What we shipped.

SEO overhaul, security hardening, and full payment lifecycle

• SEO pass: sitemap now lists only publicly indexable routes with canonical URLs; every page has a distinct title and description; Organization + SoftwareApplication + FAQ JSON-LD wired in.
• Homepage performance: lazy-loaded below-the-fold imagery, explicit width/height to prevent layout shift, code-split heavy routes, preconnect hints for third-party origins.
• Security: tightened Row-Level Security on user-owned tables, tightened Content-Security-Policy (no more unsafe-eval), and added a CSP violation reporter that logs to the operations audit trail.
• Payments: full Paddle lifecycle now covered — created, updated, canceled, past-due, paused, resumed, transaction completed, transaction payment failed, refunds and adjustments.
• PWA: Nova is now installable to the home screen with an offline-safe service worker that ships fresh HTML on every visit but caches hashed assets aggressively.
• AI disclosures: every AI-drafted card, briefing, and WhatsApp reply carries a plain 'AI-drafted — review before approving' line so nothing sends without your approval.
• Accessibility: keyboard focus rings across every interactive control, aria-labels on icon-only buttons, WCAG AA contrast locked with a full regression matrix in CI.