diff --git a/.env b/.env
index 34740107..ee0e1f9a 100644
--- a/.env
+++ b/.env
@@ -21,12 +21,6 @@ VITE_SAHAJCLOUD_URL="https://cloud.sydevelopers.com"
 # #130. Set them on every Workers Builds trigger that builds the app; the runbook is in
 # docs/environment.md.
 
-# Cloudflare Turnstile site key for the report-issue form. A SITE key is public by
-# design (the secret half lives in SahajCloud), so it belongs here rather than in
-# .env.local. This is Cloudflare's always-passes TEST key — dev, Ladle and CI use it;
-# production overrides it with the real key as a BUILD variable on its Workers Builds
-# trigger, and a production build fails if it does not (#259, docs/environment.md).
-VITE_TURNSTILE_SITE_KEY="1x00000000000000000000AA"
 
 # Where a FRAMED embed sends a visitor when its frame is too small for the interface (#161).
 # A frame cannot expand — `position: fixed` resolves against the frame — so the compact card's
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5e55bd12..0e7268e3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -44,6 +44,20 @@ cover everything a host would notice since the widget was first deployed.
 
 ### Changed
 
+- ⚠ **BREAKING: your CSP needs `frame-src https://cloud.sydevelopers.com`, and the three
+  `challenges.cloudflare.com` entries can go.** ([#343], [SahajCloud#1072]) The captcha that
+  gates every form now renders in a small frame `cloud.sydevelopers.com` serves — the origin
+  already in your `connect-src` — instead of in your document. A policy that does not allow the
+  frame shows the error screen, and the console names the fix.
+
+  ⚠ **The captcha renders only on a domain your client record lists** — the same list that
+  already gates the API. Any other domain shows the error screen. An iframe embed needs nothing
+  listed: there the challenge's parent is the widget's own page.
+
+  **Onboarding a site needs no Turnstile step**: Turnstile checks the hostname of the document
+  that renders the challenge, which is now always `cloud.sydevelopers.com`. No script of
+  Cloudflare's runs in your document, and your `Permissions-Policy` needs nothing for the captcha.
+
 - **A repeat embed report turns into at most one write in any 6 h window.** ([#160]) The widget
   still reports on every page load, and an unchanged report inside that window is answered
   without a write. This guide and the embedding guide had both published the window as one hour.
@@ -844,6 +858,8 @@ must-revalidate`, pinned rather than left to the CDN default. The production dom
 [#312]: https://github.com/sydevs/SahajAtlasWeb/pull/312
 [#320]: https://github.com/sydevs/SahajAtlasWeb/issues/320
 [#326]: https://github.com/sydevs/SahajAtlasWeb/issues/326
+[#343]: https://github.com/sydevs/SahajAtlasWeb/issues/343
+[SahajCloud#1072]: https://github.com/sydevs/SahajCloud/issues/1072
 [#322]: https://github.com/sydevs/SahajAtlasWeb/issues/322
 [#329]: https://github.com/sydevs/SahajAtlasWeb/pull/329
 [#325]: https://github.com/sydevs/SahajAtlasWeb/issues/325
diff --git a/README.md b/README.md
index 6480be5e..a56f5b5b 100644
--- a/README.md
+++ b/README.md
@@ -101,7 +101,9 @@ SahajCloud's:
 - **`react-circle-flags.pages.dev`** serves the country flag SVGs
   (`referrer-policy: no-referrer`). **`challenges.cloudflare.com`** loads
   Turnstile as soon as the interface mounts, not when a visitor opens a form
-  (#182). Both are in the CSP table in
+  (#182) — from a challenge page SahajCloud serves, not from the host's page
+  (#343), so the host allows that page under `frame-src` instead. Both are in
+  the CSP table in
   [`docs/embedding.md`](docs/embedding.md#content-security-policy).
 
 None of these has a script-URL opt-out (#149) — each is built so it does not
diff --git a/docs/embedding.md b/docs/embedding.md
index 0ee41d76..877b5292 100644
--- a/docs/embedding.md
+++ b/docs/embedding.md
@@ -239,6 +239,7 @@ Some things are **not** parameters, on purpose:
 | ---------------------------------- | ---------------------------------------------------------------------- |
 | Display name, brand colours        | your client record                                                     |
 | The path prefix for `routing=path` | your client record — the same value your canonical URLs are built from |
+| The domains you embed on           | your client record — the API refuses reads from anywhere else, and the captcha renders nowhere else |
 
 Identity is the same on every page you embed on, so making it per-embed only risks two of your
 pages disagreeing about what the product is called. The routing prefix is worse than merely
@@ -793,15 +794,21 @@ and `cloud.sydevelopers.com` is in `connect-src` already, for the widget's own r
 If your page sends a CSP, this is what the widget needs added to it. **It is a list of
 additions to your policy, not a policy** — your own sources still have to be in there.
 
+**The captcha needs nothing of yours but a listed domain.** Every form in the widget is behind a
+Cloudflare Turnstile challenge that `cloud.sydevelopers.com` serves, renders and validates, so it
+needs no key or account of yours. It renders only on a domain your client record lists ([What you
+configure in the CMS instead](#what-you-configure-in-the-cms-instead)) — tell us every domain you
+embed on — and the `frame-src` line below is your policy's whole part.
+
 ```
-script-src  https://sahajatlas.com https://api.mapbox.com https://challenges.cloudflare.com https://cdn.usefathom.com
+script-src  https://sahajatlas.com https://api.mapbox.com https://cdn.usefathom.com
 worker-src  blob:
 child-src   blob:
 style-src   'unsafe-inline'
 font-src    https://sahajatlas.com
 img-src     data: https://api.mapbox.com https://imagedelivery.net https://cloud.sydevelopers.com https://react-circle-flags.pages.dev
-connect-src https://cloud.sydevelopers.com https://api.mapbox.com https://events.mapbox.com https://ipwho.is https://challenges.cloudflare.com https://cdn.usefathom.com https://*.sentry.io
-frame-src   https://challenges.cloudflare.com
+connect-src https://cloud.sydevelopers.com https://api.mapbox.com https://events.mapbox.com https://ipwho.is https://cdn.usefathom.com https://*.sentry.io
+frame-src   https://cloud.sydevelopers.com
 ```
 
 **One line per directive, deliberately: CSP ignores every repeat of a directive name after the
@@ -814,7 +821,6 @@ believing you allowed something you hadn't.
 | -------------------------- | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `script-src`               | the widget's origin                           | The `<script>` tag fetches a small entry that pulls the rest of the bundle from the same origin. It also pulls the calendar, registration and share panels, but only once a viewer opens them.                                                                                                                                                                                                                                                                                        | nothing renders — or worse, it renders and then dies on one of those three presses                                                                                                                            |
 |                            | `api.mapbox.com`                              | Mapbox GL's right-to-left text plugin, loaded on demand from inside the map's worker on first RTL text. Workers inherit the document's policy, so this lands on `script-src` rather than `worker-src`.                                                                                                                                                                                                                                                                                | Arabic, Hebrew and Persian labels on the map render in the wrong order                                                                                                                                        |
-|                            | `challenges.cloudflare.com`                   | **Turnstile — required.** Every write the widget makes is captcha-gated, so registration is impossible without it. Loaded as soon as the interface mounts, so a policy that omits it fails immediately rather than at the moment somebody registers.                                                                                                                                                                                                                                  | **the widget shows an error screen and does not run.** Not a degradation — see the note below                                                                                                                 |
 |                            | `cdn.usefathom.com`                           | analytics, only on a build with an analytics ID                                                                                                                                                                                                                                                                                                                                                                                                                                       | analytics only                                                                                                                                                                                                |
 | `worker-src` / `child-src` | `blob:`                                       | Mapbox GL compiles its worker bundle into a `Blob` and starts a module Worker from the resulting `blob:` URL. `child-src` is the fallback for engines predating `worker-src`.                                                                                                                                                                                                                                                                                                         | **the map fails**, the rest of the widget is unaffected                                                                                                                                                       |
 | `style-src`                | `'unsafe-inline'`                             | **Narrower than its name suggests.** The widget's own stylesheet is a constructed `CSSStyleSheet` adopted by its shadow root, which `style-src` does not reach on the one engine that was measured. What the directive governs is the `<style>` elements the widget and its libraries still install at runtime — the `@font-face` rules in your `<head>`, and the place-search field's own stylesheet — plus the `style` attributes they set, which the note below covers separately. | the interface renders, fully styled. You lose the typeface — as the `font-src` row below — and place search, whose library reads back the stylesheet it just installed and throws when the browser refuses it |
@@ -827,45 +833,20 @@ believing you allowed something you hadn't.
 |                            | `api.mapbox.com`                              | tile and style requests. Also the place-search geocoder, and the reverse lookup naming the visitor's own location for "find my location".                                                                                                                                                                                                                                                                                                                                             | the map and search fail                                                                                                                                                                                       |
 |                            | `events.mapbox.com`                           | Mapbox GL's own map-load telemetry                                                                                                                                                                                                                                                                                                                                                                                                                                                    | nothing visible                                                                                                                                                                                               |
 |                            | `ipwho.is`                                    | the once-per-session IP→city lookup behind "classes near you"                                                                                                                                                                                                                                                                                                                                                                                                                         | **degrades**: the nearby suggestion is skipped                                                                                                                                                                |
-|                            | `challenges.cloudflare.com`                   | Turnstile's own verification calls                                                                                                                                                                                                                                                                                                                                                                                                                                                    | **as `script-src` above — the widget does not run**                                                                                                                                                           |
 |                            | `cdn.usefathom.com`                           | analytics, conditional as above                                                                                                                                                                                                                                                                                                                                                                                                                                                       | analytics only                                                                                                                                                                                                |
 |                            | `*.sentry.io`                                 | crash reporting. Contacted **only after the widget has already failed**, and only on a build with a DSN.                                                                                                                                                                                                                                                                                                                                                                              | **degrades**: the widget notices the refusal and stops trying for the rest of the page's life                                                                                                                 |
-| `frame-src`                | `challenges.cloudflare.com`                   | the Turnstile challenge iframe                                                                                                                                                                                                                                                                                                                                                                                                                                                        | **the challenge cannot be solved, so no form can be sent**                                                                                                                                                    |
+| `frame-src`                | `cloud.sydevelopers.com`                      | **The captcha — required.** Every write the widget makes is captcha-gated. The challenge renders in a frame `cloud.sydevelopers.com` serves, so `challenges.cloudflare.com` belongs in no directive of yours. The frame mounts with the interface, so a policy that omits this fails within seconds rather than when somebody registers.                                                                                                                                              | **the widget shows an error screen and does not run.** Not a degradation — see the note below                                                                                                                 |
 
 Notes on that table:
 
-**A challenge SOLVES on this exact policy, with no `'unsafe-eval'` in it.** A forced interactive
-challenge was clicked through in the widget's own report-issue form, in a built `map=false` embed
-and a host page served from one origin with the block above sent as a response header: the
-challenge reached its success state, the widget took the token, and the form's Submit went from
-disabled to enabled. Six runs of six in Chromium 141.0.7390.37, 2026-10-11 — three on the policy
-verbatim, three with `'unsafe-eval'` added to `script-src`, identical in both. **Do not add
-`'unsafe-eval'`.** The challenge runs inside the `challenges.cloudflare.com` frame, a separate
-document that sends its own `script-src 'nonce-…' 'unsafe-eval'`, so `frame-src` above is the
-only directive of yours that governs it at all — which is why Cloudflare's own CSP guidance for
-Turnstile asks for `challenges.cloudflare.com` under `script-src` and `frame-src`, and for
-nothing else.
-
-⚠ **The refused `eval` is not something every page view produces, and a page showing it has not
-been watched solve.** It was observed 3 times in 3 on 2026-10-10 — Chromium 141, a built
-`map=false` embed, this policy — as `Refused to evaluate a string as JavaScript because
-'unsafe-eval' is not an allowed source of script`, reported against `script-src` with a blocked
-URI of `eval`, carrying no source file and no stack, the signature of a cross-origin script —
-Turnstile's `api.js`, which does run in your document and which your `script-src` does govern.
-The widget rendered, routed and read its data normally in all three. Cloudflare ships that script
-continuously, and on 2026-10-11 it did not occur in any run: nine in the widget's own embed —
-three on the policy verbatim, three with `'unsafe-eval'` added, three on the 2026-10-10
-always-passes setup — and six more on an isolated `api.js` page. So the solve above was measured
-in its absence, not alongside it. Harmless where it has appeared, then, and normal where it has
-not. A refusal _beside_ a challenge that will not solve is the one combination nobody has seen:
-tell us if you do.
-
-⚠ **Three further things the 2026-10-11 runs did not cover.** The site key was Cloudflare's
-`3x00000000000000000000FF`, which forces the real interactive challenge, rather than the
-production key — the always-passes key short-circuits before any challenge code and can answer
-nothing here, which is why it is not what was used. Nothing was posted to the backend, so the
-measurement ends at the token rather than at an accepted submission. And map mode was not
-measured, for want of a Mapbox token, as on 2026-10-10.
+**Do not add `'unsafe-eval'` or `challenges.cloudflare.com`.** The challenge page on
+`cloud.sydevelopers.com` loads Turnstile's `api.js` under its own policy, so your `frame-src`
+above is the only directive of yours that reaches any of it.
+
+⚠ **The challenge page has not yet been watched solving in a browser.** The same protocol solved
+on this policy in Chromium 141 on 2026-10-11, when the challenge rendered in the host's document,
+but no measurement has gone past the token to an accepted submission, or covered map mode. Tell us
+if a challenge will not solve on this policy.
 
 **The `style-src` row was measured, not deduced** — Chromium 141, 2026-10-10, against a
 `map=false` embed served with the policy above and `'unsafe-inline'` removed from `style-src`
@@ -910,13 +891,13 @@ latches off after the first refusal rather than retrying.
 **Five entries are load-bearing. The rest cost only the feature in their own row.** If you allow
 nothing else, allow these — each breaks the widget as a whole:
 
-|                                        |                                     |
-| -------------------------------------- | ----------------------------------- |
-| `script-src` the widget's origin       | nothing renders                     |
-| `script-src challenges.cloudflare.com` | the widget shows an error and stops |
-| `connect-src cloud.sydevelopers.com`   | no data at all                      |
-| `worker-src blob:`                     | the map never renders               |
-| `img-src data:`                        | the map renders with no pins        |
+|                                      |                                     |
+| ------------------------------------ | ----------------------------------- |
+| `script-src` the widget's origin     | nothing renders                     |
+| `frame-src cloud.sydevelopers.com`   | the widget shows an error and stops |
+| `connect-src cloud.sydevelopers.com` | no data at all                      |
+| `worker-src blob:`                   | the map never renders               |
+| `img-src data:`                      | the map renders with no pins        |
 
 ⚠ **`style-src 'unsafe-inline'` was on that list and has left it.** It was there on the strength
 of a consequence measured before the widget moved into a shadow root, when the stylesheet really
@@ -925,18 +906,13 @@ what of — on Chromium, which is the only engine that degradation was measured
 it: a visitor who gets your typeface and no place search is still worse off. But do not trade a
 load-bearing entry away to afford it.
 
-⚠ **`challenges.cloudflare.com` moved into that list, and it is the one change here that can
-break a page which used to work.** It was previously a degradation: a host that blocked it got a
-working atlas whose report form offered an email address instead of a submit button. It is now
-fatal, deliberately — **every write the widget makes is captcha-gated, registration included, and
-registration is the thing the atlas exists for.** A blocked challenge meant a visitor could browse
-classes and then silently fail to sign up for one, with no reason for the page owner to suspect
-anything was wrong. Failing loudly is worse for five minutes and better thereafter.
-
-If your atlas has stopped working since this change, this is almost certainly why: add
-`https://challenges.cloudflare.com` to **both** `script-src` and `frame-src`, and to
-`connect-src`. The widget also writes the specific directive it needs to the browser console, so
-a developer looking at the page gets the answer without opening this document.
+⚠ **The captcha entry is fatal on purpose.** **Every write the widget makes is captcha-gated,
+registration included, and registration is the thing the atlas exists for.** A degraded challenge
+would let a visitor browse classes and then silently fail to sign up for one, with no reason for
+the page owner to suspect anything was wrong. Failing loudly is worse for five minutes and better
+thereafter. The widget writes both possible fixes to the browser console — this directive, or the
+domain to have listed on your client record — so a developer looking at the page gets the answer
+without opening this document.
 
 Everything else degrades to exactly what its "Blocked ⇒" column says — a missing typeface, a
 search field that offers no places, missing photography, missing flags, no analytics, no
@@ -966,6 +942,15 @@ by a `Permissions-Policy` header on your own page.
 you send a `Permissions-Policy` header, allow these three for your own origin. If you embed in
 an iframe, put them in its `allow` attribute as shown above.
 
+### The captcha frame needs nothing from your policy
+
+The captcha's frame carries `allow="cross-origin-isolated; fullscreen; autoplay; keyboard-map;
+gamepad; xr-spatial-tracking"`, the six features Turnstile's own widget asks for. A
+`Permissions-Policy` of yours that denies them does reach the frame, but the challenge renders and
+solves with all six denied (Chromium 153), so add nothing for the captcha. ⚠ **Private State
+Tokens are not among them**: Turnstile asks for them as `private-token`, a name no current engine
+publishes, so no policy either of us writes can delegate them.
+
 ## Where to load it from
 
 One host serves the bundle:
@@ -1033,7 +1018,7 @@ elements. On top of that, every selector is still confined to the widget's own s
 fails the build if a rule escapes. Your headings, links, lists, forms, `.container`, a `.dark`
 theme class, and your own Swiper or Mapbox instances are all left alone.
 
-Six honest exceptions, none of them styling your content:
+Seven honest exceptions, none of them styling your content:
 
 - Opening a modal panel inside the widget sets `overflow: hidden` on your `<body>` while open —
   standard scroll-lock, reverted on close.
@@ -1070,6 +1055,12 @@ Six honest exceptions, none of them styling your content:
   and without them the widget draws no borders and no shadows. Like the widget's own sheet, it is
   constructed, so it asks nothing new of your [CSP](#content-security-policy).
 
+- **A 1-pixel hidden `<iframe>` sits in your `<body>` for a moment after the widget mounts.** It
+  is the captcha's availability check, loading the challenge page from `cloud.sydevelopers.com`
+  so that a page where registration is impossible says so within seconds. It is
+  `position: fixed`, transparent, unfocusable, hidden from assistive technology, and adds no
+  scroll height.
+
 **The reverse direction is a boundary, not a defence.** The widget renders inside a **shadow
 root**, so a selector in your stylesheet cannot match an element inside it — at any specificity,
 with or without `!important`. A blanket `button { … }`, an `a { color: … !important }`, a
@@ -1184,6 +1175,13 @@ maintainers rather than editing the snippet:
   carries the visitor's **`navigator.userAgent`**. No global error handler is installed, so your
   own scripts' exceptions are never captured. No breadcrumbs, no session replay.
 
+**The captcha talks to Cloudflare from a frame, not from your page.** The Turnstile challenge
+gating every form is a small frame served from `cloud.sydevelopers.com`, and that frame's document
+makes the requests to `challenges.cloudflare.com` — so Cloudflare sees the visitor's IP but not
+your page, and no script of Cloudflare's runs in your document. The frame's URL carries your
+page's **origin** — scheme, host and port, never a path — because that is the one window it hands
+its token to. It mounts with the interface, whether or not the visitor opens a form.
+
 **`map=false` removes the Mapbox flows too** — tiles, the geocoder (which sends the visitor's
 typed query and the map centre to Mapbox), and the map-load telemetry — along with the two
 `mapbox.*` storage keys. That is the only switch for them, since they are Mapbox's own behaviour,
@@ -1261,8 +1259,7 @@ Three things to check when you migrate:
 | **The map area is blank or grey**                                            | `worker-src blob:` (Mapbox starts its worker from a `blob:` URL), or `api.mapbox.com` missing from `img-src`/`connect-src`.                                                                                                                                                                                                                                                                                                                                                                                   |
 | **The map renders but has no pins**                                          | `img-src data:` — the pins are inline SVG rasterised from a `data:` URI.                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | **Country flags are missing, everything else fine**                          | `img-src https://react-circle-flags.pages.dev`. Cosmetic.                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| **Console: "Refused to evaluate a string as JavaScript"**                    | Turnstile's `api.js` evaluating a string in your document, with no `'unsafe-eval'` in `script-src`. Harmless wherever it has appeared, and it does not appear on every page view. The challenge itself runs in a frame under Cloudflare's own policy, and solved on this CSP in later runs — which did not show the refusal. It is **not** the row below: a blocked Turnstile replaces the widget with an error screen instead. See the note under [the CSP table](#why-each-one-and-what-breaks-without-it). |
-| **The widget shows "its security check was blocked" and nothing else**       | Turnstile is blocked — add `challenges.cloudflare.com` to `script-src`, `frame-src` and `connect-src`. The browser console carries the exact directive. This used to degrade the report form instead — since the atlas cannot take a registration without it, it now fails outright.                                                                                                                                                                                                                          |
+| **The widget shows "its security check was blocked" and nothing else**       | Read the browser console, which names both fixes. If the browser also logged a refused frame, your CSP is missing `frame-src https://cloud.sydevelopers.com`; otherwise your page's domain is not on your client record — ask us to add it. Since the atlas cannot take a registration without the captcha, this fails outright rather than degrading the form.                                                                                                                                               |
 | **The widget's route never appears in the address bar**                      | The document refuses `history.replaceState` — most often `file://`. The widget detects that and routes in memory.                                                                                                                                                                                                                                                                                                                                                                                             |
 | **The compact card's button does nothing, in an iframe**                     | The frame is sandboxed without `allow-popups`, so its `target="_blank"` link cannot open. It fails silently, with nothing in the console. Add `allow-popups`, or drop `sandbox`.                                                                                                                                                                                                                                                                                                                              |
 | **`atlas=` on the script URL seems to be ignored**                           | The page's own URL already carries an `?atlas=` route, which always wins. That is intended — see [`atlas`, and how the route is chosen](#atlas-and-how-the-route-is-chosen).                                                                                                                                                                                                                                                                                                                                  |
diff --git a/docs/environment.md b/docs/environment.md
index b5013122..29b95455 100644
--- a/docs/environment.md
+++ b/docs/environment.md
@@ -19,7 +19,6 @@ place it is stated — everywhere else in this repo just points here.
 | --------------------------- | ----------------------------- | ------- |
 | `VITE_SAHAJCLOUD_URL`      | `.env`                        | SahajCloud origin. The client appends `/api`. Default `https://cloud.sydevelopers.com`. Local backend: `http://localhost:3000`. |
 | `ATLAS_API_KEY`            | shell (never committed)       | A **production** `sahaj-atlas-client` API key, read by `pnpm sync:translations` to pull the English copy out of SahajCloud. Build-time only, no `VITE_` prefix — it never reaches the bundle. The script falls back to `VITE_SAHAJCLOUD_API_KEY` **only** when `VITE_SAHAJCLOUD_URL` is the production origin: a key minted against a local CMS, sent to `cloud.sydevelopers.com`, lands in production's log as a rejected credential and gets rotated in a hurry. ⚠ It replaced `VITE_HOST` here, which #198 deleted along with `public/locales/` — the widget fetches its copy from SahajCloud now, so there is no second origin to name. |
-| `VITE_TURNSTILE_SITE_KEY`  | `.env` **+ Cloudflare — Production build variable** | Cloudflare Turnstile **site** key for the registration and report-issue forms. Public by design — the secret half lives in SahajCloud — so this is committed. `.env` holds Cloudflare's always-passes test key `1x00000000000000000000AA` for dev, Ladle, and CI. Production overrides it with the real `0x4AAAA…` key as a **build variable** on the app Worker's production Workers Builds trigger (Workers & Pages → `sahajatlas-web` → Settings → Build → Variables and secrets). ⚠ **A runtime variable (Settings → Variables and Secrets) does nothing here** — Vite inlines the key at build time, and this Worker runs no code. Previews keep the test key on purpose: a real key validates only on the hostnames it lists, and a preview's `workers.dev` host is not one. **A release guard holds this (#259)**: `scripts/turnstile-release-guard.mjs`, a Vite plugin, fails a production build whose resolved key is a test key (any `[123]x0000…`), empty, or not a bare `0x…` key (quotes or spaces pasted around it would reach Turnstile too), naming the variable and this setting. Production means Workers Builds (`WORKERS_CI=1`) building `main`, or naming no branch at all — it fails closed; every other branch, every GitHub Actions build and every local build passes on the test key. ⚠ **It guards a build, so production can change without it**: a manual `wrangler deploy` of a locally built `dist/`, or promoting or rolling back to a version no production build made — and every same-repo PR's smoke job uploads a test-key version of this very Worker (`ci.yml`, `versions upload`), so the dashboard's version list is full of them. `embed.smoke.test.ts` reads the live key after every Workers Builds deploy; after any of the others, run `Production Smoke` by hand. ⚠ It also assumes only the production trigger builds `main`: a preview trigger whose branch rule is `*` would build `main` without the key and go red on every merge. Unset, `probeTurnstile` answers `false` and `useTurnstileGuard` fails the whole widget to the captcha-blocked screen — the same state as a CSP-refused script, and no `mailto:` fallback since #182. **Since #103 this key is load-bearing, not decorative.** The form now sends a real email through SahajCloud's captcha-gated endpoint. In production, the test key then makes that captcha a no-op. A site key that does not pair with SahajCloud's `TURNSTILE_SECRET_KEY` makes every report fail with a 403 `captcha_failed`. The viewer sees only one sentence of text for this. |
 | `VITE_SENTRY_DSN`          | Cloudflare — **Production + Preview** | Sentry ingest DSN for automatic error reporting (issue #108). Use the **modern public-key form** `https://<key>@<host>/<project>`. The legacy `https://<key>:<secret>@…` form puts a real secret in the public bundle. A DSN is write-only, so it is public by design. This repo still does **not** commit it to `.env`: a committed DSN would send every fork, preview, and `pnpm dev` into the production project. Set it per Workers Builds trigger in the Cloudflare dashboard. This org is in Sentry's **DE region**, so the ingest host is `o…​.ingest.de.sentry.io` — not `…us…`, which is what the DSN's own text will tell you. **The integrator CSP needs no edit for it**: `docs/embedding.md`'s `connect-src` row already carries `*.sentry.io`, wide on purpose so a regional host matches (#123). **Unset, `reportInternalError` only logs to the console** — the SDK chunk is never fetched, and that is the only gate there is: the `error-reporting` embed attribute was removed in #149. **Preview carries one too, and that is load-bearing, not a convenience** (#232): `boot-origins.smoke.test.ts` reads the ingest host back off the deploy, and `assert-preview-host.mjs` refuses the Worker's own production host, so a preview is the only deploy the PR gate can observe. ⚠ Since #282 the preview's copy is an **Actions secret in this repo**, read by `ci.yml`'s publish build — not a Cloudflare Preview-environment variable. The production deploy's stays in the dashboard. |
 | `VITE_SENTRY_ENVIRONMENT`  | Cloudflare — **Preview**       | The `environment` tag on every reported event (#232). It replaced `import.meta.env.MODE`, which reads `production` for **every** `vite build`, preview included — so with a DSN on Preview, preview noise would be indistinguishable from the events that matter. Set it to `preview` there and leave Production alone: unset, a build defaults to `production` and `pnpm dev` to `development`, so nothing gets mislabelled. Not a secret, and not in `.env`, where it would be inert anyway — nothing reports without a DSN. |
 | `SENTRY_AUTH_TOKEN`        | Cloudflare                    | **Build-time only, and a real secret** (issue #130). It carries no `VITE_` prefix, so Vite cannot inline it. **`pnpm assert:maps` also greps every emitted file for its value** and fails the build if it appears — a gate, not a habit. Its presence switches source-map upload on. Set: `build.sourcemap: 'hidden'`, and `@sentry/vite-plugin` uploads the maps, then deletes them. Unset: **no maps are emitted at all**, and the build matches one from before #130 byte-for-byte. See runbook step 2 for the token scopes it needs. The plugin never creates, finalizes, or sets commits on a release. Still, the upload call stays release-scoped. |
@@ -31,6 +30,9 @@ place it is stated — everywhere else in this repo just points here.
 | `VITE_FATHOM_ID`           | `.env.local`                  | Fathom analytics site id (optional). Analytics is disabled when unset or on localhost. |
 | `SAHAJCLOUD_DOCS_PASSWORD` | `.env.local`                  | HTTP basic-auth password for the SahajCloud OpenAPI docs. Used **only** by the `pnpm types:openapi` script. Never `VITE_`-prefixed — tooling-only, never in the bundle. |
 
+**The widget carries no Turnstile configuration.** Its captcha renders in a page SahajCloud serves
+(`GET /api/atlas/challenge`, sydevs/SahajCloud#1072), which holds both halves of the key.
+
 ## GitHub Actions secrets — the smoke lane's preview (#282)
 
 The `Smoke` job builds the app and publishes its own Workers preview, so five values live in
@@ -56,8 +58,8 @@ deploy. That is deliberate: the alternative is a green check that read nothing,
 which is the hole #99 closed.
 
 `VITE_SENTRY_ENVIRONMENT: preview` is a plain workflow value in `ci.yml`, not a secret — unset, a
-build tags itself `production`. `VITE_SAHAJCLOUD_URL` and `VITE_TURNSTILE_SITE_KEY` keep `.env`'s
-committed defaults, the Turnstile one being the always-passes test key. `SENTRY_AUTH_TOKEN` is
+build tags itself `production`. `VITE_SAHAJCLOUD_URL` keeps `.env`'s committed default.
+`SENTRY_AUTH_TOKEN` is
 deliberately **not** set for a preview: no maps are emitted at all and `pnpm assert:maps` passes,
 which is the simplest correct state.
 
diff --git a/docs/rules/deployment.md b/docs/rules/deployment.md
index 93c6ef2f..7ce74d78 100644
--- a/docs/rules/deployment.md
+++ b/docs/rules/deployment.md
@@ -11,8 +11,6 @@ paths:
   - 'scripts/assert-no-sourcemaps.test.ts'
   - 'scripts/deploy-headers.test.ts'
   - 'scripts/wrangler-config.test.ts'
-  - 'scripts/turnstile-release-guard.mjs'
-  - 'scripts/turnstile-release-guard.test.ts'
   - '.github/workflows/*.yml'
 ---
 
@@ -114,14 +112,6 @@ Three facts to remember:
 The Sentry variables are dashboard-only, and owed to **each** target that builds the app. The
 runbook is in `docs/environment.md`.
 
-**A production build refuses Cloudflare's test Turnstile site key (#259).** The real
-`VITE_TURNSTILE_SITE_KEY` is a build variable on the production trigger only; `.env`'s test key
-is correct everywhere else. `scripts/turnstile-release-guard.mjs` fails a Workers Builds build of
-`main` whose resolved key is a test key, empty or malformed, so removing that variable fails the
-release instead of shipping a captcha that accepts everyone. `embed.smoke.test.ts` checks the live
-bundle after each Workers Builds deploy. ⚠ Neither sees a version promoted or rolled back without a
-build. What counts as production, and that gap: `docs/environment.md`.
-
 ## Deploy-side CI gates
 
 Two of the four CI gates that exist because each one once missed something, unnoticed (#99).
diff --git a/docs/testing.md b/docs/testing.md
index 25088809..9618f983 100644
--- a/docs/testing.md
+++ b/docs/testing.md
@@ -294,7 +294,7 @@ alert. The lane's last step opens an issue instead, and three things about it ar
   production read, and a ticket claiming production is red when nothing read it is worse than no
   ticket. `ci-workflows.test.ts` pins that gate and the token, since both fail silently.
 
-**One spec is scoped by environment, on purpose** (#259): `embed.smoke.test.ts`'s Turnstile case expects the committed test site key on an address `assert-preview-host.mjs` accepts as the app Worker's preview, and a real `0x4…` key with no test key everywhere else — so a bypassed build gate still reddens production. The preview half keeps the production half from passing vacuously: the same patterns must find the test key there. Measured 2026-10-30: green on `sahajatlas.com` and on `pr-344`'s preview, red against a locally served build carrying the test key and against one carrying no key. Every other spec reads both hosts alike. The lane is **18 cases**, from 14 declarations — count it rather
+Every spec reads both hosts alike. The lane is **17 cases**, from 13 declarations — count it rather
 than trusting a figure, since `.each` makes the two differ. Measured 2026-10-06 against the 16 it
 was then: all 16 passed against `sahajatlas.com`. Re-measured 2026-10-13 against the playground
 on its Worker (`PREVIEW_URL=https://design.sahajatlas.com pnpm test:smoke`, #279): **10 of the 17
diff --git a/scripts/turnstile-release-guard.mjs b/scripts/turnstile-release-guard.mjs
deleted file mode 100644
index 01603b75..00000000
--- a/scripts/turnstile-release-guard.mjs
+++ /dev/null
@@ -1,156 +0,0 @@
-/**
- * Fails a production build that would ship Cloudflare's test Turnstile site key, or none (#259).
- *
- * `.env` commits the always-passes test key on purpose: dev, Ladle, CI and every preview need it,
- * because a real key validates only on the hostnames it lists and a preview's host is not one.
- * Production gets the real key from a Workers Builds **build** variable. Remove that variable and
- * production silently falls back to `.env`'s value — a captcha that accepts everything, or one
- * that refuses every visitor, depending on SahajCloud's secret. Nothing else would notice.
- *
- * The check reads Vite's RESOLVED `import.meta.env` (`config.env`), not `process.env` or a file:
- * the shell environment beats every `.env*` file, and `--mode` chooses which files load, so this
- * is exactly the value the bundle inlines.
- *
- * ⚠ It guards a BUILD, so a promotion, a rollback or a manual deploy changes production without
- * passing it. `tests/smoke/embed.smoke.test.ts` reads the live key back after every Workers Builds
- * deploy. Which versions slip through both, and what to run then: docs/environment.md.
- */
-
-import process from 'node:process'
-
-export const SITE_KEY_VARIABLE = 'VITE_TURNSTILE_SITE_KEY'
-
-/** Workers Builds' production branch for the `sahajatlas-web` Worker (its Git branch setting). */
-export const PRODUCTION_BRANCH = 'main'
-
-/**
- * Cloudflare's dummy site keys: `1x…AA` / `1x…BB` pass, `2x…AB` / `2x…BB` block, `3x…FF` forces a
- * challenge. Matched by shape so an unpublished variant is caught too; a real key starts `0x`.
- * The lookbehind keeps a match from starting mid-token.
- */
-const TEST_SITE_KEY_SOURCE = '(?<![0-9A-Za-z])[123]x0{16,}[0-9A-Za-z]*'
-
-/**
- * Every test site key in `text`, for reading a built bundle back.
- *
- * @param {string} text
- * @returns {string[]}
- */
-export function findTestSiteKeys(text) {
-  return [...text.matchAll(new RegExp(TEST_SITE_KEY_SOURCE, 'gi'))].map((m) => m[0])
-}
-
-/**
- * A real site key's shape: `0x` and at least ten more key characters. `embed.smoke.test.ts` reads
- * the live bundle through this same source, because a stricter pattern there blames
- * `VITE_TURNSTILE_SITE_KEY` for being unset over a key this gate has passed.
- */
-const LIVE_SITE_KEY_SOURCE = '0x[0-9A-Za-z_-]{10,}'
-
-/** A real site key, exactly — Vite inlines the value byte for byte, padding and quotes too. */
-const LIVE_SITE_KEY = new RegExp(`^${LIVE_SITE_KEY_SOURCE}$`)
-
-/**
- * Every real site key in `text`, for reading a built bundle back. It must be delimited by the
- * quotes the bundle inlines it between: unanchored, `0x…` matches a hex literal anywhere in the
- * graph, and a false find here reads as production carrying a key it does not serve.
- *
- * @param {string} text
- * @returns {string[]}
- */
-export function findLiveSiteKeys(text) {
-  const delimited = new RegExp(`["'\`](${LIVE_SITE_KEY_SOURCE})["'\`]`, 'g')
-
-  return [...text.matchAll(delimited)].map((m) => m[1])
-}
-
-/**
- * `missing`, `test`, `live`, or `malformed`. Padding and quotes are looked through to find a test
- * key or nothing, but never to pass a value: Turnstile would receive them as part of the key.
- *
- * @param {string | undefined} value
- * @returns {'missing' | 'test' | 'live' | 'malformed'}
- */
-export function classifySiteKey(value) {
-  const key = (value ?? '')
-    .trim()
-    .replace(/^(["'])(.*)\1$/, '$2')
-    .trim()
-
-  if (key === '') return 'missing'
-  if (findTestSiteKeys(key).length > 0) return 'test'
-
-  return LIVE_SITE_KEY.test(value ?? '') ? 'live' : 'malformed'
-}
-
-/**
- * Is this the build Workers Builds deploys to production?
- *
- * Workers Builds sets `WORKERS_CI=1` and `WORKERS_CI_BRANCH` on every build it runs; a preview is
- * any other branch, merge-queue branches included. GitHub Actions sets neither, so `ci.yml`'s
- * builds — the smoke job's preview among them — are never production.
- * ⚠ It fails closed: a Workers build naming no branch is held to the production standard, so a
- * platform change fails a preview loudly rather than waving production through.
- *
- * @param {Record<string, string | undefined>} env
- * @returns {boolean}
- */
-export function isProductionBuild(env) {
-  const ci = env.WORKERS_CI ?? ''
-
-  if (ci === '' || ci === '0' || ci.toLowerCase() === 'false') return false
-
-  const branch = env.WORKERS_CI_BRANCH ?? ''
-
-  return branch === '' || branch === PRODUCTION_BRANCH
-}
-
-/**
- * The message a refused build fails with, or `null` when the build may proceed. It never echoes
- * the key it read.
- *
- * @param {Record<string, string | undefined>} env
- * @param {string | undefined} siteKey
- * @returns {string | null}
- */
-export function releaseGuardError(env, siteKey) {
-  if (!isProductionBuild(env)) return null
-
-  const kind = classifySiteKey(siteKey)
-
-  if (kind === 'live') return null
-
-  const found = {
-    test: `is Cloudflare's always-passes Turnstile test key (\`.env\`'s default)`,
-    missing: 'is empty or unset',
-    malformed: 'is not a site key: expected `0x…` alone, with no quotes or spaces around it',
-  }[kind]
-
-  return (
-    `✗ turnstile: refusing a production build — ${SITE_KEY_VARIABLE} ${found}.\n` +
-    `  This build (Workers Builds, branch \`${env.WORKERS_CI_BRANCH || '(none)'}\`) would ship a captcha\n` +
-    `  that accepts every visitor or refuses every one. Set ${SITE_KEY_VARIABLE} to the real\n` +
-    `  site key (\`0x4AAAA…\`) in the Cloudflare dashboard: Workers & Pages → sahajatlas-web →\n` +
-    `  Settings → Build → Variables and secrets. It must be a BUILD variable: Vite inlines it\n` +
-    `  at build time, so a runtime variable (Settings → Variables and Secrets) never reaches\n` +
-    `  the bundle. See docs/environment.md (#259).`
-  )
-}
-
-/**
- * The Vite plugin. `env` is injectable for the spec; the build reads `process.env`.
- *
- * @param {Record<string, string | undefined>} [env]
- * @returns {import('vite').Plugin}
- */
-export function turnstileReleaseGuard(env = process.env) {
-  return {
-    name: 'sy-turnstile-release-guard',
-    apply: 'build',
-    configResolved(config) {
-      const error = releaseGuardError(env, config.env[SITE_KEY_VARIABLE])
-
-      if (error) throw new Error(error)
-    },
-  }
-}
diff --git a/scripts/turnstile-release-guard.test.ts b/scripts/turnstile-release-guard.test.ts
deleted file mode 100644
index fd1ec453..00000000
--- a/scripts/turnstile-release-guard.test.ts
+++ /dev/null
@@ -1,275 +0,0 @@
-import { resolve } from 'node:path'
-
-import { resolveConfig } from 'vite'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-
-import {
-  PRODUCTION_BRANCH,
-  SITE_KEY_VARIABLE,
-  classifySiteKey,
-  findLiveSiteKeys,
-  findTestSiteKeys,
-  isProductionBuild,
-  releaseGuardError,
-  turnstileReleaseGuard,
-} from './turnstile-release-guard.mjs'
-
-// The release guard asked for on #259: a production build fails when the Turnstile site key it
-// would inline is Cloudflare's always-passes test key, or nothing at all. Every preview and every
-// local build keeps the test key, because no real key validates on a preview's hostname.
-
-// Cloudflare's published dummy site keys: pass, block and force-challenge, visible and invisible.
-const TEST_KEYS = [
-  '1x00000000000000000000AA',
-  '2x00000000000000000000AB',
-  '1x00000000000000000000BB',
-  '2x00000000000000000000BB',
-  '3x00000000000000000000FF',
-]
-
-// The shape of a real key, made up — never the production key itself.
-const LIVE_KEY = '0x4AAAAAAAexampleNotReal1'
-
-describe('classifySiteKey', () => {
-  it.each(TEST_KEYS)('calls %s a test key', (key) => {
-    expect(classifySiteKey(key)).toBe('test')
-  })
-
-  // A dashboard paste carries whatever was copied. Vite inlines the value byte for byte, so
-  // the guard must not be the one thing that reads the padding as "not the test key".
-  it.each([
-    ` ${TEST_KEYS[0]} `,
-    `"${TEST_KEYS[0]}"`,
-    `'${TEST_KEYS[4]}'`,
-    TEST_KEYS[0].toLowerCase(),
-  ])('still calls %j a test key', (key) => {
-    expect(classifySiteKey(key)).toBe('test')
-  })
-
-  // A variant Cloudflare has not published yet still has the `[123]x000…` shape.
-  it('matches the pattern, not a list of literals', () => {
-    expect(classifySiteKey('3x00000000000000000000AA')).toBe('test')
-    expect(classifySiteKey('1x0000000000000000000000CC')).toBe('test')
-  })
-
-  it.each([undefined, '', '   ', '""', "''"])('calls %j missing', (key) => {
-    expect(classifySiteKey(key)).toBe('missing')
-  })
-
-  it('calls a real-shaped key live', () => {
-    expect(classifySiteKey(LIVE_KEY)).toBe('live')
-  })
-
-  // Turnstile would receive the padding or the quotes as part of the key, and refuse it.
-  it.each([`"${LIVE_KEY}"`, ` ${LIVE_KEY}`, 'TODO', 'undefined', '0x4'])(
-    'calls %j malformed',
-    (key) => {
-      expect(classifySiteKey(key)).toBe('malformed')
-    },
-  )
-})
-
-describe('findTestSiteKeys', () => {
-  it('finds a test key inlined into minified source', () => {
-    expect(findTestSiteKeys(`const a={sitekey:"${TEST_KEYS[0]}",theme:t}`)).toEqual([TEST_KEYS[0]])
-  })
-
-  it('finds nothing in a bundle that carries a live key', () => {
-    expect(
-      findTestSiteKeys(`const a={sitekey:"${LIVE_KEY}"},b="0x0000000000000000000000"`),
-    ).toEqual([])
-  })
-
-  // `a1x000…` is not a key; a match must start at a token boundary.
-  it('does not match inside a longer token', () => {
-    expect(findTestSiteKeys('"ab1x00000000000000000000AA"')).toEqual([])
-  })
-})
-
-describe('findLiveSiteKeys', () => {
-  it('finds a live key inlined into minified source', () => {
-    expect(findLiveSiteKeys(`const a={sitekey:"${LIVE_KEY}",theme:t}`)).toEqual([LIVE_KEY])
-  })
-
-  it('finds nothing in a bundle that carries a test key', () => {
-    expect(findLiveSiteKeys(`const a={sitekey:"${TEST_KEYS[0]}"}`)).toEqual([])
-  })
-
-  // Undelimited, `0x…` matches a hex literal anywhere in the graph, and a false find reads as
-  // production carrying a key it does not serve.
-  it('needs the quotes the bundle inlines the key between', () => {
-    expect(findLiveSiteKeys(`const a=${LIVE_KEY},b=t`)).toEqual([])
-  })
-
-  // The gate and `embed.smoke.test.ts` must agree on what a real key is. A key the gate passes
-  // that this reader misses reads on production as an unset build variable.
-  it.each([LIVE_KEY, '0x5AAAAAAAAAA', '0x4AAAA_example-key'])(
-    'finds %j, which the gate calls live',
-    (key) => {
-      expect(classifySiteKey(key)).toBe('live')
-      expect(findLiveSiteKeys(`{sitekey:"${key}"}`)).toEqual([key])
-    },
-  )
-})
-
-describe('isProductionBuild', () => {
-  it('is a Workers Builds build of the production branch', () => {
-    expect(PRODUCTION_BRANCH).toBe('main')
-    expect(isProductionBuild({ WORKERS_CI: '1', WORKERS_CI_BRANCH: 'main' })).toBe(true)
-  })
-
-  // Every preview Workers Builds makes is a branch build, merge-queue branches included.
-  it.each(['feat/venue-clustering', 'gh-readonly-queue/main/pr-259-abc', 'main-old', 'Main'])(
-    'is not a Workers Builds preview of %s',
-    (branch) => {
-      expect(isProductionBuild({ WORKERS_CI: '1', WORKERS_CI_BRANCH: branch })).toBe(false)
-    },
-  )
-
-  // Fail closed: a Workers build that names no branch is held to the production standard, so a
-  // platform change that drops the variable fails a preview loudly instead of waving production
-  // through.
-  it('is a Workers Builds build that names no branch', () => {
-    expect(isProductionBuild({ WORKERS_CI: '1' })).toBe(true)
-    expect(isProductionBuild({ WORKERS_CI: '1', WORKERS_CI_BRANCH: '' })).toBe(true)
-  })
-
-  // Local `pnpm build`, the gate job in `ci.yml`, and the smoke job's own preview build. GitHub
-  // Actions sets `CI=true` and `GITHUB_REF_NAME=main` on a push, and neither one means production.
-  it.each([
-    {},
-    { CI: 'true', GITHUB_ACTIONS: 'true', GITHUB_REF_NAME: 'main' },
-    { WORKERS_CI: '', WORKERS_CI_BRANCH: 'main' },
-    { WORKERS_CI: '0', WORKERS_CI_BRANCH: 'main' },
-    { WORKERS_CI_BRANCH: 'main' },
-  ])('is not a build outside Workers Builds: %j', (env) => {
-    expect(isProductionBuild(env)).toBe(false)
-  })
-})
-
-describe('releaseGuardError', () => {
-  const production = { WORKERS_CI: '1', WORKERS_CI_BRANCH: 'main' }
-  const preview = { WORKERS_CI: '1', WORKERS_CI_BRANCH: 'feat/x' }
-
-  it('refuses a production build that would ship the test key', () => {
-    const error = releaseGuardError(production, TEST_KEYS[0])
-
-    expect(error).toContain(SITE_KEY_VARIABLE)
-    expect(error).toContain('test key')
-    // Where to set it: the build variable, not a runtime variable, which Vite never sees.
-    expect(error).toMatch(/Build.*variables/i)
-  })
-
-  it('refuses a production build with no key at all', () => {
-    expect(releaseGuardError(production, undefined)).toContain(SITE_KEY_VARIABLE)
-    expect(releaseGuardError(production, '')).toContain('empty')
-  })
-
-  it('refuses a production build whose key is malformed', () => {
-    expect(releaseGuardError(production, `"${LIVE_KEY}"`)).toContain('is not a site key')
-  })
-
-  it('passes a production build carrying a live key', () => {
-    expect(releaseGuardError(production, LIVE_KEY)).toBeNull()
-  })
-
-  it('passes every preview and local build, test key and all', () => {
-    expect(releaseGuardError(preview, TEST_KEYS[0])).toBeNull()
-    expect(releaseGuardError({}, TEST_KEYS[0])).toBeNull()
-    expect(releaseGuardError({}, undefined)).toBeNull()
-  })
-
-  // The message lands in a build log; the key is public, but it is named by prefix only.
-  it('never echoes the value it read', () => {
-    expect(releaseGuardError(production, TEST_KEYS[0])).not.toContain(TEST_KEYS[0])
-  })
-})
-
-describe('turnstileReleaseGuard', () => {
-  // The plugin reads `config.env`, Vite's RESOLVED `import.meta.env`: the shell environment
-  // beats every `.env*` file, and `--mode` picks the files. So this is the value that ships.
-  const run = (env: Record<string, string>, siteKey: string | undefined) => {
-    const plugin = turnstileReleaseGuard(env)
-    const hook = plugin.configResolved as (config: unknown) => void
-
-    return () => hook({ command: 'build', env: { [SITE_KEY_VARIABLE]: siteKey } })
-  }
-
-  it('throws on a production build with the test key', () => {
-    expect(run({ WORKERS_CI: '1', WORKERS_CI_BRANCH: 'main' }, TEST_KEYS[0])).toThrow(
-      /VITE_TURNSTILE_SITE_KEY is Cloudflare's always-passes Turnstile test key/,
-    )
-  })
-
-  // Only a resolved value that differs from the ambient one tells the two reads apart.
-  it('reads the resolved env, not the ambient one', () => {
-    vi.stubEnv(SITE_KEY_VARIABLE, undefined)
-
-    try {
-      expect(run({ WORKERS_CI: '1', WORKERS_CI_BRANCH: 'main' }, LIVE_KEY)).not.toThrow()
-    } finally {
-      vi.unstubAllEnvs()
-    }
-  })
-
-  it('lets a preview build with the test key through', () => {
-    expect(run({ WORKERS_CI: '1', WORKERS_CI_BRANCH: 'feat/x' }, TEST_KEYS[0])).not.toThrow()
-  })
-
-  it('applies to builds only, so `pnpm dev` never reads it', () => {
-    expect(turnstileReleaseGuard({}).apply).toBe('build')
-  })
-})
-
-// The pure halves above could be perfect and guard nothing. This resolves the REAL
-// `vite.config.ts` through Vite itself, so it covers the wiring, the committed `.env`, and the
-// precedence of a shell variable over that file — the one a Workers Builds build variable uses.
-describe('the app build, resolved by Vite', () => {
-  const root = resolve(import.meta.dirname, '..')
-  const build = () =>
-    resolveConfig({ root, configFile: resolve(root, 'vite.config.ts') }, 'build', 'production')
-
-  // Hermetic: vitest has already copied `.env` into `process.env`, and a shell may carry a real
-  // key or a Sentry token (whose half-config throws first). Deleting both makes `.env` on disk
-  // the only source a test can be reading.
-  beforeEach(() => {
-    vi.stubEnv(SITE_KEY_VARIABLE, undefined)
-    vi.stubEnv('SENTRY_AUTH_TOKEN', undefined)
-  })
-
-  afterEach(() => {
-    vi.unstubAllEnvs()
-  })
-
-  it('refuses a production build that falls back to the committed test key', async () => {
-    vi.stubEnv('WORKERS_CI', '1')
-    vi.stubEnv('WORKERS_CI_BRANCH', 'main')
-
-    // The reason, not just the name: refusing for "unset" would mean `.env` was never read.
-    await expect(build()).rejects.toThrow(/VITE_TURNSTILE_SITE_KEY is .*test key/)
-  })
-
-  it('passes a production build whose build variable overrides `.env`', async () => {
-    vi.stubEnv('WORKERS_CI', '1')
-    vi.stubEnv('WORKERS_CI_BRANCH', 'main')
-    vi.stubEnv(SITE_KEY_VARIABLE, LIVE_KEY)
-
-    expect((await build()).env[SITE_KEY_VARIABLE]).toBe(LIVE_KEY)
-  })
-
-  // An empty build variable still beats `.env` — Vite copies every prefixed shell value.
-  it('refuses a production build whose build variable is set but empty', async () => {
-    vi.stubEnv('WORKERS_CI', '1')
-    vi.stubEnv('WORKERS_CI_BRANCH', 'main')
-    vi.stubEnv(SITE_KEY_VARIABLE, '')
-
-    await expect(build()).rejects.toThrow('empty')
-  })
-
-  it('passes a preview build on the committed test key', async () => {
-    vi.stubEnv('WORKERS_CI', '1')
-    vi.stubEnv('WORKERS_CI_BRANCH', 'feat/x')
-
-    expect(classifySiteKey((await build()).env[SITE_KEY_VARIABLE])).toBe('test')
-  })
-})
diff --git a/src/components/molecules/Fallbacks/Fallbacks.tsx b/src/components/molecules/Fallbacks/Fallbacks.tsx
index b80aa89c..673fd263 100644
--- a/src/components/molecules/Fallbacks/Fallbacks.tsx
+++ b/src/components/molecules/Fallbacks/Fallbacks.tsx
@@ -228,9 +228,10 @@ export const ERROR_POLICY: Record<FallbackKind, FallbackPolicy> = {
     report: true,
   },
   // Turnstile failed to load, so this widget cannot send anything the viewer
-  // writes (issue #182). The usual cause is a `config` failure: a host CSP that is
-  // missing challenges.cloudflare.com. This row still earns its own row, for one
-  // reason `config` cannot express:
+  // writes (issue #182). The usual cause is a `config` failure: a host CSP that
+  // will not let the widget frame SahajCloud, where the challenge renders, or a
+  // host domain no client record lists (#343, sydevs/SahajCloud#1072). This row
+  // still earns its own row, for one reason `config` cannot express:
   //
   // **It offers no report action.** The report form is itself gated by Turnstile.
   // Sending a viewer to it would hand them a second form that also cannot submit.
@@ -238,19 +239,20 @@ export const ERROR_POLICY: Record<FallbackKind, FallbackPolicy> = {
   // `REPORTED_KINDS` mirrors it too.
   //
   // The sentence names the cause, not the fix. A visitor cannot edit a CSP. The
-  // instruction "add challenges.cloudflare.com to your script-src" means nothing
-  // to most visitors on a meditation page. Only the site's developer needs it.
+  // instruction "add SahajCloud to your frame-src" means nothing to most visitors
+  // on a meditation page. Only the site's developer needs it.
   // `reportIntegrationWarning` prints that instruction to the console, where a
   // developer debugging the embed will look. `docs/embedding.md` carries the
   // lasting version.
   //
   // ⚠ **This row DOES retry. That looks wrong next to `config`, but is correct.**
-  // The probe reports the same verdict for a CSP that blocks the script and for a
-  // script request that simply failed on the network. `loadTurnstile` clears its
-  // cached promise on failure. So a second attempt is a real second attempt, and
-  // the network-failure half of that pair can genuinely recover. A CSP block fails
-  // again the same way, which costs the viewer one press. A `config` failure has
-  // no such recoverable half, so it withholds the retry. This row does not.
+  // The check lands on this same kind for a CSP that refuses the frame and for a
+  // frame request that simply failed on the network, and it clears its memoized
+  // verdict whenever it is negative. So a second attempt mounts a fresh frame and
+  // is a real second attempt, and the network-failure half of that pair can
+  // genuinely recover. A CSP block fails again the same way, which costs the
+  // viewer one press. A `config` failure has no such recoverable half, so it
+  // withholds the retry. This row does not.
   'captcha-blocked': {
     messageKey: 'common.errors.captcha_blocked',
     fallbackText: "This Atlas can't run on this page: its security check was blocked.",
diff --git a/src/components/organisms/RegistrationForm/RegistrationForm.submit.test.tsx b/src/components/organisms/RegistrationForm/RegistrationForm.submit.test.tsx
index 86ed8ab4..568623e6 100644
--- a/src/components/organisms/RegistrationForm/RegistrationForm.submit.test.tsx
+++ b/src/components/organisms/RegistrationForm/RegistrationForm.submit.test.tsx
@@ -11,6 +11,8 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 import { RegistrationForm } from './RegistrationForm'
 
+import { challengeFrameStub } from '@/test-support/turnstile-frame'
+
 const sdk = vi.hoisted(() => ({ find: vi.fn(), findByID: vi.fn(), request: vi.fn() }))
 
 vi.mock('@payloadcms/sdk', () => ({
@@ -31,25 +33,12 @@ vi.mock('react-i18next', () => ({
 }))
 
 let container: HTMLDivElement
-let resetCalls: number
+// The challenge page, not our hook: the real `useTurnstile` frames that page and takes its
+// token over `postMessage`, which is what enables Submit. See `challengeFrameStub`.
+let challenge: ReturnType<typeof challengeFrameStub>
 
 beforeEach(() => {
   sdk.request.mockReset()
-  resetCalls = 0
-
-  // The Turnstile script, not our hook: the real `useTurnstile` solves through
-  // this callback, which is what hands the form a token.
-  window.turnstile = {
-    render: (_el, options) => {
-      options.callback?.('tok-live')
-
-      return 'widget-1'
-    },
-    remove: () => {},
-    reset: () => {
-      resetCalls += 1
-    },
-  }
 
   container = document.createElement('div')
   document.body.appendChild(container)
@@ -57,7 +46,6 @@ beforeEach(() => {
 
 afterEach(() => {
   container.remove()
-  delete window.turnstile
 })
 
 async function mountForm(
@@ -79,6 +67,10 @@ async function mountForm(
     )
   })
 
+  // The frame is appended in an effect, so the stub attaches once the form has mounted.
+  challenge = challengeFrameStub(container)
+  await act(async () => challenge.solve())
+
   return root
 }
 
@@ -255,7 +247,7 @@ describe('RegistrationForm refusals', () => {
     expect(alertText()).toContain('registration.form.error_title')
     expect(alertText()).toContain('registration.form.captcha_retry')
     expect(alertText()).not.toContain('Something went wrong.')
-    expect(resetCalls).toBe(1)
+    expect(challenge.resetCount()).toBe(1)
 
     await act(async () => root.unmount())
   })
diff --git a/src/components/organisms/ReportIssueForm/ReportIssueForm.stories.tsx b/src/components/organisms/ReportIssueForm/ReportIssueForm.stories.tsx
index e093959f..3d9e1777 100644
--- a/src/components/organisms/ReportIssueForm/ReportIssueForm.stories.tsx
+++ b/src/components/organisms/ReportIssueForm/ReportIssueForm.stories.tsx
@@ -46,9 +46,9 @@ function Panel({ children }: { children: ReactNode }) {
  * auto-attached context the viewer never types, behind a Cloudflare Turnstile
  * challenge.
  *
- * The live sections render a REAL Turnstile widget against Cloudflare's
- * always-passes test site key, so submit becomes enabled once every authored
- * field answers its own rule. Submitting performs a real
+ * The live sections render a REAL Turnstile widget, in the challenge page the
+ * configured SahajCloud serves, so submit becomes enabled once it is solved and
+ * every authored field answers its own rule. Submitting performs a real
  * `POST /api/user-submissions`. Ladle carries no API key, so it comes back
  * refused, and you land on the failure state. That is the honest outcome, and
  * the point of the ticket: the thank-you screen shows only for a stored message.
diff --git a/src/components/organisms/ReportIssueForm/ReportIssueForm.submit.test.tsx b/src/components/organisms/ReportIssueForm/ReportIssueForm.submit.test.tsx
index f5897486..03e9aefc 100644
--- a/src/components/organisms/ReportIssueForm/ReportIssueForm.submit.test.tsx
+++ b/src/components/organisms/ReportIssueForm/ReportIssueForm.submit.test.tsx
@@ -21,6 +21,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 import { ReportIssueForm } from './ReportIssueForm'
 
+import { challengeFrameStub } from '@/test-support/turnstile-frame'
 import { type ReportContext } from '@/lib/report'
 import { mockReportForm } from '@/mocks/report-form'
 
@@ -60,28 +61,13 @@ const context: ReportContext = {
 }
 
 let container: HTMLDivElement
-let resetCalls: number
+// This stands in for the challenge PAGE, rather than for OUR hook. The real `useTurnstile`
+// frames that page and takes its token over `postMessage`, which is what gives the form a
+// token and enables Send. Mocking the hook instead would skip the very wiring under test.
+let challenge: ReturnType<typeof challengeFrameStub>
 
 beforeEach(() => {
   sdk.request.mockReset()
-  resetCalls = 0
-
-  // This stands in for the Turnstile script, rather than for OUR hook.
-  // `loadTurnstile` short-circuits when `window.turnstile` already exists,
-  // so the real `useTurnstile` runs and solves through its own callback.
-  // That callback is what gives the form a token and enables Send. Mocking
-  // the hook instead would skip the very wiring under test.
-  window.turnstile = {
-    render: (_el, options) => {
-      options.callback?.('tok-live')
-
-      return 'widget-1'
-    },
-    remove: () => {},
-    reset: () => {
-      resetCalls += 1
-    },
-  }
 
   container = document.createElement('div')
   document.body.appendChild(container)
@@ -89,7 +75,6 @@ beforeEach(() => {
 
 afterEach(() => {
   container.remove()
-  delete window.turnstile
 })
 
 /** Mount the form and let the captcha's callback settle, so Send is enabled. */
@@ -105,6 +90,10 @@ async function mountForm() {
     )
   })
 
+  // The frame is appended in an effect, so the stub attaches once the form has mounted.
+  challenge = challengeFrameStub(container)
+  await act(async () => challenge.solve())
+
   return root
 }
 
@@ -202,11 +191,11 @@ describe('ReportIssueForm submit', () => {
     const root = await mountForm()
 
     await type('#report-field-0', MESSAGE)
-    expect(resetCalls).toBe(0)
+    expect(challenge.resetCount()).toBe(0)
 
     await submit()
 
-    expect(resetCalls).toBe(1)
+    expect(challenge.resetCount()).toBe(1)
 
     await act(async () => root.unmount())
   })
diff --git a/src/hooks/use-turnstile-guard.test.tsx b/src/hooks/use-turnstile-guard.test.tsx
index d834f93b..ec0accc3 100644
--- a/src/hooks/use-turnstile-guard.test.tsx
+++ b/src/hooks/use-turnstile-guard.test.tsx
@@ -118,8 +118,16 @@ describe('useTurnstileGuard', () => {
 
     // The directive is the only part of this addressed to somebody who can act on it.
     // It must survive the throw that unmounts the tree. That is why the hook orders its steps this way.
-    expect(advice).toContain('challenges.cloudflare.com')
     expect(advice).toContain('docs/embedding.md')
+    // ⚠ SahajCloud's origin under `frame-src`, not Cloudflare's (#343, sydevs/SahajCloud#1072):
+    // the challenge renders in a frame SahajCloud serves, so naming anything else would send a
+    // developer to edit a line that fixes nothing.
+    expect(advice).toContain(
+      `${new URL(import.meta.env.VITE_SAHAJCLOUD_URL).origin} under \`frame-src\``,
+    )
+    expect(advice).not.toContain('challenges.cloudflare.com')
+    // The other cause, which no policy of theirs can fix: the page's domain is on no client record.
+    expect(advice).toContain(`${window.location.hostname} is not an allowed domain`)
   })
 
   it('does not block the first paint on the probe', async () => {
diff --git a/src/hooks/use-turnstile-guard.ts b/src/hooks/use-turnstile-guard.ts
index 948286fb..85a7360b 100644
--- a/src/hooks/use-turnstile-guard.ts
+++ b/src/hooks/use-turnstile-guard.ts
@@ -3,18 +3,28 @@ import { useEffect, useState } from 'react'
 import { atlasError, reportIntegrationWarning } from '@/lib/report'
 import { probeTurnstile } from '@/hooks/use-turnstile'
 
+const GUIDE = 'https://github.com/sydevs/SahajAtlasWeb/blob/main/docs/embedding.md'
+
 /**
  * This is where a host's developer is told what to change.
  * `docs/embedding.md` carries the durable version. This is the copy that reaches them when the page is actually in front of them.
  *
  * This appears on the console, not on the screen, because the two audiences are different people.
  * The visitor gets `error.captcha_blocked`, which says the embed is broken without asking them to do anything about it.
- * The person who can edit the CSP gets the directive instead.
+ * The person who can edit the CSP, or ask for their domain to be listed, gets the fix instead.
+ *
+ * ⚠ **It names SahajCloud's origin under `frame-src`, not Cloudflare's or ours** (#343,
+ * sydevs/SahajCloud#1072): the challenge renders in a frame SahajCloud serves. The origin is read
+ * off the configured API URL, so a build pointed at a local SahajCloud names the host it needs.
+ * It names both causes rather than carrying SahajCloud's reason for a refusal: the browser logs a
+ * CSP refusal itself, beside this line, which tells the two apart.
  */
-const CSP_ADVICE =
+const captchaAdvice = (serverOrigin: string, hostname: string) =>
   'Turnstile could not load, so registration and issue reports are impossible on this page. ' +
-  "Allow https://challenges.cloudflare.com in this page's Content-Security-Policy — " +
-  'both `script-src` and `frame-src`. See https://github.com/sydevs/SahajAtlasWeb/blob/main/docs/embedding.md#content-security-policy'
+  `Either this page's Content-Security-Policy does not allow ${serverOrigin} under \`frame-src\` ` +
+  '(the browser logs that refusal itself), ' +
+  `or ${hostname} is not an allowed domain on your Sahaj Atlas client record. ` +
+  `See ${GUIDE}#troubleshooting`
 
 /**
  * This fails the widget when Turnstile cannot load. See issue #182.
@@ -34,7 +44,7 @@ const CSP_ADVICE =
  * ⚠ **Call this from the INTERFACE, never from the shell.**
  * `.claude/rules/components.md` is explicit that anything that fetches or injects a script must mount with `FullInterface`.
  * Four separate bugs, the home-region redirect, `warmCaches`, and both Fathom effects, came from effects firing for a collapsed compact card.
- * Injecting a third-party challenge script into a host's page for a card nobody has pressed would be the fifth.
+ * Mounting a challenge frame for a card nobody has pressed would be the fifth.
  * `CompactEmbedView.mount.test.tsx` asserts that this does not happen.
  *
  * This throws during render, not from the effect.
@@ -52,7 +62,12 @@ export function useTurnstileGuard(): void {
 
       // This runs before the throw, not after.
       // The throw unmounts this tree, and the console line is the only part of this addressed to somebody who can fix it.
-      reportIntegrationWarning(CSP_ADVICE)
+      reportIntegrationWarning(
+        captchaAdvice(
+          new URL(import.meta.env.VITE_SAHAJCLOUD_URL).origin,
+          window.location.hostname,
+        ),
+      )
       setBlocked(true)
     })
 
diff --git a/src/hooks/use-turnstile.test.tsx b/src/hooks/use-turnstile.test.tsx
new file mode 100644
index 00000000..2c162336
--- /dev/null
+++ b/src/hooks/use-turnstile.test.tsx
@@ -0,0 +1,400 @@
+// @vitest-environment jsdom
+import { act } from 'react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createRoot } from 'react-dom/client'
+
+import { type UseTurnstile, useTurnstile } from './use-turnstile'
+
+import { type PageMessage, sendFromFrame } from '@/test-support/turnstile-frame'
+
+/**
+ * The challenge lives in a frame SahajCloud serves (#343, sydevs/SahajCloud#1072), so what this covers is the
+ * `postMessage` seam between the widget and that frame — the part no pure test can express,
+ * and the part a real browser cannot reach either, since jsdom will not run Cloudflare's
+ * script and a browser pass cannot drive an unsolved challenge to each of these states.
+ *
+ * **jsdom, because an iframe and its `contentWindow` are the subject.** `renderToStaticMarkup`
+ * runs no effects, so it would never mount the frame these cases send messages from.
+ */
+
+// Mutable, so the re-mount case can change one between renders — the hook keys its effect on
+// both, because Turnstile bakes them into the widget it renders.
+let theme = 'dark'
+let languageCode = 'cs'
+
+vi.mock('@/hooks/use-theme', () => ({ useTheme: () => ({ theme }) }))
+vi.mock('@/hooks/use-locale', () => ({ useLocale: () => ({ languageCode }) }))
+
+let container: HTMLDivElement
+let cleanup: (() => void) | null = null
+let hook: UseTurnstile
+
+function Probe() {
+  hook = useTurnstile()
+
+  return <div ref={hook.challengeRef} />
+}
+
+/** Mounts a form-side consumer, so the frame is appended the way a real view appends it. */
+async function mount(node = <Probe />) {
+  const root = createRoot(container)
+
+  await act(async () => root.render(node))
+  cleanup = () => act(() => root.unmount())
+}
+
+const frame = () => container.querySelector('iframe')
+
+/** Speaks as the challenge page does. `sendFromFrame` owns the origin and source. */
+function fromFrame(message: PageMessage, overrides: MessageEventInit = {}) {
+  const iframe = frame()
+
+  if (!iframe) throw new Error('no challenge frame')
+
+  act(() => sendFromFrame(iframe, message, overrides))
+}
+
+beforeEach(() => {
+  theme = 'dark'
+  languageCode = 'cs'
+  container = document.createElement('div')
+  document.body.appendChild(container)
+})
+
+afterEach(() => {
+  cleanup?.()
+  cleanup = null
+  container.remove()
+  document.body.innerHTML = ''
+})
+
+describe('useTurnstile', () => {
+  it('frames the SahajCloud challenge page, naming this document as its parent', async () => {
+    await mount()
+
+    const iframe = frame()
+    const url = new URL(iframe?.src as string)
+
+    expect(url.origin).toBe(new URL(import.meta.env.VITE_SAHAJCLOUD_URL).origin)
+    // SahajCloud's route, written out: a constant shared with the hook would follow it anywhere.
+    expect(url.pathname).toBe('/api/atlas/challenge')
+    // The page hands its token to this origin alone, so it must be the document the frame is in.
+    expect(url.searchParams.get('parent')).toBe(window.location.origin)
+    expect(url.searchParams.get('theme')).toBe('dark')
+    expect(url.searchParams.get('language')).toBe('cs')
+    // The form mounts a real challenge, never the probe's handshake-only mode.
+    expect(url.searchParams.get('probe')).toBeNull()
+    expect(iframe?.title).not.toBe('')
+  })
+
+  it('delegates the features Turnstile asks for on its own widget frame', async () => {
+    await mount()
+
+    const allow = frame()?.allow ?? ''
+
+    // Permissions Policy is hierarchical: `api.js` sets these on the frame it renders inside
+    // our page, and that delegation grants nothing our own document was not granted first.
+    for (const feature of [
+      'cross-origin-isolated',
+      'fullscreen',
+      'autoplay',
+      'keyboard-map',
+      'gamepad',
+      'xr-spatial-tracking',
+    ])
+      expect(allow).toContain(feature)
+
+    // Not a Private State Token name, under either spelling: `api.js` asks for none an engine
+    // knows, so nothing a parent delegates can reach the capability.
+    expect(allow).not.toContain('token')
+  })
+
+  it('is loading until the frame hands back its handshake', async () => {
+    await mount()
+
+    expect(hook.status).toBe('loading')
+
+    fromFrame({ type: 'ready' })
+
+    expect(hook.status).toBe('ready')
+    // Rendered is not solved. A token here would enable Submit before anyone clicked.
+    expect(hook.token).toBeNull()
+  })
+
+  it('takes the solved token', async () => {
+    await mount()
+    fromFrame({ type: 'ready' })
+    fromFrame({ type: 'token', token: 'tok-1' })
+
+    expect(hook.token).toBe('tok-1')
+    expect(hook.status).toBe('ready')
+  })
+
+  it('refuses an empty token, which would enable Submit and then fail verification', async () => {
+    await mount()
+    fromFrame({ type: 'ready' })
+    fromFrame({ type: 'token', token: '' })
+
+    expect(hook.token).toBeNull()
+  })
+
+  it('drops the token on expiry, without blocking the form', async () => {
+    await mount()
+    fromFrame({ type: 'token', token: 'tok-1' })
+    fromFrame({ type: 'expired' })
+
+    expect(hook.token).toBeNull()
+    expect(hook.status).toBe('ready')
+  })
+
+  it('does not latch blocked: a later token wins the form back', async () => {
+    await mount()
+    fromFrame({ type: 'error' })
+
+    expect(hook.status).toBe('blocked')
+
+    // Turnstile's `retry` defaults to `auto`, so an errored challenge often solves by itself.
+    // Latching here would leave a visitor holding a valid token behind a dead submit button.
+    fromFrame({ type: 'token', token: 'tok-2' })
+
+    expect(hook.status).toBe('ready')
+    expect(hook.token).toBe('tok-2')
+  })
+
+  it.each([
+    ['another window', { source: window }],
+    ['another origin', { origin: 'https://evil.example' }],
+    // Anything else the page's own scripts post, `api.js` among them: same source, same origin.
+    ['no channel', { data: { type: 'token', token: 'tok-other' } }],
+  ])('ignores a token from %s', async (_label, overrides: MessageEventInit) => {
+    await mount()
+    fromFrame({ type: 'token', token: 'tok-1' }, overrides)
+
+    expect(hook.token).toBeNull()
+  })
+
+  it('reports blocked when the frame never answers', async () => {
+    vi.useFakeTimers()
+    await mount()
+
+    expect(hook.status).toBe('loading')
+
+    // A `frame-src` that refuses us, or a proxy that swallows the request, produces no message
+    // at all. Without this the form sat on `loading` for ever, behind a submit button that
+    // could never produce a token.
+    await act(async () => vi.advanceTimersByTimeAsync(10_000))
+
+    expect(hook.status).toBe('blocked')
+    vi.useRealTimers()
+  })
+
+  it('does not call the frame dead once it has handshaken', async () => {
+    vi.useFakeTimers()
+    await mount()
+    fromFrame({ type: 'ready' })
+
+    // An unsolved challenge is Turnstile's business after the handshake, not a dead frame's.
+    await act(async () => vi.advanceTimersByTimeAsync(60_000))
+
+    expect(hook.status).toBe('ready')
+    vi.useRealTimers()
+  })
+
+  it('asks the frame to reset, and drops the token first', async () => {
+    await mount()
+    fromFrame({ type: 'ready' })
+    fromFrame({ type: 'token', token: 'tok-1' })
+
+    const posted = vi.fn()
+
+    vi.spyOn(frame()?.contentWindow as Window, 'postMessage').mockImplementation(posted)
+
+    act(() => hook.reset())
+
+    expect(hook.token).toBeNull()
+    // Addressed to the frame's own origin, as narrowly as the inbound filter reads it: a frame
+    // navigated elsewhere gets no command rather than one aimed at whatever occupies it.
+    expect(posted).toHaveBeenCalledWith(
+      { channel: 'sahaj-atlas-turnstile', type: 'reset' },
+      new URL(frame()?.src as string).origin,
+    )
+  })
+
+  it('detaches its window listener on unmount', async () => {
+    // Not a tidiness check: the listener is on `window`, which the HOST page owns and which
+    // outlives every form. One leaked per open accumulates for the life of their page, and
+    // each kept its own frame reference alive. Removing the frame is covered by the
+    // theme-change case above, where a frame left behind is the one found.
+    const added = vi.spyOn(window, 'addEventListener')
+    const removed = vi.spyOn(window, 'removeEventListener')
+    const messages = (spy: typeof added) =>
+      spy.mock.calls.filter(([type]) => type === 'message').length
+
+    await mount()
+
+    expect(messages(added)).toBe(1)
+
+    cleanup?.()
+    cleanup = null
+
+    expect(messages(removed)).toBe(1)
+  })
+
+  it('reports blocked and mounts nothing when disabled', async () => {
+    function Disabled() {
+      const turnstile = useTurnstile({ disabled: true })
+
+      hook = turnstile
+
+      return <div ref={turnstile.challengeRef} />
+    }
+
+    await mount(<Disabled />)
+
+    expect(hook.status).toBe('blocked')
+    expect(frame()).toBeNull()
+  })
+
+  it('re-mounts the frame on a theme change, dropping the unsolved token with it', async () => {
+    const root = createRoot(container)
+
+    await act(async () => root.render(<Probe />))
+    cleanup = () => act(() => root.unmount())
+
+    fromFrame({ type: 'token', token: 'tok-light' })
+
+    expect(hook.token).toBe('tok-light')
+
+    theme = 'light'
+    await act(async () => root.render(<Probe />))
+
+    // Turnstile bakes the theme into the widget at render time, so the frame is replaced. The
+    // new widget has not been solved, so holding the old token would send a dead one.
+    expect(new URL(frame()?.src as string).searchParams.get('theme')).toBe('light')
+    expect(hook.token).toBeNull()
+  })
+})
+
+describe('probeTurnstile', () => {
+  const probeFrame = () =>
+    [...document.body.querySelectorAll('iframe')].find((node) =>
+      node.src.includes('/api/atlas/challenge'),
+    )
+
+  /**
+   * Starts the check on a FRESH copy of the module, and reports what it has decided so far.
+   *
+   * ⚠ **Fresh, because the verdict is memoized at module scope.** Every case here would
+   * otherwise read whichever answer the first one cached.
+   *
+   * ⚠ **Every case runs on fake timers, and that is the only thing that makes them
+   * non-vacuous.** The handshake timeout answers `false` too, so on real timers a case that
+   * awaits the verdict passes whether the signal it dispatched was read or ignored — it just
+   * takes ten seconds about it. Frozen, an ignored signal leaves the verdict pending for good.
+   */
+  async function startProbe() {
+    vi.useFakeTimers()
+    vi.resetModules()
+
+    const { probeTurnstile } = await import('./use-turnstile')
+    const verdicts: (boolean | 'pending')[] = []
+    const run = () => {
+      const index = verdicts.push('pending') - 1
+
+      return probeTurnstile().then((verdict) => {
+        verdicts[index] = verdict
+      })
+    }
+
+    return {
+      run,
+      done: run(),
+      settled: (index = 0) => verdicts[index],
+    }
+  }
+
+  const fromProbe = (message: PageMessage) => {
+    const iframe = probeFrame()
+
+    if (!iframe) throw new Error('no probe frame')
+
+    sendFromFrame(iframe, message)
+  }
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('mounts a handshake-only frame and resolves true on ready', async () => {
+    const probe = await startProbe()
+
+    expect(new URL(probeFrame()?.src as string).searchParams.get('probe')).toBe('1')
+
+    fromProbe({ type: 'ready' })
+    await probe.done
+
+    expect(probe.settled()).toBe(true)
+    // The frame is torn down with the verdict: it exists only to produce one.
+    expect(probeFrame()).toBeUndefined()
+  })
+
+  it('resolves false at once when the frame reports an error', async () => {
+    const probe = await startProbe()
+
+    // SahajCloud refusing this page's origin, among others: posted the moment the page loads.
+    fromProbe({ type: 'error' })
+    await probe.done
+
+    expect(probe.settled()).toBe(false)
+  })
+
+  it('resolves false only once the frame has had its full wait', async () => {
+    // A `frame-src` that refuses the frame is silent to its parent, so this is the path a host's
+    // stale CSP takes.
+    const probe = await startProbe()
+
+    await vi.advanceTimersByTimeAsync(9_999)
+
+    expect(probe.settled()).toBe('pending')
+
+    await vi.advanceTimersByTimeAsync(1)
+    await probe.done
+
+    expect(probe.settled()).toBe(false)
+  })
+
+  it('checks once per page and shares the answer', async () => {
+    const probe = await startProbe()
+
+    fromProbe({ type: 'ready' })
+    await probe.done
+
+    const second = probe.run()
+
+    await second
+
+    // A compact embed's dialog unmounts its children, so open/close/open would otherwise pay
+    // for a whole browsing context, three of our chunks and a Cloudflare script eval each time.
+    expect(probe.settled(1)).toBe(true)
+    expect(probeFrame()).toBeUndefined()
+  })
+
+  it('checks again after a negative verdict', async () => {
+    const probe = await startProbe()
+
+    fromProbe({ type: 'error' })
+    await probe.done
+
+    // Not cached: the same verdict covers a CSP refusal and a request that simply failed, and
+    // the second of those can recover. The script load this replaced cleared its memo for the
+    // same reason.
+    const second = probe.run()
+
+    expect(probeFrame()).toBeDefined()
+
+    fromProbe({ type: 'ready' })
+    await second
+
+    expect(probe.settled(1)).toBe(true)
+  })
+})
diff --git a/src/hooks/use-turnstile.ts b/src/hooks/use-turnstile.ts
index d7c6c379..0cdee3ba 100644
--- a/src/hooks/use-turnstile.ts
+++ b/src/hooks/use-turnstile.ts
@@ -3,230 +3,278 @@ import { type RefObject, useCallback, useEffect, useRef, useState } from 'react'
 import { useLocale } from '@/hooks/use-locale'
 import { useTheme } from '@/hooks/use-theme'
 
-// This renders Cloudflare Turnstile explicitly. See issue #79.
-// This code is hand-rolled, instead of adding `@marsidev/react-turnstile`.
-// Turnstile is a script tag and one render call.
-// The embedded bundle ships on host pages we do not control, so every added dependency is weight we would rather avoid.
+// Turnstile rendered explicitly, hand-rolled rather than through `@marsidev/react-turnstile`
+// (#79): this bundle ships on host pages we do not control, so a dependency is weight.
 //
-// ⚠ **The script is no longer lazy. That behavior inverted in issue #182.**
-// Registration is what this widget is for, and registration cannot happen without a token.
-// So a challenge that cannot load is a broken embed, not a form that degrades.
-// `useTurnstileProbe` starts the load as soon as the INTERFACE mounts, never the shell. See `FullInterface`.
-// It fails the widget when the load cannot complete.
-// So a host with an out-of-date CSP finds out from their own page, not from a visitor who could not register.
+// ⚠ **The challenge renders in a frame SahajCloud serves, never in the host's document (#343,
+// sydevs/SahajCloud#1072).** Turnstile validates the hostname of the document that renders it, so
+// one SahajCloud hostname covers every partner. SahajCloud holds both halves of the key and decides
+// which parents may receive a token; this file only frames the page and listens to it.
 //
-// The widget is still removed on unmount.
-// So reopening a form always gets a fresh challenge, not a stale or expired token.
-
-const SCRIPT_URL = 'https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit'
-
-// A Turnstile SITE key is public by design. The secret half lives in SahajCloud.
-// So the site key belongs in the committed `.env` file.
-// An absent key means the captcha cannot render, the same blocked state as a CSP-refused script.
-const SITE_KEY: string | undefined = import.meta.env.VITE_TURNSTILE_SITE_KEY
-
-type TurnstileRenderOptions = {
-  sitekey: string
-  theme?: 'light' | 'dark' | 'auto'
-  language?: string
-  callback?: (token: string) => void
-  'error-callback'?: () => void
-  'expired-callback'?: () => void
-}
+// ⚠ **Cross-repo contract** with SahajCloud's `src/endpoints/atlas/challenge/`: the path, the query
+// parameters, the channel and each message `type`. Change them in both repos in the same release —
+// a drifted protocol fails silently, the frame waiting out its handshake.
+//
+// ⚠ **The challenge is not lazy — that inverted in #182.** Registration cannot happen without a
+// token, so a challenge that cannot load fails the widget as soon as the INTERFACE mounts
+// (`useTurnstileGuard`), and a host with a stale CSP hears it from their own page.
+
+const CHALLENGE_PATH = '/api/atlas/challenge'
+
+/**
+ * Stamped on every message, both ways. `source` and `origin` pin a message to SahajCloud's page,
+ * but that page also runs Cloudflare's `api.js`, so they cannot tell this protocol from anything
+ * else its scripts post.
+ */
+const CHALLENGE_CHANNEL = 'sahaj-atlas-turnstile'
+
+/**
+ * `ready` is the handshake: Turnstile is live in the frame. `error` includes SahajCloud refusing
+ * this page's origin, which no client record lists.
+ */
+type ChallengeEvent =
+  | { type: 'ready' }
+  | { type: 'expired' }
+  | { type: 'error' }
+  | { type: 'token'; token: string }
+
+function readChallengeEvent(data: unknown): ChallengeEvent | null {
+  if (typeof data !== 'object' || data === null) return null
+
+  const { channel, type, token } = data as Record<string, unknown>
 
-type TurnstileApi = {
-  render: (container: HTMLElement, options: TurnstileRenderOptions) => string | undefined
-  remove: (widgetId: string) => void
-  reset: (widgetId: string) => void
+  if (channel !== CHALLENGE_CHANNEL) return null
+  if (type === 'ready' || type === 'expired' || type === 'error') return { type }
+  // An empty token would enable Submit and then fail verification, which reads to a visitor as
+  // the form being broken rather than the challenge.
+  if (type === 'token' && typeof token === 'string' && token !== '') return { type, token }
+
+  return null
 }
 
-declare global {
-  interface Window {
-    turnstile?: TurnstileApi
+/** Cloudflare's own widget is 300×65, and nothing else is on the page. */
+const FRAME_WIDTH = 300
+const FRAME_HEIGHT = 65
+
+/**
+ * Bounds a frame that never answers. A `frame-src` that refuses it is silent to its parent, so
+ * this is also how a host's stale CSP is found. Nothing blocks on it, so a generous bound costs a
+ * late answer rather than a slow first paint.
+ */
+const HANDSHAKE_TIMEOUT_MS = 10_000
+
+/**
+ * Read off Turnstile's own `api.js` on 2026-11-02: what it sets on the widget frame it renders.
+ *
+ * ⚠ **Every policy-controlled feature is denied to a cross-origin child by default**, so without
+ * this the challenge is less capable than when `api.js` ran in the host's document. Permissions
+ * Policy is hierarchical, so it grants nothing the host did not.
+ *
+ * ⚠ **Private State Tokens cannot be delegated from here.** `api.js` asks for `private-token`,
+ * gated on `document.featurePolicy.features()`, which in Chromium 153 lists only
+ * `private-state-token-issuance` and `-redemption` — so the pair a parent can delegate reaches
+ * nothing. `docs/embedding.md` § Permissions Policy has the host-facing half.
+ */
+const TURNSTILE_FEATURES =
+  'cross-origin-isolated; fullscreen; autoplay; keyboard-map; gamepad; xr-spatial-tracking'
+
+type FrameOptions = { theme: 'light' | 'dark' | 'auto'; language: string; probe?: boolean }
+
+/**
+ * The frame, its listener, and the one definition of its liveness, for both the hook and the
+ * probe. `event.source` pins a message to this frame's window, which no other document can forge;
+ * `origin` pins it to SahajCloud, so a frame navigated elsewhere cannot answer as the challenge.
+ *
+ * ⚠ **Silence is delivered as the page's own `error`**: a frame that never handshakes is as dead
+ * as one that failed, and both callers already answer `error`.
+ */
+function createChallengeFrame(
+  { theme, language, probe = false }: FrameOptions,
+  onEvent: (message: ChallengeEvent) => void,
+) {
+  const url = new URL(CHALLENGE_PATH, import.meta.env.VITE_SAHAJCLOUD_URL)
+
+  // The page posts to this origin and no other, so it must be the document the frame is appended
+  // to — the host's in a script embed, ours in an iframe embed.
+  url.searchParams.set('parent', window.location.origin)
+  url.searchParams.set('theme', theme)
+  url.searchParams.set('language', language)
+  // Handshake only: a hidden render would spend a solve nobody submits.
+  if (probe) url.searchParams.set('probe', '1')
+
+  const frame = document.createElement('iframe')
+
+  frame.src = url.href
+  frame.width = String(FRAME_WIDTH)
+  frame.height = String(FRAME_HEIGHT)
+  frame.style.border = '0'
+  frame.title = 'Security check'
+  // SahajCloud reads the parent from the URL, so this withholds only the host page's path and query.
+  frame.referrerPolicy = 'strict-origin'
+  frame.allow = TURNSTILE_FEATURES
+
+  const onMessage = (event: MessageEvent) => {
+    // Presence as well as identity: before the frame has a window both sides are `null`, and a
+    // message carrying no source would pass an identity test alone.
+    if (!frame.contentWindow || event.source !== frame.contentWindow) return
+    if (event.origin !== url.origin) return
+
+    const message = readChallengeEvent(event.data)
+
+    if (!message) return
+
+    clearTimeout(timer)
+    onEvent(message)
   }
-}
+  const timer = setTimeout(() => onEvent({ type: 'error' }), HANDSHAKE_TIMEOUT_MS)
 
-// This is one in-flight load, shared by every caller.
-// This clears on failure, so a later open retries instead of caching a transient network error forever.
-let scriptPromise: Promise<void> | null = null
-
-function loadTurnstile(): Promise<void> {
-  if (window.turnstile) return Promise.resolve()
-  if (scriptPromise) return scriptPromise
-
-  scriptPromise = new Promise<void>((resolve, reject) => {
-    const script = document.createElement('script')
-
-    script.src = SCRIPT_URL
-    script.async = true
-    script.defer = true
-    // Cloudflare learns the embedding hostname regardless. That is how the domain check works.
-    // But a host page that opts into `unsafe-url` referrers would otherwise leak its full path and query on this request too.
-    // This sends the origin only.
-    script.referrerPolicy = 'strict-origin'
-    script.onload = () => resolve()
-    // This fires when a host page's CSP omits `challenges.cloudflare.com` from `script-src`.
-    // It also fires on an ordinary network failure.
-    script.onerror = () => {
-      // This drops the dead tag.
-      // `scriptPromise` clears below, so every reopen retries.
-      // Without this, a host page whose CSP blocks Cloudflare would pile up an orphaned `<script>` tag, and a blocked request, in their `<head>` each time.
-      script.remove()
-      reject(new Error('Turnstile script could not be loaded'))
-    }
-    document.head.appendChild(script)
-  }).catch((error: unknown) => {
-    scriptPromise = null
-    throw error
-  })
+  window.addEventListener('message', onMessage)
 
-  return scriptPromise
+  const dispose = () => {
+    clearTimeout(timer)
+    window.removeEventListener('message', onMessage)
+    frame.remove()
+  }
+
+  return { frame, origin: url.origin, dispose }
 }
 
+/** Shared by every mount on the page. Cleared on a negative verdict, so a blip is retried. */
+let availability: Promise<boolean> | null = null
+
 /**
- * This loads the Turnstile script without rendering a challenge, and reports whether the API arrived.
- *
- * This is the reading half of the eager check. See issue #182.
- * It answers "can this page run Turnstile at all," a question about the host's CSP and the network, not about any one form.
- * This resolves to `false` rather than rejecting, because every caller treats a failure as a verdict, not an exception.
+ * Whether Turnstile can run on this page at all — the host's CSP, SahajCloud's allowlist and the
+ * network, not any one form (#182). Resolves rather than rejecting: every caller wants a verdict.
+ * Memoized, so a compact embed's open/close/open does not pay for a browsing context each time.
  *
- * ⚠ **This check is strictly weaker than a real render, and that gap is deliberate, not overlooked.**
- * Three failures are visible from here: no site key, a `script-src` that refuses `challenges.cloudflare.com`,
- * and a script that loads without defining the API, such as a content blocker or an enterprise proxy answering 200 with a stub.
- * Two failures are not visible from here: a `frame-src` that blocks the challenge iframe, and a sitekey the embedding domain is not registered for.
- * Both of those surface only when `turnstile.render` actually runs.
- * So this check is the early warning, and `useTurnstile`'s own `blocked` status remains the backstop.
- * Neither replaces the other.
+ * ⚠ **Weaker than a real render, deliberately.** The probe hands back the handshake without
+ * rendering, so it sees whatever stops the page loading Turnstile, but not a challenge that
+ * renders and then errors — `useTurnstile`'s `blocked` backstops that.
+ * ⚠ The hostname mismatch it could never see is **gone** rather than unobserved: the challenge
+ * always renders on the one hostname the Turnstile key lists, SahajCloud's (#343).
  */
 export async function probeTurnstile(): Promise<boolean> {
-  if (!SITE_KEY) return false
+  if (typeof document === 'undefined') return false
 
-  try {
-    await loadTurnstile()
+  availability ??= new Promise<boolean>((resolve) => {
+    const { frame, dispose } = createChallengeFrame(
+      { theme: 'auto', language: 'auto', probe: true },
+      (message) => {
+        if (message.type !== 'ready' && message.type !== 'error') return
 
-    return Boolean(window.turnstile)
-  } catch {
-    return false
-  }
+        dispose()
+        resolve(message.type === 'ready')
+      },
+    )
+
+    // ⚠ `fixed`, not `absolute`: this lands in the HOST page's body, where an out-of-flow element
+    // at its static position still extends the scroll area. Hidden rather than `display: none`,
+    // to keep the check as close as possible to the frame a form mounts.
+    frame.style.cssText =
+      'position:fixed;top:0;left:0;width:1px;height:1px;opacity:0;pointer-events:none;border:0'
+    frame.setAttribute('aria-hidden', 'true')
+    frame.tabIndex = -1
+    document.body.appendChild(frame)
+  }).then((available) => {
+    if (!available) availability = null
+
+    return available
+  })
+
+  return availability
 }
 
 /**
- * This is `loading` until the challenge renders.
- * This is `blocked` when Turnstile is unavailable: no site key, a CSP-blocked script, or a widget that errors out, such as when `frame-src` blocks the challenge iframe.
- * A caller must degrade on `blocked`, rather than leaving a submit button that can never produce a token.
+ * `loading` until the challenge renders, `blocked` when Turnstile is unavailable. A caller must
+ * degrade on `blocked` rather than leave a submit button that can never produce a token.
  */
 export type TurnstileStatus = 'loading' | 'ready' | 'blocked'
 
 export type UseTurnstileOptions = {
-  /** This skips loading entirely and reports `blocked`, for the Ladle story's degraded case. */
+  /** Skips the frame entirely and reports `blocked`, for the Ladle story's degraded case. */
   disabled?: boolean
 }
 
 export type UseTurnstile = {
-  /** Attach to the element the challenge renders into. */
+  /** Attach to the element the challenge frame is appended to. */
   challengeRef: RefObject<HTMLDivElement>
-  /** This is the solved token, or null while unsolved or expired. */
+  /** The solved token, or null while unsolved or expired. */
   token: string | null
   status: TurnstileStatus
   /**
-   * This discards the current token and re-runs the challenge in place.
+   * Discards the token and re-runs the challenge in place. A no-op while it is not rendered, so
+   * a caller never has to check `status` first.
    *
-   * **A Turnstile token is single-use.** The server redeems it the moment it verifies, before it does the work the token was gating.
-   * So after ANY failed submit, the token in hand may already be spent.
-   * Re-sending it would then be refused for the rest of the widget's life.
-   * A caller whose submit failed must reset, rather than offer a retry that cannot succeed.
-   *
-   * This is a no-op while the challenge is not rendered, blocked or still loading.
-   * So a caller never has to check `status` first.
+   * **A Turnstile token is single-use**, redeemed the moment the server verifies it and before
+   * the work it gated. So after ANY failed submit the token in hand may be spent, and re-sending
+   * it is refused for the rest of the widget's life: a caller whose submit failed must reset
+   * rather than offer a retry that cannot succeed.
    */
   reset: () => void
 }
 
 export function useTurnstile({ disabled = false }: UseTurnstileOptions = {}): UseTurnstile {
   const challengeRef = useRef<HTMLDivElement>(null)
-  // This is held in a ref as well as the effect closure.
-  // So `reset` can reach the live widget without re-running, and so re-rendering, the challenge.
-  const widgetIdRef = useRef<string | undefined>(undefined)
+  // A ref as well as the effect closure, so `reset` reaches the live frame without re-running the
+  // effect. The origin rides along so a frame navigated elsewhere receives no command.
+  const frameRef = useRef<{ frame: HTMLIFrameElement; origin: string } | null>(null)
   const [token, setToken] = useState<string | null>(null)
-  const [status, setStatus] = useState<TurnstileStatus>(
-    disabled || !SITE_KEY ? 'blocked' : 'loading',
-  )
+  const [status, setStatus] = useState<TurnstileStatus>(disabled ? 'blocked' : 'loading')
   const { theme } = useTheme()
   const { languageCode } = useLocale()
 
-  // Re-rendering on a theme or language change is deliberate.
-  // Turnstile bakes both into the widget at render time.
-  // So the challenge tears down and re-renders, which also drops the token correctly, since the new widget has not been solved.
+  // Re-mounting on a theme or language change is deliberate: Turnstile bakes both in at render
+  // time, so the frame carries them in its URL and the teardown drops the unsolved token with it.
   useEffect(() => {
-    if (disabled || !SITE_KEY) return
-
-    let cancelled = false
+    if (disabled || !challengeRef.current) return
 
     setToken(null)
     setStatus('loading')
 
-    loadTurnstile()
-      .then(() => {
-        if (cancelled) return
-
-        // The script can "load" without giving this hook an API.
-        // A content blocker, or an enterprise proxy that answers 200 with a stub, does exactly this.
-        // This treats a missing API as blocked.
-        // Returning early instead would strand `status` on `'loading'`, leaving a permanently disabled submit button with no mailto escape.
-        if (!challengeRef.current || !window.turnstile) {
-          setStatus('blocked')
-
-          return
-        }
-
-        widgetIdRef.current = window.turnstile.render(challengeRef.current, {
-          sitekey: SITE_KEY,
-          theme,
-          language: languageCode,
-          // Turnstile's `retry` option defaults to `auto`.
-          // So a transient failure is often followed by an automatic retry that solves.
-          // So `blocked` must NOT be a one-way latch.
-          // A solved challenge has to win the form back.
-          // Otherwise the user holds a valid token while the UI still offers only the mailto escape.
-          callback: (solved) => {
-            setToken(solved)
+    const { frame, origin, dispose } = createChallengeFrame(
+      { theme, language: languageCode },
+      (message) => {
+        switch (message.type) {
+          case 'ready':
+            setStatus('ready')
+            break
+          // Turnstile's `retry` defaults to `auto`, so a transient failure is often followed by a
+          // retry that solves. `blocked` must NOT latch, or the user holds a valid token while
+          // the UI still offers only the mailto escape.
+          case 'token':
+            setToken(message.token)
             setStatus('ready')
-          },
-          'error-callback': () => {
+            break
+          case 'expired':
+            setToken(null)
+            break
+          case 'error':
             setToken(null)
             setStatus('blocked')
-          },
-          'expired-callback': () => setToken(null),
-        })
-        // `render` returns undefined instead of a widget id when it refuses.
-        // The most common cause is a sitekey the embedding domain is not registered for.
-        // No widget means no token, so this state is blocked, not ready.
-        setStatus(widgetIdRef.current ? 'ready' : 'blocked')
-      })
-      .catch(() => {
-        if (!cancelled) setStatus('blocked')
-      })
+            break
+        }
+      },
+    )
+
+    frameRef.current = { frame, origin }
+    challengeRef.current.appendChild(frame)
 
     return () => {
-      cancelled = true
-      // This ref is written only past the `cancelled` guard above.
-      // React runs this cleanup before the next effect body.
-      // So the ref holds THIS run's widget, or nothing.
-      if (widgetIdRef.current) window.turnstile?.remove(widgetIdRef.current)
-      widgetIdRef.current = undefined
+      dispose()
+      frameRef.current = null
     }
   }, [disabled, theme, languageCode])
 
-  // This is stable across renders, with no dependencies.
-  // The caller passes this straight to `useMutation`'s `onError`.
-  // A fresh identity on each render would re-run the observer's `setOptions` for nothing.
-  // `reset` re-runs the challenge, which calls the same `callback` on success.
-  // So the new token arrives through the normal path.
+  // Stable with no dependencies: the caller hands this to `useMutation`'s `onError`, and a fresh
+  // identity each render would re-run the observer's `setOptions` for nothing. The new token
+  // arrives through the normal path, since the re-run challenge sends `token` on success.
   const reset = useCallback(() => {
-    if (!widgetIdRef.current) return
+    const live = frameRef.current
+
+    if (!live?.frame.contentWindow) return
 
     setToken(null)
-    window.turnstile?.reset(widgetIdRef.current)
+    live.frame.contentWindow.postMessage({ channel: CHALLENGE_CHANNEL, type: 'reset' }, live.origin)
   }, [])
 
   return { challengeRef, token, status, reset }
diff --git a/src/mocks/errors.ts b/src/mocks/errors.ts
index c0f4e2fc..b359b868 100644
--- a/src/mocks/errors.ts
+++ b/src/mocks/errors.ts
@@ -28,9 +28,10 @@ export const mockErrors: Record<ErrorKind, unknown> = {
   'not-found': atlasError('not-found', 'Region not found: atlantis'),
   // An embed whose API key SahajCloud rejects.
   config: sdkError(401, 'Unauthorized'),
-  // A host page whose CSP refuses challenges.cloudflare.com, so no form in the widget can
-  // produce a token (issue #182). Tagged rather than script-driven for the same reason
-  // `offline` is: the fixture must classify the same way wherever the story renders.
+  // A host page whose CSP refuses to frame SahajCloud's challenge page, so it cannot
+  // render and no form can produce a token (issues #182, #343). Tagged rather than
+  // frame-driven for the same reason `offline` is: the fixture must classify the same way
+  // wherever the story renders.
   'captcha-blocked': atlasError('captcha-blocked', 'Turnstile could not be loaded'),
   // Anything unrecognized — the catch-all that offers both a retry and a report. A zod
   // parse failure lands here too, which is why the fixture IS one: `contract` used to be
diff --git a/src/test-support/turnstile-frame.ts b/src/test-support/turnstile-frame.ts
new file mode 100644
index 00000000..4f4729c8
--- /dev/null
+++ b/src/test-support/turnstile-frame.ts
@@ -0,0 +1,74 @@
+import { vi } from 'vitest'
+
+/**
+ * SahajCloud's wire format (`src/endpoints/atlas/challenge/` there), written out rather than
+ * imported: the hook keeps its protocol private, and a stub speaking it through the hook's own
+ * constant would pass with both sides wrong together.
+ */
+const CHANNEL = 'sahaj-atlas-turnstile'
+
+/** A message as SahajCloud's page posts it, before the channel is stamped on. */
+export type PageMessage = { type: string } & Record<string, unknown>
+
+const isReset = (data: unknown) =>
+  typeof data === 'object' &&
+  data !== null &&
+  (data as Record<string, unknown>).channel === CHANNEL &&
+  (data as Record<string, unknown>).type === 'reset'
+
+/**
+ * Stands in for the challenge PAGE, never for our own hook (#343).
+ *
+ * `useTurnstile` mounts a frame on SahajCloud's origin and waits for its `postMessage`
+ * handshake, so this speaks that protocol from the other side. What the specs using it are
+ * for is the form's own wiring — the token reaching Submit, and a failed submit asking for a
+ * fresh challenge — and mocking the hook would skip exactly that.
+ *
+ * Call it after the form has mounted: the frame is appended in an effect.
+ *
+ * @param container the element the form rendered into
+ */
+export function challengeFrameStub(container: ParentNode) {
+  const frame = container.querySelector('iframe')
+
+  if (!frame?.contentWindow) throw new Error('no Turnstile challenge frame')
+
+  let resets = 0
+
+  vi.spyOn(frame.contentWindow, 'postMessage').mockImplementation(((data: unknown) => {
+    if (isReset(data)) resets += 1
+  }) as Window['postMessage'])
+
+  return {
+    /** The challenge renders and is solved, which is what hands the form its token. */
+    solve: (token = 'tok-live') => {
+      sendFromFrame(frame, { type: 'ready' })
+      sendFromFrame(frame, { type: 'token', token })
+    },
+    /** How many times the form asked the frame for a fresh challenge. */
+    resetCount: () => resets,
+  }
+}
+
+/**
+ * Dispatches one message as the challenge page would, for a spec driving the frame directly.
+ *
+ * ⚠ The origin is read off the frame's own `src`. The hook builds that URL from
+ * `VITE_SAHAJCLOUD_URL`, so hard-coding one here would make the hook's own origin check pass or fail for
+ * a reason unrelated to what the spec is testing. `overrides` is what lets a case send a
+ * deliberately wrong source, origin or shape.
+ */
+export function sendFromFrame(
+  frame: HTMLIFrameElement,
+  message: PageMessage,
+  overrides: MessageEventInit = {},
+) {
+  window.dispatchEvent(
+    new MessageEvent('message', {
+      data: { channel: CHANNEL, ...message },
+      origin: new URL(frame.src).origin,
+      source: frame.contentWindow,
+      ...overrides,
+    }),
+  )
+}
diff --git a/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx b/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx
index b7be3823..2db53034 100644
--- a/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx
+++ b/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx
@@ -69,16 +69,15 @@ const Sentinel = () => <p>{INTERFACE}</p>
 
 /**
  * A child that reaches for Turnstile the way `FullInterface` does (issue #182) — the fifth
- * candidate for the bug this file exists to catch, and the first one that injects a
- * third-party script into a page this project does not own, rather than merely fetching or
- * reporting.
+ * candidate for the bug this file exists to catch, and the first one that puts a request to a
+ * page this project does not own into their document, rather than merely fetching or reporting.
  *
  * This calls the real hook, rather than a stand-in. What is being asserted is that React never
  * renders this subtree, so anything the subtree would do is equally prevented. A fake would
  * only prove the fake stayed unrendered.
  */
-const TURNSTILE_SRC = 'challenges.cloudflare.com'
-const turnstileScripts = () => document.querySelectorAll(`script[src*="${TURNSTILE_SRC}"]`).length
+const challengeFrames = () =>
+  document.querySelectorAll('iframe[src*="/api/atlas/challenge"]').length
 
 function InterfaceWithTurnstile() {
   useTurnstileGuard()
@@ -109,23 +108,23 @@ describe('CompactEmbedView — what a collapsed card mounts', () => {
   })
 
   // The fifth candidate for the four-bug pattern above, and the one with a cost outside this
-  // project's own page. A collapsed card is one button in somebody's sidebar. Loading
-  // Cloudflare's challenge for it would put a third-party script into their document, and a
-  // request to Cloudflare from every page view, for an interface nobody opened (issue #182).
-  it('injects no Turnstile script while collapsed, and does once opened', () => {
-    expect(turnstileScripts()).toBe(0)
+  // project's own page. A collapsed card is one button in somebody's sidebar. Checking the
+  // captcha for it would put a document of ours in theirs, and a request to Cloudflare from
+  // inside it, on every page view, for an interface nobody opened (issue #182).
+  it('mounts no Turnstile frame while collapsed, and does once opened', () => {
+    expect(challengeFrames()).toBe(0)
 
     mount(<InterfaceWithTurnstile />)
 
-    // Searched from `document`, not the host element: `loadTurnstile` appends to `<head>`.
-    expect(turnstileScripts()).toBe(0)
+    // Searched from `document`, not the host element: the probe appends to `<body>`.
+    expect(challengeFrames()).toBe(0)
 
     const button = document.querySelector('button')
 
     act(() => button?.dispatchEvent(new MouseEvent('click', { bubbles: true })))
 
     // The paired positive, for the same reason as the case above: without it a guard that
-    // never loaded Turnstile at all would pass, and take the eager check with it.
-    expect(turnstileScripts()).toBe(1)
+    // never reached for Turnstile at all would pass, and take the eager check with it.
+    expect(challengeFrames()).toBe(1)
   })
 })
diff --git a/tests/smoke/embed.smoke.test.ts b/tests/smoke/embed.smoke.test.ts
index 4dbfb7c4..077ec6b3 100644
--- a/tests/smoke/embed.smoke.test.ts
+++ b/tests/smoke/embed.smoke.test.ts
@@ -1,10 +1,6 @@
 import { describe, expect, test } from 'vitest'
 
-import { appPreviewHost } from '../../scripts/assert-preview-host.mjs'
-import { appWorkerName } from '../../scripts/_wrangler-config.mjs'
-import { findLiveSiteKeys, findTestSiteKeys } from '../../scripts/turnstile-release-guard.mjs'
-
-import { PREVIEW_URL, fetchPreview, skipWithoutPreview } from './_helpers/preview'
+import { fetchPreview, skipWithoutPreview } from './_helpers/preview'
 
 // Smoke test: does the deploy serve the file a host installs?
 //
@@ -53,7 +49,7 @@ function fetchEmbed() {
  * Only a clean crawl is cached. A broken chunk or a thrown fetch clears it, so each retry
  * crawls again rather than replaying the same transient 5xx (see `fetchEmbed`).
  */
-let crawl: Promise<{ seen: string[]; broken: string[]; bodies: Map<string, string> }> | undefined
+let crawl: Promise<{ seen: string[]; broken: string[] }> | undefined
 
 function crawlDeploy() {
   crawl ??= crawlFromLoader().then(
@@ -137,13 +133,12 @@ async function crawlFromLoader() {
         bodies.set(next, text)
         queue.push(next)
       } else {
-        bodies.set(next, '')
         broken.push(`${next} → ${res.status} ${type}`)
       }
     }
   }
 
-  return { seen: [...seen], broken, bodies }
+  return { seen: [...seen], broken }
 }
 
 describe('embed bundle', () => {
@@ -180,55 +175,3 @@ describe('embed bundle', () => {
     expect(broken).toEqual([])
   })
 })
-
-// The live half of #259's release guard: the build refuses a production build on the test key,
-// and this reads what production actually serves, so a bypassed build gate still goes red.
-//
-// ⚠ The one spec in this lane whose expectation depends on the host, because the committed
-// `.env` key IS correct on a preview — no real key validates on a `workers.dev` host. Only an
-// address `assert-preview-host.mjs` accepts as the app Worker's preview may carry it; every
-// other host, `sahajatlas.com` among them, is held to production's standard. The preview half is
-// what keeps the production half honest: the same patterns must FIND the test key there, so a
-// minifier change that hid the literal fails the PR gate instead of greening production.
-//
-// Both patterns come from the guard, so what this reads back is what the gate passes. Defining
-// "a real key" a second time here, stricter, reddens production over a key the gate accepted.
-
-describe('turnstile site key', () => {
-  test.skipIf(skipWithoutPreview)(
-    'ships the test key only on a preview, and a real key everywhere else',
-    async () => {
-      const { bodies, broken } = await crawlDeploy()
-
-      // A chunk that failed to fetch is stored with an empty body, so a 404 on the chunk
-      // carrying the key would read here as an unset build variable. The sibling case above
-      // owns that failure and names it correctly.
-      if (broken.length > 0) return
-
-      const where = (find: (body: string) => string[]) =>
-        [...bodies].flatMap(([path, body]) => find(body).map((key) => `${path}: ${key}`))
-
-      const testKeys = where(findTestSiteKeys)
-      // A real key is public, but it stays out of CI logs: named by prefix only.
-      const liveKeys = where((body) => findLiveSiteKeys(body).map((key) => `${key.slice(0, 7)}…`))
-
-      if (appPreviewHost(PREVIEW_URL as string, appWorkerName())) {
-        expect(
-          testKeys.length,
-          'no Turnstile test key found on a preview — moved, or renamed?',
-        ).toBeGreaterThan(0)
-
-        return
-      }
-
-      expect(
-        testKeys,
-        'production serves the Turnstile TEST key: set VITE_TURNSTILE_SITE_KEY as a Workers Builds build variable (docs/environment.md)',
-      ).toEqual([])
-      expect(
-        liveKeys.length,
-        'production serves no Turnstile site key at all: VITE_TURNSTILE_SITE_KEY is unset on its build',
-      ).toBeGreaterThan(0)
-    },
-  )
-})
diff --git a/vite.config.ts b/vite.config.ts
index 96994c20..0f409c8c 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -11,7 +11,6 @@ import process from 'node:process'
 import { resolve } from 'path'
 
 import flattenEntryImports from './scripts/flatten-entry-imports.mjs'
-import { turnstileReleaseGuard } from './scripts/turnstile-release-guard.mjs'
 
 /**
  * Where the emitted CSS goes instead of `document.head` (#236).
@@ -282,8 +281,6 @@ export default defineConfig(({ command }) => ({
     // `<script>` tag parsed up front.
     flattenEntryImports('loader'),
     stripDsStore(),
-    // Fails a production build that would ship `.env`'s test Turnstile key (#259).
-    turnstileReleaseGuard(),
     // This plugin's position in the array does not set its order.
     // `sentryVitePlugin` returns `enforce: 'pre'`, so Vite hoists it
     // ahead of every plugin above, regardless of array order. What makes