diff --git a/.agents/skills/webjs/references/testing.md b/.agents/skills/webjs/references/testing.md
index ec1b17507..8e9ecdf89 100644
--- a/.agents/skills/webjs/references/testing.md
+++ b/.agents/skills/webjs/references/testing.md
@@ -172,7 +172,7 @@ A cross-runtime proof is often a plain assert script rather than a test file, so
 
 ## Convention validation (`webjs check`)
 
-`npm run check` is the correctness validator. Every rule catches code that is wrong to ship (a crash, a security leak, a type-strip failure), plus the `no-scaffold-placeholder` sentinel for unreplaced scaffold content. Run it and fix every violation before considering the change done (`npm run check -- --json` for an agent loop, `npm run check -- --rules` to list the rules). It is separate from `CONVENTIONS.md`, which carries the customizable project conventions you follow by judgment.
+`npm run check` is the correctness validator. Every rule catches code that is wrong to ship, a crash, a security leak, a reactive prop that silently stops re-rendering, or a type-strip failure. Run it and fix every violation before considering the change done (`npm run check -- --json` for an agent loop, `npm run check -- --rules` to list the rules). It is separate from `CONVENTIONS.md`, which carries the customizable project conventions you follow by judgment.
 
 ## What NOT to do
 
diff --git a/.claude/skills/webjs-scaffold-sync/SKILL.md b/.claude/skills/webjs-scaffold-sync/SKILL.md
index 7f53642e8..6c058aa71 100644
--- a/.claude/skills/webjs-scaffold-sync/SKILL.md
+++ b/.claude/skills/webjs-scaffold-sync/SKILL.md
@@ -199,19 +199,24 @@ Run the mandatory generate + boot + check verifications in PARALLEL when more th
    ```sh
    # generate (files only is enough for structure/typecheck; install to boot)
    node -e "import('packages/cli/lib/create.js').then(m => m.scaffoldApp('probe', '/tmp/x', { template: 'full-stack', install: false }))"
-   # then in the generated app: webjs check (only no-scaffold-placeholder should
-   # remain), webjs typecheck (clean), and boot it to hit the new route(s).
+   # then in the generated app: webjs check (clean), webjs typecheck (clean),
+   # and boot it to hit the new route(s).
    ```
    A scaffold change is NOT done until a freshly generated app of each affected
-   template BOOTS, serves the new/changed route, passes `webjs check` (only the
-   intended `no-scaffold-placeholder` markers), and `webjs typecheck` is clean.
+   template BOOTS, serves the new/changed route, passes `webjs check`, and
+   `webjs typecheck` is clean.
 5. Run the scaffold tests (`node --test 'test/scaffolds/*.test.js'`) and add/adjust
    assertions (a new demo in the FEATURES list, a per-template inclusion/exclusion
    test, the counterfactual).
 6. Respect the prose-punctuation invariant (#11) in every comment and doc, and
    keep each demo densely commented (a header stating the webjs concept + the
-   why, inline comments on the non-obvious idiom, a `webjs-scaffold-placeholder`
-   marker). The scaffold teaches by its comments; a thin demo is a bug.
+   why, and inline comments on the non-obvious idiom). Add a prune note where
+   removal is NOT obvious, which is what the demos that carry one do: a card
+   spanning several paths (the auth card names its route, its module, its api
+   routes and its schema column), or one that depends on another (the
+   server-actions card says to prune it with auth). A self-contained demo needs
+   none, since `npm run gallery:clear` sheds the lot. The scaffold teaches by its comments, and a thin demo is a
+   bug.
 
 ## Audit-mode procedure (sweep the scaffold for drift)
 
diff --git a/AGENTS.md b/AGENTS.md
index 11ba7368e..ac85c5094 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -290,7 +290,7 @@ Default export receives `{ children, params, searchParams, url }`, must embed `c
 
 ### Error / loading / metadata routes
 
-`error.{js,ts}` default-exports `({ error, ...ctx }) => TemplateResult` (catches sibling-page / deeper render errors, innermost wins, prod sends only `error.message`). `loading.{js,ts}` wraps the sibling page in `Suspense` with an immediately-flushed fallback. `forbidden.{js,ts}` / `unauthorized.{js,ts}` render the nearest 403 / 401 boundary for a thrown `forbidden()` / `unauthorized()` (#848). Two **root-only** boundaries (`app/` root exactly): `global-error.{js,ts}` is the app-wide catch-all tried after the nested `error` boundaries are exhausted, and it renders its **own** `<!doctype><html><body>` document (returned verbatim, since a root-layout failure is when it fires). Because it is returned verbatim (no framework `<head>` splice), it ships **no importmap or boot script**, so keep it **static HTML with no components/hydration** (a last-resort page must not depend on the module system that may have just failed); under an opt-in CSP, an inline `<style>`/`<script>` in it must carry the nonce via `cspNonce()`. `global-not-found.{js,ts}` renders for an unmatched-anywhere URL when no `not-found` matches. `not-found` is nearest-wins from the throwing page's chain (#848 fixed the prior root-only behavior). Metadata routes (`sitemap`, `robots`, `manifest`, `icon`, `apple-icon`, `opengraph-image`, `twitter-image`) live at app root or static segments only and default-export a possibly-async function; `sitemap(entries)` / `sitemapIndex(sitemaps)` from `@webjsdev/server` serialize spec-valid XML.
+`error.{js,ts}` default-exports `({ error, ...ctx }) => TemplateResult` (catches sibling-page / deeper render errors, innermost wins, prod sends only `error.message`). `loading.{js,ts}` wraps the sibling page in `Suspense` with an immediately-flushed fallback. `forbidden.{js,ts}` / `unauthorized.{js,ts}` render the nearest 403 / 401 boundary for a thrown `forbidden()` / `unauthorized()` (#848). Two **root-only** boundaries (`app/` root exactly): `global-error.{js,ts}` is the app-wide catch-all tried after the nested `error` boundaries are exhausted, and it renders its **own** `<!doctype><html><body>` document (returned verbatim, since a root-layout failure is when it fires). Because it is returned verbatim (no framework `<head>` splice), it ships **no importmap or boot script**, so keep it **static HTML with no components/hydration** (a last-resort page must not depend on the module system that may have just failed); under an opt-in CSP, an inline `<script>` in it must carry the nonce via `cspNonce()` (an inline `<style>` needs one only if you tighten `style-src`, since the default allows inline style outright). `global-not-found.{js,ts}` renders for an unmatched-anywhere URL when no `not-found` matches. `not-found` is nearest-wins from the throwing page's chain (#848 fixed the prior root-only behavior). Metadata routes (`sitemap`, `robots`, `manifest`, `icon`, `apple-icon`, `opengraph-image`, `twitter-image`) live at app root or static segments only and default-export a possibly-async function; `sitemap(entries)` / `sitemapIndex(sitemaps)` from `@webjsdev/server` serialize spec-valid XML.
 
 ### Route handlers (`app/**/route.{js,ts}`)
 
@@ -369,7 +369,7 @@ Derive the type at every boundary: a DB row from the schema (`typeof todos.$infe
 
 The router auto-enables when `@webjsdev/core` loads (any page with a component), so there is nothing to opt INTO. An app that wants plain full-page (MPA) navigation can opt OUT app-wide with `{ "webjs": { "clientRouter": false } }` (#629), or per-moment at runtime with `disableClientRouter()`. SSR auto-emits KEYED boundary comment pairs around each layout's children AND the page itself (open `<!--wj:children:<segment>:<route-key>-->`, close `<!--/wj:children:<segment>-->`; the route-key is the resolved path with param values percent-encoded, #1015). The router strictly scans both DOMs (any truncated, mispaired, or duplicated boundary poisons the scan) and applies a two-tier swap with Next.js remount parity: a changed route-key REPLACES (remounts) at the PARENT of the shallowest changed boundary (the range that contains the changed layout's own markup, exact Next remount scope), an unchanged one MORPHS the deepest shared boundary in place (a searchParams-only nav preserves hydrated component state). A poisoned or disjoint scan degrades to a full page load, never a guessed recovery, so silent DOM corruption is structurally impossible; outer-layout DOM identity is preserved on every soft path. **Every degradation dispatches `webjs:navigation-fallback` on `document` in ALL environments** (detail `{ cause, href, willReload }`, not cancelable), so a full page load on a click is observable in production rather than silent (#1114). Form submissions ride the same pipeline (`data-no-router` opts out). Wire bytes are minimized via the `X-Webjs-Have` header (`segment:route-key` entries, so a dynamic layout held for OTHER params is re-rendered rather than short-circuited; the server returns only the divergent fragment, served `private` so a shared cache can never store the reduced body and serve it to a full-page navigation, and additionally marked `Vary: X-Webjs-Have` for caches that honour it (#1140; `Vary` alone was not enough, since Cloudflare honours only `Accept-Encoding`)); scroll is restored on back/forward. **The link-prefetch cache is ANCHOR-VALIDATED** (#1114): a reduced fragment begins at the boundary the server short-circuited on, and on consume the router checks that boundary is still live with the same route-key. A root-anchored fragment therefore survives an unrelated navigation (still a cache hit), while one anchored deeper is discarded once that layout is gone, because applying it would share no boundary with the live DOM and force a full page load. The router also never prefetches the page it is already on (#1106): that request can never serve a later navigation and only occupies a capped cache slot. A non-GET `<form>` that BINDS a server action (`action=${fn}`) is the no-JS write-path (with JS the router posts the same body to the same url and applies the response in place: a `422` swaps without reload, a `303` is followed via fetch). A failed navigation recovers in place (a cancelable `webjs:navigation-error` event, else a minimal in-place alert), never a destructive full reload.
 
-The advanced client-router surface is in `references/client-router-and-streaming.md`: **link prefetch** (on by default, device-adaptive default: `intent` on a hover pointer, `viewport` (dwell-gated, cancel-on-scroll-out) on touch, per-link `data-prefetch` override), **`<webjs-frame>`** partial-swap regions, **View Transitions** (opt-in via `<meta name="view-transition">`, plus `data-webjs-permanent` to persist a live element), **stream actions** (`<webjs-stream>` element-level updates, #248), and the **opt-in nav-loading indicator** (`<html data-webjs-nav-progress>` exposes a `data-navigating` attribute during a nav so you can style a CSS-only progress affordance, off by default because toggling a root attribute re-resolves `oklch()` tokens to a one-frame repaint flash on iOS WebKit, #610). Production benefits from HTTP/2 at the edge; `npm run start` speaks plain HTTP/1.1 (put a reverse proxy in front for TLS + HTTP/2).
+The advanced client-router surface is in `references/client-router-and-streaming.md`: **link prefetch** (on by default, device-adaptive default: `intent` on a hover pointer, `viewport` (dwell-gated, cancel-on-scroll-out) on touch, per-link `data-prefetch` override), **`<webjs-frame>`** partial-swap regions, **View Transitions** (opt-in via `<meta name="view-transition" content="same-origin">`, where the router checks that exact `content` value and a bare tag enables nothing, plus `data-webjs-permanent` to persist a live element), **stream actions** (`<webjs-stream>` element-level updates, #248), and the **opt-in nav-loading indicator** (`<html data-webjs-nav-progress>` exposes a `data-navigating` attribute during a nav so you can style a CSS-only progress affordance, off by default because toggling a root attribute re-resolves `oklch()` tokens to a one-frame repaint flash on iOS WebKit, #610). Production benefits from HTTP/2 at the edge; `npm run start` speaks plain HTTP/1.1 (put a reverse proxy in front for TLS + HTTP/2).
 
 ---
 
@@ -534,7 +534,7 @@ webjs vendor pin|unpin|list|audit|outdated|update [--from PROVIDER]   # importma
 
 Every app ships the **conventions** as prose, in `.agents/skills/webjs/SKILL.md` (how to build) and `.agents/rules/workflow.md` (git, tests, review). These are guidance a reasonable project could do differently (modules layout, action placement, one-function-per-file, testing, styling, git workflow), followed by judgment, not tool-enforced.
 
-**`webjs check` is a separate, narrower tool: correctness checks only.** Every rule catches code that is wrong to ship (a crash, a security leak, a build/type-strip failure). They run unconditionally with no per-project disabling. The dividing line: could a sensible app legitimately want this to pass? If yes it is a convention (prose), if no it is a check (the tool). `webjs check --rules` lists them.
+**`webjs check` is a separate, narrower tool: correctness checks only.** Every rule catches code that is wrong to ship (a crash, a security leak, a reactive prop that silently stops re-rendering, a build/type-strip failure). They run unconditionally with no per-project disabling. The dividing line: could a sensible app legitimately want this to pass? If yes it is a convention (prose), if no it is a check (the tool). `webjs check --rules` lists them.
 
 So: read the skill and follow its conventions by judgment; run `webjs check` and fix every violation (correctness bugs, not style).
 
diff --git a/blog/ai-first-is-plumbing.md b/blog/ai-first-is-plumbing.md
index 123dc4ea7..1efda0908 100644
--- a/blog/ai-first-is-plumbing.md
+++ b/blog/ai-first-is-plumbing.md
@@ -48,21 +48,18 @@ What this gets us is that an agent in autonomous mode (running with permission t
 
 # The convention validator
 
-`webjs check` runs a set of lint rules over the project:
+`webjs check` runs a set of lint rules over the project. A few real ones:
 
-- `tests-exist`: every server action / query has a corresponding test
-- `no-server-imports-in-components`: components do not import `node:*` or a DB driver (`pg`)
+- `no-server-import-in-browser-module`: a module that genuinely ships to the browser does not import a server-only file, whose client stub throws at load
 - `use-server-needs-extension`: a `'use server'` directive requires a `.server.{js,ts}` filename
 - `no-static-properties`: reactive properties are declared via the `extends WebComponent({ … })` factory, not a hand-written `static properties`
 - `erasable-typescript-only`: `tsconfig.json` has `erasableSyntaxOnly: true`
 - `shell-in-non-root-layout`: non-root layouts and pages don't write `<!doctype>` / `<html>` / `<head>` / `<body>`
-- `no-json-data-files`: app data lives in the database, not in JSON files
 - `no-server-env-in-components`: `process.env.X` in components only reads `WEBJS_PUBLIC_*` or `NODE_ENV`
-- `light-dom-css-prefix`: light-DOM components with custom CSS prefix every selector with the tag name
 
-Each rule lives in `packages/server/src/check.js`. New rules are about 20 lines apiece. The agent runs `webjs check` before committing, sees violations as concrete messages, and fixes them.
+Each rule lives in `packages/server/src/check.js`. The agent runs `webjs check` before committing, sees violations as concrete messages, and fixes them.
 
-The lint is intentionally narrow. We have ~10 rules, not 100. The rules cover invariants that crash in production. The framework does not lint style preferences.
+The lint is intentionally narrow. Every rule catches something that is wrong to ship, a crash, a leaked secret, a reactive prop that silently stops re-rendering, or source that will not strip, and the framework does not lint style preferences. `webjs check --rules` prints the current set, which is the only place worth reading it from, because a list copied into a blog post goes stale the next time a rule lands.
 
 # Hooks beyond pre-commit
 
diff --git a/blog/client-router-turbo-drive-style.md b/blog/client-router-turbo-drive-style.md
index bc74edf1a..6ea2ef08a 100644
--- a/blog/client-router-turbo-drive-style.md
+++ b/blog/client-router-turbo-drive-style.md
@@ -18,12 +18,12 @@ The fix is to intercept link clicks, fetch the next page over fetch(), and patch
 
 # The mechanism
 
-When the framework's client router is loaded (one ES module import in your root layout), every same-origin `<a>` click goes through this path. The docstring describes it in five steps:
+The client router turns itself on as soon as `@webjsdev/core` loads, which any page carrying a component already does, so there is nothing to import and nothing to opt into. Once it is live, every same-origin `<a>` click goes through this path. The docstring describes it in five steps:
 
-1. SSR injects `<!--wj:children:<segment-path>-->...<!--/wj:children-->` comment markers around each layout's `${children}` interpolation (one pair per layout in the chain).
+1. SSR injects `<!--wj:children:<segment-path>:<route-key>-->...<!--/wj:children:<segment-path>-->` comment markers around each layout's `${children}` interpolation, one pair per layout in the chain, plus one around the page itself (skipped when the page's segment would collide with the innermost layout's). The route key is the resolved path with param values filled in.
 2. On link click, walk both the live DOM and the incoming HTML for these markers and build a path-to-range map.
-3. Find the longest shared marker path. That is the deepest layout both pages have in common.
-4. Replace nodes between that marker pair in the live DOM with the equivalent range from the incoming HTML, using a keyed reconciler that preserves input values, scroll, popover state, and DOM identity where it can.
+3. Compare the two maps. A shared boundary whose route key CHANGED wins first, and the swap is anchored at the parent of the shallowest such change, which remounts that layout the way Next does. Only when no key changed does the deepest shared boundary become the target.
+4. Apply the swap. A replace tears the live range out and inserts the incoming nodes, which is a real remount, and only elements marked `data-webjs-permanent` are carried across. A morph instead reconciles the two ranges with a keyed reconciler that preserves DOM identity, input values, scroll, and popover state; it is the more expensive path and it exists precisely to keep that state. Morphing is chosen only when the target boundary is the leaf on both sides and no route key changed.
 5. Merge head tags, re-run scripts, upgrade custom elements, `history.pushState`.
 
 The whole loop runs in a microtask. The body never repaints between pages.
@@ -39,21 +39,23 @@ Web component state survives. A `<theme-toggle>` holding its theme as an instanc
 
 Scroll position is preserved on the parts of the page that did not change. If you have a sidenav with a scroll position, navigation within the sidenav's sub-section does not snap it back to the top.
 
-The naive alternative (full page reload) breaks all three. The slightly-less-naive alternative (fetch + replace `<body>`) breaks them too because the layout itself unmounts. Walking marker pairs and replacing only the innermost is what preserves them.
+The naive alternative (full page reload) breaks all three. The slightly-less-naive alternative (fetch + replace `<body>`) breaks them too because the layout itself unmounts. Swapping the narrowest range that actually changed is what preserves them, and the route key is what decides how narrow that is: a layout still showing the same resolved path is left alone, while one whose params changed is remounted on purpose.
 
 
 # How it knows what to swap
 
-The framework auto-emits the HTML comment markers at SSR time. You do not write them. The renderer detects `${children}` interpolations inside layout functions and emits `<!--wj:children:<segment-path>-->` before and `<!--/wj:children-->` after.
+The framework auto-emits the HTML comment markers at SSR time. You do not write them. The renderer detects `${children}` interpolations inside layout functions and emits `<!--wj:children:<segment-path>:<route-key>-->` before and `<!--/wj:children:<segment-path>-->` after. The page gets its own pair too, which is what makes a bare param change remount the page.
 
-The path encoding (`/<segment-path>`) lets the client distinguish between nested layouts. Root `/`, then `/dashboard`, then `/dashboard/settings`, each as its own marker pair. The deepest matching pair between the current and incoming DOM is where the swap happens.
+The path encoding (`/<segment-path>`) lets the client distinguish between nested layouts. Root `/`, then `/dashboard`, then `/dashboard/settings`, each as its own marker pair. Where no route key changed, the deepest matching pair between the current and incoming DOM is where the swap happens.
+
+The route key on the opening marker carries the resolved path with its param values, and it takes precedence over that deepest-pair rule. `/users/7` and `/users/9` share a segment path but not a route key, so the router replaces at the parent of that boundary rather than morphing one user's chrome into another's. Segment membership alone would have called those two the same layout.
 
 This is automatic. The user does not write the markers. The framework adds them at SSR time wherever a layout interpolates `${children}`. The router uses them as nav-stable swap points.
 
 
 # The X-Webjs-Have optimization
 
-A naive implementation would fetch the full HTML for every navigation. The client router does better. It sends an `X-Webjs-Have` header listing the marker paths it already has.
+A naive implementation would fetch the full HTML for every navigation. The client router does better. It sends an `X-Webjs-Have` header listing what it already holds, as `segment:route-key` entries rather than bare paths, so a dynamic layout it is holding for different params is re-rendered instead of wrongly short-circuited.
 
 The server reads this header in `packages/server/src/ssr.js`. It iterates the target page's layout chain from innermost to outermost. Layouts at-or-above the deepest match are skipped. The response wraps only the divergent fragment in the deepest shared marker pair.
 
@@ -73,13 +75,13 @@ Forms that already call `event.preventDefault()` in their `@submit` handler are
 
 # What the router does not do
 
-Three explicit non-goals, called out in the source.
+Two explicit non-goals, plus one that used to be on this list and has since been built.
 
-No prefetching. The router does not warm `<a>` targets on hover or viewport entry. The platform is getting better at this (Speculation Rules API, Chrome's per-link prefetch hints), and we did not want to ship a heuristic we would have to tune. Apps that need it can layer it on.
+No view-transitions API by default. View Transitions are great when supported, but the spec is still evolving, so the default off-state matches what works in every browser. An app that wants them opts in with `<meta name="view-transition" content="same-origin">` in the root layout. The `content` value is load-bearing rather than decorative, since the router reads it and enables nothing unless it says `same-origin`.
 
-No view-transitions API by default. View Transitions are great when supported (Chromium-only as of writing), but the spec is still evolving. The default off-state matches what works in every browser.
+No nested-route data deduplication. `X-Webjs-Have` trims the HTML a navigation pays for, but that is markup, not data. The router does not keep "data we already have" and refetch only the diff. The HTTP cache and the framework's `cache()` query memoization handle that at a different layer.
 
-No nested-route data deduplication. Each navigation re-fetches the page from scratch. We do not try to keep "data we already have" and only refetch the diff. The HTTP cache and the framework's `cache()` query memoization handle this at a different layer.
+Prefetching was the one that changed. The router warms link targets on its own now, and it picks the strategy from the device rather than applying one everywhere: hover intent where there is a real pointer, and dwell-gated viewport entry on touch, where hover does not exist to hook. I wrote up how that choice gets made in [Device-adaptive link prefetch](/blog/device-adaptive-link-prefetch).
 
 
 # What happens on a rapid click
@@ -100,7 +102,7 @@ Hotwire's Turbo Drive is the closest precedent. Same DOM-swap philosophy, same s
 
 # Why I shipped this in core
 
-`@webjsdev/core` is small. Adding a 1400-line file to it (`router-client.js`) is meaningful weight. I added it anyway because the white flash is what makes pages feel slow. If you measure with Lighthouse, metrics look fine without a client router. But the perceived speed is noticeably worse. Users say "it feels weird" not "it took 100ms longer." The fix is the router.
+`@webjsdev/core` is small. Adding `router-client.js` to it is meaningful weight, and it has only grown since. I added it anyway because the white flash is what makes pages feel slow. If you measure with Lighthouse, metrics look fine without a client router. But the perceived speed is noticeably worse. Users say "it feels weird" not "it took 100ms longer." The fix is the router.
 
 The other reason it lives in core: the boundary-detection trick (HTML comments at `${children}` interpolation points) is too tightly coupled to the SSR renderer to make sense in a separate package. The renderer emits the markers. The router reads them. Splitting them across packages would require synchronizing two version trees.
 
diff --git a/blog/familiar-on-purpose-what-webjs-invents.md b/blog/familiar-on-purpose-what-webjs-invents.md
index 0e6462d9a..cad540b29 100644
--- a/blog/familiar-on-purpose-what-webjs-invents.md
+++ b/blog/familiar-on-purpose-what-webjs-invents.md
@@ -75,7 +75,7 @@ See https://webjs.dev/docs/components.
 
 It names your class, shows the replacement, and links the reference. The failure it replaces is the silent kind, which is what makes it worth the code. Reactivity that quietly stops working looks like your own bug, and you will go looking for it in your own code first.
 
-The static counterpart is `webjs check`, which today runs 20 correctness rules and nothing else. The bar for a rule is deliberately narrow. It has to catch code that is wrong to ship, a crash or a security leak or a type-strip failure, and never a matter of preference. Preferences live in prose where they can be argued with. So a class field replacing a reactive accessor is a rule, and so is a server-only import reaching a module that genuinely ships to the browser. Where you put your files is not.
+The static counterpart is `webjs check`, which today runs 20 correctness rules and nothing else. The bar for a rule is deliberately narrow. It has to catch code that is wrong to ship, a crash or a security leak or a reactive prop that silently stops re-rendering or a type-strip failure, and never a matter of preference. Preferences live in prose where they can be argued with. So a class field replacing a reactive accessor is a rule, and so is a server-only import reaching a module that genuinely ships to the browser. Where you put your files is not.
 
 The pattern is that the divergences are the things that carry enforcement. Familiar surfaces need no guardrail, since being right by default is what makes them familiar. The exceptions are where the throws and the check rules go.
 
diff --git a/blog/light-dom-by-default.md b/blog/light-dom-by-default.md
index 819ddad51..9375f7b26 100644
--- a/blog/light-dom-by-default.md
+++ b/blog/light-dom-by-default.md
@@ -110,7 +110,7 @@ The argument for shadow DOM is usually scoping: your component's styles will not
 
 For most application code, this is not the problem you have. You control the page. You control the components. Your CSS is intentional. The "leakage" risk is mostly a thought experiment.
 
-Tailwind sidesteps the scoping question entirely: utility classes are atomic, intentional, and unique by construction. There is nothing to leak. If you author components with Tailwind utilities, scoping is a non-issue. The same applies to other naming-discipline approaches like BEM or scoped class prefixes; the framework's `webjs check` ships a `light-dom-css-prefix` rule that flags unprefixed class selectors in vanilla CSS for light-DOM components, so the linter helps you keep selectors uniquely scoped if you choose that route.
+Tailwind sidesteps the scoping question entirely: utility classes are atomic, intentional, and unique by construction. There is nothing to leak. If you author components with Tailwind utilities, scoping is a non-issue. The same applies to other naming-discipline approaches like BEM or scoped class prefixes. When a light-DOM component does author vanilla CSS, the convention is to prefix every class selector with the component's own tag name, which makes it as unique as a utility class would be. That one is a discipline you keep rather than something tooling checks for you, which is one more reason Tailwind stays the lower-effort default.
 
 WebJs's recommendation: use Tailwind (or your chosen styling story) in light DOM by default. If a specific component needs strict isolation (third-party embed, design-system component meant to drop into hostile pages), opt into shadow DOM for that one component:
 
diff --git a/blog/no-build-via-jspm-io.md b/blog/no-build-via-jspm-io.md
index c6488f1a3..4d7b7cfa4 100644
--- a/blog/no-build-via-jspm-io.md
+++ b/blog/no-build-via-jspm-io.md
@@ -96,7 +96,7 @@ While I was already in the request pipeline, I followed Turbo Drive's CSP-nonce
 
 A nonce-based `script-src` is now enough for a WebJs app, with no `'unsafe-inline'` and no `'unsafe-eval'` among the script sources. The default pairs the nonce with `'strict-dynamic'`, which is the part that lets a nonce-loaded module pull in its own importmap-driven dependency graph without every URL being allow-listed by hand.
 
-`style-src` is the directive that still permits inline styles, and it is there for what the app puts in the document rather than for anything the framework emits. The framework's own head `<style>` carries the nonce. App styles generally do not: a light-DOM component's `<style>` block in `render()`, a shadow component's `static styles`, an inline `<style>` written by a page or layout. Then there are `style="..."` attributes, which no nonce can ever reach, because the nonce mechanism applies to elements and there is no such thing as a nonce on an attribute. A style element is not a script-injection vector, so none of this weakens the script protection. Run a strict CSP and the app still works.
+`style-src` is the directive that still permits inline styles, and it has to, because it carries no nonce source at all. The nonce covers scripts only, so every inline style in the document is admitted by `'unsafe-inline'`, including the one rule WebJs itself writes into the head. What makes the allowance hard to give up is the app's own styling: a light-DOM component's `<style>` block in `render()`, a shadow component's `static styles`, an inline `<style>` written by a page or layout. Then there are `style="..."` attributes, which no nonce can ever reach, because the nonce mechanism applies to elements and there is no such thing as a nonce on an attribute. A style element is not a script-injection vector, so none of this weakens the script protection. Run a strict CSP and the app still works.
 
 # What this lets us delete
 
diff --git a/blog/stop-ai-agents-breaking-your-code.md b/blog/stop-ai-agents-breaking-your-code.md
index 8d7112c3e..2e2d27a6c 100644
--- a/blog/stop-ai-agents-breaking-your-code.md
+++ b/blog/stop-ai-agents-breaking-your-code.md
@@ -84,7 +84,7 @@ The rules are the concrete failure modes an agent trips over. A few real ones:
 - `no-static-properties`, reactive properties are declared through the `WebComponent({ ... })` factory, not a hand-written `static properties` block that would throw at runtime.
 - `erasable-typescript-only`, the tsconfig must keep types strippable, because WebJs has no bundler to fall back on.
 - `shell-in-non-root-layout`, only the root layout may write `<!doctype>` / `<html>` / `<head>` / `<body>`.
-- `light-dom-css-prefix`, a light-DOM component with custom CSS prefixes every selector with its tag name.
+- `no-browser-globals-in-render`, a component's constructor and `render()` stay off browser globals, because both run on the server too and a `window` read there crashes the SSR pass.
 
 An agent runs `webjs check`, reads concrete violation messages, and fixes them before the code is anywhere near a review. The narrowness is deliberate. It is a short list of "this will break", not a hundred style opinions, so a green check actually means something.
 
diff --git a/blog/strip-types-not-esbuild.md b/blog/strip-types-not-esbuild.md
index 91d4cf555..ec392de1b 100644
--- a/blog/strip-types-not-esbuild.md
+++ b/blog/strip-types-not-esbuild.md
@@ -23,15 +23,18 @@ Worse, the assistant would sometimes read the generated JS instead of the source
 
 # What Node 24 changed
 
-Node 24 ships `module.stripTypeScriptTypes`. The dev server imports it directly:
+Node 24 ships `module.stripTypeScriptTypes`. The stripper reaches it through a namespace import rather than a named one:
 
 ```js
-import { createRequire, stripTypeScriptTypes } from 'node:module';
+import * as nodeModule from 'node:module';
+// nodeModule.stripTypeScriptTypes, or undefined on a runtime without it
 ```
 
+That detail is not stylistic. A named import of a builtin export that does not exist is a link-time SyntaxError, and it fires before any module body runs, so on an older Node that never shipped the API it would crash the import of the server package before the version preflight could report the real problem. A namespace import links on every runtime, leaves the property simply undefined where the builtin is absent, which is the case on Bun, and lets the choice happen at run time.
+
 It is a position-preserving type eraser. Take a `.ts` file, strip the types, and the output has every line at the same line number and every column at the same column. Where there used to be `let foo: number = 1`, there is now `let foo         = 1`. The whitespace shows up where the type annotation used to be. The semantics are identical to what the user wrote.
 
-The runtime backing is the `amaro` package, vendored into Node 24. If a future Node version stops shipping it, the framework needs to install `amaro` directly. The code path that handles this is gated on a feature-detection check at server start.
+The runtime backing is the `amaro` package, vendored into Node 24. WebJs also depends on `amaro` directly, as an optional dependency, which is what covers a runtime that ships no stripper of its own. Which of the two runs is decided by a feature-detection check at server start.
 
 What it gets you:
 
@@ -52,14 +55,16 @@ The work landed as PR #9 (merge `3c29d99`, branch `feat/replace-esbuild-with-str
 The cache shape is straightforward:
 
 ```ts
-const TS_CACHE = new Map();
 const TS_CACHE_MAX = 500;
+// state.tsCache, one Map per request handler
 // Entry: { mtimeMs, code, map: string | null }
 ```
 
-Capped at 500 entries to prevent unbounded memory growth in long-running production servers. Keyed by absolute path, invalidated when the file's mtime changes. First request through is on the order of a hundred microseconds per file. Subsequent requests are Map lookups.
+Capped at 500 entries to prevent unbounded memory growth in long-running production servers. Keyed by absolute path, invalidated when the file's mtime changes. First request through is on the order of a hundred microseconds per file. Subsequent requests are Map lookups. The Map hangs off the request handler rather than the module, because the cached bytes bake in that handler's elision verdict, so two handlers for the same app with different elision settings must not share one.
+
+There is no fallback for a file that uses non-erasable syntax. Stripping throws and the server returns a clean 500, and that is the entire error path. In dev the response names the offending construct and points at the rule; in production it stays terse on purpose, so no path leaks to a visitor, and the detail goes to the server log instead. Nothing regenerates the code through a bundler, which is what keeps the guarantee worth having: the file on disk is the file that runs, with no second code path where that stops being true. Two `webjs check` rules catch the problem at edit time instead, `erasable-typescript-only` on the tsconfig flag and `no-non-erasable-typescript` on the source itself.
 
-For the rare case where a file uses non-erasable syntax, the server falls back to `esbuild.transform`. The fallback path is triggered specifically when the primary path throws `ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX`. esbuild emits an inline sourcemap so DevTools can still resolve source positions for the regenerated JS. Mostly fires for third-party `.ts` files; user code is enforced erasable by `webjs check`'s `erasable-typescript-only` rule.
+What does vary is the backend doing the stripping. On Node it is the built-in `module.stripTypeScriptTypes`. On Bun, which has no such built-in, it is `amaro`, and since Node's built-in is itself a thin wrapper over `amaro`'s `strip-only` mode, both runtimes produce byte-identical output with the same position preservation.
 
 
 # What this enabled downstream
diff --git a/examples/blog/CONVENTIONS.md b/examples/blog/CONVENTIONS.md
index cfe763e12..f77ce5203 100644
--- a/examples/blog/CONVENTIONS.md
+++ b/examples/blog/CONVENTIONS.md
@@ -18,8 +18,8 @@ agents), not a hard gate. Customize any of them; sections marked
 `<!-- OVERRIDE -->` are explicit customization points.
 
 `webjs check` is a separate, narrower tool: **correctness checks** that
-catch objectively broken code (a crash, a security leak, a build or
-type-strip failure). Those always run, there is no per-project
+catch objectively broken code (a crash, a security leak, a reactive prop
+that silently stops re-rendering, a build or type-strip failure). Those always run, there is no per-project
 disabling, and they are not listed here (run `webjs check --rules` to
 see them). The line between the two: *could a sensible app legitimately
 want this to pass?* If yes, it is a convention (this file); if no, it is
diff --git a/packages/cli/bin/webjs.js b/packages/cli/bin/webjs.js
index 719e98357..19a1cfbf6 100755
--- a/packages/cli/bin/webjs.js
+++ b/packages/cli/bin/webjs.js
@@ -655,7 +655,8 @@ async function main() {
       if (rest.includes('--rules')) {
         console.log('webjs check, correctness rules:');
         console.log('  Every rule catches code that is wrong to ship: a crash, a');
-        console.log('  security leak, or a build/type-strip failure. They always');
+        console.log('  security leak, a reactive prop that silently stops');
+        console.log('  re-rendering, or a build/type-strip failure. They always');
         console.log('  run. Project conventions (layout, style, process) are');
         console.log('  guidance in CONVENTIONS.md, not rules here.\n');
         for (const r of RULES) {
diff --git a/packages/cli/lib/api-gallery.js b/packages/cli/lib/api-gallery.js
index 3172c7df2..468de0b53 100644
--- a/packages/cli/lib/api-gallery.js
+++ b/packages/cli/lib/api-gallery.js
@@ -13,8 +13,7 @@ import { join } from 'node:path';
 /**
  * Write the api backend-features gallery into `<appDir>/app/api/features/**`
  * plus a boot-time env-validation example at `app/env.ts`. Each demo carries a
- * `webjs-scaffold-placeholder` marker so `webjs check` fails until it is
- * pruned or adapted.
+ * comment naming exactly what to delete when it is pruned.
  * @param {string} appDir
  */
 export async function writeApiGallery(appDir) {
@@ -35,7 +34,7 @@ export async function writeApiGallery(appDir) {
   ].join('\n'));
   await mkdir(feat('validate'), { recursive: true });
   await writeFile(feat('validate', 'route.ts'), [
-    "// webjs-scaffold-placeholder. API backend-features demo. Keep and adapt it, or prune it (delete this app/api/features/validate route AND modules/widgets), then delete this marker line. webjs check fails while the marker remains.",
+    "// API backend-features demo. Keep and adapt it, or prune it (delete this app/api/features/validate route AND modules/widgets).",
     "// route() turns a 'use server' action into a REST endpoint: it merges the URL",
     "// query, route params, and JSON body into one input, runs `validate` at the",
     "// boundary (a { success:false, fieldErrors } return is a 422, no action call),",
@@ -76,7 +75,7 @@ export async function writeApiGallery(appDir) {
     "",
   ].join('\n'));
   await writeFile(feat('rate-limit', 'route.ts'), [
-    "// webjs-scaffold-placeholder. API backend-features demo. Keep and adapt it, or prune it (delete this app/api/features/rate-limit route), then delete this marker line. webjs check fails while the marker remains.",
+    "// API backend-features demo. Keep and adapt it, or prune it (delete this app/api/features/rate-limit route).",
     "// The middleware.ts beside this file stamps X-RateLimit-* headers and returns",
     "// a 429 with Retry-After once the window is exhausted, so this handler never",
     "// runs on a limited request. Call it six times in ten seconds to see the 429.",
@@ -89,7 +88,7 @@ export async function writeApiGallery(appDir) {
   // 3) Streaming response (chunks flushed as produced, no buffering).
   await mkdir(feat('stream'), { recursive: true });
   await writeFile(feat('stream', 'route.ts'), [
-    "// webjs-scaffold-placeholder. API backend-features demo. Keep and adapt it, or prune it (delete this app/api/features/stream route), then delete this marker line. webjs check fails while the marker remains.",
+    "// API backend-features demo. Keep and adapt it, or prune it (delete this app/api/features/stream route).",
     "// Streams JSON-per-line chunks as they are produced, so a slow or large",
     "// result is delivered incrementally instead of buffered whole. A hand-written",
     "// route.ts returns a ReadableStream for full control. Served as text/plain so",
@@ -115,7 +114,7 @@ export async function writeApiGallery(appDir) {
   // 4) File storage (upload + serve), both hand-written route.ts.
   await mkdir(feat('files', '[key]'), { recursive: true });
   await writeFile(feat('files', 'route.ts'), [
-    "// webjs-scaffold-placeholder. API backend-features demo. Keep and adapt it, or prune it (delete this app/api/features/files route), then delete this marker line. webjs check fails while the marker remains.",
+    "// API backend-features demo. Keep and adapt it, or prune it (delete this app/api/features/files route).",
     "// POST a multipart file: the bytes stream into the FileStore (a local",
     "// .webjs/uploads dir by default, gitignored; swap for S3/R2 with one",
     "// setFileStore() call). Returns the key + a URL served by [key]/route.ts.",
@@ -166,7 +165,7 @@ export async function writeApiGallery(appDir) {
   // 5) WebSocket endpoint with broadcast fan-out.
   await mkdir(feat('ws'), { recursive: true });
   await writeFile(feat('ws', 'route.ts'), [
-    "// webjs-scaffold-placeholder. API backend-features demo. Keep and adapt it, or prune it (delete this app/api/features/ws route), then delete this marker line. webjs check fails while the marker remains.",
+    "// API backend-features demo. Keep and adapt it, or prune it (delete this app/api/features/ws route).",
     "// A WebSocket endpoint: exporting WS(ws, req) upgrades this route to a socket.",
     "// The framework auto-registers each connection to its path, so broadcast()",
     "// fans a message out to every connected client. Connect two clients to",
diff --git a/packages/cli/templates/gallery/app/features/route-handler/data/route.ts b/packages/cli/templates/gallery/app/features/route-handler/data/route.ts
index a47cd1231..773031f04 100644
--- a/packages/cli/templates/gallery/app/features/route-handler/data/route.ts
+++ b/packages/cli/templates/gallery/app/features/route-handler/data/route.ts
@@ -24,7 +24,8 @@ export async function GET(req: Request) {
     // not a cookie, so do not read it here.
     cookieCount: cookies().entries().length,
     // cspNonce() reads the request's CSP nonce ('' with CSP off). Server-side
-    // you use it to nonce a server-rendered inline <script>/<style> under CSP.
+    // you use it to nonce a server-rendered inline <script> under CSP (a <style>
+    // only needs it if you tighten style-src, which by default allows inline).
     hasNonce: cspNonce().length > 0,
   });
 }
diff --git a/packages/cli/templates/gallery/app/features/view-transitions/page.ts b/packages/cli/templates/gallery/app/features/view-transitions/page.ts
index 836ab122f..7e6bc06c3 100644
--- a/packages/cli/templates/gallery/app/features/view-transitions/page.ts
+++ b/packages/cli/templates/gallery/app/features/view-transitions/page.ts
@@ -22,7 +22,7 @@ export default function ViewTransitionsExample() {
     ${pageHeading('View transitions')}
     <div class="rounded-2xl bg-primary/10 border border-primary/30 p-6 mb-6">
       <p class="text-foreground m-0">Page one. Navigate to page two: with the
-        <code class="font-mono">&lt;meta name="view-transition"&gt;</code> opt-in,
+        <code class="font-mono">&lt;meta name="view-transition" content="same-origin"&gt;</code> opt-in,
         the swap cross-fades.</p>
     </div>
     <label class="block mb-6">
diff --git a/packages/cli/templates/gallery/app/global-error.ts b/packages/cli/templates/gallery/app/global-error.ts
index 3e46e3433..8126030fa 100644
--- a/packages/cli/templates/gallery/app/global-error.ts
+++ b/packages/cli/templates/gallery/app/global-error.ts
@@ -5,8 +5,9 @@
 // returned verbatim with NO framework <head> splice, so it ships no importmap
 // and no boot script. Keep it static HTML with no components or hydration: a
 // last-resort page must not depend on the module system that may have just
-// failed. (Under an opt-in CSP, any inline <style>/<script> here needs a nonce
-// via cspNonce() from @webjsdev/server.)
+// failed. (Under an opt-in CSP, an inline <script> here needs a nonce via
+// cspNonce() from @webjsdev/core. An inline <style> only needs one if you
+// tighten style-src, since the default policy allows inline style outright.)
 //
 // Distinct from error.ts (a nested, per-segment boundary that renders a body
 // fragment the framework wraps) and from global-not-found.ts (the unmatched-URL
@@ -17,8 +18,10 @@ export default function GlobalError({ error }: { error: Error }) {
   const message = process.env.NODE_ENV === 'production'
     ? 'Something went wrong. Please try again.'
     : error?.message || 'Unknown error';
-  // cspNonce() is '' with CSP off (the default), so this is safe as-is; under an
-  // opt-in CSP it carries the per-request nonce so the inline <style> is allowed.
+  // cspNonce() is '' with CSP off (the default), so this is safe as-is. Under the
+  // default opt-in policy the inline <style> is allowed by 'unsafe-inline' rather
+  // than by this nonce, which is stamped so the page still works if you tighten
+  // style-src to a nonce source.
   return html`<!doctype html>
     <html lang="en">
       <head>
diff --git a/packages/server/src/check.js b/packages/server/src/check.js
index 69e3bb01b..dcaa3272e 100644
--- a/packages/server/src/check.js
+++ b/packages/server/src/check.js
@@ -525,8 +525,9 @@ function importedValueNames(clause) {
 /**
  * Scan a WebJs app directory and report convention violations.
  *
- * Every rule is a correctness check (a crash, a security leak, or a
- * build/type-strip failure), so they all run unconditionally. There is no
+ * Every rule is a correctness check (a crash, a security leak, a reactive
+ * prop that silently stops re-rendering, or a build/type-strip failure), so
+ * they all run unconditionally. There is no
  * per-project disabling: project conventions (layout, style, process) live in
  * CONVENTIONS.md as guidance, not in this tool.
  *
diff --git a/packages/server/src/csp.js b/packages/server/src/csp.js
index e3b7a1929..c6400f47f 100644
--- a/packages/server/src/csp.js
+++ b/packages/server/src/csp.js
@@ -50,8 +50,9 @@ const CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/;
  * with webjs's own output, which is: nonce-signed inline `<script>` tags
  * (the boot script, the public-env shim, the importmap), nonce-signed
  * `<link rel="modulepreload">`, ES modules fetched same-origin and from
- * the configured vendor CDN, and Tailwind's runtime which injects a
- * `<style>` element (so inline styles must be allowed).
+ * the configured vendor CDN, and one inline `<style>` in the head. The
+ * nonce covers scripts only, so that rule and every app-authored style
+ * alike are admitted by `'unsafe-inline'` (see the `style-src` note).
  *
  * `script-src` uses `'strict-dynamic'` so a nonce-loaded module can pull
  * in its own dependencies (the importmap-driven per-file ESM graph)
@@ -67,10 +68,25 @@ const CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/;
 const DEFAULT_DIRECTIVES = {
   'default-src': "'self'",
   'script-src': "'nonce-__NONCE__' 'strict-dynamic' 'self' https:",
-  // Tailwind's browser runtime injects a <style> element, and webjs
-  // emits an inline <style> for adopted component styles, so inline
-  // styles must be permitted. Style elements are not a script-injection
-  // vector, so this does not weaken the script protection.
+  // NOTE this directive carries no nonce source, unlike `script-src`, so a
+  // nonce attribute on a <style> is INERT here and every inline style is
+  // admitted by 'unsafe-inline' alone. That includes WebJs's own head rule
+  // (the @layer webjs-host block), which SSR does stamp with the nonce but
+  // which this policy never checks it against. Dropping 'unsafe-inline'
+  // would block that rule too, not only app style.
+  //
+  // What keeps the allowance necessary is inline style with no realistic
+  // nonce path, and it arrives in four shapes. A page or layout may write
+  // an inline <style>, which an author could nonce by hand but does not by
+  // default. A light-DOM component's <style> and a shadow component's
+  // `static styles`, serialized into its declarative shadow root, are both
+  // emitted by the core renderer with no nonce and no way to supply one.
+  // And every style="..." attribute is unfixable in principle, since a
+  // nonce applies to elements and never to attributes. No styling library
+  // is involved in any of them.
+  //
+  // Style elements are not a script-injection vector, so this does not
+  // weaken the script protection.
   'style-src': "'self' 'unsafe-inline'",
   'img-src': "'self' data: https:",
   'font-src': "'self' data: https:",
diff --git a/test/scaffolds/scaffold-gallery.test.js b/test/scaffolds/scaffold-gallery.test.js
index e608c5968..d80bad5b3 100644
--- a/test/scaffolds/scaffold-gallery.test.js
+++ b/test/scaffolds/scaffold-gallery.test.js
@@ -334,6 +334,28 @@ test('the api template ships the backend-features showcase, not the UI gallery',
   }
 });
 
+/*
+ * The full-stack gallery is asserted marker-free above, but nothing covered the
+ * api showcase, which is how it kept shipping `webjs-scaffold-placeholder` (and
+ * a comment claiming `webjs check` fails on it) for every generated api app long
+ * after that rule was retired. The token names a check rule that does not exist,
+ * so a developer grepping for it finds nothing to satisfy.
+ */
+test('no api showcase route carries a scaffold-placeholder marker (gate retired)', async () => {
+  const cwd = await tempCwd();
+  try {
+    await scaffoldApp('demo', cwd, { template: 'api' });
+    const appDir = join(cwd, 'demo');
+    for (const name of ['validate', 'rate-limit', 'stream', 'files', 'ws']) {
+      const src = await readFile(join(appDir, 'app', 'api', 'features', name, 'route.ts'), 'utf8');
+      assert.doesNotMatch(src, /webjs-scaffold-placeholder/, `app/api/features/${name} has no marker`);
+      assert.doesNotMatch(src, /webjs check fails/, `app/api/features/${name} claims no retired gate`);
+    }
+  } finally {
+    await rm(cwd, { recursive: true, force: true });
+  }
+});
+
 test('the api gallery:clear sheds the showcase to a health + users base', async () => {
   const cwd = await tempCwd();
   try {
diff --git a/website/app/docs/configuration/page.ts b/website/app/docs/configuration/page.ts
index fd261fafb..ea636159c 100644
--- a/website/app/docs/configuration/page.ts
+++ b/website/app/docs/configuration/page.ts
@@ -99,7 +99,7 @@ webjs routes --help     # one command's help (flag form)</code-block>
     </ul>
 
     <h2>webjs check: correctness, not config</h2>
-    <p><code>webjs check</code> runs a fixed set of correctness checks (a crash, a security leak, a build or type-strip failure). They always run; there is no project-level config to disable them, and the checks read no <code>package.json</code> config block of their own. Project <em>conventions</em> (layout, naming, testing) are guidance in the shipped skill (<code>.agents/skills/webjs/SKILL.md</code>) and <code>AGENTS.md</code>, not a tool. See <a href="/docs/conventions">Conventions &amp; AI Workflow</a> for the split and run <code>webjs check --rules</code> to list the checks.</p>
+    <p><code>webjs check</code> runs a fixed set of correctness checks (a crash, a security leak, a reactive prop that silently stops re-rendering, a build or type-strip failure). They always run; there is no project-level config to disable them, and the checks read no <code>package.json</code> config block of their own. Project <em>conventions</em> (layout, naming, testing) are guidance in the shipped skill (<code>.agents/skills/webjs/SKILL.md</code>) and <code>AGENTS.md</code>, not a tool. See <a href="/docs/conventions">Conventions &amp; AI Workflow</a> for the split and run <code>webjs check --rules</code> to list the checks.</p>
 
     <h2>Security response headers</h2>
     <p>WebJs sets standard security headers on every response by default (<code>X-Content-Type-Options</code>, <code>X-Frame-Options</code>, <code>Referrer-Policy</code>, <code>Permissions-Policy</code>, plus <code>Strict-Transport-Security</code> in production over HTTPS). Override or extend them per path with a <code>webjs.headers</code> block in <code>package.json</code>, an array of <code>&#123; source, headers: [&#123; key, value &#125;] &#125;</code> rules where <code>source</code> is a URLPattern path pattern and a <code>null</code> value removes a default. App middleware wins over the path config, which wins over the defaults. A <code>webjs.csp</code> key (off by default) additionally mints a per-request CSP nonce and emits a matching <code>Content-Security-Policy</code> header. See <a href="/docs/deployment">Deployment &rarr; Secure response headers</a> for the full reference.</p>
diff --git a/website/app/docs/deployment/page.ts b/website/app/docs/deployment/page.ts
index ce2851b97..5fd3233da 100644
--- a/website/app/docs/deployment/page.ts
+++ b/website/app/docs/deployment/page.ts
@@ -79,7 +79,7 @@ npm run start -- --port 8080</code-block>
     <code-block>&#123;
   "webjs": &#123; "csp": true &#125;
 &#125;</code-block>
-    <p><code>true</code> turns on a strict-by-default policy: <code>script-src 'nonce-&lt;minted&gt;' 'strict-dynamic' 'self' https:</code> plus <code>default-src 'self'</code>, <code>object-src 'none'</code>, <code>frame-ancestors 'self'</code>, and an inline-style allowance. That last one is there for the styles your app puts in the document, which do not carry a nonce: a light-DOM component's <code>&lt;style&gt;</code> block in <code>render()</code>, a shadow component's <code>static styles</code>, an inline <code>&lt;style&gt;</code> written by a page or layout, and <code>style="…"</code> attributes, which no nonce can reach at all since nonces apply to elements rather than attributes. The framework's own head style rule carries the nonce. On every request the framework mints a CSPRNG nonce (16 random bytes, base64), stamps it on every inline <code>&lt;script&gt;</code>, the importmap, and the <code>modulepreload</code> hints it emits (the same value <code>cspNonce()</code> returns during SSR), and sets the header carrying that exact nonce. The nonce on the header and the nonce on the scripts are one minted value, so there is no drift, and it changes every request.</p>
+    <p><code>true</code> turns on a strict-by-default policy: <code>script-src 'nonce-&lt;minted&gt;' 'strict-dynamic' 'self' https:</code> plus <code>default-src 'self'</code>, <code>object-src 'none'</code>, <code>frame-ancestors 'self'</code>, and an inline-style allowance. That last one is needed because <code>style-src</code> carries no nonce source at all, so every inline style is admitted by <code>'unsafe-inline'</code>, the framework's own head rule included. What keeps it hard to give up is the style your app puts in the document: a light-DOM component's <code>&lt;style&gt;</code> block in <code>render()</code>, a shadow component's <code>static styles</code>, an inline <code>&lt;style&gt;</code> written by a page or layout, and <code>style="…"</code> attributes, which no nonce could reach even if the directive honoured one, since nonces apply to elements rather than attributes. On every request the framework mints a CSPRNG nonce (16 random bytes, base64), stamps it on every inline <code>&lt;script&gt;</code>, the importmap, and the <code>modulepreload</code> hints it emits (the same value <code>cspNonce()</code> returns during SSR), and sets the header carrying that exact nonce. The nonce on the header and the nonce on the scripts are one minted value, so there is no drift, and it changes every request.</p>
     <p>For a custom policy, give an object. <code>directives</code> is merged over the strict defaults (override one directive without restating the rest; a <code>null</code> value drops a default directive), and <code>reportOnly: true</code> emits <code>Content-Security-Policy-Report-Only</code> for a staged rollout:</p>
     <code-block>&#123;
   "webjs": &#123;
diff --git a/website/app/docs/error-handling/page.ts b/website/app/docs/error-handling/page.ts
index 846ae54ba..16f616945 100644
--- a/website/app/docs/error-handling/page.ts
+++ b/website/app/docs/error-handling/page.ts
@@ -101,7 +101,7 @@ export default function GlobalError({ error }: { error: Error }) {
   ${'`'};
 }</code-block>
 
-    <p>Keep <code>global-error.ts</code> static (no components / hydration): it is returned verbatim with no importmap or boot script, so it must not depend on the module system that may have just failed. Under an opt-in CSP, give any inline <code>&lt;style&gt;</code> the <code>cspNonce()</code>.</p>
+    <p>Keep <code>global-error.ts</code> static (no components / hydration): it is returned verbatim with no importmap or boot script, so it must not depend on the module system that may have just failed. Under an opt-in CSP, give any inline <code>&lt;script&gt;</code> the <code>cspNonce()</code>. An inline <code>&lt;style&gt;</code> needs one only if you tighten <code>style-src</code>, since the default policy allows inline style outright.</p>
 
     <p><code>global-not-found.ts</code> renders for a URL that matches nothing anywhere, when no <code>not-found.ts</code> applies.</p>