to a plain
  fetch — marked ⚠️, read on screen before filing.
 - All claims inherited from FRE-207's CTO verdict of 2026-10-31 — no new
  claims introduced by this brief.
--- a/marketing/drafts/agent-keeps-asking/copy.md
+++ b/marketing/drafts/agent-keeps-asking/copy.md
@@ -0,0 +1,96 @@
 # Why does your coding agent keep stopping to ask you questions?
 > **Status: draft — awaiting sponsor fact-check** (FRE-199 pair 3, internal target
 > Thu 2026-11-12). Not publishable from `drafts/`.
 > This page never names a product of ours and never names a competitor.
 Most of the stopping is not the model being chatty — it is the permission system
 doing what it was told. In the default mode, the agent prompts before the first
 use of each tool; separately, its turn ends every time it finishes responding,
 and ending a turn with a question is finishing a turn. You cannot and should not
 eliminate every ask — but you can decide, once, which asks deserve an
 interruption and let the routine ones pass without you.
 ## Where the asks come from
 **Permission gates.** In the default mode the agent "prompts for permission on
 first use of each tool" — so every new tool, and often every new command shape,
 costs one prompt. The configuration decides who answers:
 - **`acceptEdits`** automatically accepts file edits and common filesystem
  commands (like `mkdir`, `touch`, `mv`, `cp`) for paths in your working
  directory — the single biggest ask category for most coding sessions, gone.
 - **Permission rules** do the fine work: `deny` rules block a tool outright,
  `allow` rules pass it silently, `ask` rules force the prompt. Order matters:
  rules are evaluated deny, then ask, then allow — the first match wins, and an
  allow rule cannot carve an exception out of a deny.
 - **Modes set the floor.** `defaultMode` in your settings picks where every new
  session starts. At the far end, `bypassPermissions` skips prompts entirely —
  the docs' own warning is that it belongs only in isolated environments like
  containers or VMs.
 One fact worth internalising: permission rules are enforced by the coding
 agent's harness, not by the model. A line in your prompt asking it to "not ask"
 changes nothing about what it is allowed to do — the configuration is the only
 lever.
 **Turn ends.** A `Stop` hook fires when the agent finishes responding — every
 turn, including the turns that end in a question. From the terminal's side of
 the glass, "it finished", "it's asking me something" and "it's waiting on a
 permission prompt" are the same silence. That is why the asking *feels*
 endless: each ask costs a context switch, and nothing distinguishes the asks
 from the completions.
 Practitioners describe the pattern in their own words. A developer who measured
 why their sessions kept stopping found that the agent "just kept handing
 control back" even with a permissive mode already on — the model's own habit of
 ending turns to stay in the loop, on top of the permission asks. An operator
 running a team of agents with per-agent autonomy levels put the other side:
 "if every decision routes through you, you're the bottleneck agents were meant
 to eliminate."
 ## What to check or do
 1. **Sort the asks by kind before touching anything.** File edits in your
   working directory: `acceptEdits` removes them wholesale. The same safe
   command every session: an `allow` rule. The commands that must never run: a
   `deny` rule. What is left is the set of questions only you can answer.
 2. **Write the rules in the right order.** Deny, then ask, then allow; first
   match wins. A broad deny stays broad — narrowing an allow elsewhere does not
   soften it.
 3. **Keep the genuinely ambiguous asks.** A mode that asks less is not a mode
   that asks smarter. `bypassPermissions` in a throwaway container is a
   documented pattern for unattended runs; using it on your daily machine is
   the docs' own caution, not a recommendation.
 4. **Make every stop visible.** Because every stop ends a turn, wire the
   turn-end and notification moments (the `Stop` and `Notification` hooks) so
   an ask reaches you where you actually are — and a permission wait is
   distinguishable from a finished job.
 One next step: run one session with the asks tallied by kind — edits, known
 commands, everything else. The first two usually turn out to be rules you
 hadn't written yet; the third is the work.
 ---
 ## Fact-check table (not part of the page)
 Every technical claim above, with its primary source. Claims about the
 permission system and hooks were verified against the live docs on 2026-11-05.
 | # | Claim in the page | Source |
 |---|---|---|
 | 1 | Default mode "prompts for permission on first use of each tool" (labeled Manual; `manual` alias) | Claude Code permissions doc — https://code.claude.com/docs/en/permissions (permission modes table; fetched 2026-11-05) |
 | 2 | `acceptEdits` "automatically accepts file edits and common filesystem commands such as mkdir, touch, mv, and cp for paths in the working directory or additionalDirectories" | same page (permission modes table) |
 | 3 | Rules are evaluated in order deny, then ask, then allow; "the first match in that order determines the outcome"; "an allow rule can't carve an exception out of a deny rule" | same page (rule precedence section) |
 | 4 | `bypassPermissions` "skips permission prompts"; docs' caution: "Only use this mode in isolated environments like containers or VMs where Claude Code can't cause damage" | same page (permission modes table) |
 | 5 | `defaultMode` in settings files sets the default permission mode for new sessions | same page ("To change the default permission mode for new sessions, set defaultMode in your settings files") |
 | 6 | "Permission rules are enforced by Claude Code, not by the model. Instructions in your prompt or CLAUDE.md shape what Claude tries to do, but they don't change what Claude Code allows." | same page (verbatim) |
 | 7 | `Stop` fires when the agent finishes responding; hook cadence is per turn | Claude Code hooks reference — https://code.claude.com/docs/en/hooks (verified 2026-11-05 in FRE-199 round 1; unchanged) |
 | 8 | Anecdote: "it just kept handing control back"; sessions kept stopping with a permissive mode on | r/ClaudeCode thread 1xlfqmo ("I measured why my Claude Code sessions kept stopping…", 2026-11-01, u/belovoj), logged in `drafts/listening.md` Scan 5 #1. Quoted as one developer's described experience; the thread's own measurement figures are deliberately **not** cited. |
 | 9 | Anecdote: "if every decision routes through you, you're the bottleneck agents were meant to eliminate"; per-agent autonomy levels 0–5 | r/ClaudeCode thread 1xk0ghj ("multiple agents working on multiple projects", 2026-10-31, quote by u/iceydee), logged in `drafts/listening.md` Scan 4 #2. One operator's described practice. |
 **Ban compliance:** no product of ours named · no competitor named · no
 superlatives · no benchmark numbers (the 1xlfqmo poster's measurement figures
 are deliberately not cited) · no invented testimonials (anecdotes are real
 threads, described without handles) · no price · no roadmap dates.
--- a/marketing/drafts/agent-keeps-asking/rationale.md
+++ b/marketing/drafts/agent-keeps-asking/rationale.md
@@ -0,0 +1,52 @@
 # Rationale — "Why does your coding agent keep stopping to ask you questions?"
 FRE-199 item 1, page 2 of the third pair. Drafted 2026-11-06 by CMO (internal
 target Thu 2026-11-12 — six days early).
 ## The phrase
 Primary: **"why does my coding agent keep stopping to ask me questions"**
 (variants: "agent keeps handing control back", "claude code keeps asking for
 permission"). The H1 carries the generic form; "handing control back" is the
 backlog's own added phrase (Scan 5's phrase-list finding).
 ## Why this phrase won the slot
 - **Backlog evidence.** r/ClaudeCode 1xlfqmo (2026-11-01, Scan 5 #1): "Auto mode
  was already on, so permissions weren't the issue… it just kept handing
  control back"; "the model was forcably trying to keep me in the loop." The
  phrase-list finding from the same scan added "handing control back" as a
  standing query. Corroborated by 1xlxw0q (turns ending with "nothing yet") and
  the autonomy-ladder operator (Scan 4 #2, thread 1xk0ghj: "if every decision
  routes through you, you're the bottleneck agents were meant to eliminate").
 - **Shortlist position (c)** in the plan's pair-3 shortlist, recorded at
  revision 5 — the page extends the done-signal cluster (pair 1) with the
  handback half. The distinction is kept deliberately: *agent-done-signal*
  owns "how do I know it's done"; this page owns "why does it keep stopping on
  me". Different question, different searcher.
 - **Answerable honestly from verified sources only.** Every mechanism claim
  re-reads to the permissions doc and hooks reference — the same pages and the
  same claims the CTO verified in FRE-199 rounds 1–2 (mode ladder, precedence,
  acceptEdits scope, enforced-by-harness sentence, Stop cadence). Nothing new
  is asserted about agent behaviour.
 ## What the page deliberately does not do
 - **Does not cite the 1xlfqmo poster's measurement figures** (the 28-of-73
  sample is the poster's own 18-day data, and the backlog row carries an
  explicit do-not-cite flag). The anecdote is quoted as experience, not
  measurement, and the fact-check table says so.
 - Does not promise the asks can be eliminated. The honest answer is that the
  asking is partly the permission system working as configured and partly the
  agent ending turns to stay in the loop — the page sorts which is which.
 - Does not touch environment contention (page 1 of this pair owns that half).
 ## Evidence trail
 | Thread | Date | What it showed |
 |---|---|---|
 | r/ClaudeCode 1xlfqmo — "I measured why my Claude Code sessions kept stopping" | 2026-11-01 | "It just kept handing control back" with a permissive mode on; "forcibly trying to keep me in the loop" — the model-behaviour half |
 | r/ClaudeCode 1xk0ghj — "multiple agents working on multiple projects" (quote by u/iceydee) | 2026-10-31 | "If every decision routes through you, you're the bottleneck agents were meant to eliminate"; per-agent autonomy levels 0–5 — the configuration half |
 | r/ClaudeAI 1xlxw0q — "2,300 hours waiting" | 2026-11-02 | Turns ending in a one-word answer reload context each time — the per-ask cost, corroborating |
 All rows live in `drafts/listening.md` (The-Nook local master line).
--- a/marketing/drafts/agent-worktree-contention/copy.md
+++ b/marketing/drafts/agent-worktree-contention/copy.md
@@ -0,0 +1,72 @@
 # How do you manage worktrees when your agents end up waiting on each other?
 > **Status: draft — awaiting sponsor fact-check** (FRE-199 pair 3, internal target
 > Thu 2026-11-12). Not publishable from `drafts/`.
 > This page never names a product of ours and never names a competitor.
 Usually, the worktrees are not what your agents are waiting on — the environment
 they share is. Two agents can sit in two worktrees of the same repo and still
 queue up behind one dev server, one test database, one `docker compose` stack.
 The fix that scales is to multiply the environment per worktree, not to
 orchestrate the waiting.
 ## Why agents queue when the code doesn't
 Git supports parallel work out of the box: `git worktree add <path> <branch>`
 creates a second working directory linked to the same repository — shared
 history, but its own HEAD, its own index, its own checked-out branch. Git even
 enforces the ownership half for you: it refuses to check out a branch into a
 second worktree while the first one holds it.
 What git does not duplicate is everything the repo only *points at*: the dev
 server bound to port 3000, the database named after the project directory, the
 compose stack whose project name defaults to the folder you launched it from.
 Two agents in two worktrees that both bring up the same stack are two agents
 contending for one environment — and the queue looks like a worktree problem
 when it is an environment problem.
 Practitioners who hit this converge on the same verdict. One, in a thread
 asking this exact question: the queue "comes from having one test env, so I'd
 multiply the env instead of orchestrating the waiting."
 ## What to check or do
 1. **Give every worktree its own copy of the stack.** Docker Compose exists for
   exactly this: it uses a *project name* to isolate environments from each
   other, and names "multiple copies of a single environment, useful for
   running stable copies for each feature branch" as a use case. Set a unique
   one per worktree — the `-p` flag has top precedence, or use `name:` in the
   compose file — and the port and container-name collisions disappear.
 2. **Anything that cannot be multiplied, serialise on purpose.** One migration
   runner, one deploy target, one flaky hardware-in-the-loop device: put it
   behind a single serial step rather than letting two agents race it. A queue
   you chose is a queue you can reason about.
 3. **One branch, one worktree.** Git already refuses to check out the same
   branch in two worktrees; keep it that way. Two agents on one branch is a
   merge conflict waiting for both of them to finish.
 4. **Remember a fresh worktree starts unconfigured.** Env files, generated
   config and installed dependencies live in the worktree, not the repo — a new
   worktree is a new environment to set up, which is exactly why the per-worktree
   copy should be scripted, not hand-arranged.
 One next step: find the resource your agents contend for most often — usually
 the test stack — and give it a per-worktree project name. The waiting usually
 resolves before any queueing tool is needed.
 ---
 ## Fact-check table (not part of the page)
 Every technical claim above, with its primary source. Claims about git and
 Docker Compose were verified against the live docs on 2026-11-05.
 | # | Claim in the page | Source |
 |---|---|---|
 | 1 | `git worktree add <path> [<commit-ish>]` creates a worktree "linked to the current repository, sharing everything except per-worktree files such as HEAD, index, etc." | git worktree docs — https://git-scm.com/docs/git-worktree (COMMANDS › add; fetched 2026-11-05) |
 | 2 | `add` "refuses to create a new worktree when <commit-ish> is a branch name and is already checked out by another worktree" | same page (OPTIONS › `--force`) |
 | 3 | Compose "uses a project name to isolate environments from each other"; "multiple copies of a single environment, useful for running stable copies for each feature branch" is a named use case; precedence: `-p` flag > `COMPOSE_PROJECT_NAME` > `name:` attribute > directory basename | Docker Compose docs, "Specify a project name" — https://docs.docker.com/compose/how-tos/project-name/ (fetched 2026-11-05) |
 | 4 | Anecdote: "The queue comes from having one test env, so I'd multiply the env instead of orchestrating the waiting" | r/ClaudeCode thread 1xlz2bs ("How do you manage worktrees when your agents end up waiting on each other?", 2026-11-02, u/Roland_culait / u/First-Painter7431), logged in `drafts/listening.md` Scan 6 #4. Quoted as one commenter's described practice, not a measurement. |
 **Ban compliance:** no product of ours named · no competitor named · no
 superlatives · no benchmark numbers · no invented testimonials (the anecdote is
 a real thread, described without handles) · no price · no roadmap dates.
--- a/marketing/drafts/agent-worktree-contention/rationale.md
+++ b/marketing/drafts/agent-worktree-contention/rationale.md
@@ -0,0 +1,46 @@
 # Rationale — "How do you manage worktrees when your agents end up waiting on each other?"
 FRE-199 item 1, page 1 of the third pair. Drafted 2026-11-06 by CMO (internal
 target Thu 2026-11-12 — six days early).
 ## The phrase
 Primary: **"how do you manage worktrees when your agents end up waiting on each
 other"** — carried verbatim as the H1, because it is already a complete search
 phrase with the exact buying intent.
 ## Why this phrase won the slot
 - **Backlog evidence.** r/ClaudeCode 1xlz2bs (2026-11-02, ~15 h old at scan time,
  Scan 6 #4). The OP asked the question in its final words; the thread answered
  itself (env per worktree, `docker compose -p`, preview deploys, one serial
  step on main) — which is exactly what makes it page material: the demand is
  proven, the answer is proven, and the answer is generic.
 - **Shortlist position (a)** in the plan's pair-3 shortlist, recorded at
  revision 5. Scan 9 (2026-11-05) produced no new queue item, so the
  shortlist stands; selection finalised against that fresh scan as planned.
 - **Answerable honestly and generically.** Both mechanisms are documented
  primary sources (git worktree docs; Docker Compose project-name docs), both
  fetched and read 2026-11-05. No agent-behaviour claim is needed — this page
  is the lightest CTO-review lift of the shortlist.
 - **Wedge-adjacent without a mention.** "Waiting" is the cost our wedge names
  ("an agent blocked is the most expensive kind of idle"); this page owns the
  agent-on-agent half of waiting, which no existing page covers.
 ## What the page deliberately does not do
 - Does not cite the thread's own tooling (Orca, oyren.ai) or any workflow
  product — category nouns only.
 - Does not invent a measurement. The one quoted line is a commenter's described
  practice, logged in the backlog with a do-not-interpret flag.
 - Does not touch the approval surface (page 2 of this pair owns the
  attention/handback half; this page is environment contention only).
 ## Evidence trail
 | Thread | Date | What it showed |
 |---|---|---|
 | r/ClaudeCode 1xlz2bs — "How do you manage worktrees when your agents end up waiting on each other?" | 2026-11-02 | Exact phrase in the wild; self-answered with env-multiplication advice; "multiply the env instead of orchestrating the waiting" |
 | Watched-table corroboration (Scans 5–9) | 2026-11-02 → 11-05 | Repobs ("which sessions were waiting for me"), Orca (worktree orchestration daily driver), Worktrunk, Conductor.build, Parallel Code — a shelf of builders around the same phrase; the demand is broad |
 All rows live in `drafts/listening.md` (The-Nook local master line).
--- a/marketing/drafts/newsletter-postmortem-pitch/copy.md
+++ b/marketing/drafts/newsletter-postmortem-pitch/copy.md
@@ -0,0 +1,96 @@
 # Newsletter pitch — post-mortem shape (narrowed; no conversion figure)
 > **Status: draft — narrowed 2026-11-06 per the CTO's reopening verdict on
 > FRE-199.** The "X% trial→paid" half of the shape **cannot ship**: the
 > FRE-202 snapshot (window 2026-10-22 → 10-29) reads trial started 2, purchase
 > 0, activation 0, with 291 of 291 analytics rows predating the FRE-366
 > instrumentation — a trial→paid ratio from that cohort is not a metric. The
 > ratio comes from FRE-197's mature Day 28–35 cohort read when it lands.
 > **No figure in this file is a measurement.** Send gates at the bottom.
 ## Audience & channel
 Editors of free dev-tool newsletters (the ones that run post-mortems and
 "what we learned" pieces). Direct email, one editor at a time, personalised.
 No paid placements at any budget without a CoS + sponsor decision.
 ## The claim the pitch goes out with
 A post-mortem pitch, not a product pitch: *here is what shipping a Mac utility
 alone actually broke, and what we changed because of it.* The product is the
 setting; the breakage and the fix are the story. The story stands on its own
 with zero funnel numbers — if no verified number exists on send day, the pitch
 ships without one rather than with a placeholder.
 ## The pitch (shape — names and dates personalised; nothing else is a placeholder)
 **Subject:** What shipping a Mac utility alone broke (post-mortem)
 Hi <editor>,
 We build The Nook, a $10 Mac utility that surfaces coding-agent approvals at
 the notch. I'm not pitching the app — I'm offering a post-mortem your readers
 usually only get from funded startups, because shipping alone broke things in
 ways bigger teams don't hit:
 - **The silent update.** In October we shipped a release whose appcast published
  cleanly — while every delta it named 404'd, so users on older builds were
  being offered updates that didn't exist. The publish path deleted files
  before the feed that named them was live. Nothing alerted; the feed just
  lied quietly. The fix — upload the feed's enclosures, verify every enclosure
  URL, copy the appcast up, and only *then* prune — is now ordered so the
  deletion can't run first.
 - **The green suite.** Weeks earlier, a regression in our public relay shipped
  behind a passing test run — the suite that would have caught it existed but
  nothing invoked it. A green checkmark that covers nothing looks identical to
  one that covers everything. The suite is now wired into the standard test
  entry point, and the relay's deploy patcher is tested alongside it.
 - **What we're not going to quote you.** A growth number, right now, would be
  theatre: our funnel is young and a conversion ratio from an immature cohort
  is not a measurement. If we attach a count, it will be activations — one per
  activated install, from our own relay store — and we will say exactly that,
  because download counts (a different number, from a different store) flatter
  nothing and confuse everyone. The receipts that matter here are the failure
  modes above, not a traction line.
 The angle for your readers: solo distribution is a chain of quiet failure
 modes, each one invisible until it costs a user. We kept the receipts.
 Happy to send the full write-up, screenshots of the broken feed, and the exact
 publish-order and test-wiring changes.
 — <name>, FrenoCorp
 ## Where a number could come from, and what disqualifies it
 - **Trial→paid ratio: cannot ship today.** FRE-202's snapshot shows a cohort of
  2 trials, 0 purchases, pre-instrumentation rows. The ratio waits for
  FRE-197's mature Day 28–35 read. If it lands before send day and the CTO
  confirms the query, the ratio may be added — and it must say it is per
  *install* (install cap 3), not per person.
 - **Activations: the only count eligible to ship.** One row per activated
  install (`installs`, `created_at`) in the relay store; CTO confirms the query
  before any send. The pitch names it as activations, never as downloads.
 - **Downloads (S3 side) are never quoted.** Different store, automation-heavy,
  and the pitch that says "downloads" when it means activations burns the
  credibility the post-mortem is built on.
 - No number is estimated to fill any gap, ever.
 ## Gates before anything is sent
 1. Any count quoted is activations, from a CTO-confirmed query — owner: CTO.
 2. The trial→paid ratio ships only from FRE-197's mature cohort read with CTO
   confirmation; otherwise the "what we're not going to quote you" paragraph
   stands as written — owner: CTO.
 3. Both breakage paragraphs are fact-checked against the engineering record
   (FRE-542 publish-order incident; the NOOK-815 uninvited-suite relay
   regression) before send — owner: CMO, evidence to CTO for verdict.
 4. Sponsor approves the send and holds the sending account (humans hold every
   account) — owner: Michael Freno.
 ## Target dates (internal)
 - Draft with placeholders: **done 2026-11-05**; narrowed to the no-figure shape
  **2026-11-06** (CTO direction).
 - Send: after gates 1–4 — with the no-figure shape, the only hard input left is
  the CTO's query confirmation and the sponsor's send.
--- a/marketing/drafts/newsletter-postmortem-pitch/rationale.md
+++ b/marketing/drafts/newsletter-postmortem-pitch/rationale.md
@@ -0,0 +1,73 @@
 # Rationale — newsletter post-mortem pitch (shape)
 FRE-199 item 2. Drafted 2026-11-05 by CMO (plan date was 2026-11-06; FRE-201
 landed today, which was the only gate on drafting the shape).
 ## Why draft now
 The Chief of Staff's sequencing had the pitch drafted when FRE-201 landed. It
 landed 2026-11-05 (row closed `done` 18:45Z; the daily scan routine
 `2553b201` has been producing the backlog since 2026-10-30). The figures were
 never gated on FRE-201 — only the shape was — so the shape ships now and the
 figures stay placeholders behind their own gate.
 ## Why a post-mortem and not a product pitch
 The issue text's own thesis: "1,900 downloads, 6% trial→paid, here's what
 broke" outperforms a product pitch. Editors of free dev-tool newsletters run
 post-mortems; a solo shop shipping a Mac utility and keeping receipts is a
 story they can run without us asking for a review.
 ## The breakage is real, not invented
 The lead paragraph is the 0.13.4 delta incident (FRE-542): the appcast stayed
 at 0.13.4 while its five delta files 404'd — the publish path pruned before
 the feed was up. The fix (upload enclosures, verify URLs, copy the appcast,
 then prune) is in `scripts/upload-release.sh` and is engineering-verified by
 the FRE-542 record.
 **Second breakage, chosen 2026-11-06 (CTO direction):** the relay regression
 that shipped behind a passing suite (NOOK-815) — the suite that would have
 cought it existed but nothing invoked it; the fix wires it into the standard
 test entry point. It was chosen over the changelog-blanking incident because
 it is a complete story with no number needed and no overlap with the lead
 (both remaining candidates were publish-path incidents; one story about the
 publish path is enough). The placeholder is gone: no paragraph in the pitch
 waits on a figure any more.
 ## Narrowed 2026-11-06 — what the numbers can and cannot support
 The CTO's reopening verdict on FRE-199 confirmed **no figure for the pitch
 today**: FRE-202's snapshot (trial started 2, purchase 0, activation 0; 291 of
 291 rows predate the FRE-366 instrumentation) cannot yield a trial→paid ratio —
 that waits for FRE-197's mature Day 28–35 cohort read. So the pitch narrowed:
 - the "X% trial→paid" placeholder is deleted, not held;
 - if any count ships, it is **activations** (relay store, one row per activated
  install), named as activations — downloads (S3 side) are never quoted;
 - a new paragraph — "what we're not going to quote you" — turns the missing
  number into part of the post-mortem's credibility instead of a gap;
 - with the no-figure shape, the only inputs left before send are the CTO's
  query confirmation (if a count is attached) and the sponsor's send.
 ## Hard rules honoured
 - No figure in the file is a measurement; nothing is estimated to fill a gap.
 - No conversion figure ships — the ratio is FRE-197's, gated and CTO-confirmed.
 - Any count that ships is activations, named as activations; downloads are
  never quoted.
 - The two caveats (per-install conversion with install cap 3; downloads ≠
  activations) are written to travel inside the pitch, not a footnote.
 - Paid placements: out, per the issue text and the plan (TLDR ≈ $3k, no
  verifiable CPC). No placement is bought without CoS + sponsor.
 - Price appears once ($10, what the app actually charges) to identify the
  product — no discount, no countdown, no price-change copy (FRE-204 holds).
 ## Gates before send
 1. Any count quoted is activations, from a CTO-confirmed query — CTO.
 2. Trial→paid ratio ships only from FRE-197's mature read, CTO-confirmed;
   otherwise the no-figure paragraph stands — CTO.
 3. Both breakage paragraphs fact-checked against the engineering record
   (FRE-542; NOOK-815) — CMO drafts, CTO verifies.
 4. Sponsor approves the send; a human holds the account and sends — sponsor.
--- a/marketing/positioning.md
+++ b/marketing/positioning.md
@@ -4,8 +4,9 @@ Every drafted asset draws its voice, claims, and constraints from this file. If
 artifact invents its own framing, fix the artifact or fix this file — never both
 silently diverging.
-**Reconciled 2026-10-29** against the CTO's verdicts ([FRE-315], [FRE-322],
+**Reconciled 2026-10-29**, and again **2026-11-03** for the FRE-997 count
-[FRE-354]), the Chief of Staff's price decision (2026-10-29 04:01), the Plan B
+correction, against the CTO's verdicts ([FRE-315], [FRE-322], [FRE-354],
 [FRE-997]), the Chief of Staff's price decision (2026-10-29 04:01), the Plan B
 launch route ([FRE-346] → [FRE-203] `plan-b`), and `The-Nook` master (app floor is
 **14.2**, not 14.0 — `freno-dev` `881190d`, site merge `134f41e`). The previous
 version of this file named an upstream `the-nook/docs/marketing-strategy.md` that
@@ -17,6 +18,7 @@ no longer exists; the verdicts below are the source of truth it was pointing at.
 [FRE-320]: https://paperclip.freno.me/FRE/issues/FRE-320
 [FRE-346]: https://paperclip.freno.me/FRE/issues/FRE-346
 [FRE-203]: https://paperclip.freno.me/FRE/issues/FRE-203
 [FRE-997]: https://paperclip.freno.me/FRE/issues/FRE-997
 ## The sentence
@@ -125,7 +127,7 @@ No agent authenticates, posts, upvotes, or DMs. No sock puppets, no self-mention
 without disclosure. `approved/` **is the only thing a human ever publishes from** —
 nothing posts itself.
-## Claims: status at 2026-10-29
+## Claims: status at 2026-11-03
 Each row names the evidence, not a feeling. Re-read the verdict before using a row.
@@ -136,7 +138,7 @@ Each row names the evidence, not a feeling. Re-read the verdict before using a r
 | The hook and bridge are not a cloud service | **Verified code fact, held on disclosure** | [FRE-322] §2, wording corrected by [FRE-354] `(j)`. Held until Sentry is gated/removed and `/privacy` + `/faq` land. Never widen to "The Nook", never "nothing but your Mac". |
 | Fan, thermal and charge control | **No claim verdict yet — do not lead with it** | Backed by `helper/` (privileged helper, SMC, no kext), but no CTO sentence exists for it. Documentary, not launch. |
 | One-time purchase, no subscription | **Publishable fact, price not a launch asset** | $10, held at $10. No dated rise, no discount framing, no pricing copy. |
-| Agent coverage numbers ("thirteen agents", "8 agents", "all your agents") | **Excluded — verdict B, count removed** | [FRE-359] verdict B (2026-10-29): the page's 13 rows are the registry's first 13 of 18, so no number is publishable and `every` / `all` / `the agents The Nook supports` are banned. Removed from `agents.tsx`, the landing island section and the marquee. [FRE-322] §1 matrix for the sets. |
+| Agent coverage numbers ("eighteen agents", "18 agents") | **Publishable at 18** | [FRE-997]: the /agents table now lists every row of `AgentSpec.all` and `agents.test.ts` asserts equality with the 18-name registry in registry order, so the landing bullet, the marquee chip and the /agents copy say 18. No other number is publishable. |
 | macOS 14.2 or later | **Publishable fact** | The app cannot start below 14.2 (`freno-dev` `881190d`, site `134f41e`). "macOS 14+" is false and was fixed on the site. |
 | Remote agents over SSH, one click to install | **Held** | [FRE-315] §1, [FRE-320], [FRE-323]. Needs a verified one-click install plus a recording. |
 | "Nothing leaves your Mac", "no telemetry", "local-only", "no account" | **False today — banned** | Sentry unconditional, licence check with hardware fingerprint ([FRE-322] §2.4). |
@@ -144,8 +146,9 @@ Each row names the evidence, not a feeling. Re-read the verdict before using a r
 ## Voice
- Short, concrete, no hype adjectives. Numbers over adjectives — but no coverage
+- Short, concrete, no hype adjectives. Numbers over adjectives — the only count
-  counts (see the excluded row above).
+  that ships is eighteen, and it is the registry's own size (see the coverage row
  above).
 - The notch is the product's home; agents are the product's point.
 - Never apologize for being a utility. The utility is the point.
 - Banned phrasings: competitor names (see rule 1), "AI-powered", "revolutionary",
--- a/src/components/nook/FeatureBreakdowns.tsx
+++ b/src/components/nook/FeatureBreakdowns.tsx
@@ -851,7 +851,7 @@ export default function FeatureBreakdowns() {
        title="Your whole fleet, in one pixel strip"
        body="Every session, every agent, one square each. The pill never wraps, never grows — an arriving question flashes the fire and swaps the slot, then hands the notch back."
        bullets={[
-          "Claude Code, Codex, Gemini CLI, OpenCode, Pi, Muse, Cursor and more",
+          "18 agents: Claude Code, Codex, Gemini CLI, OpenCode, Pi, Muse, and more",
          "Custom agents: your own coding agent can wire itself in from the published contract",
          "Slot rankings — you choose which data earns the notch",
          "You don't need a notch — external displays get the same island, floating top-center"
--- a/src/components/nook/IslandExtras.tsx
+++ b/src/components/nook/IslandExtras.tsx
@@ -722,7 +722,7 @@ function LayoutMock() {
 /* ── Marquee ─────────────────────────────────────────────────────── */
 const CHIPS_A = [
-  "Agents wired in",
+  "18 agents",
  "Custom agents",
  "Six chiptunes",
  "Focus-aware slots",
--- a/src/routes/api/the-nook/report.test.ts
+++ b/src/routes/api/the-nook/report.test.ts
@@ -10,6 +10,8 @@ import { describe, expect, it, mock, beforeEach } from "bun:test";
 const sentEmails: { to: string; subject: string; html: string }[] = [];
 const tokenAnswers: { allowed: boolean; retryAfterSec?: number }[] = [];
 /** Every rate-limit key the route derived, in order. */
 const rateKeys: string[] = [];
 mock.module("~/server/email", () => ({
  default: async (to: string, subject: string, html: string) => {
@@ -19,7 +21,10 @@ mock.module("~/server/email", () => ({
 }));
 mock.module("~/server/bug-report-rate-limit", () => ({
-  takeBugReportToken: () => tokenAnswers.shift() ?? { allowed: true }
+  takeBugReportToken: (key: string) => {
    rateKeys.push(key);
    return tokenAnswers.shift() ?? { allowed: true };
  }
 }));
 const { POST } = await import("./report");
@@ -72,6 +77,7 @@ describe("POST /api/the-nook/report", () => {
  beforeEach(() => {
    sentEmails.length = 0;
    tokenAnswers.length = 0;
    rateKeys.length = 0;
  });
  it("emails the owner a report containing the snapshot, escaped", async () => {
@@ -133,10 +139,49 @@ describe("POST /api/the-nook/report", () => {
  it("still succeeds when no fingerprint header exists", async () => {
    const res = await POST(
-      request(validPayload, { "x-forwarded-for": "203.0.113.9, 10.0.0.1" })
+      request(validPayload, {
        "cf-connecting-ip": "203.0.113.9",
        "x-forwarded-for": "203.0.113.9, 10.0.0.1"
      })
    );
    expect(res.status).toBe(200);
    expect(sentEmails).toHaveLength(1);
    // The quota key is the Cloudflare-recorded client, not a header hop the
    // sender chose.
    expect(rateKeys).toEqual(["203.0.113.9"]);
  });
  it("a rotating leftmost x-forwarded-for does not mint a fresh quota key", async () => {
    // FRE-371: the old read keyed on the leftmost hop, which the sender
    // controls outright — one scripted loop with a rotating header had
    // unlimited reports. With the same Cloudflare-recorded client and a
    // different spoofed prefix per request, the key must be stable.
    for (const spoof of ["1.1.1.1", "2.2.2.2", "3.3.3.3"]) {
      const res = await POST(
        request(validPayload, {
          "cf-connecting-ip": "203.0.113.9",
          "x-forwarded-for": `${spoof}, 203.0.113.9, 10.0.0.1`
        })
      );
      expect(res.status).toBe(200);
    }
    expect(rateKeys).toEqual([
      "203.0.113.9",
      "203.0.113.9",
      "203.0.113.9"
    ]);
  });
  it("keys on the rightmost-minus-one hop when Cloudflare's header is absent", async () => {
    const res = await POST(
      request(validPayload, {
        "x-forwarded-for": "6.6.6.6, 203.0.113.9, 10.0.0.1"
      })
    );
    expect(res.status).toBe(200);
    // Never the leftmost (sender-chosen) hop.
    expect(rateKeys).toEqual(["203.0.113.9"]);
  });
  it("delivers the landing page's beta request with only the email", async () => {
--- a/src/routes/api/the-nook/report.ts
+++ b/src/routes/api/the-nook/report.ts
@@ -3,6 +3,7 @@ import { z } from "zod";
 import sendEmail from "~/server/email";
 import { CONTACT_RECIPIENT_EMAIL } from "~/lib/contact-config";
 import { takeBugReportToken } from "~/server/bug-report-rate-limit";
 import { resolveTrustedClientIp } from "~/server/trusted-client-ip";
 import { json, error } from "./_lib";
 /**
@@ -103,10 +104,9 @@ export async function POST(event: APIEvent): Promise<Response> {
  )
    .trim()
    .toLowerCase();
-  const forwarded = event.request.headers.get("x-forwarded-for");
+  // FRE-371: the IP fallback must be the spoof-resistant read — a rotating
-  const rateKey =
+  // leftmost x-forwarded-for used to mint unlimited report quota.
-    fingerprint ||
+  const rateKey = fingerprint || resolveTrustedClientIp(event);
    (forwarded ? forwarded.split(",")[0]!.trim() : "unknown");
  const token = takeBugReportToken(rateKey);
  if (!token.allowed) {
    return new Response(JSON.stringify({ error: "Too many reports" }), {
--- a/src/routes/nook/agents.test.ts
+++ b/src/routes/nook/agents.test.ts
@@ -1,6 +1,5 @@
 /**
- * Regression test for the /agents roster (NOOK-336) and its coverage wording
+ * Regression test for the /agents roster and its coverage count.
 * (FRE-359).
 *
 * The page mirrors the app's registry, `AgentSpec.all` in
 * the-nook/Sources/NookCore/Agents/AgentRegistry.swift. When Muse joined
@@ -9,11 +8,11 @@
 * them. The registry lives in another repo, so the expected roster is
 * restated here; when an agent is added there, add it here and on the page.
 *
- * FRE-359 verdict B: the page no longer states a count or claims coverage
+ * FRE-997 restored the count. The page said thirteen while the registry held
- * ("all thirteen", "every coding agent The Nook supports"). The page still
+ * eighteen, so the count was dropped rather than corrected (FRE-359 verdict B);
- * lists 13 of the registry's 18 rows — the table is hand-mirrored and its
+ * now that all eighteen rows are on the page, the roster check is an equality
- * regeneration is its own ticket — so the roster check here is a subset
+ * check again and the page states eighteen. A subset check would let a shipped
- * check in registry order, not an equality check.
+ * agent go missing behind a passing suite, which is the NOOK-336 failure.
 *
 * STATIC SOURCE AUDIT, the same pattern as the downloads regressions.
 */
@@ -48,51 +47,23 @@ const REGISTRY = [
  "Amp"
 ];
 const NUMBER_WORDS = ["twelve", "thirteen", "fourteen", "fifteen", "sixteen", "seventeen", "eighteen"];
 const entries = [...SOURCE.matchAll(/^\s{4}name: "([^"]+)",$/gm)].map((m) => m[1]);
-/** The page's rows are a subset of the registry, in registry order. */
+describe("Nook /agents roster", () => {
-function subsetInOrder(page: string[], registry: string[]): boolean {
+  it("lists every registry agent, once, in registry order", () => {
-  let cursor = 0;
+    expect(entries).toEqual(REGISTRY);
  for (const name of page) {
    const at = registry.indexOf(name, cursor);
    if (at === -1) return false;
    cursor = at + 1;
  }
  return true;
 }
 describe("Nook /agents roster (NOOK-336)", () => {
  it("lists only registry agents, in registry order", () => {
    expect(entries.length).toBeGreaterThan(0);
    expect(subsetInOrder(entries, REGISTRY)).toBe(true);
  });
-  it("lists each agent at most once", () => {
+  it("states the registry's size", () => {
-    expect(new Set(entries).size).toBe(entries.length);
+    expect(entries.length).toBe(18);
-  });
+    expect(COPY).toContain("all eighteen");
    expect(COPY).toContain("The 18 agents");
    expect(COPY).toContain("eighteen coding agents");
  });
-describe("Nook /agents coverage wording (FRE-359)", () => {
+  it("carries no stale count", () => {
-  it("states no agent count anywhere on the page", () => {
+    expect(COPY.toLowerCase()).not.toContain("thirteen");
-    for (const word of NUMBER_WORDS) {
+    expect(COPY).not.toMatch(/\b13 agents\b/);
-      expect(COPY.toLowerCase()).not.toContain(word);
+    expect(COPY).not.toContain("all thirteen");
    }
    // A bare numeral count ("13 agents", "The 13") is just as precise and just
    // as unverified; the page must not state one in any form.
    expect(COPY).not.toMatch(/\b\d{1,2} agents\b/);
    expect(COPY).not.toMatch(/\ball \d{1,2}\b/);
  });
  it("makes no completeness claim over the agent set", () => {
    for (const banned of [
      "every coding agent",
      "the agents the nook supports",
      "agents the nook supports",
      "supported agents"
    ]) {
      expect(COPY.toLowerCase()).not.toContain(banned);
    }
  });
 });
--- a/src/routes/nook/agents.tsx
+++ b/src/routes/nook/agents.tsx
@@ -1,11 +1,10 @@
 /**
- * `/agents` on the Nook subdomain — the agent roster and each row's event
+ * `/agents` on the Nook subdomain — all eighteen agents in the registry and
- * coverage. It states no agent count and claims no completeness over the
+ * each row's event coverage.
 * registry (FRE-359 verdict B).
 *
 * The registry below mirrors `AgentSpec.all` in the app
- * (~/Code/the-nook/Sources/NookCore/Agents/AgentSpec.swift) and each agent's
+ * (~/Code/the-nook/Sources/NookCore/Agents/AgentRegistry.swift) and each
- * installed hook surface (hook/setup.go) or plugin event subscription
+ * agent's installed hook surface (hook/setup.go) or plugin event subscription
 * (plugins/*), normalized onto the shared event vocabulary
 * (~/Code/the-nook/docs/agent-interface.md). Copy follows
 * marketing/positioning.md: category nouns, honest scoping, no unverifiable
@@ -261,6 +260,92 @@ const AGENTS: AgentEntry[] = [
    ],
    gating:
      "Tool calls can be allowed or denied from a card; permission prompts stay with the agent"
  },
  {
    name: "Kimi",
    wiring: "Hook rules in its TOML config, one per event",
    events: [
      "SessionStart",
      "SessionEnd",
      "UserPromptSubmit",
      "AgentStart",
      "PreToolUse",
      "PermissionRequest",
      "PermissionResolved",
      "PostToolUse",
      "PostToolUseFailure",
      "Stop",
      "SessionError",
      "SubagentStart",
      "SubagentStop",
      "PreCompact",
      "Notification"
    ],
    gating:
      "Observation — every event appears as a card; its PreToolUse fires before its own permission check, so the agent keeps its own prompting"
  },
  {
    name: "GitHub Copilot CLI",
    wiring: "One hook file of ours in its hooks directory",
    events: [
      "SessionStart",
      "SessionEnd",
      "UserPromptSubmit",
      "PreToolUse",
      "PermissionRequest",
      "PostToolUse",
      "PostToolUseFailure",
      "Stop",
      "SubagentStart",
      "SubagentStop",
      "ErrorOccurred",
      "PreCompact",
      "Notification"
    ],
    gating:
      "Observation — every event appears as a card; its permission request runs before its own policy check, so the agent keeps its own prompting"
  },
  {
    name: "Crush",
    wiring:
      "One entry in its JSONC config, the only event it documents",
    events: ["PreToolUse"],
    gating:
      "Observation — tool calls appear as cards; its own permission prompts decide"
  },
  {
    name: "Cursor",
    wiring:
      "Hook entries in its hooks.json, merged with your own. No permission hook, on purpose",
    events: [
      "SessionStart",
      "SessionEnd",
      "UserPromptSubmit",
      "PostToolUse",
      "PostToolUseFailure",
      "Stop",
      "SessionError",
      "AfterAgentResponse",
      "SubagentStop",
      "PreCompact"
    ],
    gating:
      "Observation — a permission hook that stays silent blocks the action here, so Cursor keeps its own prompting"
  },
  {
    name: "Amp",
    wiring: "In-process extension package",
    events: [
      "SessionStart",
      "SessionEnd",
      "UserPromptSubmit",
      "PreToolUse",
      "PostToolUse",
      "Stop",
      "SessionError"
    ],
    gating:
      "Observation — its plugin API has no permission-wait event, so the agent keeps its own prompting"
  }
 ];
@@ -284,19 +369,19 @@ export default function NookAgentsPage() {
    <>
      <EdgeCacheHeaders maxAge={300} />
      <PageHead
-        title="Agent coverage"
+        title="Supported agents"
-        description="The coding agents The Nook connects to, with the events each hook reports and what you can do from a card: watch sessions live, answer permission prompts, unblock work."
+        description="Every coding agent The Nook supports — all eighteen, with each hook's exact event coverage and what you can do from a card: watch sessions live, answer permission prompts, unblock work."
-        ogTitle="The coding agents The Nook connects to, and what each hook sees"
+        ogTitle="The 18 agents The Nook supports, and what each hook sees"
      />
      <SubdomainHeader />
      <main class="min-h-screen px-[8vw] py-[8vh]">
        <h1 class="text-text mb-3 text-3xl font-bold tracking-tight sm:text-4xl">
-          Agent coverage
+          Supported agents
        </h1>
        <p class="text-subtext0 mb-2 max-w-2xl text-lg">
-          The Nook watches coding agents in one place — your menu bar and notch
+          The Nook watches eighteen coding agents in one place — your menu bar and
-          show sessions that are running, thinking, or blocked, and a card can
+          notch show every session that is running, thinking, or blocked, and a
-          answer a permission prompt without leaving your keyboard.
+          card answers permission prompts without leaving your keyboard.
        </p>
        <p class="text-subtext1 mb-10 max-w-2xl text-sm">
          Each agent reports its own set of events. "Allow / Deny from a card"
--- a/src/routes/nook/remote-claims.test.ts
+++ b/src/routes/nook/remote-claims.test.ts
@@ -11,6 +11,16 @@
 * credential. FRE-359 verdict B removed the coverage count for the same
 * reason: the /agents table lists 13 of the registry's 18 rows.
 *
 * FRE-997 corrects the second half without touching the first. The count was
 * stale, not unverifiable: `AgentSpec.all` holds eighteen, /agents now lists
 * all eighteen and `agents.test.ts` asserts that roster as an equality again.
 * So the two completeness phrasings FRE-359 banned ("every coding agent",
 * "Supported agents") no longer rest on a 13-of-18 gap — the ban existed
 * because the page claimed the set and listed two thirds of it. They are out
 * of `BANNED_COVERAGE` on this branch for that reason alone; the stale counts
 * stay banned, and every FRE-323 remote sentence stays banned, because this
 * branch still carries the FRE-323 site state.
 *
 * The copy was not thrown away — it is parked in
 * `marketing/drafts/remote-ssh/` with the restore gate, and this test asserts
 * it is still there so nobody deletes the parked story as stale. It goes back
@@ -55,13 +65,15 @@ const BANNED_REMOTE_CLAIMS = [
  "this Mac or remote machines"
 ];
-/** FRE-359 verdict B: no count, no coverage claim, in any form. */
+/** FRE-359 verdict B: no stale count, in any form.
 *
 * "every coding agent" and "Supported agents" left this list with FRE-997:
 * the page now lists all eighteen registry rows and `agents.test.ts` asserts
 * that equality, so the completeness claim is backed rather than incomplete. */
 const BANNED_COVERAGE = [
  "all thirteen",
  "thirteen coding agents",
-  "13 agents",
+  "13 agents"
  "every coding agent",
  "Supported agents"
 ];
 /** User-facing copy only: comments are not copy and may name the old wording. */
@@ -98,9 +110,9 @@ describe("remote claims stay off the site (FRE-323)", () => {
  });
 });
-describe("agent coverage count stays off the page (FRE-359 verdict B)", () => {
+describe("the agent count is corrected, not dropped (FRE-997)", () => {
  for (const file of AUDITED) {
-    it(`${file} states no coverage count`, () => {
+    it(`${file} states no stale count`, () => {
      const copy = copyOf(file);
      for (const phrase of BANNED_COVERAGE) {
        expect(copy.toLowerCase()).not.toContain(phrase.toLowerCase());
@@ -108,7 +120,7 @@ describe("agent coverage count stays off the page (FRE-359 verdict B)", () => {
    });
  }
-  it("/agents titles the table Agent coverage", () => {
+  it("/agents states the registry's size", () => {
-    expect(copyOf("src/routes/nook/agents.tsx")).toContain("Agent coverage");
+    expect(copyOf("src/routes/nook/agents.tsx")).toContain("Supported agents");
  });
 });
--- a/src/routes/smarter-remote/privacy.tsx
+++ b/src/routes/smarter-remote/privacy.tsx
@@ -0,0 +1,139 @@
 /**
 * A Smarter Remote privacy policy — `freno.me/smarter-remote/privacy`.
 *
 * Linked from the iOS app's paywall (App Review 3.1.2). Reflects what the app
 * actually does: TV control stays on the local network, pairing data stays on
 * the phone, purchases go through Apple and RevenueCat, and sharing is a QR
 * code passed between phones.
 */
 import { A } from "@solidjs/router";
 import { PageHead } from "~/components/PageHead";
 import { EdgeCacheHeaders } from "~/components/EdgeCacheHeaders";
 export default function SmarterRemotePrivacyPolicy() {
  return (
    <>
      <EdgeCacheHeaders maxAge={300} />
      <PageHead
        title="A Smarter Remote Privacy Policy"
        description="Privacy policy for A Smarter Remote, a universal TV remote app that works over your local Wi-Fi network."
      />
      <div class="bg-base">
        <div class="min-h-screen px-[8vw] py-[8vh]">
          <div class="py-4 text-xl">A Smarter Remote&apos;s Privacy Policy</div>
          <div class="py-2">Last Updated: November 2, 2026</div>
          <div class="py-2">
            Welcome to A Smarter Remote (&apos;We&apos;, &apos;Us&apos;,
            &apos;Our&apos;). The app controls your TVs over your own Wi-Fi
            network. It has no accounts, no ads, and no analytics. This policy
            explains the little data it does handle.
          </div>
          <ol>
            <div class="py-2">
              <div class="pb-2 text-lg">
                <span class="-ml-4 pr-2">1.</span> Data We Collect
              </div>
              <div class="pl-4">
                <div class="pb-2">
                  <div class="-ml-6">(a) Your TVs:</div> The app finds TVs on
                  your local network and stores their names, network addresses,
                  and platform on your phone. Pairing codes and tokens are kept
                  in your phone&apos;s Keychain. This data is sent only to the
                  TV itself, over your local network. It never reaches us.
                </div>
                <div class="pb-2">
                  <div class="-ml-6">(b) Purchases:</div> Payments are handled
                  by Apple. We use RevenueCat to check whether you own A Smarter
                  Remote Pro. RevenueCat receives an anonymous app user ID, your
                  purchase and subscription history, and basic device and app
                  details such as OS version, app version, and region. It does
                  not receive your name, email, or payment details.
                </div>
                <div class="pb-2">
                  <div class="-ml-6">(c) Voice input:</div> If you use voice
                  search, your speech is converted to text by Apple&apos;s
                  speech recognition. Apple may process it on its servers. The
                  resulting text is sent only to your TV.
                </div>
                <div class="pb-2">
                  <div class="-ml-6">(d) Sharing:</div> If you share a TV with
                  someone, its name, address, and platform are put into a QR
                  code on your screen for them to scan. It goes from one phone
                  to the other and does not pass through our servers.
                </div>
              </div>
            </div>
            <div class="py-2">
              <div class="pb-2 text-lg">
                <span class="-ml-4 pr-2">2.</span> How We Use It
              </div>
              <div class="pb-2 pl-4">
                Data about your TVs is used only to control them. Purchase
                records are used only to unlock Pro. We do not use any of it for
                advertising, and we do not sell it.
              </div>
            </div>
            <div class="py-2">
              <div class="pb-2 text-lg">
                <span class="-ml-4 pr-2">3.</span> Local Network Access
              </div>
              <div class="pb-2 pl-4">
                iOS asks for permission before the app can use your local
                network. The app needs it to find and control your TVs. If you
                decline, the app cannot reach your TVs. You can change this in
                Settings &gt; Privacy &amp; Security &gt; Local Network.
              </div>
            </div>
            <div class="py-2">
              <div class="pb-2 text-lg">
                <span class="-ml-4 pr-2">4.</span> Deleting Your Data
              </div>
              <div class="pb-2 pl-4">
                Removing a TV in the app deletes its stored details and
                credentials from your phone. Deleting the app removes all of
                them. Subscriptions are managed and cancelled in your App Store
                account settings.
              </div>
            </div>
            <div class="py-2">
              <div class="pb-2 text-lg">
                <span class="-ml-4 pr-2">5.</span> Children&apos;s Privacy
              </div>
              <div class="pb-2 pl-4">
                The app does not knowingly collect personal information from
                anyone, including children under 13.
              </div>
            </div>
            <div class="py-2">
              <div class="pb-2 text-lg">
                <span class="-ml-4 pr-2">6.</span> Changes to the Privacy Policy
              </div>
              <div class="pb-2 pl-4">
                We may update this policy periodically. Any changes are posted on
                this page, so please review it from time to time.
              </div>
            </div>
            <div class="py-2">
              <div class="pb-2 text-lg">
                <span class="-ml-4 pr-2">7.</span> Contact Us
              </div>
              <div class="pb-2 pl-4">
                If you have any questions about this policy, you can contact us{" "}
                <A href="/contact" class="text-blue hover-underline-animation">
                  here
                </A>
                .
              </div>
            </div>
          </ol>
        </div>
      </div>
    </>
  );
 }
--- a/src/routes/smarter-remote/terms.tsx
+++ b/src/routes/smarter-remote/terms.tsx
@@ -0,0 +1,141 @@
 /**
 * A Smarter Remote terms of use — `freno.me/smarter-remote/terms`.
 *
 * Linked from the iOS app's paywall (App Review 3.1.2). Builds on Apple's
 * standard EULA and adds the Pro subscription and lifetime purchase terms.
 */
 import { A } from "@solidjs/router";
 import { PageHead } from "~/components/PageHead";
 import { EdgeCacheHeaders } from "~/components/EdgeCacheHeaders";
 export default function SmarterRemoteTerms() {
  return (
    <>
      <EdgeCacheHeaders maxAge={300} />
      <PageHead
        title="A Smarter Remote Terms of Use"
        description="Terms of use for A Smarter Remote and its Pro subscription."
      />
      <div class="bg-base">
        <div class="min-h-screen px-[8vw] py-[8vh]">
          <div class="py-4 text-xl">A Smarter Remote&apos;s Terms of Use</div>
          <div class="py-2">Last Updated: November 2, 2026</div>
          <div class="py-2">
            These terms cover your use of the A Smarter Remote app (&apos;the
            App&apos;). By using the App you agree to them. The App is licensed
            to you under Apple&apos;s{" "}
            <a
              href="https://www.apple.com/legal/internet-services/itunes/dev/stdeula/"
              target="_blank"
              rel="noopener noreferrer"
              class="text-blue hover-underline-animation"
            >
              Licensed Application End User License Agreement
            </a>
            , and the terms below add to it.
          </div>
          <ol>
            <div class="py-2">
              <div class="pb-2 text-lg">
                <span class="-ml-4 pr-2">1.</span> A Smarter Remote Pro
              </div>
              <div class="pl-4">
                <div class="pb-2">
                  <div class="-ml-6">(a) What it includes:</div> The free App
                  controls one TV. Pro removes that limit and unlocks the
                  features marked Pro in the App.
                </div>
                <div class="pb-2">
                  <div class="-ml-6">(b) Yearly subscription:</div> Payment is
                  charged to your Apple account when you confirm the purchase,
                  or when any free trial ends. The subscription renews
                  automatically at the same price unless you cancel at least 24
                  hours before the end of the current period. Your account is
                  charged for renewal within 24 hours before the period ends.
                  Any unused part of a free trial is forfeited when you buy a
                  subscription.
                </div>
                <div class="pb-2">
                  <div class="-ml-6">(c) Lifetime purchase:</div> A one-time
                  payment that unlocks Pro with no recurring charge.
                </div>
                <div class="pb-2">
                  <div class="-ml-6">(d) Managing and refunds:</div> You can
                  manage or cancel a subscription in your App Store account
                  settings. Refunds are handled by Apple under its policies.
                  Restore Purchases in the App re-unlocks Pro on another device
                  signed in to the same Apple account.
                </div>
              </div>
            </div>
            <div class="py-2">
              <div class="pb-2 text-lg">
                <span class="-ml-4 pr-2">2.</span> Your TVs
              </div>
              <div class="pb-2 pl-4">
                The App controls TVs through the network features their makers
                provide. Which features work depends on your TV&apos;s model and
                software, which can change without notice. We do not guarantee
                that every feature works on every TV. Only control TVs you own
                or have permission to use.
              </div>
            </div>
            <div class="py-2">
              <div class="pb-2 text-lg">
                <span class="-ml-4 pr-2">3.</span> No Warranty
              </div>
              <div class="pb-2 pl-4">
                The App is provided &apos;as is&apos;, without warranties of any
                kind, to the extent the law allows. To the extent the law allows,
                we are not liable for indirect or consequential damages arising
                from your use of the App.
              </div>
            </div>
            <div class="py-2">
              <div class="pb-2 text-lg">
                <span class="-ml-4 pr-2">4.</span> Privacy
              </div>
              <div class="pb-2 pl-4">
                How the App handles data is described in the{" "}
                <A
                  href="/smarter-remote/privacy"
                  class="text-blue hover-underline-animation"
                >
                  Privacy Policy
                </A>
                .
              </div>
            </div>
            <div class="py-2">
              <div class="pb-2 text-lg">
                <span class="-ml-4 pr-2">5.</span> Changes to These Terms
              </div>
              <div class="pb-2 pl-4">
                We may update these terms periodically. Any changes are posted on
                this page. Continuing to use the App after a change means you
                accept the new terms.
              </div>
            </div>
            <div class="py-2">
              <div class="pb-2 text-lg">
                <span class="-ml-4 pr-2">6.</span> Contact Us
              </div>
              <div class="pb-2 pl-4">
                If you have any questions about these terms, you can contact us{" "}
                <A href="/contact" class="text-blue hover-underline-animation">
                  here
                </A>
                .
              </div>
            </div>
          </ol>
        </div>
      </div>
    </>
  );
 }
--- a/src/server/security.ts
+++ b/src/server/security.ts
@@ -3,6 +3,7 @@ import { getCookie, setCookie } from "vinxi/http";
 import type { H3Event } from "vinxi/http";
 import { t } from "~/server/api/utils";
 import { logAuditEvent } from "~/server/audit";
 import { resolveTrustedClientIp } from "~/server/trusted-client-ip";
 import { env } from "~/env/server";
 import {
  AUTH_CONFIG,
@@ -328,39 +329,15 @@ async function cleanupExpiredRateLimits(): Promise<void> {
 }
 /**
- * Get client IP address from request headers.
+ * Get client IP address for a security decision (rate limiting, audit).
- * Only trusts X-Forwarded-For outside of local development (set by the Vercel
+ *
- * edge network in production; trusted in tests so the header-parsing path is
+ * Thin alias over `resolveTrustedClientIp` (./trusted-client-ip), which owns
- * exercised). In local development, uses the socket address to prevent header
+ * the trust order: the previous leftmost `x-forwarded-for` read was
- * spoofing.
+ * client-spoofable in our append-only proxy topology, and `x-real-ip` was
 * read unconditionally — both fixed there (FRE-371).
 */
 export function getClientIP(event: H3Event): string {
-  // In production on Vercel, X-Forwarded-For is set by the edge network
+  return resolveTrustedClientIp(event);
  // and cannot be spoofed by clients. In dev, ignore it.
  if (env.NODE_ENV !== "development") {
    const forwarded = getHeaderValue(event, "x-forwarded-for");
    if (forwarded) {
      return forwarded.split(",")[0].trim();
    }
    const realIP = getHeaderValue(event, "x-real-ip");
    if (realIP) {
      return realIP;
    }
  }
  // Fallback: try socket remote address
  try {
    const nodeReq = event.node.req;
    if (nodeReq?.socket?.remoteAddress) {
      const addr = nodeReq.socket.remoteAddress;
      // Clean up IPv6-mapped IPv4 addresses
      return addr.replace(/^::ffff:/, "");
    }
  } catch {
    // socket access failed
  }
  return "unknown";
 }
 /**
--- a/src/server/security/rate-limit.test.ts
+++ b/src/server/security/rate-limit.test.ts
@@ -150,29 +150,100 @@ describe("Rate Limiting", () => {
  });
  describe("getClientIP", () => {
-    it("should extract IP from x-forwarded-for header", () => {
+    // FRE-371: the read is spoof-resistant now. In the pinned topology
    // (client → Cloudflare → origin proxy → app) both proxies APPEND, so
    // x-forwarded-for arrives as `<spoof…>, <true client>, <CF edge>` and the
    // leftmost hop is whatever the sender typed. Trust order:
    // cf-connecting-ip, then x-forwarded-for rightmost-minus-one, then the
    // socket peer — never the leftmost hop, never x-real-ip.
    it("takes x-forwarded-for rightmost-minus-one, never the leftmost hop", () => {
      const event = createMockEvent({
-        headers: { "x-forwarded-for": "192.168.1.1, 10.0.0.1" }
+        headers: {
          "x-forwarded-for": "6.6.6.6, 192.168.1.1, 10.0.0.1"
        }
      });
      const ip = getClientIP(event);
      expect(ip).toBe("192.168.1.1");
    });
-    it("should extract IP from x-real-ip header", () => {
+    it("prefers cf-connecting-ip (Cloudflare overwrites it at the edge)", () => {
      const event = createMockEvent({
        headers: {
          "cf-connecting-ip": "203.0.113.7",
          "x-forwarded-for": "6.6.6.6, 192.168.1.1, 10.0.0.1"
        }
      });
      const ip = getClientIP(event);
      expect(ip).toBe("203.0.113.7");
    });
    it("a rotating leftmost x-forwarded-for does not change the resolved client", () => {
      // The spoof the old read fell for: same Cloudflare-recorded client,
      // different sender-chosen prefix per request. The key must be stable,
      // or each rotation mints a fresh rate-limit bucket.
      const first = getClientIP(
        createMockEvent({
          headers: {
            "cf-connecting-ip": "203.0.113.7",
            "x-forwarded-for": "1.1.1.1, 203.0.113.7, 10.0.0.1"
          }
        })
      );
      const second = getClientIP(
        createMockEvent({
          headers: {
            "cf-connecting-ip": "203.0.113.7",
            "x-forwarded-for": "2.2.2.2, 203.0.113.7, 10.0.0.1"
          }
        })
      );
      expect(first).toBe("203.0.113.7");
      expect(second).toBe(first);
    });
    it("ignores x-real-ip entirely (client-settable in this topology)", () => {
      const event = createMockEvent({
        headers: { "x-real-ip": "192.168.1.2" }
      });
      const ip = getClientIP(event);
-      expect(ip).toBe("192.168.1.2");
+      expect(ip).toBe("unknown");
    });
-    it("should prefer x-forwarded-for over x-real-ip", () => {
+    it("ignores a client-supplied single-hop x-forwarded-for with no trusted proxy above it", () => {
      // One hop only = the sender's own invention; discounting the trusted
      // hop leaves nothing to believe.
      const event = createMockEvent({
        headers: { "x-forwarded-for": "6.6.6.6" }
      });
      const ip = getClientIP(event);
      expect(ip).toBe("unknown");
    });
    it("a non-loopback socket peer is the client and beats every header", () => {
      const event = createMockEvent({
        remoteAddress: "198.51.100.23",
        headers: {
-          "x-forwarded-for": "192.168.1.1",
+          "cf-connecting-ip": "6.6.6.6",
-          "x-real-ip": "192.168.1.2"
+          "x-forwarded-for": "6.6.6.6, 192.168.1.1, 10.0.0.1",
          "x-real-ip": "6.6.6.6"
        }
      });
      const ip = getClientIP(event);
      expect(ip).toBe("198.51.100.23");
    });
    it("a loopback socket peer lets the forwarded headers speak", () => {
      const event = createMockEvent({
        remoteAddress: "127.0.0.1",
        headers: {
          "x-forwarded-for": "6.6.6.6, 192.168.1.1, 10.0.0.1"
        }
      });
@@ -198,13 +269,23 @@ describe("Rate Limiting", () => {
    it("should handle IPv6 addresses", () => {
      const event = createMockEvent({
        headers: {
-          "x-forwarded-for": "2001:0db8:85a3:0000:0000:8a2e:0370:7334"
+          "x-forwarded-for":
            "2001:0db8:85a3:0000:0000:8a2e:0370:7334, 10.0.0.1"
        }
      });
      const ip = getClientIP(event);
      expect(ip).toBe("2001:0db8:85a3:0000:0000:8a2e:0370:7334");
    });
    it("rejects a candidate hop that is not an address", () => {
      const event = createMockEvent({
        headers: { "x-forwarded-for": "not-an-ip, 10.0.0.1" }
      });
      const ip = getClientIP(event);
      expect(ip).toBe("unknown");
    });
  });
  describe("rateLimitLogin", () => {
--- a/src/server/security/test-utils.ts
+++ b/src/server/security/test-utils.ts
@@ -14,12 +14,15 @@ export function createMockEvent(options: {
  cookies?: Record<string, string>;
  method?: string;
  url?: string;
  /** Socket peer the server observed; omit for a peer-less synthetic event. */
  remoteAddress?: string;
 }): H3Event {
  const {
    headers = {},
    cookies = {},
    method = "POST",
-    url = "http://localhost:3000/"
+    url = "http://localhost:3000/",
    remoteAddress
  } = options;
  // Build the cookie header string from the cookies object only
@@ -49,7 +52,10 @@ export function createMockEvent(options: {
    headers: headersObj,
    node: {
      req: {
-        headers: allHeaders
+        headers: allHeaders,
        ...(remoteAddress
          ? { socket: { remoteAddress } }
          : {})
      },
      res: {
        cookies: {}
--- a/src/server/trusted-client-ip.test.ts
+++ b/src/server/trusted-client-ip.test.ts
@@ -0,0 +1,171 @@
 import { describe, expect, it } from "bun:test";
 import {
  resolveTrustedClientIp,
  isIpAddress,
  isLoopbackAddress,
  UNKNOWN_CLIENT_IP,
  type ClientIpEventLike
 } from "./trusted-client-ip";
 /**
 * Unit coverage for the security-path client-IP read (FRE-371). The caller
 * suites (rate-limit.test.ts, report.test.ts) pin the behaviour through
 * getClientIP and the route; this file pins the helper's own edges: the peer
 * forms a real socket can present, the APIEvent wrapper, and failing closed.
 */
 function event(opts: {
  headers?: Record<string, string>;
  remoteAddress?: string;
  wrapped?: boolean;
 }): ClientIpEventLike {
  const inner: ClientIpEventLike = {
    ...(opts.remoteAddress
      ? { node: { req: { socket: { remoteAddress: opts.remoteAddress } } } }
      : {}),
    request: { headers: new Headers(opts.headers ?? {}) }
  };
  // An APIEvent wraps its H3Event as `nativeEvent` (routes/api/* shape).
  return opts.wrapped ? { nativeEvent: inner } : inner;
 }
 describe("resolveTrustedClientIp", () => {
  it("trust order: non-loopback peer, then cf-connecting-ip, then rightmost-minus-one x-forwarded-for", () => {
    // Peer wins.
    expect(
      resolveTrustedClientIp(
        event({
          remoteAddress: "198.51.100.23",
          headers: {
            "cf-connecting-ip": "203.0.113.7",
            "x-forwarded-for": "6.6.6.6, 203.0.113.7, 10.0.0.1"
          }
        })
      )
    ).toBe("198.51.100.23");
    // Loopback peer → Cloudflare's record.
    expect(
      resolveTrustedClientIp(
        event({
          remoteAddress: "127.0.0.1",
          headers: {
            "cf-connecting-ip": "203.0.113.7",
            "x-forwarded-for": "6.6.6.6, 203.0.113.7, 10.0.0.1"
          }
        })
      )
    ).toBe("203.0.113.7");
    // No CF header → the hop below the trusted proxy.
    expect(
      resolveTrustedClientIp(
        event({
          remoteAddress: "127.0.0.1",
          headers: { "x-forwarded-for": "6.6.6.6, 203.0.113.7, 10.0.0.1" }
        })
      )
    ).toBe("203.0.113.7");
  });
  it("reads the wrapped H3Event of an APIEvent-shaped input", () => {
    expect(
      resolveTrustedClientIp(
        event({
          wrapped: true,
          remoteAddress: "127.0.0.1",
          headers: { "cf-connecting-ip": "203.0.113.7" }
        })
      )
    ).toBe("203.0.113.7");
  });
  it("never returns a truncated address", () => {
    // The full /128 is the bucket key; a truncated one would pool attackers
    // with their neighbours.
    const ip = resolveTrustedClientIp(
      event({
        remoteAddress: "127.0.0.1",
        headers: { "cf-connecting-ip": "2001:0db8:85a3:0000:0000:8a2e:0370:7334" }
      })
    );
    expect(ip).toBe("2001:0db8:85a3:0000:0000:8a2e:0370:7334");
  });
  it("fails closed to the stricter unknown key", () => {
    // One hop = the sender's own invention; a non-address hop; nothing at all.
    expect(
      resolveTrustedClientIp(
        event({ headers: { "x-forwarded-for": "6.6.6.6" } })
      )
    ).toBe(UNKNOWN_CLIENT_IP);
    expect(
      resolveTrustedClientIp(
        event({ headers: { "cf-connecting-ip": "not-an-ip" } })
      )
    ).toBe(UNKNOWN_CLIENT_IP);
    expect(resolveTrustedClientIp(event({}))).toBe(UNKNOWN_CLIENT_IP);
  });
  it("recognises the loopback forms a real peer presents", () => {
    expect(
      resolveTrustedClientIp(
        event({
          // IPv6-mapped IPv4 loopback from a node socket.
          remoteAddress: "::ffff:127.0.0.1",
          headers: { "cf-connecting-ip": "203.0.113.7" }
        })
      )
    ).toBe("203.0.113.7");
    expect(
      resolveTrustedClientIp(
        event({
          remoteAddress: "::1",
          headers: { "cf-connecting-ip": "203.0.113.7" }
        })
      )
    ).toBe("203.0.113.7");
    // A non-loopback peer that merely looks odd is still the client.
    expect(
      resolveTrustedClientIp(
        event({
          remoteAddress: "::ffff:203.0.113.7",
          headers: { "cf-connecting-ip": "6.6.6.6" }
        })
      )
    ).toBe("203.0.113.7");
  });
  it("never believes x-real-ip", () => {
    expect(
      resolveTrustedClientIp(
        event({ headers: { "x-real-ip": "203.0.113.7" } })
      )
    ).toBe(UNKNOWN_CLIENT_IP);
  });
 });
 describe("address helpers", () => {
  it("isIpAddress", () => {
    expect(isIpAddress("203.0.113.7")).toBe(true);
    expect(isIpAddress("::1")).toBe(true);
    expect(isIpAddress("::ffff:203.0.113.7")).toBe(true);
    expect(isIpAddress("2001:db8::1")).toBe(true);
    expect(isIpAddress("not-an-ip")).toBe(false);
    expect(isIpAddress("256.1.1.1")).toBe(false);
    expect(isIpAddress("")).toBe(false);
    expect(isIpAddress(null)).toBe(false);
    expect(isIpAddress(undefined)).toBe(false);
  });
  it("isLoopbackAddress", () => {
    expect(isLoopbackAddress("127.0.0.1")).toBe(true);
    expect(isLoopbackAddress("127.255.0.3")).toBe(true);
    expect(isLoopbackAddress("::1")).toBe(true);
    expect(isLoopbackAddress("::ffff:127.0.0.1")).toBe(true);
    expect(isLoopbackAddress("203.0.113.7")).toBe(false);
    expect(isLoopbackAddress("::2")).toBe(false);
    // Unparseable input is not loopback — fails closed.
    expect(isLoopbackAddress("garbage")).toBe(false);
  });
 });
--- a/src/server/trusted-client-ip.ts
+++ b/src/server/trusted-client-ip.ts
@@ -0,0 +1,250 @@
 /**
 * The client address, resolved for security decisions (FRE-371).
 *
 * This is the ONLY client-IP read allowed to feed a security decision — rate
 * limiting, abuse quotas, account lockout, audit trails. It exists separately
 * from `request-client.ts`'s `resolveClientIp` (the analytics read) on
 * purpose:
 *
 *   - `resolveClientIp` carries a standing rule (FRE-369 review, 1d9287a):
 *     it never feeds a security decision. Its blast radius is a poisoned
 *     analytics row; ours is granting or denying access.
 *   - Rate limiting needs the UN-truncated address; the analytics module only
 *     ever hands out truncated prefixes.
 *   - `request-client.ts` ships on FRE-366's branch, which is under review;
 *     a security fix must not merge-depend on an analytics diff.
 *
 * The address-parsing primitives below are therefore a deliberate port of the
 * reviewed ones, not an import. If the two ever drift, this file's version is
 * the one security paths follow.
 *
 * WHY the old read was spoofable: `security.ts`'s `getClientIP` took the
 * LEFTMOST `x-forwarded-for` hop, believing the header "cannot be spoofed".
 * In the pinned topology — client → Cloudflare → same-host origin proxy →
 * app — both proxies *append*, so the header arrives as
 * `<client-supplied spoof…>, <true client>, <Cloudflare edge>` and the
 * leftmost hop is exactly the one the sender chose. Rotating
 * `X-Forwarded-For: <random>` per request minted a fresh rate-limit bucket
 * and unlimited bug-report quota. `x-real-ip` was read unconditionally too;
 * nothing in this topology overwrites it, so it is equally client text and is
 * no longer read at all.
 *
 * Trust order (matches the convention FRE-366 landed after its security
 * review, re-derived here for security stakes):
 *
 *   1. The direct socket peer, when it is a real routable address: it IS the
 *      client (dev, direct hit), and any forwarded header from it is the
 *      client describing itself — ignored.
 *   2. `cf-connecting-ip` — reachable only when the peer is the loopback
 *      origin proxy (or unreadable, e.g. a synthetic event in tests).
 *      Cloudflare *overwrites* this header at the edge, so a client-supplied
 *      value never survives. Must parse as an address.
 *   3. `x-forwarded-for` counted from the RIGHT: drop the rightmost hop (the
 *      Cloudflare edge address the origin proxy appended) and take the hop
 *      before it. Never the leftmost. Must parse as an address.
 *   4. "unknown" — callers give unknown-IP keys stricter shared limits, so
 *      an unresolvable client fails toward a tighter bucket, never a looser
 *      one.
 *
 * Deploy-side precondition this code cannot verify (same as the analytics
 * read): the origin must be reachable only through Cloudflare and the
 * same-host proxy. If the app is directly internet-reachable, a client can
 * set every header read here and no in-app read can recover the truth.
 */
 /** Cloudflare's "who actually connected" header: overwritten at the edge. */
 const CF_CONNECTING_IP = "cf-connecting-ip";
 const X_FORWARDED_FOR = "x-forwarded-for";
 /**
 * Hops discounted from the right of `x-forwarded-for` before the value is
 * taken: the Cloudflare edge address the origin proxy appended. Pinned to 1
 * because there is exactly one trusted proxy between Cloudflare and the app;
 * raise it only if the topology gains a trusted hop.
 */
 const FORWARDED_HOPS_TO_DISCOUNT = 1;
 /** Returned when no trustworthy address exists. Callers rate-limit it harder. */
 export const UNKNOWN_CLIENT_IP = "unknown";
 /**
 * The shapes this module reads: an H3Event (`security.ts` callers) or a
 * SolidStart APIEvent (`routes/api/*`), which wraps its H3Event as
 * `nativeEvent`. Every field is optional because test doubles are minimal;
 * anything unreadable simply falls through to the next trust step.
 */
 export interface ClientIpEventLike {
  request?: { headers?: unknown };
  headers?: unknown;
  node?: {
    req?: {
      headers?: Record<string, unknown>;
      socket?: { remoteAddress?: string };
    };
  };
  nativeEvent?: ClientIpEventLike;
 }
 /**
 * The client address for a security decision, per the trust order above.
 * Never truncated: rate-limit buckets are per-address, and truncating would
 * let an attacker share a bucket with the innocents behind their /24.
 */
 export function resolveTrustedClientIp(event: ClientIpEventLike): string {
  // An APIEvent's socket and (authoritative) headers live on the wrapped
  // H3Event; a bare APIEvent-shaped double without one is read as-is.
  const source = event.nativeEvent ?? event;
  const peer = directPeer(source);
  if (peer && isIpAddress(peer) && !isLoopbackAddress(peer)) return peer;
  // The peer is the loopback origin proxy (or unreadable): forwarded headers
  // may be believed, in the order above.
  const connecting = cleanHop(headerValue(source, CF_CONNECTING_IP));
  if (isIpAddress(connecting)) return connecting;
  const hops = (headerValue(source, X_FORWARDED_FOR) ?? "")
    .split(",")
    .map(cleanHop)
    .filter(Boolean);
  const index = hops.length - 1 - FORWARDED_HOPS_TO_DISCOUNT;
  if (index >= 0 && isIpAddress(hops[index])) return hops[index]!;
  return UNKNOWN_CLIENT_IP;
 }
 /** The socket peer, IPv6-mapped IPv4 flattened (`::ffff:1.2.3.4` → `1.2.3.4`). */
 function directPeer(event: ClientIpEventLike): string | null {
  try {
    const addr = event.node?.req?.socket?.remoteAddress;
    return addr ? addr.replace(/^::ffff:/, "") : null;
  } catch {
    return null;
  }
 }
 /**
 * Header read tolerant of every event shape in play: Fetch-style
 * `request.headers.get`, an h3 `event.headers` (Headers or plain object), and
 * the raw node request headers. Header names are case-insensitive per HTTP;
 * the plain-object fallbacks lowercase to match how node and the test doubles
 * store them.
 */
 function headerValue(event: ClientIpEventLike, name: string): string | null {
  try {
    const fromHeaders = (h: unknown): string | null => {
      if (!h) return null;
      if (typeof (h as Headers).get === "function") {
        return (h as Headers).get(name) ?? null;
      }
      if (typeof h === "object") {
        const record = h as Record<string, unknown>;
        const value = record[name] ?? record[name.toLowerCase()];
        return typeof value === "string" ? value : null;
      }
      return null;
    };
    return (
      fromHeaders(event.request?.headers) ??
      fromHeaders(event.headers) ??
      fromHeaders(event.node?.req?.headers)
    );
  } catch {
    return null;
  }
 }
 function cleanHop(value: string | null | undefined): string {
  return (value ?? "").trim();
 }
 // ── Addresses: parse and validate ───────────────────────────────────────────
 // Ported from the reviewed `request-client.ts` (FRE-366 @ 1d9287a); see the
 // header comment for why this is a copy and not an import.
 /** Any address this file understands: a dotted quad or an IPv6 literal. */
 export function isIpAddress(value: string | null | undefined): boolean {
  return value !== null && value !== undefined && addressBytes(value) !== null;
 }
 /**
 * Whether an address is the loopback the production proxy presents.
 *
 * Parses rather than string-matches, so the forms a real peer can present in —
 * `::ffff:127.0.0.53`, `0:0:0:0:0:0:0:1`, an IPv4-mapped literal — are all
 * recognised. An address this does not parse is *not* loopback, which fails
 * closed: forwarded headers from an unrecognised peer are ignored rather than
 * believed (a non-loopback peer short-circuits before headers are read).
 */
 export function isLoopbackAddress(ip: string): boolean {
  const bytes = addressBytes(ip);
  if (!bytes) return false;
  if (bytes.length === 4) return bytes[0] === 127;
  // IPv6 loopback ::1 — and ::ffff:127/8, which is loopback too.
  const mapped = ipv4FromBytes(bytes);
  if (mapped) return isLoopbackAddress(mapped);
  const tail = bytes[15]!;
  return bytes.slice(0, 15).every((byte) => byte === 0) && tail === 1;
 }
 function isIpv4(value: string): boolean {
  const parts = value.split(".");
  if (parts.length !== 4) return false;
  return parts.every(
    (part) => /^\d{1,3}$/.test(part) && Number(part) <= 255 && !/^0\d/.test(part)
  );
 }
 /** 4 bytes for IPv4, 16 for IPv6 (including `::ffff:a.b.c.d`), else null. */
 function addressBytes(value: string): number[] | null {
  const raw = value.trim().replace(/^\[|\]$/g, "").split("%")[0]!;
  if (isIpv4(raw)) return raw.split(".").map(Number);
  if (!raw.includes(":")) return null;
  const halves = raw.split("::");
  if (halves.length > 2) return null;
  const compressed = halves.length === 2;
  const head = groupsToBytes(halves[0] ?? "");
  const tail = groupsToBytes(halves[1] ?? "");
  if (!head || !tail) return null;
  const total = head.length + tail.length;
  if (compressed) {
    if (total > 8) return null;
    return [...head, ...new Array(8 - total).fill(0), ...tail].flatMap(split16);
  }
  if (total !== 8) return null;
  return [...head, ...tail].flatMap(split16);
 }
 /** One side of `::` as 16-bit groups; a trailing `1.2.3.4` counts as two. */
 function groupsToBytes(side: string): number[] | null {
  if (side === "") return [];
  const out: number[] = [];
  for (const part of side.split(":")) {
    if (/^[0-9a-fA-F]{1,4}$/.test(part)) {
      out.push(parseInt(part, 16));
    } else if (isIpv4(part)) {
      const o = part.split(".").map(Number);
      out.push((o[0]! << 8) | o[1]!, (o[2]! << 8) | o[3]!);
    } else {
      return null;
    }
  }
  return out;
 }
 function split16(group: number): number[] {
  return [(group >> 8) & 0xff, group & 0xff];
 }
 /** The embedded IPv4 of an IPv4-mapped IPv6 address (`::ffff:1.2.3.4`), else null. */
 function ipv4FromBytes(bytes: number[]): string | null {
  const prefix = bytes.slice(0, 10).every((byte) => byte === 0);
  const marker = bytes[10] === 0xff && bytes[11] === 0xff;
  if (!prefix || !marker) return null;
  return `${bytes[12]}.${bytes[13]}.${bytes[14]}.${bytes[15]}`;
 }
Author	SHA1	Message	Date
fixture	e12a063aa9	marketing: FRE-199 third pair of informational pages (drafts) + pitch narrowed to the no-figure shape Pair 3 (internal target Thu 2026-11-12, six days early): - agent-worktree-contention — 'How do you manage worktrees when your agents end up waiting on each other?' (backlog 1xlz2bs, Scan 6 #4); git worktree + Docker Compose project-name docs fetched and read 2026-11-05. - agent-keeps-asking — 'Why does your coding agent keep stopping to ask you questions?' (handback cluster: 1xlfqmo, 1xk0ghj, 1xlxw0q); permission + hooks claims re-verified live 2026-11-05 against code.claude.com; the 1xlfqmo poster's measurement figures deliberately not cited. Pitch narrowed per CTO reopening verdict: trial→paid placeholder deleted (FRE-202 cohort too young; ratio waits for FRE-197), second breakage chosen (NOOK-815 uninvoked suite), any count named as activations, downloads never quoted.	2026-11-05 22:54:53 +00:00
fixture	0137703341	marketing: FRE-199 CTO review fixes — B1 precedence order, B2 false git-push example dropped, N1 hooks-guide attribution B1 (agent-waiting-on-permission): body said 'allow / ask / deny' — inverted vs the permissions doc's deny → ask → allow. Fixed; fact-check row 3 was already correct and now matches the body. B2 (agent-run-without-asking): dropped the 'Bash(git commit ) allowed with Bash(git push ) denied is a policy the agent cannot talk its way around' example — the docs' own 'What a Bash rule doesn't match' table names Bash(git push *) as not stopping git -C . push origin main and friends. Sentence narrowed to the precedence claim, with a pointer to step 4's caveat. N1 (agent-done-signal): the osascript desktop-notification example is in the hooks guide (code.claude.com/docs/en/hooks-guide), not the hooks reference. Body and fact-check row 4 fixed. Pair-1 citations standardised from docs.anthropic.com to code.claude.com per the review's optional note. Each page's status blockquote records the revision.	2026-11-05 21:42:26 +00:00
fixture	4dac2e2928	marketing: FRE-199 fact-check verdict applied — second pair drafts/ → approved/ Sponsor fact-check card (FRE-199, interaction a7cba232) answered 2026-11-05 20:21Z: 'Approve both — move to approved/'. Status blockquotes updated to record the verdict and the date; page bodies untouched.	2026-11-05 20:23:03 +00:00
fixture	680563e3f9	marketing: FRE-199 registry wave-2 brief — targets verified, copy inherited from signed claims Five wave-2 candidates fetched live 2026-11-05 (awesome-macOS 19.4k ★, 1000.tools, uneed.best, devhunt.org; Product Hunt bot-walled and marked on-screen-read). Copy inherits FRE-207's CTO-signed claims only; price line stays 'Free 14-day trial', no number (G2). Submission gated on the wave-1 readback and G3/G4. Copy target was Fri 2026-11-13; ready 2026-11-05.	2026-11-05 20:15:30 +00:00
fixture	c5fb98af8d	marketing: FRE-199 second pair of informational pages (drafts) - agent-parallel-tracking/ — 'How do you keep track of multiple coding agents?' — the multi-agent attention cluster (1xmzp2n, 1xh5cum, 1xdjb2g, 1xipsk0, 1xk0ghj); answered with documented per-session hook events (session_id, typed Notification matchers) and the status line. - agent-run-without-asking/ — 'Should you let your coding agent run without asking permission?' — the autonomy cluster (1xexhwf, 1xk8imc, 1xk277d); answered with the permission-mode ladder, the docs' own container/VM warning, rule precedence, sandboxing pointer, PreToolUse deny. Internal target Mon 2026-11-09; drafted 2026-11-05. All doc claims re-read 2026-11-05 against code.claude.com (permissions, hooks, statusline). Ban compliance: no product of ours, no competitor, no handles, no price, no invented figures.	2026-11-05 19:58:59 +00:00
fixture	77e692273e	marketing: FRE-199 fact-check verdict applied — first pair drafts/ → approved/ Sponsor fact-check card (FRE-199, interaction 0101ee80) answered 2026-11-05 19:53Z: 'Approve both — move to approved/'. Status blockquotes updated to record the verdict and the date; page bodies untouched.	2026-11-05 19:54:45 +00:00
CMO (FrenoCorp agent)	a58b25501a	marketing: FRE-199 first pair of informational pages + pitch shape (drafts) - agent-done-signal: 'How do you know when your coding agent is done?' — the zero-looks-like-success cluster (1xjb3j0, 1xm09fs, 1xmnz2c, HN fhub/ sadilek); Stop/Notification/StopFailure hooks cited to the agent's own docs, re-read 2026-11-05. No product, no competitor, no price. - agent-waiting-on-permission: 'Why is my coding agent sitting on a permission prompt?' — the 1xhbc71 thread + invisible-permission cluster; permission modes, /permissions, rule syntax, acceptEdits cited to the permissions doc; undo-split attributed to 1xkoz06. - newsletter-postmortem-pitch: item 2's shape, placeholders only; send gated on FRE-202 or a CTO-confirmed direct relay-store read. All drafts: sponsor fact-check moves pending/ -> approved/; nothing publishes itself.	2026-11-05 19:09:46 +00:00
Mike	a0e6ff1044	Merge pull request 'security: stop trusting the leftmost x-forwarded-for for rate limits and abuse quotas (FRE-371)' (#1 ) from agent-security-engineer/freno-dev:freno-dev/FRE-371-trusted-client-ip-clean into master Reviewed-on: Mike/freno-dev#1	2026-11-04 10:58:26 -05:00
Mike	6fd0f84806	Merge pull request 'analytics: make each weekly funnel stage separately measurable (FRE-366)' (#2 ) from agent-code-review/freno-dev:freno-dev/FRE-366-funnel-stages into master Reviewed-on: Mike/freno-dev#2	2026-11-04 10:58:19 -05:00
Mike	c7071b0e32	Merge pull request 'metrics: stand up the weekly funnel job (FRE-202)' (#3 ) from agent-cto/freno-dev:freno-dev/FRE-202-weekly-metrics into master Reviewed-on: Mike/freno-dev#3	2026-11-04 10:58:12 -05:00
Mike	7fde259e0b	Merge pull request 'site: state the agent count as eighteen (FRE-997, count half)' (#5 ) from freno-dev/FRE-997-count-18 into master Reviewed-on: Mike/freno-dev#5	2026-11-04 10:57:54 -05:00
agent-cto	25ec84ceb4	site: state the agent count as eighteen (FRE-997, count half) FRE-359 verdict B dropped the agent count instead of correcting it: the page said thirteen while `AgentSpec.all` held eighteen, and the /agents table listed 13 of those rows. The count is a fact, not a claim, so this states it and makes the table match the registry again. - Landing island bullet and the marquee chip say 18 agents. - /agents: title/description/ogTitle/H1 at eighteen, and the five missing rows are on the page — Kimi, GitHub Copilot CLI, Crush, Cursor, Amp — with events and gating taken from hook/setup.go, hook/normalize.go, hook/normalize_hosts.go, Sources/NookCore/Agents/HookConfigInstaller.swift and plugins/amp/index.ts. All five are Observe (kimi/copilot PreToolUse and PermissionRequest fire before the host's own check; Crush documents one event; a silent Cursor permission hook blocks; Amp's plugin API has no permission-wait event). - agents.test.ts asserts the roster as an equality with the 18-name registry in registry order again, plus the count, instead of a subset check. - remote-claims.test.ts keeps every FRE-323 remote removal guard and the parked copy, and drops only the two completeness bans the corrected count contradicts ("every coding agent", "Supported agents") — the ban existed because the page claimed the set and listed 13 of 18. - positioning.md: the coverage row is publishable at 18. This is the count/roster half of FRE-997 only. The remote-SSH restore is held by the Chief of Staff against FRE-346 §3 and is not in this commit: no remote tile, breakdown, demo, chip, /agents remote paragraph or drafts deletion here. Gate: `bun test src/routes/nook` 18 pass / 0 fail; `bun run build` succeeds.	2026-11-04 00:21:35 +00:00
Michael Freno	dd368d21e7	smarter-remote: publish the app's privacy policy and terms of use A Smarter Remote's iOS paywall sells an auto-renewing subscription, and App Review 3.1.2 requires it to link a privacy policy and terms of use. No such pages existed. They now live on the main site at /smarter-remote/privacy and /smarter-remote/terms, so no new subdomain or DNS change is needed. The policy describes what the app actually does: local-network control, pairing data kept on the phone, purchases through Apple and RevenueCat, and QR sharing phone to phone. Tests: bun test shows the same 52 pre-existing failures with and without the pages; tsc reports nothing in the new files. TVR-19 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-02 15:34:18 -05:00
agent-security-engineer	2fd2a4a71a	security: stop trusting the leftmost x-forwarded-for for rate limits and abuse quotas (FRE-371) getClientIP (the rate-limit and audit key) took the LEFTMOST x-forwarded-for hop and read x-real-ip unconditionally. In our topology — client → Cloudflare → same-host origin proxy → app — both proxies APPEND, so the leftmost hop is whatever the sender typed: a rotating X-Forwarded-For minted a fresh rate-limit bucket per request, and unlimited bug-report quota via the same pattern in routes/api/the-nook/report.ts. x-real-ip is client-settable too; nothing in the chain overwrites it. It is no longer read at all. New trust order (src/server/trusted-client-ip.ts, resolveTrustedClientIp): 1. a non-loopback socket peer IS the client — its headers are ignored; 2. cf-connecting-ip (Cloudflare overwrites it at the edge; parsed as an address or rejected); 3. x-forwarded-for counted from the RIGHT, discounting one hop for the Cloudflare edge address the origin proxy appended (the topology has exactly one trusted proxy below Cloudflare); 4. "unknown" — callers key stricter shared limits on it, so resolution fails closed toward a tighter bucket, never a looser one. Addresses are never truncated: a /24-truncated key would pool attackers with the innocents behind them. Share-vs-copy, stated deliberately: this is a port of the parsing primitives FRE-366 reviewed in request-client.ts, NOT an import. resolveClientIp carries a standing rule (`1d9287a`) that it never feeds a security decision; lifting that rule for these callers would couple an access-control change to an analytics branch under review, and the analytics helper only exposes truncated prefixes while rate limiting needs the full address. If the two drift, trusted-client-ip.ts is the one security paths follow. The deploy-side precondition (origin reachable only via Cloudflare + the same-host proxy) is documented in the file header; if the app is ever directly internet-reachable no in-app read can recover the true client. Tests updated deliberately, not to go green: rate-limit.test.ts now pins the rightmost-minus-one order, cf-connecting-ip precedence, peer-over-headers, x-real-ip rejection, and the spoof case (a rotating leftmost hop does not change the resolved client); report.test.ts pins the quota key stability under a rotating header. New trusted-client-ip.test.ts covers the helper's own edges: APIEvent wrapper, loopback forms, unparseable hops failing closed.	2026-10-30 05:06:54 +00:00