What changed, when, and what we took away.

The public surface gets built, and the first false claim gets removed

• ADD A design system with one canonical token file shared by the marketing site and the product, so the colours stop changing under a visitor at the moment they convert. A test makes drift between the two copies a build failure, and a living style guide renders every token and component so a change is visible rather than described.
• ADD Two typefaces vendored into this origin under the SIL Open Font License, subset offline. No font service, no content delivery network, no request to any host we do not control.
• ADD A pricing page with actual numbers on it, a comparison against the incumbents using figures observed on a stated date, and a published ledger of what is shipped against what is still being built.
• ADD A security and architecture page that states the key-encryption mechanism, the threat model and its limits, and an unhedged list of the certifications we do not hold.
• ADD A documentation index: the window catalog, the command grammar, the twenty-five documented analytic methods, and the provenance model.
• POLICY Terms of service and a refund policy published for the first time, both marked as unreviewed drafts with their unfilled blanks visible rather than hidden.
• POLICY The privacy policy rewritten against the actual data model — every table and column that holds personal data, its lawful basis, its retention period, and the sub-processor list with three rows honestly marked undecided.
• REMOVE The claim, now retired, that the product performs confirm-gated order execution. It appeared in the page description, the social preview text and the structured data that search engines read. It was wrong: the hosted build contains no broker code and never will, so the sentence advertised a capability the software does not have — and it is the exact sentence that makes a payment underwriter ask whether we are a broker. The claim is retired, and the gate described in the next line makes reintroducing it a failing test rather than a code-review miss.
• ADD A build gate that fails a page which claims order execution without denying it in the same sentence, references a third-party host in a script, style, font or image, or contains an emoji. The rule is now enforced by a test rather than by remembering.
• FIX Content security policy tightened so that every fetch directive resolves to this origin or to nothing, which makes loading a third-party asset impossible rather than merely discouraged. Framing denied, document base pinned, form submissions restricted to this origin.