From 8729ff1f59ba649d166363d44b5a46417600abc1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 1 Nov 2026 20:11:49 +0000
Subject: [PATCH 01/14] fix(turnstile): render the challenge in a frame on our
 own origin

Turnstile validates the hostname of the document that RENDERS the challenge,
not the top-level page. The script embed puts our tree inside the host's
document, so every partner site not on the widget's Turnstile hostname list
failed its captcha with 110200 and the visitor got the captcha-blocked screen.
The free plan caps that list at 10 hostnames, 5 of which were already spent.

The challenge now renders in a small frame served from /challenge.html on the
widget's own origin, so Turnstile always sees sahajatlas.com whatever page
hosts the widget. One hostname list covers every partner, with no per-site
onboarding step and no SahajCloud change.

- challenge.html + src/challenge.ts: a third Vite HTML input. Loads api.js
  under its own policy, renders the site key with the theme and language the
  parent gives it on the query string, and talks to its parent over
  postMessage. The reset lives in style ATTRIBUTES because every stylesheet in
  this build is rewritten to :where(.sy-atlas), which matches nothing here.
- src/lib/turnstile-frame.ts: the protocol, shared by both sides of the frame
  rather than duplicated, so it cannot drift silently.
- useTurnstile keeps its public shape. It appends the frame instead of calling
  turnstile.render, accepts only messages whose source is the frame's own
  contentWindow and whose origin is the frame's, and posts `reset` instead of
  calling turnstile.reset.
- probeTurnstile mounts the frame in probe mode: the page hands back its
  handshake and renders nothing, so the eager check spends no solve. It now
  SEES a frame-src refusal, through securitypolicyviolation, which it could
  never see before; the hostname mismatch it also could not see is gone rather
  than unobserved.
- CSP_ADVICE names our origin under frame-src, read off the frame URL so a
  preview and a dev server each name the host they need.
- embed.smoke.test.ts crawls the challenge page's graph too: the site key moved
  there, and the loader's graph alone reads as production carrying no key.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mg9rjYffj6R24HDkeuBGpj
---
 CHANGELOG.md                                  |  17 +
 challenge.html                                |  32 ++
 docs/embedding.md                             | 167 ++++----
 docs/environment.md                           |   2 +-
 docs/testing.md                               |   2 +-
 src/challenge.ts                              | 126 ++++++
 .../RegistrationForm.submit.test.tsx          |  28 +-
 .../ReportIssueForm.submit.test.tsx           |  33 +-
 src/hooks/use-turnstile-guard.test.tsx        |  16 +-
 src/hooks/use-turnstile-guard.ts              |  23 +-
 src/hooks/use-turnstile.test.tsx              | 373 ++++++++++++++++++
 src/hooks/use-turnstile.ts                    | 296 +++++++-------
 src/lib/turnstile-frame.test.ts               | 141 +++++++
 src/lib/turnstile-frame.ts                    | 141 +++++++
 src/test-support/turnstile-frame.ts           |  49 +++
 .../CompactEmbedView.mount.test.tsx           |  24 +-
 tests/smoke/embed.smoke.test.ts               | 110 +++++-
 vite.config.ts                                |   4 +
 18 files changed, 1302 insertions(+), 282 deletions(-)
 create mode 100644 challenge.html
 create mode 100644 src/challenge.ts
 create mode 100644 src/hooks/use-turnstile.test.tsx
 create mode 100644 src/lib/turnstile-frame.test.ts
 create mode 100644 src/lib/turnstile-frame.ts
 create mode 100644 src/test-support/turnstile-frame.ts

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5e55bd12..bb98d789 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -44,6 +44,22 @@ cover everything a host would notice since the widget was first deployed.
 
 ### Changed
 
+- ⚠ **BREAKING: your CSP needs `frame-src https://sahajatlas.com`, and the three
+  `challenges.cloudflare.com` entries can go.** ([#343]) The captcha that gates every form now
+  renders in a small frame served from the widget's own origin, instead of inside your document.
+  So `challenges.cloudflare.com` leaves your `script-src`, `connect-src` and `frame-src`, and
+  the widget's origin joins `frame-src`. **A policy that does not allow our origin to be framed
+  shows the error screen**, exactly as a blocked Turnstile did before — and the console names
+  the directive. Leaving the old three in place breaks nothing; they are simply dead.
+
+  Two things improve for you, and neither needs a change. **Onboarding a site needs no captcha
+  step at all**: Turnstile validates the hostname of the document that renders the challenge, so
+  every partner site used to need its hostname registered with us before a registration could be
+  sent — and the free plan caps that list at ten. It is our one hostname now, whatever page
+  hosts the widget. And **no script of Cloudflare's runs in your document any more**: the
+  requests to `challenges.cloudflare.com` are made by our frame, so your page's URL is no longer
+  the document asking.
+
 - **A repeat embed report turns into at most one write in any 6 h window.** ([#160]) The widget
   still reports on every page load, and an unchanged report inside that window is answered
   without a write. This guide and the embedding guide had both published the window as one hour.
@@ -844,6 +860,7 @@ must-revalidate`, pinned rather than left to the CDN default. The production dom
 [#312]: https://github.com/sydevs/SahajAtlasWeb/pull/312
 [#320]: https://github.com/sydevs/SahajAtlasWeb/issues/320
 [#326]: https://github.com/sydevs/SahajAtlasWeb/issues/326
+[#343]: https://github.com/sydevs/SahajAtlasWeb/issues/343
 [#322]: https://github.com/sydevs/SahajAtlasWeb/issues/322
 [#329]: https://github.com/sydevs/SahajAtlasWeb/pull/329
 [#325]: https://github.com/sydevs/SahajAtlasWeb/issues/325
diff --git a/challenge.html b/challenge.html
new file mode 100644
index 00000000..3e73b548
--- /dev/null
+++ b/challenge.html
@@ -0,0 +1,32 @@
+<!doctype html>
+
+<!--
+  The Turnstile challenge, served from the widget's own origin and framed by the widget
+  (#343). Turnstile validates the hostname of the document that renders it, so rendering it
+  inside a partner's page failed with `110200` on every hostname not on the widget's list.
+  Here it always sees `sahajatlas.com`. src/lib/turnstile-frame.ts carries the reasoning.
+
+  This is not a page anybody navigates to — src/challenge.ts talks to its parent frame and
+  nothing else. It carries no stylesheet of ours: the widget's sheet is scoped to `.sy-atlas`
+  and adopted into a shadow root, neither of which exists here, and the only thing on the page
+  is Cloudflare's own 300×65 widget.
+
+  ⚠ The reset is in `style` ATTRIBUTES, and may not move into a `<style>` block. Every
+  stylesheet in this build goes through scripts/postcss-scope-widget.mjs, which rewrites each
+  selector to `:where(.sy-atlas)` — measured here, where it collapsed `html, body` onto one
+  selector matching neither element, so the body kept its 8px default margin and pushed the
+  widget out of a frame sized to it. Transparent, so the challenge sits on whatever surface
+  the form puts the frame on; Cloudflare's widget paints its own card.
+-->
+<html lang="en" style="margin: 0; padding: 0; background: transparent; overflow: hidden">
+  <head>
+    <meta charset="UTF-8" />
+    <!-- As index.html: the layer that does not depend on Cloudflare serving public/_headers. -->
+    <meta name="robots" content="noindex" />
+    <title>Security check</title>
+  </head>
+  <body style="margin: 0; padding: 0; background: transparent; overflow: hidden">
+    <div id="challenge"></div>
+    <script type="module" src="/src/challenge.ts"></script>
+  </body>
+</html>
diff --git a/docs/embedding.md b/docs/embedding.md
index 0ee41d76..e71d1381 100644
--- a/docs/embedding.md
+++ b/docs/embedding.md
@@ -793,15 +793,20 @@ and `cloud.sydevelopers.com` is in `connect-src` already, for the widget's own r
 If your page sends a CSP, this is what the widget needs added to it. **It is a list of
 additions to your policy, not a policy** — your own sources still have to be in there.
 
+**There is nothing to configure per site for the captcha.** Every form in the widget is behind a
+Cloudflare Turnstile challenge, and that challenge is served, rendered and validated on the
+widget's own origin. So onboarding a new site needs no key of yours, no account of yours, and no
+hostname of yours registered with us. The `frame-src` line below is the whole of it.
+
 ```
-script-src  https://sahajatlas.com https://api.mapbox.com https://challenges.cloudflare.com https://cdn.usefathom.com
+script-src  https://sahajatlas.com https://api.mapbox.com https://cdn.usefathom.com
 worker-src  blob:
 child-src   blob:
 style-src   'unsafe-inline'
 font-src    https://sahajatlas.com
 img-src     data: https://api.mapbox.com https://imagedelivery.net https://cloud.sydevelopers.com https://react-circle-flags.pages.dev
-connect-src https://cloud.sydevelopers.com https://api.mapbox.com https://events.mapbox.com https://ipwho.is https://challenges.cloudflare.com https://cdn.usefathom.com https://*.sentry.io
-frame-src   https://challenges.cloudflare.com
+connect-src https://cloud.sydevelopers.com https://api.mapbox.com https://events.mapbox.com https://ipwho.is https://cdn.usefathom.com https://*.sentry.io
+frame-src   https://sahajatlas.com
 ```
 
 **One line per directive, deliberately: CSP ignores every repeat of a directive name after the
@@ -814,7 +819,6 @@ believing you allowed something you hadn't.
 | -------------------------- | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `script-src`               | the widget's origin                           | The `<script>` tag fetches a small entry that pulls the rest of the bundle from the same origin. It also pulls the calendar, registration and share panels, but only once a viewer opens them.                                                                                                                                                                                                                                                                                        | nothing renders — or worse, it renders and then dies on one of those three presses                                                                                                                            |
 |                            | `api.mapbox.com`                              | Mapbox GL's right-to-left text plugin, loaded on demand from inside the map's worker on first RTL text. Workers inherit the document's policy, so this lands on `script-src` rather than `worker-src`.                                                                                                                                                                                                                                                                                | Arabic, Hebrew and Persian labels on the map render in the wrong order                                                                                                                                        |
-|                            | `challenges.cloudflare.com`                   | **Turnstile — required.** Every write the widget makes is captcha-gated, so registration is impossible without it. Loaded as soon as the interface mounts, so a policy that omits it fails immediately rather than at the moment somebody registers.                                                                                                                                                                                                                                  | **the widget shows an error screen and does not run.** Not a degradation — see the note below                                                                                                                 |
 |                            | `cdn.usefathom.com`                           | analytics, only on a build with an analytics ID                                                                                                                                                                                                                                                                                                                                                                                                                                       | analytics only                                                                                                                                                                                                |
 | `worker-src` / `child-src` | `blob:`                                       | Mapbox GL compiles its worker bundle into a `Blob` and starts a module Worker from the resulting `blob:` URL. `child-src` is the fallback for engines predating `worker-src`.                                                                                                                                                                                                                                                                                                         | **the map fails**, the rest of the widget is unaffected                                                                                                                                                       |
 | `style-src`                | `'unsafe-inline'`                             | **Narrower than its name suggests.** The widget's own stylesheet is a constructed `CSSStyleSheet` adopted by its shadow root, which `style-src` does not reach on the one engine that was measured. What the directive governs is the `<style>` elements the widget and its libraries still install at runtime — the `@font-face` rules in your `<head>`, and the place-search field's own stylesheet — plus the `style` attributes they set, which the note below covers separately. | the interface renders, fully styled. You lose the typeface — as the `font-src` row below — and place search, whose library reads back the stylesheet it just installed and throws when the browser refuses it |
@@ -827,45 +831,30 @@ believing you allowed something you hadn't.
 |                            | `api.mapbox.com`                              | tile and style requests. Also the place-search geocoder, and the reverse lookup naming the visitor's own location for "find my location".                                                                                                                                                                                                                                                                                                                                             | the map and search fail                                                                                                                                                                                       |
 |                            | `events.mapbox.com`                           | Mapbox GL's own map-load telemetry                                                                                                                                                                                                                                                                                                                                                                                                                                                    | nothing visible                                                                                                                                                                                               |
 |                            | `ipwho.is`                                    | the once-per-session IP→city lookup behind "classes near you"                                                                                                                                                                                                                                                                                                                                                                                                                         | **degrades**: the nearby suggestion is skipped                                                                                                                                                                |
-|                            | `challenges.cloudflare.com`                   | Turnstile's own verification calls                                                                                                                                                                                                                                                                                                                                                                                                                                                    | **as `script-src` above — the widget does not run**                                                                                                                                                           |
 |                            | `cdn.usefathom.com`                           | analytics, conditional as above                                                                                                                                                                                                                                                                                                                                                                                                                                                       | analytics only                                                                                                                                                                                                |
 |                            | `*.sentry.io`                                 | crash reporting. Contacted **only after the widget has already failed**, and only on a build with a DSN.                                                                                                                                                                                                                                                                                                                                                                              | **degrades**: the widget notices the refusal and stops trying for the rest of the page's life                                                                                                                 |
-| `frame-src`                | `challenges.cloudflare.com`                   | the Turnstile challenge iframe                                                                                                                                                                                                                                                                                                                                                                                                                                                        | **the challenge cannot be solved, so no form can be sent**                                                                                                                                                    |
+| `frame-src`                | the widget's origin                           | **The captcha — required.** Every write the widget makes is captcha-gated, so registration is impossible without it. The challenge is Cloudflare Turnstile, and it renders in a small frame the widget serves from its own origin rather than in your document, so `challenges.cloudflare.com` belongs in no directive of yours. The frame is mounted as soon as the interface does, so a policy that omits this fails immediately rather than at the moment somebody registers.      | **the widget shows an error screen and does not run.** Not a degradation — see the note below                                                                                                                 |
 
 Notes on that table:
 
-**A challenge SOLVES on this exact policy, with no `'unsafe-eval'` in it.** A forced interactive
-challenge was clicked through in the widget's own report-issue form, in a built `map=false` embed
-and a host page served from one origin with the block above sent as a response header: the
-challenge reached its success state, the widget took the token, and the form's Submit went from
-disabled to enabled. Six runs of six in Chromium 141.0.7390.37, 2026-10-11 — three on the policy
-verbatim, three with `'unsafe-eval'` added to `script-src`, identical in both. **Do not add
-`'unsafe-eval'`.** The challenge runs inside the `challenges.cloudflare.com` frame, a separate
-document that sends its own `script-src 'nonce-…' 'unsafe-eval'`, so `frame-src` above is the
-only directive of yours that governs it at all — which is why Cloudflare's own CSP guidance for
-Turnstile asks for `challenges.cloudflare.com` under `script-src` and `frame-src`, and for
-nothing else.
-
-⚠ **The refused `eval` is not something every page view produces, and a page showing it has not
-been watched solve.** It was observed 3 times in 3 on 2026-10-10 — Chromium 141, a built
-`map=false` embed, this policy — as `Refused to evaluate a string as JavaScript because
-'unsafe-eval' is not an allowed source of script`, reported against `script-src` with a blocked
-URI of `eval`, carrying no source file and no stack, the signature of a cross-origin script —
-Turnstile's `api.js`, which does run in your document and which your `script-src` does govern.
-The widget rendered, routed and read its data normally in all three. Cloudflare ships that script
-continuously, and on 2026-10-11 it did not occur in any run: nine in the widget's own embed —
-three on the policy verbatim, three with `'unsafe-eval'` added, three on the 2026-10-10
-always-passes setup — and six more on an isolated `api.js` page. So the solve above was measured
-in its absence, not alongside it. Harmless where it has appeared, then, and normal where it has
-not. A refusal _beside_ a challenge that will not solve is the one combination nobody has seen:
-tell us if you do.
-
-⚠ **Three further things the 2026-10-11 runs did not cover.** The site key was Cloudflare's
-`3x00000000000000000000FF`, which forces the real interactive challenge, rather than the
-production key — the always-passes key short-circuits before any challenge code and can answer
-nothing here, which is why it is not what was used. Nothing was posted to the backend, so the
-measurement ends at the token rather than at an accepted submission. And map mode was not
-measured, for want of a Mapbox token, as on 2026-10-10.
+**Nothing of Cloudflare's runs in your document, and `'unsafe-eval'` is not wanted here.** The
+challenge is a separate document on the widget's own origin, which loads Turnstile's `api.js`
+under its own policy and nests Cloudflare's own challenge frame inside itself. So your
+`frame-src` above is the only directive of yours that reaches any of it. **Do not add
+`'unsafe-eval'`**, and do not add `challenges.cloudflare.com` — neither buys you anything, and
+Cloudflare's own CSP guidance for Turnstile is about the page that renders the challenge, which
+is ours rather than yours.
+
+⚠ **A challenge was watched SOLVE on the earlier arrangement, not on this one.** On 2026-10-11 a
+forced interactive challenge rendered in the host's own document was clicked through in six runs
+of six, Chromium 141.0.7390.37, on the policy of that day: the challenge reached its success
+state, the widget took the token, and Submit went from disabled to enabled. What has been
+measured since is that the challenge reaches its success state in a nested frame on our origin
+and that `frame-src` is what refuses it — not a full solve-and-submit on a partner site. Two
+things have therefore never been covered in either arrangement: nothing was posted to the
+backend, so the measurement ends at the token rather than at an accepted submission, and map
+mode was not measured, for want of a Mapbox token. Tell us if a challenge will not solve on
+this policy.
 
 **The `style-src` row was measured, not deduced** — Chromium 141, 2026-10-10, against a
 `map=false` embed served with the policy above and `'unsafe-inline'` removed from `style-src`
@@ -910,13 +899,13 @@ latches off after the first refusal rather than retrying.
 **Five entries are load-bearing. The rest cost only the feature in their own row.** If you allow
 nothing else, allow these — each breaks the widget as a whole:
 
-|                                        |                                     |
-| -------------------------------------- | ----------------------------------- |
-| `script-src` the widget's origin       | nothing renders                     |
-| `script-src challenges.cloudflare.com` | the widget shows an error and stops |
-| `connect-src cloud.sydevelopers.com`   | no data at all                      |
-| `worker-src blob:`                     | the map never renders               |
-| `img-src data:`                        | the map renders with no pins        |
+|                                      |                                     |
+| ------------------------------------ | ----------------------------------- |
+| `script-src` the widget's origin     | nothing renders                     |
+| `frame-src` the widget's origin      | the widget shows an error and stops |
+| `connect-src cloud.sydevelopers.com` | no data at all                      |
+| `worker-src blob:`                   | the map never renders               |
+| `img-src data:`                      | the map renders with no pins        |
 
 ⚠ **`style-src 'unsafe-inline'` was on that list and has left it.** It was there on the strength
 of a consequence measured before the widget moved into a shadow root, when the stylesheet really
@@ -925,18 +914,21 @@ what of — on Chromium, which is the only engine that degradation was measured
 it: a visitor who gets your typeface and no place search is still worse off. But do not trade a
 load-bearing entry away to afford it.
 
-⚠ **`challenges.cloudflare.com` moved into that list, and it is the one change here that can
-break a page which used to work.** It was previously a degradation: a host that blocked it got a
-working atlas whose report form offered an email address instead of a submit button. It is now
-fatal, deliberately — **every write the widget makes is captcha-gated, registration included, and
-registration is the thing the atlas exists for.** A blocked challenge meant a visitor could browse
-classes and then silently fail to sign up for one, with no reason for the page owner to suspect
-anything was wrong. Failing loudly is worse for five minutes and better thereafter.
-
-If your atlas has stopped working since this change, this is almost certainly why: add
-`https://challenges.cloudflare.com` to **both** `script-src` and `frame-src`, and to
-`connect-src`. The widget also writes the specific directive it needs to the browser console, so
-a developer looking at the page gets the answer without opening this document.
+⚠ **The captcha entry is on that list, and it is the one that can break a page which used to
+work.** It was once a degradation: a host that blocked the challenge got a working atlas whose
+report form offered an email address instead of a submit button. It is now fatal, deliberately —
+**every write the widget makes is captcha-gated, registration included, and registration is the
+thing the atlas exists for.** A blocked challenge meant a visitor could browse classes and then
+silently fail to sign up for one, with no reason for the page owner to suspect anything was
+wrong. Failing loudly is worse for five minutes and better thereafter.
+
+⚠ **Which line that entry is has CHANGED.** It used to be `challenges.cloudflare.com`, under
+`script-src`, `frame-src` and `connect-src`. It is now `https://sahajatlas.com` under
+`frame-src` alone, and the three Cloudflare entries can go. A policy still carrying the old
+three is not broken by this — they are simply dead — but one that never had `frame-src
+https://sahajatlas.com` will show the error screen. The widget writes the specific directive it
+needs to the browser console, so a developer looking at the page gets the answer without opening
+this document.
 
 Everything else degrades to exactly what its "Blocked ⇒" column says — a missing typeface, a
 search field that offers no places, missing photography, missing flags, no analytics, no
@@ -1184,6 +1176,14 @@ maintainers rather than editing the snippet:
   carries the visitor's **`navigator.userAgent`**. No global error handler is installed, so your
   own scripts' exceptions are never captured. No breadcrumbs, no session replay.
 
+**The captcha's own requests no longer come from your page.** Cloudflare Turnstile gates every
+form in the widget, and the challenge is now a small frame served from the widget's origin, so
+the requests to `challenges.cloudflare.com` are made by that frame's document rather than by
+yours. Cloudflare still sees the visitor's IP, as it did before — what changed is that it no
+longer sees your page as the document asking, and no script of Cloudflare's runs in your
+document. The frame is mounted as soon as the interface is, so this happens whether or not the
+visitor opens a form.
+
 **`map=false` removes the Mapbox flows too** — tiles, the geocoder (which sends the visitor's
 typed query and the map centre to Mapbox), and the map-load telemetry — along with the two
 `mapbox.*` storage keys. That is the only switch for them, since they are Mapbox's own behaviour,
@@ -1249,33 +1249,32 @@ Three things to check when you migrate:
 
 ## Troubleshooting
 
-| Symptom                                                                      | Likely cause                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Nothing renders, a 404 for the script**                                    | The filename is `auto.js`. `embed.js` exists but is the widget the loader fetches, not the file you install.                                                                                                                                                                                                                                                                                                                                                                                                  |
-| **"Not set up correctly" / configuration error**                             | The parameter is `key`, not `api-key` (renamed when configuration moved onto the script URL). The loader logs an error naming it. Otherwise the key is wrong, revoked, or not yet issued.                                                                                                                                                                                                                                                                                                                     |
-| **Nothing renders, no console error, script loaded fine**                    | `map=false` with no height on the element — it collapsed to zero. Give it `display:block;height:…`.                                                                                                                                                                                                                                                                                                                                                                                                           |
-| **Console: "the embed script is on this page more than once"**               | Exactly that. Only one widget runs per page, so the second copy renders nothing and its settings are ignored. Remove the extra script tag.                                                                                                                                                                                                                                                                                                                                                                    |
-| **Text is in your own font, and the search field offers no places**          | `style-src 'unsafe-inline'` is missing from your CSP. The console says `Refused to apply inline style`, and the violation reports name **`style-src-elem`**. The field keeps its box — it falls back to a plain text input — and the rest of the interface keeps its styling, since the widget's own sheet is not governed by `style-src`.                                                                                                                                                                    |
-| **Labels are English on a non-English page**                                 | Either `connect-src https://cloud.sydevelopers.com` is missing, or that language is not switched on in the CMS. The widget carries English compiled in, so this is what a blocked or unavailable language looks like — ask us to enable the language you need.                                                                                                                                                                                                                                                |
-| **Widget loads and styles, but shows an error instead of any events**        | `connect-src https://cloud.sydevelopers.com` is missing.                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| **The map area is blank or grey**                                            | `worker-src blob:` (Mapbox starts its worker from a `blob:` URL), or `api.mapbox.com` missing from `img-src`/`connect-src`.                                                                                                                                                                                                                                                                                                                                                                                   |
-| **The map renders but has no pins**                                          | `img-src data:` — the pins are inline SVG rasterised from a `data:` URI.                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| **Country flags are missing, everything else fine**                          | `img-src https://react-circle-flags.pages.dev`. Cosmetic.                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| **Console: "Refused to evaluate a string as JavaScript"**                    | Turnstile's `api.js` evaluating a string in your document, with no `'unsafe-eval'` in `script-src`. Harmless wherever it has appeared, and it does not appear on every page view. The challenge itself runs in a frame under Cloudflare's own policy, and solved on this CSP in later runs — which did not show the refusal. It is **not** the row below: a blocked Turnstile replaces the widget with an error screen instead. See the note under [the CSP table](#why-each-one-and-what-breaks-without-it). |
-| **The widget shows "its security check was blocked" and nothing else**       | Turnstile is blocked — add `challenges.cloudflare.com` to `script-src`, `frame-src` and `connect-src`. The browser console carries the exact directive. This used to degrade the report form instead — since the atlas cannot take a registration without it, it now fails outright.                                                                                                                                                                                                                          |
-| **The widget's route never appears in the address bar**                      | The document refuses `history.replaceState` — most often `file://`. The widget detects that and routes in memory.                                                                                                                                                                                                                                                                                                                                                                                             |
-| **The compact card's button does nothing, in an iframe**                     | The frame is sandboxed without `allow-popups`, so its `target="_blank"` link cannot open. It fails silently, with nothing in the console. Add `allow-popups`, or drop `sandbox`.                                                                                                                                                                                                                                                                                                                              |
-| **`atlas=` on the script URL seems to be ignored**                           | The page's own URL already carries an `?atlas=` route, which always wins. That is intended — see [`atlas`, and how the route is chosen](#atlas-and-how-the-route-is-chosen).                                                                                                                                                                                                                                                                                                                                  |
-| **Sharing offers no link**                                                   | The same memory-routing mode, on a page with no canonical atlas URL to offer instead.                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| **The widget covers the rest of the page**                                   | A map embed with no height of its own renders `position: fixed; inset: 0`. Give the element a `display: block` and a height to keep the map inside it, or use `map=false` for an embed with no map.                                                                                                                                                                                                                                                                                                           |
-| **The widget looks wrong on your site only**                                 | Not a selector of yours — the shadow root stops those. Look instead at an inherited property the widget does not restate on its own root, your root `font-size` (the calendar only), or the `sahaj-atlas-fonts` `<style>` missing from your `<head>` — or sitting there inert, which is what a `style-src` without `'unsafe-inline'` leaves behind. See [what the widget does to your page](#what-the-widget-does-to-your-page).                                                                              |
-| **It broke after working yesterday**                                         | The embed updates in place. Check [`CHANGELOG.md`](../CHANGELOG.md). Then look for a cached `auto.js` or `embed.js` at your edge requesting chunk names that no longer exist.                                                                                                                                                                                                                                                                                                                                 |
-| **Console: "could not find a place to render"**                              | The snippet is in `<head>`, or carries `async`/`defer`. Move it into the body without those attributes, or add an empty `<sahaj-atlas></sahaj-atlas>` where the widget should appear.                                                                                                                                                                                                                                                                                                                         |
-| **Nothing renders; console: "Cannot use import statement outside a module"** | The script tag lost its `type="module"`. An optimizer or an HTML5-cleanup filter rewrote the tag, or combined `auto.js` into a classic bundle. Exclude `auto.js` from minifying, combining and delaying, and from any filter that rewrites script tags. None of the widget runs in this state, so this browser error is the only report you get.                                                                                                                                                              |
-| **Console: "could not load the widget"**                                     | The loader ran, but `embed.js` or one of its `assets/` chunks did not load — the error printed with it names the URL. Look for that request in the network panel: a blocker, a CSP rule, or a stale copy cached at your edge (see [Updates and caching](#updates-and-caching)).                                                                                                                                                                                                                               |
-| **The widget shows an error after the page is translated**                   | A translation plugin rewrote the widget's text in the browser and ignored its `translate="no"`. Add `sahaj-atlas` to the plugin's excluded elements — see [the widget follows your page's language](#the-widget-follows-your-pages-language).                                                                                                                                                                                                                                                                 |
-| **Console: "no `key` parameter on the embed script URL"**                    | The query string is missing or was stripped. Some page builders drop everything after `?` from a script URL — if so, that platform cannot host the widget this way. Talk to the maintainers.                                                                                                                                                                                                                                                                                                                  |
-| **The widget only appears when you scroll to it**                            | Intended. The loader defers fetching the widget until it nears the viewport. A below-the-fold widget therefore costs visitors nothing until they reach it.                                                                                                                                                                                                                                                                                                                                                    |
+| Symptom                                                                      | Likely cause                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| ---------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Nothing renders, a 404 for the script**                                    | The filename is `auto.js`. `embed.js` exists but is the widget the loader fetches, not the file you install.                                                                                                                                                                                                                                                                                                                     |
+| **"Not set up correctly" / configuration error**                             | The parameter is `key`, not `api-key` (renamed when configuration moved onto the script URL). The loader logs an error naming it. Otherwise the key is wrong, revoked, or not yet issued.                                                                                                                                                                                                                                        |
+| **Nothing renders, no console error, script loaded fine**                    | `map=false` with no height on the element — it collapsed to zero. Give it `display:block;height:…`.                                                                                                                                                                                                                                                                                                                              |
+| **Console: "the embed script is on this page more than once"**               | Exactly that. Only one widget runs per page, so the second copy renders nothing and its settings are ignored. Remove the extra script tag.                                                                                                                                                                                                                                                                                       |
+| **Text is in your own font, and the search field offers no places**          | `style-src 'unsafe-inline'` is missing from your CSP. The console says `Refused to apply inline style`, and the violation reports name **`style-src-elem`**. The field keeps its box — it falls back to a plain text input — and the rest of the interface keeps its styling, since the widget's own sheet is not governed by `style-src`.                                                                                       |
+| **Labels are English on a non-English page**                                 | Either `connect-src https://cloud.sydevelopers.com` is missing, or that language is not switched on in the CMS. The widget carries English compiled in, so this is what a blocked or unavailable language looks like — ask us to enable the language you need.                                                                                                                                                                   |
+| **Widget loads and styles, but shows an error instead of any events**        | `connect-src https://cloud.sydevelopers.com` is missing.                                                                                                                                                                                                                                                                                                                                                                         |
+| **The map area is blank or grey**                                            | `worker-src blob:` (Mapbox starts its worker from a `blob:` URL), or `api.mapbox.com` missing from `img-src`/`connect-src`.                                                                                                                                                                                                                                                                                                      |
+| **The map renders but has no pins**                                          | `img-src data:` — the pins are inline SVG rasterised from a `data:` URI.                                                                                                                                                                                                                                                                                                                                                         |
+| **Country flags are missing, everything else fine**                          | `img-src https://react-circle-flags.pages.dev`. Cosmetic.                                                                                                                                                                                                                                                                                                                                                                        |
+| **The widget shows "its security check was blocked" and nothing else**       | The captcha's frame is blocked — add `https://sahajatlas.com` to `frame-src`. The browser console carries the exact directive. `challenges.cloudflare.com` is **not** the answer any more: the challenge renders on our origin, not in your document. This used to degrade the report form instead — since the atlas cannot take a registration without it, it now fails outright.                                               |
+| **The widget's route never appears in the address bar**                      | The document refuses `history.replaceState` — most often `file://`. The widget detects that and routes in memory.                                                                                                                                                                                                                                                                                                                |
+| **The compact card's button does nothing, in an iframe**                     | The frame is sandboxed without `allow-popups`, so its `target="_blank"` link cannot open. It fails silently, with nothing in the console. Add `allow-popups`, or drop `sandbox`.                                                                                                                                                                                                                                                 |
+| **`atlas=` on the script URL seems to be ignored**                           | The page's own URL already carries an `?atlas=` route, which always wins. That is intended — see [`atlas`, and how the route is chosen](#atlas-and-how-the-route-is-chosen).                                                                                                                                                                                                                                                     |
+| **Sharing offers no link**                                                   | The same memory-routing mode, on a page with no canonical atlas URL to offer instead.                                                                                                                                                                                                                                                                                                                                            |
+| **The widget covers the rest of the page**                                   | A map embed with no height of its own renders `position: fixed; inset: 0`. Give the element a `display: block` and a height to keep the map inside it, or use `map=false` for an embed with no map.                                                                                                                                                                                                                              |
+| **The widget looks wrong on your site only**                                 | Not a selector of yours — the shadow root stops those. Look instead at an inherited property the widget does not restate on its own root, your root `font-size` (the calendar only), or the `sahaj-atlas-fonts` `<style>` missing from your `<head>` — or sitting there inert, which is what a `style-src` without `'unsafe-inline'` leaves behind. See [what the widget does to your page](#what-the-widget-does-to-your-page). |
+| **It broke after working yesterday**                                         | The embed updates in place. Check [`CHANGELOG.md`](../CHANGELOG.md). Then look for a cached `auto.js` or `embed.js` at your edge requesting chunk names that no longer exist.                                                                                                                                                                                                                                                    |
+| **Console: "could not find a place to render"**                              | The snippet is in `<head>`, or carries `async`/`defer`. Move it into the body without those attributes, or add an empty `<sahaj-atlas></sahaj-atlas>` where the widget should appear.                                                                                                                                                                                                                                            |
+| **Nothing renders; console: "Cannot use import statement outside a module"** | The script tag lost its `type="module"`. An optimizer or an HTML5-cleanup filter rewrote the tag, or combined `auto.js` into a classic bundle. Exclude `auto.js` from minifying, combining and delaying, and from any filter that rewrites script tags. None of the widget runs in this state, so this browser error is the only report you get.                                                                                 |
+| **Console: "could not load the widget"**                                     | The loader ran, but `embed.js` or one of its `assets/` chunks did not load — the error printed with it names the URL. Look for that request in the network panel: a blocker, a CSP rule, or a stale copy cached at your edge (see [Updates and caching](#updates-and-caching)).                                                                                                                                                  |
+| **The widget shows an error after the page is translated**                   | A translation plugin rewrote the widget's text in the browser and ignored its `translate="no"`. Add `sahaj-atlas` to the plugin's excluded elements — see [the widget follows your page's language](#the-widget-follows-your-pages-language).                                                                                                                                                                                    |
+| **Console: "no `key` parameter on the embed script URL"**                    | The query string is missing or was stripped. Some page builders drop everything after `?` from a script URL — if so, that platform cannot host the widget this way. Talk to the maintainers.                                                                                                                                                                                                                                     |
+| **The widget only appears when you scroll to it**                            | Intended. The loader defers fetching the widget until it nears the viewport. A below-the-fold widget therefore costs visitors nothing until they reach it.                                                                                                                                                                                                                                                                       |
 
 If none of these fit, the widget's own **Report an issue** form (behind the settings
 control, and offered on most error screens) reaches the maintainers with the failure
diff --git a/docs/environment.md b/docs/environment.md
index 5e98c454..d31b4a30 100644
--- a/docs/environment.md
+++ b/docs/environment.md
@@ -19,7 +19,7 @@ place it is stated — everywhere else in this repo just points here.
 | --------------------------- | ----------------------------- | ------- |
 | `VITE_SAHAJCLOUD_URL`      | `.env`                        | SahajCloud origin. The client appends `/api`. Default `https://cloud.sydevelopers.com`. Local backend: `http://localhost:3000`. |
 | `ATLAS_API_KEY`            | shell (never committed)       | A **production** `sahaj-atlas-client` API key, read by `pnpm sync:translations` to pull the English copy out of SahajCloud. Build-time only, no `VITE_` prefix — it never reaches the bundle. The script falls back to `VITE_SAHAJCLOUD_API_KEY` **only** when `VITE_SAHAJCLOUD_URL` is the production origin: a key minted against a local CMS, sent to `cloud.sydevelopers.com`, lands in production's log as a rejected credential and gets rotated in a hurry. ⚠ It replaced `VITE_HOST` here, which #198 deleted along with `public/locales/` — the widget fetches its copy from SahajCloud now, so there is no second origin to name. |
-| `VITE_TURNSTILE_SITE_KEY`  | `.env` **+ Cloudflare — Production build variable** | Cloudflare Turnstile **site** key for the registration and report-issue forms. Public by design — the secret half lives in SahajCloud — so this is committed. `.env` holds Cloudflare's always-passes test key `1x00000000000000000000AA` for dev, Ladle, and CI. Production overrides it with the real `0x4AAAA…` key as a **build variable** on the app Worker's production Workers Builds trigger (Workers & Pages → `sahajatlas` → Settings → Build → Variables and secrets). ⚠ **A runtime variable (Settings → Variables and Secrets) does nothing here** — Vite inlines the key at build time, and this Worker runs no code. Previews keep the test key on purpose: a real key validates only on the hostnames it lists, and a preview's `workers.dev` host is not one. **A release guard holds this (#259)**: `scripts/turnstile-release-guard.mjs`, a Vite plugin, fails a production build whose resolved key is a test key (any `[123]x0000…`), empty, or not a bare `0x…` key (quotes or spaces pasted around it would reach Turnstile too), naming the variable and this setting. Production means Workers Builds (`WORKERS_CI=1`) building `main`, or naming no branch at all — it fails closed; every other branch, every GitHub Actions build and every local build passes on the test key. ⚠ **It guards a build, so production can change without it**: a manual `wrangler deploy` of a locally built `dist/`, or promoting or rolling back to a version no production build made — and every same-repo PR's smoke job uploads a test-key version of this very Worker (`ci.yml`, `versions upload`), so the dashboard's version list is full of them. `embed.smoke.test.ts` reads the live key after every Workers Builds deploy; after any of the others, run `Production Smoke` by hand. ⚠ It also assumes only the production trigger builds `main`: a preview trigger whose branch rule is `*` would build `main` without the key and go red on every merge. Unset, `probeTurnstile` answers `false` and `useTurnstileGuard` fails the whole widget to the captcha-blocked screen — the same state as a CSP-refused script, and no `mailto:` fallback since #182. **Since #103 this key is load-bearing, not decorative.** The form now sends a real email through SahajCloud's captcha-gated endpoint. In production, the test key then makes that captcha a no-op. A site key that does not pair with SahajCloud's `TURNSTILE_SECRET_KEY` makes every report fail with a 403 `captcha_failed`. The viewer sees only one sentence of text for this. |
+| `VITE_TURNSTILE_SITE_KEY`  | `.env` **+ Cloudflare — Production build variable** | Cloudflare Turnstile **site** key for the registration and report-issue forms. Public by design — the secret half lives in SahajCloud — so this is committed. ⚠ **`src/challenge.ts` is its ONE reader since #343** — the challenge renders in a frame served from `/challenge.html` on the widget's own origin, so Turnstile always sees `sahajatlas.com` whatever page hosts the widget, and the key is inlined into that page's chunk rather than the widget's. `embed.smoke.test.ts` reads both graphs for that reason: the widget's alone would report production as carrying no key at all. `.env` holds Cloudflare's always-passes test key `1x00000000000000000000AA` for dev, Ladle, and CI. Production overrides it with the real `0x4AAAA…` key as a **build variable** on the app Worker's production Workers Builds trigger (Workers & Pages → `sahajatlas` → Settings → Build → Variables and secrets). ⚠ **A runtime variable (Settings → Variables and Secrets) does nothing here** — Vite inlines the key at build time, and this Worker runs no code. Previews keep the test key on purpose: a real key validates only on the hostnames it lists, and a preview's `workers.dev` host is not one — the frame makes every HOST page's hostname irrelevant, never the deploy's own. **A release guard holds this (#259)**: `scripts/turnstile-release-guard.mjs`, a Vite plugin, fails a production build whose resolved key is a test key (any `[123]x0000…`), empty, or not a bare `0x…` key (quotes or spaces pasted around it would reach Turnstile too), naming the variable and this setting. Production means Workers Builds (`WORKERS_CI=1`) building `main`, or naming no branch at all — it fails closed; every other branch, every GitHub Actions build and every local build passes on the test key. ⚠ **It guards a build, so production can change without it**: a manual `wrangler deploy` of a locally built `dist/`, or promoting or rolling back to a version no production build made — and every same-repo PR's smoke job uploads a test-key version of this very Worker (`ci.yml`, `versions upload`), so the dashboard's version list is full of them. `embed.smoke.test.ts` reads the live key after every Workers Builds deploy; after any of the others, run `Production Smoke` by hand. ⚠ It also assumes only the production trigger builds `main`: a preview trigger whose branch rule is `*` would build `main` without the key and go red on every merge. Unset, `probeTurnstile` answers `false` and `useTurnstileGuard` fails the whole widget to the captcha-blocked screen — the same state as a CSP-refused script, and no `mailto:` fallback since #182. **Since #103 this key is load-bearing, not decorative.** The form now sends a real email through SahajCloud's captcha-gated endpoint. In production, the test key then makes that captcha a no-op. A site key that does not pair with SahajCloud's `TURNSTILE_SECRET_KEY` makes every report fail with a 403 `captcha_failed`. The viewer sees only one sentence of text for this. |
 | `VITE_SENTRY_DSN`          | Cloudflare — **Production + Preview** | Sentry ingest DSN for automatic error reporting (issue #108). Use the **modern public-key form** `https://<key>@<host>/<project>`. The legacy `https://<key>:<secret>@…` form puts a real secret in the public bundle. A DSN is write-only, so it is public by design. This repo still does **not** commit it to `.env`: a committed DSN would send every fork, preview, and `pnpm dev` into the production project. Set it per Workers Builds trigger in the Cloudflare dashboard. This org is in Sentry's **DE region**, so the ingest host is `o…​.ingest.de.sentry.io` — not `…us…`, which is what the DSN's own text will tell you. **The integrator CSP needs no edit for it**: `docs/embedding.md`'s `connect-src` row already carries `*.sentry.io`, wide on purpose so a regional host matches (#123). **Unset, `reportInternalError` only logs to the console** — the SDK chunk is never fetched, and that is the only gate there is: the `error-reporting` embed attribute was removed in #149. **Preview carries one too, and that is load-bearing, not a convenience** (#232): `boot-origins.smoke.test.ts` reads the ingest host back off the deploy, and `assert-preview-host.mjs` refuses the Worker's own production host, so a preview is the only deploy the PR gate can observe. ⚠ Since #282 the preview's copy is an **Actions secret in this repo**, read by `ci.yml`'s publish build — not a Cloudflare Preview-environment variable. The production deploy's stays in the dashboard. |
 | `VITE_SENTRY_ENVIRONMENT`  | Cloudflare — **Preview**       | The `environment` tag on every reported event (#232). It replaced `import.meta.env.MODE`, which reads `production` for **every** `vite build`, preview included — so with a DSN on Preview, preview noise would be indistinguishable from the events that matter. Set it to `preview` there and leave Production alone: unset, a build defaults to `production` and `pnpm dev` to `development`, so nothing gets mislabelled. Not a secret, and not in `.env`, where it would be inert anyway — nothing reports without a DSN. |
 | `SENTRY_AUTH_TOKEN`        | Cloudflare                    | **Build-time only, and a real secret** (issue #130). It carries no `VITE_` prefix, so Vite cannot inline it. **`pnpm assert:maps` also greps every emitted file for its value** and fails the build if it appears — a gate, not a habit. Its presence switches source-map upload on. Set: `build.sourcemap: 'hidden'`, and `@sentry/vite-plugin` uploads the maps, then deletes them. Unset: **no maps are emitted at all**, and the build matches one from before #130 byte-for-byte. See runbook step 2 for the token scopes it needs. The plugin never creates, finalizes, or sets commits on a release. Still, the upload call stays release-scoped. |
diff --git a/docs/testing.md b/docs/testing.md
index 453b7382..d1994504 100644
--- a/docs/testing.md
+++ b/docs/testing.md
@@ -288,7 +288,7 @@ alert. The lane's last step opens an issue instead, and three things about it ar
   production read, and a ticket claiming production is red when nothing read it is worse than no
   ticket. `ci-workflows.test.ts` pins that gate and the token, since both fail silently.
 
-**One spec is scoped by environment, on purpose** (#259): `embed.smoke.test.ts`'s Turnstile case expects the committed test site key on an address `assert-preview-host.mjs` accepts as the app Worker's preview, and a real `0x4…` key with no test key everywhere else — so a bypassed build gate still reddens production. The preview half keeps the production half from passing vacuously: the same patterns must find the test key there. Measured 2026-10-30: green on `sahajatlas.com` and on `pr-344`'s preview, red against a locally served build carrying the test key and against one carrying no key. Every other spec reads both hosts alike. The lane is **18 cases**, from 14 declarations — count it rather
+**One spec is scoped by environment, on purpose** (#259): `embed.smoke.test.ts`'s Turnstile case expects the committed test site key on an address `assert-preview-host.mjs` accepts as the app Worker's preview, and a real `0x4…` key with no test key everywhere else — so a bypassed build gate still reddens production. The preview half keeps the production half from passing vacuously: the same patterns must find the test key there. ⚠ **It reads two graphs, and must keep doing so** (#343): the key moved into `challenge.html`'s chunk, which the loader crawl cannot reach because nothing `import()`s the challenge page — the widget frames it by a URL composed at runtime. Measured 2026-11-01 against a locally served build: the loader's graph alone reports "no Turnstile site key at all", the false reading that spec exists to avoid. Measured 2026-10-30: green on `sahajatlas.com` and on `pr-344`'s preview, red against a locally served build carrying the test key and against one carrying no key. Every other spec reads both hosts alike. The lane is **20 cases**, from 16 declarations — count it rather
 than trusting a figure, since `.each` makes the two differ. Measured 2026-10-06 against the 16 it
 was then: all 16 passed against `sahajatlas.com`. Re-measured 2026-10-13 against the playground
 on its Worker (`PREVIEW_URL=https://design.sahajatlas.com pnpm test:smoke`, #279): **10 of the 17
diff --git a/src/challenge.ts b/src/challenge.ts
new file mode 100644
index 00000000..d589988b
--- /dev/null
+++ b/src/challenge.ts
@@ -0,0 +1,126 @@
+/**
+ * The Turnstile challenge, rendered on the widget's OWN origin and framed by the widget (#343).
+ *
+ * Why this page exists at all is in `src/lib/turnstile-frame.ts`: Turnstile checks the hostname
+ * of the document that renders it, so a script embed rendering the challenge inside the host's
+ * page failed on every partner hostname. Everything here runs in a frame the widget mounts; it
+ * is never a page a visitor navigates to.
+ *
+ * ⚠ **Every framer is untrusted, and that is fine.** A Turnstile token is single-use and only
+ * redeemable against SahajCloud's secret for this site key, so anybody who frames this page can
+ * obtain one exactly as they could by loading Turnstile themselves. That is why the token goes
+ * out with `'*'` as the target origin: the parent's origin is the host site's, unknown here and
+ * different per partner, and pinning it would need a list this approach exists to avoid.
+ */
+
+import {
+  type ChallengeEvent,
+  challengeMessage,
+  parseChallengeCommand,
+  readChallengeOptions,
+} from '@/lib/turnstile-frame'
+
+const SCRIPT_URL = 'https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit'
+
+// The site key is public by design — the secret half lives in SahajCloud. This page is its one
+// reader now, so `scripts/turnstile-release-guard.mjs` gates the build that inlines it here.
+const SITE_KEY: string | undefined = import.meta.env.VITE_TURNSTILE_SITE_KEY
+
+type TurnstileRenderOptions = {
+  sitekey: string
+  theme?: 'light' | 'dark' | 'auto'
+  language?: string
+  callback?: (token: string) => void
+  'error-callback'?: () => void
+  'expired-callback'?: () => void
+}
+
+type TurnstileApi = {
+  render: (container: HTMLElement, options: TurnstileRenderOptions) => string | undefined
+  reset: (widgetId: string) => void
+}
+
+declare global {
+  interface Window {
+    turnstile?: TurnstileApi
+  }
+}
+
+function send(message: ChallengeEvent) {
+  window.parent.postMessage(challengeMessage(message), '*')
+}
+
+function mount() {
+  const container = document.getElementById('challenge')
+
+  if (!container) {
+    send({ type: 'error' })
+
+    return
+  }
+
+  const options = readChallengeOptions(window.location.search)
+
+  // No key means no captcha anywhere in the widget, so the handshake must NOT succeed: the
+  // eager check reads its absence as a blocked embed and fails the widget to the
+  // captcha-blocked screen, which is the behaviour an unset build variable has always had.
+  if (!SITE_KEY) {
+    send({ type: 'error' })
+
+    return
+  }
+
+  const script = document.createElement('script')
+
+  script.src = SCRIPT_URL
+  script.async = true
+  // Cloudflare learns this origin regardless — it is the hostname check. This keeps the path
+  // and query off the request, which now carry the parent's theme and language.
+  script.referrerPolicy = 'strict-origin'
+  script.addEventListener('error', () => send({ type: 'error' }))
+  script.addEventListener('load', () => {
+    const turnstile = window.turnstile
+
+    // A script that loads without defining the API is a content blocker or a proxy answering
+    // 200 with a stub. Reported as an error rather than left to the parent's timeout, so the
+    // widget fails in a second instead of ten.
+    if (!turnstile) {
+      send({ type: 'error' })
+
+      return
+    }
+
+    send({ type: 'ready' })
+
+    if (options.probe) return
+
+    const widgetId = turnstile.render(container, {
+      sitekey: SITE_KEY,
+      theme: options.theme,
+      language: options.language,
+      callback: (token) => send({ type: 'token', token }),
+      'error-callback': () => send({ type: 'error' }),
+      'expired-callback': () => send({ type: 'expired' }),
+    })
+
+    // `render` returns no id when it refuses. With the challenge on our own origin the
+    // hostname mismatch that used to cause this cannot happen, so what is left is a
+    // malformed key — still no widget, so still no token.
+    if (!widgetId) {
+      send({ type: 'error' })
+
+      return
+    }
+
+    window.addEventListener('message', (event) => {
+      // Only the window that framed this page may drive it. A token is worth nothing to a
+      // third party, but a reset from one would discard a challenge the visitor just solved.
+      if (event.source !== window.parent) return
+      if (parseChallengeCommand(event.data)) turnstile.reset(widgetId)
+    })
+  })
+
+  document.head.appendChild(script)
+}
+
+mount()
diff --git a/src/components/organisms/RegistrationForm/RegistrationForm.submit.test.tsx b/src/components/organisms/RegistrationForm/RegistrationForm.submit.test.tsx
index 86ed8ab4..568623e6 100644
--- a/src/components/organisms/RegistrationForm/RegistrationForm.submit.test.tsx
+++ b/src/components/organisms/RegistrationForm/RegistrationForm.submit.test.tsx
@@ -11,6 +11,8 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 import { RegistrationForm } from './RegistrationForm'
 
+import { challengeFrameStub } from '@/test-support/turnstile-frame'
+
 const sdk = vi.hoisted(() => ({ find: vi.fn(), findByID: vi.fn(), request: vi.fn() }))
 
 vi.mock('@payloadcms/sdk', () => ({
@@ -31,25 +33,12 @@ vi.mock('react-i18next', () => ({
 }))
 
 let container: HTMLDivElement
-let resetCalls: number
+// The challenge page, not our hook: the real `useTurnstile` frames that page and takes its
+// token over `postMessage`, which is what enables Submit. See `challengeFrameStub`.
+let challenge: ReturnType<typeof challengeFrameStub>
 
 beforeEach(() => {
   sdk.request.mockReset()
-  resetCalls = 0
-
-  // The Turnstile script, not our hook: the real `useTurnstile` solves through
-  // this callback, which is what hands the form a token.
-  window.turnstile = {
-    render: (_el, options) => {
-      options.callback?.('tok-live')
-
-      return 'widget-1'
-    },
-    remove: () => {},
-    reset: () => {
-      resetCalls += 1
-    },
-  }
 
   container = document.createElement('div')
   document.body.appendChild(container)
@@ -57,7 +46,6 @@ beforeEach(() => {
 
 afterEach(() => {
   container.remove()
-  delete window.turnstile
 })
 
 async function mountForm(
@@ -79,6 +67,10 @@ async function mountForm(
     )
   })
 
+  // The frame is appended in an effect, so the stub attaches once the form has mounted.
+  challenge = challengeFrameStub(container)
+  await act(async () => challenge.solve())
+
   return root
 }
 
@@ -255,7 +247,7 @@ describe('RegistrationForm refusals', () => {
     expect(alertText()).toContain('registration.form.error_title')
     expect(alertText()).toContain('registration.form.captcha_retry')
     expect(alertText()).not.toContain('Something went wrong.')
-    expect(resetCalls).toBe(1)
+    expect(challenge.resetCount()).toBe(1)
 
     await act(async () => root.unmount())
   })
diff --git a/src/components/organisms/ReportIssueForm/ReportIssueForm.submit.test.tsx b/src/components/organisms/ReportIssueForm/ReportIssueForm.submit.test.tsx
index f5897486..03e9aefc 100644
--- a/src/components/organisms/ReportIssueForm/ReportIssueForm.submit.test.tsx
+++ b/src/components/organisms/ReportIssueForm/ReportIssueForm.submit.test.tsx
@@ -21,6 +21,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 import { ReportIssueForm } from './ReportIssueForm'
 
+import { challengeFrameStub } from '@/test-support/turnstile-frame'
 import { type ReportContext } from '@/lib/report'
 import { mockReportForm } from '@/mocks/report-form'
 
@@ -60,28 +61,13 @@ const context: ReportContext = {
 }
 
 let container: HTMLDivElement
-let resetCalls: number
+// This stands in for the challenge PAGE, rather than for OUR hook. The real `useTurnstile`
+// frames that page and takes its token over `postMessage`, which is what gives the form a
+// token and enables Send. Mocking the hook instead would skip the very wiring under test.
+let challenge: ReturnType<typeof challengeFrameStub>
 
 beforeEach(() => {
   sdk.request.mockReset()
-  resetCalls = 0
-
-  // This stands in for the Turnstile script, rather than for OUR hook.
-  // `loadTurnstile` short-circuits when `window.turnstile` already exists,
-  // so the real `useTurnstile` runs and solves through its own callback.
-  // That callback is what gives the form a token and enables Send. Mocking
-  // the hook instead would skip the very wiring under test.
-  window.turnstile = {
-    render: (_el, options) => {
-      options.callback?.('tok-live')
-
-      return 'widget-1'
-    },
-    remove: () => {},
-    reset: () => {
-      resetCalls += 1
-    },
-  }
 
   container = document.createElement('div')
   document.body.appendChild(container)
@@ -89,7 +75,6 @@ beforeEach(() => {
 
 afterEach(() => {
   container.remove()
-  delete window.turnstile
 })
 
 /** Mount the form and let the captcha's callback settle, so Send is enabled. */
@@ -105,6 +90,10 @@ async function mountForm() {
     )
   })
 
+  // The frame is appended in an effect, so the stub attaches once the form has mounted.
+  challenge = challengeFrameStub(container)
+  await act(async () => challenge.solve())
+
   return root
 }
 
@@ -202,11 +191,11 @@ describe('ReportIssueForm submit', () => {
     const root = await mountForm()
 
     await type('#report-field-0', MESSAGE)
-    expect(resetCalls).toBe(0)
+    expect(challenge.resetCount()).toBe(0)
 
     await submit()
 
-    expect(resetCalls).toBe(1)
+    expect(challenge.resetCount()).toBe(1)
 
     await act(async () => root.unmount())
   })
diff --git a/src/hooks/use-turnstile-guard.test.tsx b/src/hooks/use-turnstile-guard.test.tsx
index d834f93b..f3918e70 100644
--- a/src/hooks/use-turnstile-guard.test.tsx
+++ b/src/hooks/use-turnstile-guard.test.tsx
@@ -6,7 +6,7 @@ import { ErrorBoundary } from 'react-error-boundary'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { createRoot } from 'react-dom/client'
 
-import { useTurnstileGuard } from './use-turnstile-guard'
+import { cspAdvice, useTurnstileGuard } from './use-turnstile-guard'
 
 import { classifyError } from '@/lib/report'
 
@@ -118,10 +118,22 @@ describe('useTurnstileGuard', () => {
 
     // The directive is the only part of this addressed to somebody who can act on it.
     // It must survive the throw that unmounts the tree. That is why the hook orders its steps this way.
-    expect(advice).toContain('challenges.cloudflare.com')
+    expect(advice).toContain('frame-src')
     expect(advice).toContain('docs/embedding.md')
   })
 
+  // ⚠ The advice names OUR origin, not Cloudflare's, since #343: the challenge renders in a
+  // frame served from the widget's origin, so `challenges.cloudflare.com` has left the host's
+  // policy altogether and naming it would send a developer to edit a line that fixes nothing.
+  it('names the widget origin under frame-src, and nothing a host no longer needs', () => {
+    const advice = cspAdvice('https://sahajatlas.com')
+
+    expect(advice).toContain('frame-src')
+    expect(advice).toContain('https://sahajatlas.com')
+    expect(advice).not.toContain('challenges.cloudflare.com')
+    expect(advice).not.toContain('script-src')
+  })
+
   it('does not block the first paint on the probe', async () => {
     // This is a promise that never settles, the slow-network case.
     // The interface must already be on screen.
diff --git a/src/hooks/use-turnstile-guard.ts b/src/hooks/use-turnstile-guard.ts
index 948286fb..42aadd49 100644
--- a/src/hooks/use-turnstile-guard.ts
+++ b/src/hooks/use-turnstile-guard.ts
@@ -1,5 +1,6 @@
 import { useEffect, useState } from 'react'
 
+import { challengeOrigin } from '@/lib/turnstile-frame'
 import { atlasError, reportIntegrationWarning } from '@/lib/report'
 import { probeTurnstile } from '@/hooks/use-turnstile'
 
@@ -10,11 +11,23 @@ import { probeTurnstile } from '@/hooks/use-turnstile'
  * This appears on the console, not on the screen, because the two audiences are different people.
  * The visitor gets `error.captcha_blocked`, which says the embed is broken without asking them to do anything about it.
  * The person who can edit the CSP gets the directive instead.
+ *
+ * ⚠ **It names OUR origin under `frame-src`, not Cloudflare's. See issue #343.** The challenge
+ * renders in a frame on the widget's origin, so `challenges.cloudflare.com` is governed by that
+ * frame's own policy and has left the host's `script-src`, `connect-src` and `frame-src`
+ * entirely. The origin is read off the frame URL rather than written out, so a preview deploy
+ * and `pnpm dev` each name the host they actually need allowed.
  */
-const CSP_ADVICE =
-  'Turnstile could not load, so registration and issue reports are impossible on this page. ' +
-  "Allow https://challenges.cloudflare.com in this page's Content-Security-Policy — " +
-  'both `script-src` and `frame-src`. See https://github.com/sydevs/SahajAtlasWeb/blob/main/docs/embedding.md#content-security-policy'
+export function cspAdvice(origin: string): string {
+  return (
+    'Turnstile could not load, so registration and issue reports are impossible on this page. ' +
+    `Allow ${origin} in this page's Content-Security-Policy, under \`frame-src\` — ` +
+    'the challenge renders in a frame served from there. ' +
+    'See https://github.com/sydevs/SahajAtlasWeb/blob/main/docs/embedding.md#content-security-policy'
+  )
+}
+
+const CSP_ADVICE = cspAdvice(challengeOrigin(import.meta.url))
 
 /**
  * This fails the widget when Turnstile cannot load. See issue #182.
@@ -34,7 +47,7 @@ const CSP_ADVICE =
  * ⚠ **Call this from the INTERFACE, never from the shell.**
  * `.claude/rules/components.md` is explicit that anything that fetches or injects a script must mount with `FullInterface`.
  * Four separate bugs, the home-region redirect, `warmCaches`, and both Fathom effects, came from effects firing for a collapsed compact card.
- * Injecting a third-party challenge script into a host's page for a card nobody has pressed would be the fifth.
+ * Mounting a challenge frame for a card nobody has pressed would be the fifth.
  * `CompactEmbedView.mount.test.tsx` asserts that this does not happen.
  *
  * This throws during render, not from the effect.
diff --git a/src/hooks/use-turnstile.test.tsx b/src/hooks/use-turnstile.test.tsx
new file mode 100644
index 00000000..c4720512
--- /dev/null
+++ b/src/hooks/use-turnstile.test.tsx
@@ -0,0 +1,373 @@
+// @vitest-environment jsdom
+import { act } from 'react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createRoot } from 'react-dom/client'
+
+import { type UseTurnstile, probeTurnstile, useTurnstile } from './use-turnstile'
+
+import { CHALLENGE_CHANNEL } from '@/lib/turnstile-frame'
+
+/**
+ * The challenge lives in a frame on our own origin since #343, so what this covers is the
+ * `postMessage` seam between the widget and that frame — the part no pure test can express,
+ * and the part a real browser cannot reach either, since jsdom will not run Cloudflare's
+ * script and a browser pass cannot drive an unsolved challenge to each of these states.
+ *
+ * **jsdom, because an iframe and its `contentWindow` are the subject.** `renderToStaticMarkup`
+ * runs no effects, so it would never mount the frame these cases send messages from.
+ */
+
+// Mutable, so the re-mount case can change one between renders — the hook keys its effect on
+// both, because Turnstile bakes them into the widget it renders.
+let theme = 'dark'
+let languageCode = 'cs'
+
+vi.mock('@/hooks/use-theme', () => ({ useTheme: () => ({ theme }) }))
+vi.mock('@/hooks/use-locale', () => ({ useLocale: () => ({ languageCode }) }))
+
+let container: HTMLDivElement
+let cleanup: (() => void) | null = null
+let hook: UseTurnstile
+
+function Probe() {
+  hook = useTurnstile()
+
+  return <div ref={hook.challengeRef} />
+}
+
+/** Mounts a form-side consumer, so the frame is appended the way a real view appends it. */
+async function mount(node = <Probe />) {
+  const root = createRoot(container)
+
+  await act(async () => root.render(node))
+  cleanup = () => act(() => root.unmount())
+}
+
+const frame = () => container.querySelector('iframe')
+
+/**
+ * Speaks as the challenge page does.
+ *
+ * ⚠ The origin is read off the frame's own `src`, never written out. The hook resolves that
+ * URL against its module URL, so the origin is the dev server's here and the deploy's in
+ * production — hard-coding either would make this pass for the wrong reason.
+ */
+function fromFrame(message: Record<string, unknown>, overrides: MessageEventInit = {}) {
+  const iframe = frame()
+
+  if (!iframe) throw new Error('no challenge frame')
+
+  act(() =>
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { channel: CHALLENGE_CHANNEL, ...message },
+        origin: new URL(iframe.src).origin,
+        source: iframe.contentWindow,
+        ...overrides,
+      }),
+    ),
+  )
+}
+
+beforeEach(() => {
+  theme = 'dark'
+  languageCode = 'cs'
+  container = document.createElement('div')
+  document.body.appendChild(container)
+})
+
+afterEach(() => {
+  cleanup?.()
+  cleanup = null
+  container.remove()
+  document.body.innerHTML = ''
+})
+
+describe('useTurnstile', () => {
+  it('frames the challenge page on its own origin, carrying theme and language', async () => {
+    await mount()
+
+    const iframe = frame()
+    const url = new URL(iframe?.src as string)
+
+    expect(url.pathname).toBe('/challenge.html')
+    expect(url.searchParams.get('theme')).toBe('dark')
+    expect(url.searchParams.get('language')).toBe('cs')
+    // The form mounts a real challenge, never the probe's handshake-only mode.
+    expect(url.searchParams.get('probe')).toBeNull()
+    expect(iframe?.title).not.toBe('')
+  })
+
+  it('is loading until the frame hands back its handshake', async () => {
+    await mount()
+
+    expect(hook.status).toBe('loading')
+
+    fromFrame({ type: 'ready' })
+
+    expect(hook.status).toBe('ready')
+    // Rendered is not solved. A token here would enable Submit before anyone clicked.
+    expect(hook.token).toBeNull()
+  })
+
+  it('takes the solved token', async () => {
+    await mount()
+    fromFrame({ type: 'ready' })
+    fromFrame({ type: 'token', token: 'tok-1' })
+
+    expect(hook.token).toBe('tok-1')
+    expect(hook.status).toBe('ready')
+  })
+
+  it('drops the token on expiry, without blocking the form', async () => {
+    await mount()
+    fromFrame({ type: 'token', token: 'tok-1' })
+    fromFrame({ type: 'expired' })
+
+    expect(hook.token).toBeNull()
+    expect(hook.status).toBe('ready')
+  })
+
+  it('does not latch blocked: a later token wins the form back', async () => {
+    await mount()
+    fromFrame({ type: 'error' })
+
+    expect(hook.status).toBe('blocked')
+
+    // Turnstile's `retry` defaults to `auto`, so an errored challenge often solves by itself.
+    // Latching here would leave a visitor holding a valid token behind a dead submit button.
+    fromFrame({ type: 'token', token: 'tok-2' })
+
+    expect(hook.status).toBe('ready')
+    expect(hook.token).toBe('tok-2')
+  })
+
+  it('ignores a message from another window', async () => {
+    await mount()
+    fromFrame({ type: 'token', token: 'tok-evil' }, { source: window })
+
+    expect(hook.token).toBeNull()
+  })
+
+  it('ignores a message from another origin', async () => {
+    await mount()
+    fromFrame({ type: 'token', token: 'tok-evil' }, { origin: 'https://evil.example' })
+
+    expect(hook.token).toBeNull()
+  })
+
+  it('ignores a message on another channel', async () => {
+    await mount()
+
+    const iframe = frame()
+
+    act(() =>
+      window.dispatchEvent(
+        new MessageEvent('message', {
+          // A host page's own cross-frame traffic. Without the channel marker this shape
+          // would read as a solved challenge.
+          data: { type: 'token', token: 'tok-host' },
+          origin: new URL(iframe?.src as string).origin,
+          source: iframe?.contentWindow,
+        }),
+      ),
+    )
+
+    expect(hook.token).toBeNull()
+  })
+
+  it('asks the frame to reset, and drops the token first', async () => {
+    await mount()
+    fromFrame({ type: 'ready' })
+    fromFrame({ type: 'token', token: 'tok-1' })
+
+    const posted = vi.fn()
+
+    vi.spyOn(frame()?.contentWindow as Window, 'postMessage').mockImplementation(posted)
+
+    act(() => hook.reset())
+
+    expect(hook.token).toBeNull()
+    expect(posted).toHaveBeenCalledWith(
+      { channel: CHALLENGE_CHANNEL, type: 'reset' },
+      expect.anything(),
+    )
+  })
+
+  it('detaches its window listener on unmount', async () => {
+    // Not a tidiness check: the listener is on `window`, which the HOST page owns and which
+    // outlives every form. One leaked per open accumulates for the life of their page, and
+    // each kept its own frame reference alive. Removing the frame is covered by the
+    // theme-change case above, where a frame left behind is the one found.
+    const added = vi.spyOn(window, 'addEventListener')
+    const removed = vi.spyOn(window, 'removeEventListener')
+    const messages = (spy: typeof added) =>
+      spy.mock.calls.filter(([type]) => type === 'message').length
+
+    await mount()
+
+    expect(messages(added)).toBe(1)
+
+    cleanup?.()
+    cleanup = null
+
+    expect(messages(removed)).toBe(1)
+  })
+
+  it('reports blocked and mounts nothing when disabled', async () => {
+    function Disabled() {
+      const turnstile = useTurnstile({ disabled: true })
+
+      hook = turnstile
+
+      return <div ref={turnstile.challengeRef} />
+    }
+
+    await mount(<Disabled />)
+
+    expect(hook.status).toBe('blocked')
+    expect(frame()).toBeNull()
+  })
+
+  it('re-mounts the frame on a theme change, dropping the unsolved token with it', async () => {
+    const root = createRoot(container)
+
+    await act(async () => root.render(<Probe />))
+    cleanup = () => act(() => root.unmount())
+
+    fromFrame({ type: 'token', token: 'tok-light' })
+
+    expect(hook.token).toBe('tok-light')
+
+    theme = 'light'
+    await act(async () => root.render(<Probe />))
+
+    // Turnstile bakes the theme into the widget at render time, so the frame is replaced. The
+    // new widget has not been solved, so holding the old token would send a dead one.
+    expect(new URL(frame()?.src as string).searchParams.get('theme')).toBe('light')
+    expect(hook.token).toBeNull()
+  })
+})
+
+describe('probeTurnstile', () => {
+  const probeFrame = () =>
+    [...document.body.querySelectorAll('iframe')].find((node) =>
+      node.src.includes('/challenge.html'),
+    )
+
+  /**
+   * Starts the check and reports what it has decided so far.
+   *
+   * ⚠ **Every case here runs on fake timers, and that is the only thing that makes them
+   * non-vacuous.** The check's timeout answers `false` too, so a case that simply awaits the
+   * verdict passes whether the signal it dispatched was read or ignored — it just takes ten
+   * seconds about it. What each case asserts is therefore WHEN the verdict lands.
+   */
+  function startProbe() {
+    vi.useFakeTimers()
+
+    let state: boolean | 'pending' = 'pending'
+    const done = probeTurnstile().then((available) => {
+      state = available
+    })
+
+    return {
+      done,
+      settled: () => state,
+      origin: () => new URL(probeFrame()?.src as string).origin,
+    }
+  }
+
+  const violation = (directive: string, blockedURI: string) =>
+    document.dispatchEvent(
+      Object.assign(new Event('securitypolicyviolation'), {
+        effectiveDirective: directive,
+        violatedDirective: directive,
+        blockedURI,
+      }),
+    )
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('mounts a handshake-only frame and resolves true on ready', async () => {
+    const probe = startProbe()
+    const iframe = probeFrame()
+
+    expect(new URL(iframe?.src as string).searchParams.get('probe')).toBe('1')
+
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { channel: CHALLENGE_CHANNEL, type: 'ready' },
+        origin: new URL(iframe?.src as string).origin,
+        source: iframe?.contentWindow,
+      }),
+    )
+    await probe.done
+
+    expect(probe.settled()).toBe(true)
+    // The frame is torn down with the verdict: it exists only to produce one.
+    expect(probeFrame()).toBeUndefined()
+  })
+
+  it('resolves false when the frame reports an error', async () => {
+    const probe = startProbe()
+    const iframe = probeFrame()
+
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { channel: CHALLENGE_CHANNEL, type: 'error' },
+        origin: new URL(iframe?.src as string).origin,
+        source: iframe?.contentWindow,
+      }),
+    )
+    await probe.done
+
+    expect(probe.settled()).toBe(false)
+  })
+
+  it('resolves false at once on a frame-src violation naming our origin', async () => {
+    const probe = startProbe()
+
+    violation('frame-src', `${probe.origin()}/challenge.html`)
+    await vi.advanceTimersByTimeAsync(0)
+
+    // Before the timeout, which is the whole point: a refused frame fires no load and no
+    // error of its own, so without this the widget would run for ten seconds looking healthy.
+    expect(probe.settled()).toBe(false)
+  })
+
+  // Two near misses, because each filter in the violation handler is wrong on its own. A
+  // strict-CSP host can produce either: the widget fetches its own flags and pins from this
+  // same origin, and it frames nothing else from Cloudflare's.
+  it.each([
+    ['another directive, our origin', 'img-src', true],
+    ['frame-src, another origin', 'frame-src', false],
+  ])('ignores a violation about %s', async (_label, directive, ours) => {
+    const probe = startProbe()
+
+    violation(directive, ours ? `${probe.origin()}/logo.svg` : 'https://widgets.example/f.html')
+    await vi.advanceTimersByTimeAsync(5_000)
+
+    expect(probe.settled()).toBe('pending')
+
+    await vi.advanceTimersByTimeAsync(5_000)
+    await probe.done
+
+    expect(probe.settled()).toBe(false)
+  })
+
+  it('resolves false only once the frame has had its full wait', async () => {
+    const probe = startProbe()
+
+    await vi.advanceTimersByTimeAsync(9_999)
+
+    expect(probe.settled()).toBe('pending')
+
+    await vi.advanceTimersByTimeAsync(1)
+    await probe.done
+
+    expect(probe.settled()).toBe(false)
+  })
+})
diff --git a/src/hooks/use-turnstile.ts b/src/hooks/use-turnstile.ts
index d7c6c379..dc6472fa 100644
--- a/src/hooks/use-turnstile.ts
+++ b/src/hooks/use-turnstile.ts
@@ -1,129 +1,179 @@
 import { type RefObject, useCallback, useEffect, useRef, useState } from 'react'
 
+import {
+  type ChallengeEvent,
+  type ChallengeOptions,
+  challengeMessage,
+  challengeSrc,
+  parseChallengeEvent,
+} from '@/lib/turnstile-frame'
 import { useLocale } from '@/hooks/use-locale'
 import { useTheme } from '@/hooks/use-theme'
 
 // This renders Cloudflare Turnstile explicitly. See issue #79.
 // This code is hand-rolled, instead of adding `@marsidev/react-turnstile`.
-// Turnstile is a script tag and one render call.
 // The embedded bundle ships on host pages we do not control, so every added dependency is weight we would rather avoid.
 //
-// ⚠ **The script is no longer lazy. That behavior inverted in issue #182.**
+// ⚠ **The challenge renders in a frame on OUR origin, never in the host's document. See issue #343.**
+// Turnstile validates the hostname of the document that renders it, so the script embed used to present the partner's hostname and fail with `110200`.
+// `src/lib/turnstile-frame.ts` owns that reasoning and the message protocol; `challenge.html` is the page.
+// Nothing here branches on embed mode: the frame is used standalone and framed alike, so one code path is the only one anybody tests.
+//
+// ⚠ **The challenge is no longer lazy. That behavior inverted in issue #182.**
 // Registration is what this widget is for, and registration cannot happen without a token.
 // So a challenge that cannot load is a broken embed, not a form that degrades.
-// `useTurnstileProbe` starts the load as soon as the INTERFACE mounts, never the shell. See `FullInterface`.
-// It fails the widget when the load cannot complete.
+// `useTurnstileGuard` starts the check as soon as the INTERFACE mounts, never the shell. See `FullInterface`.
+// It fails the widget when the check cannot complete.
 // So a host with an out-of-date CSP finds out from their own page, not from a visitor who could not register.
 //
-// The widget is still removed on unmount.
+// The frame is still removed on unmount.
 // So reopening a form always gets a fresh challenge, not a stale or expired token.
 
-const SCRIPT_URL = 'https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit'
+/** Cloudflare's own widget is 300×65. The frame is sized to it, since nothing else is on the page. */
+const FRAME_WIDTH = 300
+const FRAME_HEIGHT = 65
 
-// A Turnstile SITE key is public by design. The secret half lives in SahajCloud.
-// So the site key belongs in the committed `.env` file.
-// An absent key means the captcha cannot render, the same blocked state as a CSP-refused script.
-const SITE_KEY: string | undefined = import.meta.env.VITE_TURNSTILE_SITE_KEY
+/**
+ * How long the availability check waits for the frame's handshake.
+ *
+ * It bounds a frame that neither loads nor errors: a CSP refusal reports
+ * `securitypolicyviolation` and is caught at once, but a host behind a proxy that swallows the
+ * request leaves the frame blank with no event at all. Nothing waits on this promise, so the
+ * cost of the bound being generous is a verdict that lands late, not a slow first paint.
+ */
+const PROBE_TIMEOUT_MS = 10_000
 
-type TurnstileRenderOptions = {
-  sitekey: string
-  theme?: 'light' | 'dark' | 'auto'
-  language?: string
-  callback?: (token: string) => void
-  'error-callback'?: () => void
-  'expired-callback'?: () => void
-}
+/**
+ * Builds the frame and the listener that reads it, for both the hook and the probe.
+ *
+ * Two checks decide what counts as the frame talking, and both are needed. `event.source`
+ * pins the message to this frame's own window, which no other document can forge. `origin`
+ * pins it to the origin we built the `src` from, so a frame navigated elsewhere — a redirect,
+ * a captive portal — cannot keep answering as the challenge.
+ */
+function createChallengeFrame(
+  options: ChallengeOptions,
+  onEvent: (message: ChallengeEvent | null) => void,
+) {
+  const frame = document.createElement('iframe')
+  const src = challengeSrc(import.meta.url, options)
 
-type TurnstileApi = {
-  render: (container: HTMLElement, options: TurnstileRenderOptions) => string | undefined
-  remove: (widgetId: string) => void
-  reset: (widgetId: string) => void
-}
+  frame.src = src
+  frame.width = String(FRAME_WIDTH)
+  frame.height = String(FRAME_HEIGHT)
+  frame.style.border = '0'
+  // The frame's content is a captcha with its own labelling. A title is still required of
+  // every frame, and "security check" is what a screen-reader user needs to hear here.
+  frame.title = 'Security check'
+  // Cloudflare learns our origin from the request regardless. This keeps the host page's path
+  // and query out of it, which an `unsafe-url` referrer policy on the host would otherwise send.
+  frame.referrerPolicy = 'strict-origin'
 
-declare global {
-  interface Window {
-    turnstile?: TurnstileApi
+  const expectedOrigin = new URL(src).origin
+  const onMessage = (event: MessageEvent) => {
+    // `contentWindow` is checked for presence as well as identity: a frame with none yet
+    // leaves both sides `null`, and `null !== null` is false, so a message carrying no source
+    // would pass an identity test alone.
+    if (!frame.contentWindow || event.source !== frame.contentWindow) return
+    if (event.origin !== expectedOrigin) return
+
+    onEvent(parseChallengeEvent(event.data))
   }
-}
 
-// This is one in-flight load, shared by every caller.
-// This clears on failure, so a later open retries instead of caching a transient network error forever.
-let scriptPromise: Promise<void> | null = null
-
-function loadTurnstile(): Promise<void> {
-  if (window.turnstile) return Promise.resolve()
-  if (scriptPromise) return scriptPromise
-
-  scriptPromise = new Promise<void>((resolve, reject) => {
-    const script = document.createElement('script')
-
-    script.src = SCRIPT_URL
-    script.async = true
-    script.defer = true
-    // Cloudflare learns the embedding hostname regardless. That is how the domain check works.
-    // But a host page that opts into `unsafe-url` referrers would otherwise leak its full path and query on this request too.
-    // This sends the origin only.
-    script.referrerPolicy = 'strict-origin'
-    script.onload = () => resolve()
-    // This fires when a host page's CSP omits `challenges.cloudflare.com` from `script-src`.
-    // It also fires on an ordinary network failure.
-    script.onerror = () => {
-      // This drops the dead tag.
-      // `scriptPromise` clears below, so every reopen retries.
-      // Without this, a host page whose CSP blocks Cloudflare would pile up an orphaned `<script>` tag, and a blocked request, in their `<head>` each time.
-      script.remove()
-      reject(new Error('Turnstile script could not be loaded'))
-    }
-    document.head.appendChild(script)
-  }).catch((error: unknown) => {
-    scriptPromise = null
-    throw error
-  })
+  window.addEventListener('message', onMessage)
 
-  return scriptPromise
+  const dispose = () => {
+    window.removeEventListener('message', onMessage)
+    frame.remove()
+  }
+
+  return { frame, expectedOrigin, dispose }
 }
 
 /**
- * This loads the Turnstile script without rendering a challenge, and reports whether the API arrived.
+ * This mounts the challenge page hidden, and reports whether Turnstile is live inside it.
  *
  * This is the reading half of the eager check. See issue #182.
  * It answers "can this page run Turnstile at all," a question about the host's CSP and the network, not about any one form.
  * This resolves to `false` rather than rejecting, because every caller treats a failure as a verdict, not an exception.
  *
- * ⚠ **This check is strictly weaker than a real render, and that gap is deliberate, not overlooked.**
- * Three failures are visible from here: no site key, a `script-src` that refuses `challenges.cloudflare.com`,
- * and a script that loads without defining the API, such as a content blocker or an enterprise proxy answering 200 with a stub.
- * Two failures are not visible from here: a `frame-src` that blocks the challenge iframe, and a sitekey the embedding domain is not registered for.
- * Both of those surface only when `turnstile.render` actually runs.
- * So this check is the early warning, and `useTurnstile`'s own `blocked` status remains the backstop.
- * Neither replaces the other.
+ * ⚠ **This check is weaker than a real render, and that gap is deliberate, not overlooked.**
+ * The frame is mounted in probe mode, so it hands back the handshake without rendering a
+ * challenge — a real render here would spend a solve nobody submits, in a frame nobody can see.
+ * What it therefore sees: a `frame-src` that refuses our origin, a `script-src` inside our own
+ * frame (ours to get right, not a host's), an absent site key, and a script that loads without
+ * defining the API.
+ * What it cannot see: a challenge that renders and then errors, which `useTurnstile`'s own
+ * `blocked` status remains the backstop for.
+ * ⚠ The hostname mismatch this check could never see is **gone** rather than unobserved — the
+ * challenge now always renders on the one hostname the widget's Turnstile key lists (#343).
  */
 export async function probeTurnstile(): Promise<boolean> {
-  if (!SITE_KEY) return false
+  if (typeof document === 'undefined') return false
 
-  try {
-    await loadTurnstile()
+  return new Promise<boolean>((resolve) => {
+    let settled = false
+    const settle = (available: boolean) => {
+      if (settled) return
 
-    return Boolean(window.turnstile)
-  } catch {
-    return false
-  }
+      settled = true
+      clearTimeout(timer)
+      document.removeEventListener('securitypolicyviolation', onViolation)
+      dispose()
+      resolve(available)
+    }
+
+    // The violation the probe exists to catch: a host `frame-src` (or `child-src`, or a
+    // `default-src` standing in for either) that refuses our origin. The frame then fires no
+    // load and no error of its own, so without this the verdict would wait out the timeout.
+    const onViolation = (event: SecurityPolicyViolationEvent) => {
+      const directive = event.effectiveDirective || event.violatedDirective
+
+      if (!/^(frame|child|default)-src$/.test(directive)) return
+      if (!event.blockedURI.startsWith(expectedOrigin)) return
+
+      settle(false)
+    }
+
+    const { frame, expectedOrigin, dispose } = createChallengeFrame(
+      { theme: 'auto', language: 'auto', probe: true },
+      (message) => {
+        if (message?.type === 'ready') settle(true)
+        if (message?.type === 'error') settle(false)
+      },
+    )
+
+    // Hidden, not `display: none`: a frame with no box is still fetched, but keeping it in the
+    // layout tree is what keeps this check as close as possible to the frame a form mounts.
+    frame.style.position = 'absolute'
+    frame.style.width = '1px'
+    frame.style.height = '1px'
+    frame.style.opacity = '0'
+    frame.style.pointerEvents = 'none'
+    frame.setAttribute('aria-hidden', 'true')
+    frame.tabIndex = -1
+
+    const timer = setTimeout(() => settle(false), PROBE_TIMEOUT_MS)
+
+    document.addEventListener('securitypolicyviolation', onViolation)
+    document.body.appendChild(frame)
+  })
 }
 
 /**
  * This is `loading` until the challenge renders.
- * This is `blocked` when Turnstile is unavailable: no site key, a CSP-blocked script, or a widget that errors out, such as when `frame-src` blocks the challenge iframe.
+ * This is `blocked` when Turnstile is unavailable: no site key, a CSP-blocked frame, or a widget that errors out.
  * A caller must degrade on `blocked`, rather than leaving a submit button that can never produce a token.
  */
 export type TurnstileStatus = 'loading' | 'ready' | 'blocked'
 
 export type UseTurnstileOptions = {
-  /** This skips loading entirely and reports `blocked`, for the Ladle story's degraded case. */
+  /** This skips the frame entirely and reports `blocked`, for the Ladle story's degraded case. */
   disabled?: boolean
 }
 
 export type UseTurnstile = {
-  /** Attach to the element the challenge renders into. */
+  /** Attach to the element the challenge frame is appended to. */
   challengeRef: RefObject<HTMLDivElement>
   /** This is the solved token, or null while unsolved or expired. */
   token: string | null
@@ -145,88 +195,70 @@ export type UseTurnstile = {
 export function useTurnstile({ disabled = false }: UseTurnstileOptions = {}): UseTurnstile {
   const challengeRef = useRef<HTMLDivElement>(null)
   // This is held in a ref as well as the effect closure.
-  // So `reset` can reach the live widget without re-running, and so re-rendering, the challenge.
-  const widgetIdRef = useRef<string | undefined>(undefined)
+  // So `reset` can reach the live frame without re-running, and so re-mounting, the challenge.
+  const frameRef = useRef<HTMLIFrameElement | null>(null)
   const [token, setToken] = useState<string | null>(null)
-  const [status, setStatus] = useState<TurnstileStatus>(
-    disabled || !SITE_KEY ? 'blocked' : 'loading',
-  )
+  const [status, setStatus] = useState<TurnstileStatus>(disabled ? 'blocked' : 'loading')
   const { theme } = useTheme()
   const { languageCode } = useLocale()
 
-  // Re-rendering on a theme or language change is deliberate.
-  // Turnstile bakes both into the widget at render time.
-  // So the challenge tears down and re-renders, which also drops the token correctly, since the new widget has not been solved.
+  // Re-mounting on a theme or language change is deliberate.
+  // Turnstile bakes both into the widget at render time, so the frame carries them in its URL.
+  // So the challenge tears down and re-mounts, which also drops the token correctly, since the new widget has not been solved.
   useEffect(() => {
-    if (disabled || !SITE_KEY) return
-
-    let cancelled = false
+    if (disabled || !challengeRef.current) return
 
     setToken(null)
     setStatus('loading')
 
-    loadTurnstile()
-      .then(() => {
-        if (cancelled) return
-
-        // The script can "load" without giving this hook an API.
-        // A content blocker, or an enterprise proxy that answers 200 with a stub, does exactly this.
-        // This treats a missing API as blocked.
-        // Returning early instead would strand `status` on `'loading'`, leaving a permanently disabled submit button with no mailto escape.
-        if (!challengeRef.current || !window.turnstile) {
-          setStatus('blocked')
-
-          return
-        }
-
-        widgetIdRef.current = window.turnstile.render(challengeRef.current, {
-          sitekey: SITE_KEY,
-          theme,
-          language: languageCode,
+    const { frame, dispose } = createChallengeFrame(
+      { theme, language: languageCode },
+      (message) => {
+        switch (message?.type) {
+          case 'ready':
+            setStatus('ready')
+            break
           // Turnstile's `retry` option defaults to `auto`.
           // So a transient failure is often followed by an automatic retry that solves.
           // So `blocked` must NOT be a one-way latch.
           // A solved challenge has to win the form back.
           // Otherwise the user holds a valid token while the UI still offers only the mailto escape.
-          callback: (solved) => {
-            setToken(solved)
+          case 'token':
+            setToken(message.token)
             setStatus('ready')
-          },
-          'error-callback': () => {
+            break
+          case 'expired':
+            setToken(null)
+            break
+          case 'error':
             setToken(null)
             setStatus('blocked')
-          },
-          'expired-callback': () => setToken(null),
-        })
-        // `render` returns undefined instead of a widget id when it refuses.
-        // The most common cause is a sitekey the embedding domain is not registered for.
-        // No widget means no token, so this state is blocked, not ready.
-        setStatus(widgetIdRef.current ? 'ready' : 'blocked')
-      })
-      .catch(() => {
-        if (!cancelled) setStatus('blocked')
-      })
+            break
+        }
+      },
+    )
+
+    frameRef.current = frame
+    challengeRef.current.appendChild(frame)
 
     return () => {
-      cancelled = true
-      // This ref is written only past the `cancelled` guard above.
-      // React runs this cleanup before the next effect body.
-      // So the ref holds THIS run's widget, or nothing.
-      if (widgetIdRef.current) window.turnstile?.remove(widgetIdRef.current)
-      widgetIdRef.current = undefined
+      dispose()
+      frameRef.current = null
     }
   }, [disabled, theme, languageCode])
 
   // This is stable across renders, with no dependencies.
   // The caller passes this straight to `useMutation`'s `onError`.
   // A fresh identity on each render would re-run the observer's `setOptions` for nothing.
-  // `reset` re-runs the challenge, which calls the same `callback` on success.
+  // `reset` re-runs the challenge, which sends the same `token` message on success.
   // So the new token arrives through the normal path.
   const reset = useCallback(() => {
-    if (!widgetIdRef.current) return
+    const frame = frameRef.current
+
+    if (!frame?.contentWindow) return
 
     setToken(null)
-    window.turnstile?.reset(widgetIdRef.current)
+    frame.contentWindow.postMessage(challengeMessage({ type: 'reset' }), '*')
   }, [])
 
   return { challengeRef, token, status, reset }
diff --git a/src/lib/turnstile-frame.test.ts b/src/lib/turnstile-frame.test.ts
new file mode 100644
index 00000000..4b455a36
--- /dev/null
+++ b/src/lib/turnstile-frame.test.ts
@@ -0,0 +1,141 @@
+import { describe, expect, it } from 'vitest'
+
+import {
+  CHALLENGE_CHANNEL,
+  challengeMessage,
+  challengeOrigin,
+  challengeSrc,
+  parseChallengeCommand,
+  parseChallengeEvent,
+  readChallengeOptions,
+} from './turnstile-frame'
+
+/**
+ * The frame protocol, in the node lane. The transport is spec'd in `use-turnstile.test.tsx`,
+ * which needs a DOM; everything here is a string.
+ */
+
+// What `import.meta.url` is inside a built chunk: the widget's own graph, under /assets/.
+const CHUNK = 'https://sahajatlas.com/assets/use-turnstile-a1b2c3.js'
+
+describe('challengeSrc', () => {
+  it('resolves to the challenge page at the ROOT of the chunk-s own origin', () => {
+    const url = new URL(challengeSrc(CHUNK, { theme: 'dark', language: 'cs' }))
+
+    // The whole fix turns on this origin being ours rather than the host page's (#343), and
+    // on the path being the output root rather than the chunk's own directory — Vite emits
+    // an HTML input there, so `/assets/challenge.html` would 404 into the SPA fallback.
+    expect(url.origin).toBe('https://sahajatlas.com')
+    expect(url.pathname).toBe('/challenge.html')
+  })
+
+  it('carries the theme and language the widget is rendering in', () => {
+    const url = new URL(challengeSrc(CHUNK, { theme: 'dark', language: 'cs' }))
+
+    expect(url.searchParams.get('theme')).toBe('dark')
+    expect(url.searchParams.get('language')).toBe('cs')
+    expect(url.searchParams.get('probe')).toBeNull()
+  })
+
+  it('marks a probe frame, so it hands back the handshake and renders nothing', () => {
+    const url = new URL(challengeSrc(CHUNK, { theme: 'auto', language: 'auto', probe: true }))
+
+    expect(url.searchParams.get('probe')).toBe('1')
+  })
+
+  it.each([
+    ['a dev server', 'http://localhost:5174/src/hooks/use-turnstile.ts'],
+    ['a Workers preview', 'https://pr-9-sahajatlas.sydevs.workers.dev/assets/x.js'],
+  ])('follows the origin the bundle was served from — %s', (_label, moduleUrl) => {
+    const expected = new URL(moduleUrl).origin
+
+    expect(new URL(challengeSrc(moduleUrl, { theme: 'auto', language: 'en' })).origin).toBe(
+      expected,
+    )
+    expect(challengeOrigin(moduleUrl)).toBe(expected)
+  })
+})
+
+describe('readChallengeOptions', () => {
+  it('reads what the widget sent', () => {
+    expect(readChallengeOptions('?theme=dark&language=ru&probe=1')).toEqual({
+      theme: 'dark',
+      language: 'ru',
+      probe: true,
+    })
+  })
+
+  it.each([
+    ['an unknown theme', '?theme=sepia&language=en', 'auto', 'en'],
+    ['no theme at all', '?language=en', 'auto', 'en'],
+    // A language Turnstile would refuse, or one carrying anything but a locale code, must not
+    // stop the challenge rendering: `auto` follows the browser, which is a worse answer than
+    // the widget's own locale and a far better one than no captcha.
+    ['a non-locale language', '?theme=light&language=klingon', 'light', 'auto'],
+    ['an empty query', '', 'auto', 'auto'],
+  ])('falls back rather than refusing, given %s', (_label, search, theme, language) => {
+    expect(readChallengeOptions(search)).toEqual({ theme, language, probe: false })
+  })
+
+  it('treats any probe value but 1 as a real challenge', () => {
+    expect(readChallengeOptions('?probe=0').probe).toBe(false)
+    expect(readChallengeOptions('?probe=true').probe).toBe(false)
+  })
+})
+
+describe('parseChallengeEvent', () => {
+  const on = (message: Record<string, unknown>) => ({ channel: CHALLENGE_CHANNEL, ...message })
+
+  it.each(['ready', 'expired', 'error'])('reads %s', (type) => {
+    expect(parseChallengeEvent(on({ type }))).toEqual({ type })
+  })
+
+  it('reads a token', () => {
+    expect(parseChallengeEvent(on({ type: 'token', token: 'tok' }))).toEqual({
+      type: 'token',
+      token: 'tok',
+    })
+  })
+
+  it.each([
+    // The host page's own cross-frame traffic, which this shape is indistinguishable from
+    // without the channel marker.
+    ['no channel', { type: 'token', token: 'tok' }],
+    ['another channel', { channel: 'other-widget', type: 'token', token: 'tok' }],
+    ['an unknown type', on({ type: 'solved' })],
+    // An empty token would enable Submit and then fail verification, which reads to a visitor
+    // as the form being broken rather than the challenge.
+    ['an empty token', on({ type: 'token', token: '' })],
+    ['a non-string token', on({ type: 'token', token: 42 })],
+    ['no token', on({ type: 'token' })],
+    ['a string', 'ready'],
+    ['null', null],
+  ])('refuses %s', (_label, data) => {
+    expect(parseChallengeEvent(data)).toBeNull()
+  })
+})
+
+describe('parseChallengeCommand', () => {
+  it('reads a reset', () => {
+    expect(parseChallengeCommand(challengeMessage({ type: 'reset' }))).toEqual({ type: 'reset' })
+  })
+
+  it.each([
+    ['an unchannelled reset', { type: 'reset' }],
+    // The page accepts commands, not events: a `token` echoed back at it is not one.
+    ['an event', { channel: CHALLENGE_CHANNEL, type: 'token', token: 'tok' }],
+    ['null', null],
+  ])('refuses %s', (_label, data) => {
+    expect(parseChallengeCommand(data)).toBeNull()
+  })
+})
+
+describe('challengeMessage', () => {
+  it('stamps the channel on everything either side sends', () => {
+    expect(challengeMessage({ type: 'token', token: 'tok' })).toEqual({
+      channel: CHALLENGE_CHANNEL,
+      type: 'token',
+      token: 'tok',
+    })
+  })
+})
diff --git a/src/lib/turnstile-frame.ts b/src/lib/turnstile-frame.ts
new file mode 100644
index 00000000..35c98e0f
--- /dev/null
+++ b/src/lib/turnstile-frame.ts
@@ -0,0 +1,141 @@
+/**
+ * The contract between the widget and the Turnstile challenge page it frames (#343).
+ *
+ * **Turnstile validates the hostname of the document that RENDERS it, not the top-level page.**
+ * The script embed puts our React tree inside the HOST's document, so the challenge used to
+ * render on the partner's hostname and every one not on the widget's Turnstile hostname list
+ * failed with `110200` — measured directly, and in a nested frame on the same host, where it
+ * passed. One hostname list covers every partner once the challenge renders on our origin, so
+ * there is no per-partner onboarding step and nothing for a host to configure.
+ *
+ * Pure, and shared by both sides of the frame: `src/challenge.ts` is the page, and
+ * `src/hooks/use-turnstile.ts` frames it. One module rather than two copies, because a
+ * protocol that drifts fails silently — the parent waits for a handshake the page stopped
+ * sending, and the form stays disabled with nothing on the console.
+ */
+
+/** The challenge page's own path. A Vite HTML input, so it lands at the output root. */
+export const CHALLENGE_PATH = '/challenge.html'
+
+/**
+ * Namespaces every message in both directions.
+ *
+ * The frame's `postMessage` traffic lands on a window the HOST page also owns, and a host may
+ * run its own cross-frame messaging, a chat widget or an analytics bridge. Without a channel
+ * marker a message shaped like `{ type: 'token' }` from any of those would read as a solved
+ * challenge.
+ */
+export const CHALLENGE_CHANNEL = 'sahaj-atlas-turnstile'
+
+/** What the page tells its parent. `ready` is the handshake: Turnstile is live on our origin. */
+export type ChallengeEvent =
+  | { type: 'ready' }
+  | { type: 'token'; token: string }
+  | { type: 'expired' }
+  | { type: 'error' }
+
+/** What the parent tells the page. */
+export type ChallengeCommand = { type: 'reset' }
+
+export type ChallengeOptions = {
+  theme: 'light' | 'dark' | 'auto'
+  /** Turnstile's own `language` option — a two-letter code, as the widget's locale gives it. */
+  language: string
+  /**
+   * Hand back `ready` and render nothing.
+   *
+   * The eager availability check asks whether Turnstile can run here at all, which the
+   * handshake answers on its own. Rendering for it would solve a challenge nobody submits,
+   * against the account's own quota, in a frame the viewer cannot see.
+   */
+  probe?: boolean
+}
+
+/**
+ * The frame's `src`, resolved against the module's own URL so the frame is always same-origin
+ * with the bundle — production, a Workers preview, `pnpm dev` or Ladle, with nothing to
+ * configure. `src/styles/fonts.ts` resolves the font files the same way and for the same
+ * reason: the deploy origin is not knowable at build time.
+ *
+ * ⚠ Pass `import.meta.url` as `moduleUrl` rather than writing it inside this function. Vite
+ * rewrites the literal `new URL(…, import.meta.url)` expression at transform time as its
+ * asset-URL idiom; a variable base is left alone.
+ */
+export function challengeSrc(moduleUrl: string, options: ChallengeOptions): string {
+  const url = new URL(CHALLENGE_PATH, moduleUrl)
+
+  url.searchParams.set('theme', options.theme)
+  url.searchParams.set('language', options.language)
+  if (options.probe) url.searchParams.set('probe', '1')
+
+  return url.href
+}
+
+/**
+ * The origin the challenge frame is served from — the one a host must allow under `frame-src`.
+ *
+ * ⚠ Pass `import.meta.url`, for the reason `challengeSrc` gives.
+ */
+export function challengeOrigin(moduleUrl: string): string {
+  return new URL(CHALLENGE_PATH, moduleUrl).origin
+}
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null
+
+const onChannel = (data: unknown): Record<string, unknown> | null =>
+  isRecord(data) && data.channel === CHALLENGE_CHANNEL ? data : null
+
+/** The page's message, or `null` for anything else on the window. */
+export function parseChallengeEvent(data: unknown): ChallengeEvent | null {
+  const message = onChannel(data)
+
+  if (!message) return null
+
+  switch (message.type) {
+    case 'ready':
+    case 'expired':
+    case 'error':
+      return { type: message.type }
+    case 'token':
+      // An empty token would enable Submit and then fail verification, which reads to a
+      // visitor as the form being broken rather than the challenge.
+      return typeof message.token === 'string' && message.token !== ''
+        ? { type: 'token', token: message.token }
+        : null
+    default:
+      return null
+  }
+}
+
+/** The parent's command, or `null`. Read by the page, where every framer is untrusted. */
+export function parseChallengeCommand(data: unknown): ChallengeCommand | null {
+  const message = onChannel(data)
+
+  return message?.type === 'reset' ? { type: 'reset' } : null
+}
+
+/** Wraps an outgoing message. Both sides send through this, so the channel cannot be forgotten. */
+export function challengeMessage<T extends ChallengeEvent | ChallengeCommand>(message: T) {
+  return { channel: CHALLENGE_CHANNEL, ...message }
+}
+
+/**
+ * The page's own query string, read back.
+ *
+ * Unknown values fall back rather than refusing: these reach us from a URL the parent built,
+ * and a captcha that will not render is a worse answer than one rendered in the wrong theme.
+ */
+export function readChallengeOptions(search: string): ChallengeOptions {
+  const params = new URLSearchParams(search)
+  const theme = params.get('theme')
+
+  return {
+    theme: theme === 'light' || theme === 'dark' || theme === 'auto' ? theme : 'auto',
+    // Turnstile takes `auto` for "follow the browser", which is the right default here too.
+    language: /^[a-z]{2}(-[a-z]{2})?$/i.test(params.get('language') ?? '')
+      ? (params.get('language') as string)
+      : 'auto',
+    probe: params.get('probe') === '1',
+  }
+}
diff --git a/src/test-support/turnstile-frame.ts b/src/test-support/turnstile-frame.ts
new file mode 100644
index 00000000..1b793f73
--- /dev/null
+++ b/src/test-support/turnstile-frame.ts
@@ -0,0 +1,49 @@
+import { vi } from 'vitest'
+
+import { CHALLENGE_CHANNEL, parseChallengeCommand } from '@/lib/turnstile-frame'
+
+/**
+ * Stands in for the challenge PAGE, never for our own hook (#343).
+ *
+ * `useTurnstile` mounts a frame on the widget's origin and waits for its `postMessage`
+ * handshake, so this speaks that protocol from the other side. What the specs using it are
+ * for is the form's own wiring — the token reaching Submit, and a failed submit asking for a
+ * fresh challenge — and mocking the hook would skip exactly that.
+ *
+ * Call it after the form has mounted: the frame is appended in an effect.
+ *
+ * @param container the element the form rendered into
+ */
+export function challengeFrameStub(container: ParentNode) {
+  const frame = container.querySelector('iframe')
+
+  if (!frame?.contentWindow) throw new Error('no Turnstile challenge frame')
+
+  const commands: string[] = []
+
+  vi.spyOn(frame.contentWindow, 'postMessage').mockImplementation(((data: unknown) => {
+    if (parseChallengeCommand(data)) commands.push('reset')
+  }) as Window['postMessage'])
+
+  // ⚠ The origin is read off the frame's own `src`. The hook resolves that URL against its
+  // module URL, so hard-coding one here would make the hook's own origin check pass or fail
+  // for a reason unrelated to the form under test.
+  const send = (message: Record<string, unknown>) =>
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { channel: CHALLENGE_CHANNEL, ...message },
+        origin: new URL(frame.src).origin,
+        source: frame.contentWindow,
+      }),
+    )
+
+  return {
+    /** The challenge renders and is solved, which is what hands the form its token. */
+    solve: (token = 'tok-live') => {
+      send({ type: 'ready' })
+      send({ type: 'token', token })
+    },
+    /** How many times the form asked the frame for a fresh challenge. */
+    resetCount: () => commands.length,
+  }
+}
diff --git a/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx b/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx
index b7be3823..fbc36563 100644
--- a/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx
+++ b/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx
@@ -69,16 +69,18 @@ const Sentinel = () => <p>{INTERFACE}</p>
 
 /**
  * A child that reaches for Turnstile the way `FullInterface` does (issue #182) — the fifth
- * candidate for the bug this file exists to catch, and the first one that injects a
- * third-party script into a page this project does not own, rather than merely fetching or
- * reporting.
+ * candidate for the bug this file exists to catch, and the first one that puts a request to a
+ * page this project does not own into their document, rather than merely fetching or reporting.
  *
  * This calls the real hook, rather than a stand-in. What is being asserted is that React never
  * renders this subtree, so anything the subtree would do is equally prevented. A fake would
  * only prove the fake stayed unrendered.
+ *
+ * ⚠ **What the guard mounts is a frame, not a script, since #343** — the challenge renders on
+ * the widget's own origin now. The cost to a host is the same shape: a document and a request
+ * for an interface nobody opened.
  */
-const TURNSTILE_SRC = 'challenges.cloudflare.com'
-const turnstileScripts = () => document.querySelectorAll(`script[src*="${TURNSTILE_SRC}"]`).length
+const challengeFrames = () => document.querySelectorAll(`iframe[src*="/challenge.html"]`).length
 
 function InterfaceWithTurnstile() {
   useTurnstileGuard()
@@ -112,20 +114,20 @@ describe('CompactEmbedView — what a collapsed card mounts', () => {
   // project's own page. A collapsed card is one button in somebody's sidebar. Loading
   // Cloudflare's challenge for it would put a third-party script into their document, and a
   // request to Cloudflare from every page view, for an interface nobody opened (issue #182).
-  it('injects no Turnstile script while collapsed, and does once opened', () => {
-    expect(turnstileScripts()).toBe(0)
+  it('mounts no Turnstile frame while collapsed, and does once opened', () => {
+    expect(challengeFrames()).toBe(0)
 
     mount(<InterfaceWithTurnstile />)
 
-    // Searched from `document`, not the host element: `loadTurnstile` appends to `<head>`.
-    expect(turnstileScripts()).toBe(0)
+    // Searched from `document`, not the host element: the probe appends to `<body>`.
+    expect(challengeFrames()).toBe(0)
 
     const button = document.querySelector('button')
 
     act(() => button?.dispatchEvent(new MouseEvent('click', { bubbles: true })))
 
     // The paired positive, for the same reason as the case above: without it a guard that
-    // never loaded Turnstile at all would pass, and take the eager check with it.
-    expect(turnstileScripts()).toBe(1)
+    // never reached for Turnstile at all would pass, and take the eager check with it.
+    expect(challengeFrames()).toBe(1)
   })
 })
diff --git a/tests/smoke/embed.smoke.test.ts b/tests/smoke/embed.smoke.test.ts
index 4dbfb7c4..ecfb2e0c 100644
--- a/tests/smoke/embed.smoke.test.ts
+++ b/tests/smoke/embed.smoke.test.ts
@@ -3,6 +3,7 @@ import { describe, expect, test } from 'vitest'
 import { appPreviewHost } from '../../scripts/assert-preview-host.mjs'
 import { appWorkerName } from '../../scripts/_wrangler-config.mjs'
 import { findLiveSiteKeys, findTestSiteKeys } from '../../scripts/turnstile-release-guard.mjs'
+import { CHALLENGE_PATH } from '../../src/lib/turnstile-frame'
 
 import { PREVIEW_URL, fetchPreview, skipWithoutPreview } from './_helpers/preview'
 
@@ -146,6 +147,96 @@ async function crawlFromLoader() {
   return { seen: [...seen], broken, bodies }
 }
 
+/**
+ * The Turnstile challenge page's own graph, crawled once and shared.
+ *
+ * It is a SECOND entry, not reachable from the loader: `challenge.html` is framed at runtime
+ * by a URL the widget composes, so no `import()` names it and the crawl above cannot find it
+ * (#343). Its chunks are where the site key now lives, which is why the key spec below reads
+ * both maps.
+ *
+ * Only a clean crawl is cached, as `crawlDeploy`.
+ */
+let challenge:
+  | Promise<{
+      html: string
+      status: number
+      type: string
+      broken: string[]
+      bodies: Map<string, string>
+    }>
+  | undefined
+
+function crawlChallenge() {
+  challenge ??= crawlChallengePage().then(
+    (result) => {
+      if (result.broken.length > 0) challenge = undefined
+
+      return result
+    },
+    (err) => {
+      challenge = undefined
+      throw err
+    },
+  )
+
+  return challenge
+}
+
+async function crawlChallengePage() {
+  const res = await fetchPreview(CHALLENGE_PATH)
+  const html = await res.text()
+  const bodies = new Map<string, string>()
+  const broken: string[] = []
+
+  // Vite emits the entry as a `<script type="module" src>` plus `modulepreload` links. Both
+  // shapes are matched, because which chunks get a preload hint is the bundler's choice and
+  // the key could be inlined into any of them.
+  const specs = new Set(
+    [...html.matchAll(/(?:src|href)="(\/assets\/[^"]+\.js)"/g)].map(([, path]) => path),
+  )
+
+  for (const path of specs) {
+    const chunk = await fetchPreview(path)
+    const type = chunk.headers.get('content-type') ?? ''
+
+    // As the loader crawl: the SPA fallback answers 200 `text/html` for a path the deploy
+    // does not have, so the content type is what tells a chunk from the shell.
+    if (chunk.status === 200 && /javascript|ecmascript/i.test(type)) {
+      bodies.set(path, await chunk.text())
+    } else {
+      bodies.set(path, '')
+      broken.push(`${path} → ${chunk.status} ${type}`)
+    }
+  }
+
+  return { html, broken, bodies, status: res.status, type: res.headers.get('content-type') ?? '' }
+}
+
+describe('turnstile challenge page', () => {
+  // Every registration and every issue report frames this page. A deploy that does not serve
+  // it answers the SPA shell with a 200 instead, so the frame loads the whole widget inside
+  // itself, never sends a handshake, and the eager check fails the embed ten seconds later —
+  // on every host at once.
+  test.skipIf(skipWithoutPreview)('serves the challenge page, not the SPA shell', async () => {
+    const { html, status, type } = await crawlChallenge()
+
+    expect(status).toBe(200)
+    expect(type).toMatch(/text\/html/)
+    expect(html).toContain('id="challenge"')
+    // The shell's own mount point. `assets.not_found_handling` serves it for any path the
+    // deploy lacks, which is exactly the failure this case exists to catch.
+    expect(html).not.toContain('id="syatlas"')
+  })
+
+  test.skipIf(skipWithoutPreview)('serves every chunk the challenge page names', async () => {
+    const { broken, bodies } = await crawlChallenge()
+
+    expect(bodies.size).toBeGreaterThan(0)
+    expect(broken).toEqual([])
+  })
+})
+
 describe('embed bundle', () => {
   test.skipIf(skipWithoutPreview)('serves auto.js as a loader, not as the widget', async () => {
     const { status, body } = await fetchEmbed()
@@ -198,15 +289,22 @@ describe('turnstile site key', () => {
   test.skipIf(skipWithoutPreview)(
     'ships the test key only on a preview, and a real key everywhere else',
     async () => {
-      const { bodies, broken } = await crawlDeploy()
+      const loader = await crawlDeploy()
+      const page = await crawlChallenge()
 
       // A chunk that failed to fetch is stored with an empty body, so a 404 on the chunk
-      // carrying the key would read here as an unset build variable. The sibling case above
-      // owns that failure and names it correctly.
-      if (broken.length > 0) return
-
+      // carrying the key would read here as an unset build variable. The sibling cases above
+      // own that failure and name it correctly.
+      if (loader.broken.length > 0 || page.broken.length > 0) return
+
+      // ⚠ Both graphs, because the key moved out of the widget's own into the challenge
+      // page's when the challenge moved to a frame (#343) — and a key found in EITHER is a
+      // key production serves. Reading only the loader's graph would report production as
+      // carrying no key at all, and reading only the page's would miss a key re-inlined into
+      // the widget.
+      const bodies = [...loader.bodies, ...page.bodies]
       const where = (find: (body: string) => string[]) =>
-        [...bodies].flatMap(([path, body]) => find(body).map((key) => `${path}: ${key}`))
+        bodies.flatMap(([path, body]) => find(body).map((key) => `${path}: ${key}`))
 
       const testKeys = where(findTestSiteKeys)
       // A real key is public, but it stays out of CI logs: named by prefix only.
diff --git a/vite.config.ts b/vite.config.ts
index 96994c20..7842c9f1 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -311,6 +311,10 @@ export default defineConfig(({ command }) => ({
     rolldownOptions: {
       input: {
         main: resolve(import.meta.dirname, 'index.html'),
+        // The Turnstile challenge, served from our origin so Turnstile sees one hostname
+        // whatever page hosts the widget (#343). An HTML input, so it lands at the output
+        // root as `/challenge.html` — the path `src/lib/turnstile-frame.ts` resolves.
+        challenge: resolve(import.meta.dirname, 'challenge.html'),
         // This is the one script a host installs. Nobody loads
         // `embed.js` directly any more — the loader imports it
         // dynamically. It stays an explicit entry so it keeps a stable,

From 4c8c9468133cb7ecd8bc788e0894aa9248c386e2 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 1 Nov 2026 20:11:49 +0000
Subject: [PATCH 02/14] fix(turnstile): keep the availability probe out of the
 host's scroll height
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The probe's frame lands in the HOST page's body, and an out-of-flow element at
its static position still extends the document's scroll area — a stray pixel of
scroll on somebody else's page for the length of the check. `fixed` contributes
none.

Records what a browser said about the violation the probe reads, measured
against the built page in Chromium 153.0.8010.12: a host sending
`frame-src 'none'` and one sending only `default-src 'self'` both report
`effectiveDirective: 'frame-src'` with `blockedURI` the bare origin, no trailing
slash and no path. That is why the handler matches by prefix, and the spec now
covers both shapes.

docs/embedding.md gains the frame as a seventh exception under what the widget
does to a host's page, since a transient element in their body is observable.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mg9rjYffj6R24HDkeuBGpj
---
 docs/embedding.md                | 10 +++++++++-
 src/hooks/use-turnstile.test.tsx |  9 +++++++--
 src/hooks/use-turnstile.ts       | 22 ++++++++++++++++++----
 3 files changed, 34 insertions(+), 7 deletions(-)

diff --git a/docs/embedding.md b/docs/embedding.md
index e71d1381..e25d6e27 100644
--- a/docs/embedding.md
+++ b/docs/embedding.md
@@ -1025,7 +1025,7 @@ elements. On top of that, every selector is still confined to the widget's own s
 fails the build if a rule escapes. Your headings, links, lists, forms, `.container`, a `.dark`
 theme class, and your own Swiper or Mapbox instances are all left alone.
 
-Six honest exceptions, none of them styling your content:
+Seven honest exceptions, none of them styling your content:
 
 - Opening a modal panel inside the widget sets `overflow: hidden` on your `<body>` while open —
   standard scroll-lock, reverted on close.
@@ -1062,6 +1062,14 @@ Six honest exceptions, none of them styling your content:
   and without them the widget draws no borders and no shadows. Like the widget's own sheet, it is
   constructed, so it asks nothing new of your [CSP](#content-security-policy).
 
+- **A 1-pixel hidden `<iframe>` sits in your `<body>` for a moment after the widget mounts**,
+  and is removed again as soon as it has answered. It is the captcha's availability check: it
+  loads the challenge page from the widget's origin and asks whether your policy lets it, so a
+  page where registration is impossible says so immediately rather than at the moment somebody
+  tries to sign up. It is `position: fixed`, fully transparent, not focusable and hidden from
+  assistive technology, and it adds nothing to your page's scroll height. Nothing else of yours
+  is touched.
+
 **The reverse direction is a boundary, not a defence.** The widget renders inside a **shadow
 root**, so a selector in your stylesheet cannot match an element inside it — at any specificity,
 with or without `!important`. A blanket `button { … }`, an `a { color: … !important }`, a
diff --git a/src/hooks/use-turnstile.test.tsx b/src/hooks/use-turnstile.test.tsx
index c4720512..caf5f5b9 100644
--- a/src/hooks/use-turnstile.test.tsx
+++ b/src/hooks/use-turnstile.test.tsx
@@ -327,10 +327,15 @@ describe('probeTurnstile', () => {
     expect(probe.settled()).toBe(false)
   })
 
-  it('resolves false at once on a frame-src violation naming our origin', async () => {
+  // Chromium reports the BARE origin as `blockedURI` — measured, and the reason the handler
+  // matches by prefix. The path form is kept for the engines that were not measured.
+  it.each([
+    ['the bare origin, as Chromium sends it', ''],
+    ['the origin with a path', '/challenge.html'],
+  ])('resolves false at once on a frame-src violation naming %s', async (_label, path) => {
     const probe = startProbe()
 
-    violation('frame-src', `${probe.origin()}/challenge.html`)
+    violation('frame-src', `${probe.origin()}${path}`)
     await vi.advanceTimersByTimeAsync(0)
 
     // Before the timeout, which is the whole point: a refused frame fires no load and no
diff --git a/src/hooks/use-turnstile.ts b/src/hooks/use-turnstile.ts
index dc6472fa..6419cd55 100644
--- a/src/hooks/use-turnstile.ts
+++ b/src/hooks/use-turnstile.ts
@@ -123,9 +123,16 @@ export async function probeTurnstile(): Promise<boolean> {
       resolve(available)
     }
 
-    // The violation the probe exists to catch: a host `frame-src` (or `child-src`, or a
-    // `default-src` standing in for either) that refuses our origin. The frame then fires no
-    // load and no error of its own, so without this the verdict would wait out the timeout.
+    // The violation the probe exists to catch: a host policy that refuses to frame our
+    // origin. The frame then fires no load and no error of its own, so without this the
+    // verdict would wait out the timeout.
+    //
+    // Measured in Chromium 153.0.8010.12 against the built page, 2026-11-01: a host sending
+    // `frame-src 'none'` AND one sending only `default-src 'self'` both report
+    // `effectiveDirective: 'frame-src'` with `blockedURI` the BARE ORIGIN — no trailing
+    // slash and no path. Hence `startsWith`, which holds for either shape, rather than an
+    // equality test. `child-src` and `default-src` are matched for the engines this was not
+    // measured on, and for `violatedDirective`, which is the older spelling.
     const onViolation = (event: SecurityPolicyViolationEvent) => {
       const directive = event.effectiveDirective || event.violatedDirective
 
@@ -145,7 +152,14 @@ export async function probeTurnstile(): Promise<boolean> {
 
     // Hidden, not `display: none`: a frame with no box is still fetched, but keeping it in the
     // layout tree is what keeps this check as close as possible to the frame a form mounts.
-    frame.style.position = 'absolute'
+    //
+    // ⚠ `fixed`, not `absolute`. This lands in the HOST page's body, and an out-of-flow
+    // element at its static position still extends the document's scroll area — a stray
+    // pixel of scroll on somebody else's page for the length of the check. A fixed element
+    // contributes none.
+    frame.style.position = 'fixed'
+    frame.style.top = '0'
+    frame.style.left = '0'
     frame.style.width = '1px'
     frame.style.height = '1px'
     frame.style.opacity = '0'

From 4af17ebcb391dc95b67122174899a6c823bc7433 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 1 Nov 2026 20:11:49 +0000
Subject: [PATCH 03/14] refactor(turnstile): one liveness rule, one page check,
 one crawl
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Applies the /simplify pass over the branch. Two of these change behaviour and
are the reason the pass was worth running:

- `useTurnstile` had no handshake timeout, so a form under a `frame-src` that
  refuses us sat on `loading` for ever, behind a submit button that could never
  produce a token. The bound moves into `createChallengeFrame`, which delivers
  silence as the page's own `error` — the event both callers already answer
  correctly. One liveness rule, shared.
- `probeTurnstile` re-ran on every interface mount. The script load it replaced
  memoized itself, so a compact embed's open/close/open used to cost nothing and
  now paid for a browsing context, three chunks and a Cloudflare script eval
  each time. Memoized, and cleared on a negative verdict so a transient network
  failure is retried rather than cached for the page's life.

The rest is cleanup. The smoke lane's two crawls now share one memo wrapper,
one "did the deploy really serve this chunk" rule, and one transitive walk —
the challenge page's graph was crawled one level deep, which is the defect #96
recorded against the loader. `/challenge.html` gets a `Cache-Control` rule
rather than a host-dependent platform default, and its HTML comment moves into
the modules, since Vite strips no HTML comment and the page is fetched inside a
frame on the registration path.

Three comments had gone false with the rewrite and are corrected: `Fallbacks`
justified its retry by `loadTurnstile`'s cleared promise and told hosts to edit
`script-src`, `src/mocks/errors.ts` named the wrong directive, and README's
privacy bullet still put Cloudflare in the host's own CSP.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mg9rjYffj6R24HDkeuBGpj
---
 README.md                                     |   9 +-
 challenge.html                                |  20 +-
 public/_headers                               |  10 +
 src/challenge.ts                              |  20 +-
 .../molecules/Fallbacks/Fallbacks.tsx         |  24 ++-
 src/hooks/use-turnstile-guard.ts              |   4 +-
 src/hooks/use-turnstile.test.tsx              | 176 +++++++++------
 src/hooks/use-turnstile.ts                    |  71 +++++--
 src/lib/turnstile-frame.ts                    |  26 +--
 src/mocks/errors.ts                           |   7 +-
 src/test-support/turnstile-frame.ts           |  47 ++--
 .../CompactEmbedView.mount.test.tsx           |   8 +-
 tests/smoke/embed.smoke.test.ts               | 201 +++++++++---------
 13 files changed, 346 insertions(+), 277 deletions(-)

diff --git a/README.md b/README.md
index 6480be5e..e6f425e1 100644
--- a/README.md
+++ b/README.md
@@ -99,10 +99,13 @@ SahajCloud's:
   posts load telemetry to `events.mapbox.com`. `map=false` drops the whole
   subtree.
 - **`react-circle-flags.pages.dev`** serves the country flag SVGs
-  (`referrer-policy: no-referrer`). **`challenges.cloudflare.com`** loads
-  Turnstile as soon as the interface mounts, not when a visitor opens a form
-  (#182). Both are in the CSP table in
+  (`referrer-policy: no-referrer`); it is in the CSP table in
   [`docs/embedding.md`](docs/embedding.md#content-security-policy).
+  **`challenges.cloudflare.com`** loads Turnstile as soon as the interface
+  mounts, not when a visitor opens a form (#182) — but since #343 it is loaded
+  by the challenge document on OUR origin, not by the host's page, so it is in
+  no directive of theirs and their URL is never the referrer. The host allows
+  `frame-src` for our origin instead.
 
 None of these has a script-URL opt-out (#149) — each is built so it does not
 need one. A compliance requirement we have not anticipated becomes a setting
diff --git a/challenge.html b/challenge.html
index 3e73b548..82e6ee37 100644
--- a/challenge.html
+++ b/challenge.html
@@ -2,21 +2,13 @@
 
 <!--
   The Turnstile challenge, served from the widget's own origin and framed by the widget
-  (#343). Turnstile validates the hostname of the document that renders it, so rendering it
-  inside a partner's page failed with `110200` on every hostname not on the widget's list.
-  Here it always sees `sahajatlas.com`. src/lib/turnstile-frame.ts carries the reasoning.
+  (#343). src/challenge.ts and src/lib/turnstile-frame.ts carry the reasoning; this file is
+  deliberately thin, because Vite strips no HTML comment and every byte here is fetched inside
+  a frame on the registration path.
 
-  This is not a page anybody navigates to — src/challenge.ts talks to its parent frame and
-  nothing else. It carries no stylesheet of ours: the widget's sheet is scoped to `.sy-atlas`
-  and adopted into a shadow root, neither of which exists here, and the only thing on the page
-  is Cloudflare's own 300×65 widget.
-
-  ⚠ The reset is in `style` ATTRIBUTES, and may not move into a `<style>` block. Every
-  stylesheet in this build goes through scripts/postcss-scope-widget.mjs, which rewrites each
-  selector to `:where(.sy-atlas)` — measured here, where it collapsed `html, body` onto one
-  selector matching neither element, so the body kept its 8px default margin and pushed the
-  widget out of a frame sized to it. Transparent, so the challenge sits on whatever surface
-  the form puts the frame on; Cloudflare's widget paints its own card.
+  ⚠ The reset below is in `style` ATTRIBUTES and may not move into a `<style>` block:
+  scripts/postcss-scope-widget.mjs rewrites every selector in this build to `:where(.sy-atlas)`,
+  which matches nothing on this page.
 -->
 <html lang="en" style="margin: 0; padding: 0; background: transparent; overflow: hidden">
   <head>
diff --git a/public/_headers b/public/_headers
index b70ce7a0..2f115674 100644
--- a/public/_headers
+++ b/public/_headers
@@ -29,6 +29,16 @@
 /embed.js
   Cache-Control: public, max-age=0, must-revalidate
 
+# The Turnstile challenge document (#343). Unhashed, like the two above, because the widget
+# composes its URL at runtime — but it is fetched inside a frame on the registration path, and
+# it references only content-hashed assets, so it can be cached briefly rather than revalidated
+# on every mount. Without a rule it falls to the platform default, which this file records as
+# host-dependent (`max-age=14400` on the custom domain, `max-age=0` on a vendor host): four
+# hours is too long for a document that names hashed chunks, and zero is a network round trip
+# per frame.
+/challenge.html
+  Cache-Control: public, max-age=600, must-revalidate
+
 
 # CORS. The widget is embedded in OTHER sites, so everything it loads at runtime is a
 # cross-origin request from the host page's point of view. A font is always fetched in CORS
diff --git a/src/challenge.ts b/src/challenge.ts
index d589988b..0715359e 100644
--- a/src/challenge.ts
+++ b/src/challenge.ts
@@ -15,6 +15,7 @@
 
 import {
   type ChallengeEvent,
+  type ChallengeOptions,
   challengeMessage,
   parseChallengeCommand,
   readChallengeOptions,
@@ -28,7 +29,7 @@ const SITE_KEY: string | undefined = import.meta.env.VITE_TURNSTILE_SITE_KEY
 
 type TurnstileRenderOptions = {
   sitekey: string
-  theme?: 'light' | 'dark' | 'auto'
+  theme?: ChallengeOptions['theme']
   language?: string
   callback?: (token: string) => void
   'error-callback'?: () => void
@@ -51,14 +52,10 @@ function send(message: ChallengeEvent) {
 }
 
 function mount() {
-  const container = document.getElementById('challenge')
-
-  if (!container) {
-    send({ type: 'error' })
-
-    return
-  }
-
+  // The div is this document's own, so the fallback is for nothing that can happen rather than
+  // a case to branch on. `challenge.html` carries the id because the smoke lane reads it back
+  // to tell this page from the SPA shell a missing deploy would serve in its place.
+  const container = document.getElementById('challenge') ?? document.body
   const options = readChallengeOptions(window.location.search)
 
   // No key means no captcha anywhere in the widget, so the handshake must NOT succeed: the
@@ -74,8 +71,9 @@ function mount() {
 
   script.src = SCRIPT_URL
   script.async = true
-  // Cloudflare learns this origin regardless — it is the hostname check. This keeps the path
-  // and query off the request, which now carry the parent's theme and language.
+  // This is the Cloudflare-facing hop, and the only one. Cloudflare learns this origin
+  // regardless — that is the hostname check. What this keeps off the request is the path and
+  // query, which carry the parent's theme and language.
   script.referrerPolicy = 'strict-origin'
   script.addEventListener('error', () => send({ type: 'error' }))
   script.addEventListener('load', () => {
diff --git a/src/components/molecules/Fallbacks/Fallbacks.tsx b/src/components/molecules/Fallbacks/Fallbacks.tsx
index b80aa89c..5c3783d7 100644
--- a/src/components/molecules/Fallbacks/Fallbacks.tsx
+++ b/src/components/molecules/Fallbacks/Fallbacks.tsx
@@ -228,9 +228,10 @@ export const ERROR_POLICY: Record<FallbackKind, FallbackPolicy> = {
     report: true,
   },
   // Turnstile failed to load, so this widget cannot send anything the viewer
-  // writes (issue #182). The usual cause is a `config` failure: a host CSP that is
-  // missing challenges.cloudflare.com. This row still earns its own row, for one
-  // reason `config` cannot express:
+  // writes (issue #182). The usual cause is a `config` failure: a host CSP that
+  // will not let the widget frame its own origin, where the challenge renders
+  // (#343). This row still earns its own row, for one reason `config` cannot
+  // express:
   //
   // **It offers no report action.** The report form is itself gated by Turnstile.
   // Sending a viewer to it would hand them a second form that also cannot submit.
@@ -238,19 +239,20 @@ export const ERROR_POLICY: Record<FallbackKind, FallbackPolicy> = {
   // `REPORTED_KINDS` mirrors it too.
   //
   // The sentence names the cause, not the fix. A visitor cannot edit a CSP. The
-  // instruction "add challenges.cloudflare.com to your script-src" means nothing
-  // to most visitors on a meditation page. Only the site's developer needs it.
+  // instruction "add our origin to your frame-src" means nothing to most visitors
+  // on a meditation page. Only the site's developer needs it.
   // `reportIntegrationWarning` prints that instruction to the console, where a
   // developer debugging the embed will look. `docs/embedding.md` carries the
   // lasting version.
   //
   // ⚠ **This row DOES retry. That looks wrong next to `config`, but is correct.**
-  // The probe reports the same verdict for a CSP that blocks the script and for a
-  // script request that simply failed on the network. `loadTurnstile` clears its
-  // cached promise on failure. So a second attempt is a real second attempt, and
-  // the network-failure half of that pair can genuinely recover. A CSP block fails
-  // again the same way, which costs the viewer one press. A `config` failure has
-  // no such recoverable half, so it withholds the retry. This row does not.
+  // The check reports the same verdict for a CSP that refuses the frame and for a
+  // frame request that simply failed on the network, and it clears its memoized
+  // verdict whenever it is negative. So a second attempt mounts a fresh frame and
+  // is a real second attempt, and the network-failure half of that pair can
+  // genuinely recover. A CSP block fails again the same way, which costs the
+  // viewer one press. A `config` failure has no such recoverable half, so it
+  // withholds the retry. This row does not.
   'captcha-blocked': {
     messageKey: 'common.errors.captcha_blocked',
     fallbackText: "This Atlas can't run on this page: its security check was blocked.",
diff --git a/src/hooks/use-turnstile-guard.ts b/src/hooks/use-turnstile-guard.ts
index 42aadd49..6c7e83b8 100644
--- a/src/hooks/use-turnstile-guard.ts
+++ b/src/hooks/use-turnstile-guard.ts
@@ -27,8 +27,6 @@ export function cspAdvice(origin: string): string {
   )
 }
 
-const CSP_ADVICE = cspAdvice(challengeOrigin(import.meta.url))
-
 /**
  * This fails the widget when Turnstile cannot load. See issue #182.
  *
@@ -65,7 +63,7 @@ export function useTurnstileGuard(): void {
 
       // This runs before the throw, not after.
       // The throw unmounts this tree, and the console line is the only part of this addressed to somebody who can fix it.
-      reportIntegrationWarning(CSP_ADVICE)
+      reportIntegrationWarning(cspAdvice(challengeOrigin(import.meta.url)))
       setBlocked(true)
     })
 
diff --git a/src/hooks/use-turnstile.test.tsx b/src/hooks/use-turnstile.test.tsx
index caf5f5b9..af4c5dc5 100644
--- a/src/hooks/use-turnstile.test.tsx
+++ b/src/hooks/use-turnstile.test.tsx
@@ -3,9 +3,10 @@ import { act } from 'react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { createRoot } from 'react-dom/client'
 
-import { type UseTurnstile, probeTurnstile, useTurnstile } from './use-turnstile'
+import { type UseTurnstile, useTurnstile } from './use-turnstile'
 
-import { CHALLENGE_CHANNEL } from '@/lib/turnstile-frame'
+import { sendFromFrame } from '@/test-support/turnstile-frame'
+import { CHALLENGE_CHANNEL, type ChallengeEvent } from '@/lib/turnstile-frame'
 
 /**
  * The challenge lives in a frame on our own origin since #343, so what this covers is the
@@ -45,28 +46,13 @@ async function mount(node = <Probe />) {
 
 const frame = () => container.querySelector('iframe')
 
-/**
- * Speaks as the challenge page does.
- *
- * ⚠ The origin is read off the frame's own `src`, never written out. The hook resolves that
- * URL against its module URL, so the origin is the dev server's here and the deploy's in
- * production — hard-coding either would make this pass for the wrong reason.
- */
-function fromFrame(message: Record<string, unknown>, overrides: MessageEventInit = {}) {
+/** Speaks as the challenge page does. `sendFromFrame` owns the origin and source. */
+function fromFrame(message: ChallengeEvent, overrides: MessageEventInit = {}) {
   const iframe = frame()
 
   if (!iframe) throw new Error('no challenge frame')
 
-  act(() =>
-    window.dispatchEvent(
-      new MessageEvent('message', {
-        data: { channel: CHALLENGE_CHANNEL, ...message },
-        origin: new URL(iframe.src).origin,
-        source: iframe.contentWindow,
-        ...overrides,
-      }),
-    ),
-  )
+  act(() => sendFromFrame(iframe, message, overrides))
 }
 
 beforeEach(() => {
@@ -158,22 +144,38 @@ describe('useTurnstile', () => {
 
   it('ignores a message on another channel', async () => {
     await mount()
+    // A host page's own cross-frame traffic. Without the channel marker this shape would read
+    // as a solved challenge.
+    fromFrame({ type: 'token', token: 'tok-1' }, { data: { type: 'token', token: 'tok-host' } })
 
-    const iframe = frame()
+    expect(hook.token).toBeNull()
+  })
 
-    act(() =>
-      window.dispatchEvent(
-        new MessageEvent('message', {
-          // A host page's own cross-frame traffic. Without the channel marker this shape
-          // would read as a solved challenge.
-          data: { type: 'token', token: 'tok-host' },
-          origin: new URL(iframe?.src as string).origin,
-          source: iframe?.contentWindow,
-        }),
-      ),
-    )
+  it('reports blocked when the frame never answers', async () => {
+    vi.useFakeTimers()
+    await mount()
 
-    expect(hook.token).toBeNull()
+    expect(hook.status).toBe('loading')
+
+    // A `frame-src` that refuses us, or a proxy that swallows the request, produces no message
+    // at all. Without this the form sat on `loading` for ever, behind a submit button that
+    // could never produce a token.
+    await act(async () => vi.advanceTimersByTimeAsync(10_000))
+
+    expect(hook.status).toBe('blocked')
+    vi.useRealTimers()
+  })
+
+  it('does not call the frame dead once it has handshaken', async () => {
+    vi.useFakeTimers()
+    await mount()
+    fromFrame({ type: 'ready' })
+
+    // An unsolved challenge is Turnstile's business after the handshake, not a dead frame's.
+    await act(async () => vi.advanceTimersByTimeAsync(60_000))
+
+    expect(hook.status).toBe('ready')
+    vi.useRealTimers()
   })
 
   it('asks the frame to reset, and drops the token first', async () => {
@@ -256,24 +258,35 @@ describe('probeTurnstile', () => {
     )
 
   /**
-   * Starts the check and reports what it has decided so far.
+   * Starts the check on a FRESH copy of the module, and reports what it has decided so far.
    *
-   * ⚠ **Every case here runs on fake timers, and that is the only thing that makes them
-   * non-vacuous.** The check's timeout answers `false` too, so a case that simply awaits the
+   * ⚠ **Fresh, because the verdict is memoized at module scope.** Every case here would
+   * otherwise read whichever answer the first one cached.
+   *
+   * ⚠ **Every case runs on fake timers, and that is the only thing that makes them
+   * non-vacuous.** The handshake timeout answers `false` too, so a case that simply awaits the
    * verdict passes whether the signal it dispatched was read or ignored — it just takes ten
    * seconds about it. What each case asserts is therefore WHEN the verdict lands.
    */
-  function startProbe() {
+  async function startProbe() {
     vi.useFakeTimers()
+    vi.resetModules()
+
+    const { probeTurnstile } = await import('./use-turnstile')
+    const verdicts: (boolean | 'pending')[] = []
+    const run = () => {
+      const index = verdicts.push('pending') - 1
 
-    let state: boolean | 'pending' = 'pending'
-    const done = probeTurnstile().then((available) => {
-      state = available
-    })
+      return probeTurnstile().then((available) => {
+        verdicts[index] = available
+      })
+    }
 
     return {
-      done,
-      settled: () => state,
+      run,
+      done: run(),
+      settled: (index = 0) => verdicts[index],
+      calls: () => verdicts.length,
       origin: () => new URL(probeFrame()?.src as string).origin,
     }
   }
@@ -287,23 +300,24 @@ describe('probeTurnstile', () => {
       }),
     )
 
+  const fromProbe = (type: ChallengeEvent['type']) => {
+    const iframe = probeFrame()
+
+    if (!iframe) throw new Error('no probe frame')
+
+    sendFromFrame(iframe, { type } as ChallengeEvent)
+  }
+
   afterEach(() => {
     vi.useRealTimers()
   })
 
   it('mounts a handshake-only frame and resolves true on ready', async () => {
-    const probe = startProbe()
-    const iframe = probeFrame()
+    const probe = await startProbe()
 
-    expect(new URL(iframe?.src as string).searchParams.get('probe')).toBe('1')
+    expect(new URL(probeFrame()?.src as string).searchParams.get('probe')).toBe('1')
 
-    window.dispatchEvent(
-      new MessageEvent('message', {
-        data: { channel: CHALLENGE_CHANNEL, type: 'ready' },
-        origin: new URL(iframe?.src as string).origin,
-        source: iframe?.contentWindow,
-      }),
-    )
+    fromProbe('ready')
     await probe.done
 
     expect(probe.settled()).toBe(true)
@@ -312,16 +326,9 @@ describe('probeTurnstile', () => {
   })
 
   it('resolves false when the frame reports an error', async () => {
-    const probe = startProbe()
-    const iframe = probeFrame()
+    const probe = await startProbe()
 
-    window.dispatchEvent(
-      new MessageEvent('message', {
-        data: { channel: CHALLENGE_CHANNEL, type: 'error' },
-        origin: new URL(iframe?.src as string).origin,
-        source: iframe?.contentWindow,
-      }),
-    )
+    fromProbe('error')
     await probe.done
 
     expect(probe.settled()).toBe(false)
@@ -333,13 +340,13 @@ describe('probeTurnstile', () => {
     ['the bare origin, as Chromium sends it', ''],
     ['the origin with a path', '/challenge.html'],
   ])('resolves false at once on a frame-src violation naming %s', async (_label, path) => {
-    const probe = startProbe()
+    const probe = await startProbe()
 
     violation('frame-src', `${probe.origin()}${path}`)
     await vi.advanceTimersByTimeAsync(0)
 
-    // Before the timeout, which is the whole point: a refused frame fires no load and no
-    // error of its own, so without this the widget would run for ten seconds looking healthy.
+    // Before the handshake timeout, which is the whole point: a refused frame fires no load
+    // and no error of its own, so without this the widget looks healthy for ten seconds.
     expect(probe.settled()).toBe(false)
   })
 
@@ -350,7 +357,7 @@ describe('probeTurnstile', () => {
     ['another directive, our origin', 'img-src', true],
     ['frame-src, another origin', 'frame-src', false],
   ])('ignores a violation about %s', async (_label, directive, ours) => {
-    const probe = startProbe()
+    const probe = await startProbe()
 
     violation(directive, ours ? `${probe.origin()}/logo.svg` : 'https://widgets.example/f.html')
     await vi.advanceTimersByTimeAsync(5_000)
@@ -364,7 +371,7 @@ describe('probeTurnstile', () => {
   })
 
   it('resolves false only once the frame has had its full wait', async () => {
-    const probe = startProbe()
+    const probe = await startProbe()
 
     await vi.advanceTimersByTimeAsync(9_999)
 
@@ -375,4 +382,39 @@ describe('probeTurnstile', () => {
 
     expect(probe.settled()).toBe(false)
   })
+
+  it('checks once per page and shares the answer', async () => {
+    const probe = await startProbe()
+
+    fromProbe('ready')
+    await probe.done
+
+    const second = probe.run()
+
+    await second
+
+    // A compact embed's dialog unmounts its children, so open/close/open would otherwise pay
+    // for a whole browsing context, three of our chunks and a Cloudflare script eval each time.
+    expect(probe.settled(1)).toBe(true)
+    expect(probeFrame()).toBeUndefined()
+  })
+
+  it('checks again after a negative verdict', async () => {
+    const probe = await startProbe()
+
+    fromProbe('error')
+    await probe.done
+
+    // Not cached: the same verdict covers a CSP refusal and a request that simply failed, and
+    // the second of those can recover. The script load this replaced cleared its memo for the
+    // same reason.
+    const second = probe.run()
+
+    expect(probeFrame()).toBeDefined()
+
+    fromProbe('ready')
+    await second
+
+    expect(probe.settled(1)).toBe(true)
+  })
 })
diff --git a/src/hooks/use-turnstile.ts b/src/hooks/use-turnstile.ts
index 6419cd55..351a7a34 100644
--- a/src/hooks/use-turnstile.ts
+++ b/src/hooks/use-turnstile.ts
@@ -34,22 +34,29 @@ const FRAME_WIDTH = 300
 const FRAME_HEIGHT = 65
 
 /**
- * How long the availability check waits for the frame's handshake.
+ * How long either caller waits for the frame's handshake before calling it dead.
  *
- * It bounds a frame that neither loads nor errors: a CSP refusal reports
- * `securitypolicyviolation` and is caught at once, but a host behind a proxy that swallows the
- * request leaves the frame blank with no event at all. Nothing waits on this promise, so the
- * cost of the bound being generous is a verdict that lands late, not a slow first paint.
+ * It bounds a frame that neither loads nor errors — a host behind a proxy that swallows the
+ * request, or one whose policy refuses the frame on an engine that reports no violation — and
+ * both callers need the same bound. Nothing blocks on the verdict, so a generous bound costs a
+ * late answer, never a slow first paint.
  */
-const PROBE_TIMEOUT_MS = 10_000
+const HANDSHAKE_TIMEOUT_MS = 10_000
 
 /**
- * Builds the frame and the listener that reads it, for both the hook and the probe.
+ * Builds the frame, the listener that reads it, and the one definition of its liveness — for
+ * both the hook and the probe.
  *
  * Two checks decide what counts as the frame talking, and both are needed. `event.source`
  * pins the message to this frame's own window, which no other document can forge. `origin`
  * pins it to the origin we built the `src` from, so a frame navigated elsewhere — a redirect,
  * a captive portal — cannot keep answering as the challenge.
+ *
+ * ⚠ **Silence is delivered as the page's own `error`.** A frame that never handshakes is as
+ * dead as one that reported a failure, and both callers already answer `error` correctly — the
+ * probe with `false`, the hook with `blocked`. Giving the hook no timeout of its own is what
+ * left a form under a refusing `frame-src` on `loading` for ever, with a submit button that
+ * could never produce a token.
  */
 function createChallengeFrame(
   options: ChallengeOptions,
@@ -65,11 +72,17 @@ function createChallengeFrame(
   // The frame's content is a captcha with its own labelling. A title is still required of
   // every frame, and "security check" is what a screen-reader user needs to hear here.
   frame.title = 'Security check'
-  // Cloudflare learns our origin from the request regardless. This keeps the host page's path
-  // and query out of it, which an `unsafe-url` referrer policy on the host would otherwise send.
+  // This request goes to OUR origin, not Cloudflare's — `src/challenge.ts` owns that hop. What
+  // this keeps out of our own logs is the host page's path and query, which a host opting into
+  // an `unsafe-url` referrer policy would otherwise send us.
   frame.referrerPolicy = 'strict-origin'
 
   const expectedOrigin = new URL(src).origin
+  const deliver = (message: ChallengeEvent | null) => {
+    if (message) clearTimeout(timer)
+
+    onEvent(message)
+  }
   const onMessage = (event: MessageEvent) => {
     // `contentWindow` is checked for presence as well as identity: a frame with none yet
     // leaves both sides `null`, and `null !== null` is false, so a message carrying no source
@@ -77,12 +90,14 @@ function createChallengeFrame(
     if (!frame.contentWindow || event.source !== frame.contentWindow) return
     if (event.origin !== expectedOrigin) return
 
-    onEvent(parseChallengeEvent(event.data))
+    deliver(parseChallengeEvent(event.data))
   }
+  const timer = setTimeout(() => onEvent({ type: 'error' }), HANDSHAKE_TIMEOUT_MS)
 
   window.addEventListener('message', onMessage)
 
   const dispose = () => {
+    clearTimeout(timer)
     window.removeEventListener('message', onMessage)
     frame.remove()
   }
@@ -108,24 +123,41 @@ function createChallengeFrame(
  * ⚠ The hostname mismatch this check could never see is **gone** rather than unobserved — the
  * challenge now always renders on the one hostname the widget's Turnstile key lists (#343).
  */
+let availability: Promise<boolean> | null = null
+
 export async function probeTurnstile(): Promise<boolean> {
   if (typeof document === 'undefined') return false
 
+  // One check per page, shared by every mount. The script load this replaced memoized itself,
+  // so reopening an interface cost nothing; without this a compact embed's open/close/open
+  // pays for a whole browsing context, three of our chunks and a Cloudflare script eval each
+  // time. Cleared on a negative verdict, so a transient network failure is retried rather
+  // than cached for the life of the page.
+  availability ??= runCheck().then((available) => {
+    if (!available) availability = null
+
+    return available
+  })
+
+  return availability
+}
+
+function runCheck(): Promise<boolean> {
   return new Promise<boolean>((resolve) => {
     let settled = false
     const settle = (available: boolean) => {
       if (settled) return
 
       settled = true
-      clearTimeout(timer)
       document.removeEventListener('securitypolicyviolation', onViolation)
       dispose()
       resolve(available)
     }
 
-    // The violation the probe exists to catch: a host policy that refuses to frame our
-    // origin. The frame then fires no load and no error of its own, so without this the
-    // verdict would wait out the timeout.
+    // A host policy that refuses to frame our origin. The frame then fires no load and no
+    // error of its own, so this is the only thing that answers before the handshake timeout —
+    // a latency decision, not a second liveness rule. Ten seconds of a healthy-looking widget
+    // before the error screen is worse than the screen arriving at once.
     //
     // Measured in Chromium 153.0.8010.12 against the built page, 2026-11-01: a host sending
     // `frame-src 'none'` AND one sending only `default-src 'self'` both report
@@ -157,18 +189,11 @@ export async function probeTurnstile(): Promise<boolean> {
     // element at its static position still extends the document's scroll area — a stray
     // pixel of scroll on somebody else's page for the length of the check. A fixed element
     // contributes none.
-    frame.style.position = 'fixed'
-    frame.style.top = '0'
-    frame.style.left = '0'
-    frame.style.width = '1px'
-    frame.style.height = '1px'
-    frame.style.opacity = '0'
-    frame.style.pointerEvents = 'none'
+    frame.style.cssText =
+      'position:fixed;top:0;left:0;width:1px;height:1px;opacity:0;pointer-events:none;border:0'
     frame.setAttribute('aria-hidden', 'true')
     frame.tabIndex = -1
 
-    const timer = setTimeout(() => settle(false), PROBE_TIMEOUT_MS)
-
     document.addEventListener('securitypolicyviolation', onViolation)
     document.body.appendChild(frame)
   })
diff --git a/src/lib/turnstile-frame.ts b/src/lib/turnstile-frame.ts
index 35c98e0f..9d325145 100644
--- a/src/lib/turnstile-frame.ts
+++ b/src/lib/turnstile-frame.ts
@@ -52,14 +52,15 @@ export type ChallengeOptions = {
 }
 
 /**
- * The frame's `src`, resolved against the module's own URL so the frame is always same-origin
- * with the bundle — production, a Workers preview, `pnpm dev` or Ladle, with nothing to
- * configure. `src/styles/fonts.ts` resolves the font files the same way and for the same
- * reason: the deploy origin is not knowable at build time.
+ * The frame's `src`, resolved against the calling module's own URL so the frame is always
+ * same-origin with the bundle — production, a Workers preview, `pnpm dev` or Ladle, with
+ * nothing to configure. `src/styles/fonts.ts` resolves the font files the same way and for the
+ * same reason: the deploy origin is not knowable at build time.
  *
- * ⚠ Pass `import.meta.url` as `moduleUrl` rather than writing it inside this function. Vite
- * rewrites the literal `new URL(…, import.meta.url)` expression at transform time as its
- * asset-URL idiom; a variable base is left alone.
+ * ⚠ `moduleUrl` is a parameter rather than a `import.meta.url` read inside this module, for
+ * two reasons. Vite rewrites the literal `new URL(…, import.meta.url)` expression at transform
+ * time as its asset-URL idiom, and a variable base is left alone. And it is what lets a spec
+ * assert the shape this returns on a real deploy, rather than on the test runner's own origin.
  */
 export function challengeSrc(moduleUrl: string, options: ChallengeOptions): string {
   const url = new URL(CHALLENGE_PATH, moduleUrl)
@@ -71,11 +72,7 @@ export function challengeSrc(moduleUrl: string, options: ChallengeOptions): stri
   return url.href
 }
 
-/**
- * The origin the challenge frame is served from — the one a host must allow under `frame-src`.
- *
- * ⚠ Pass `import.meta.url`, for the reason `challengeSrc` gives.
- */
+/** The origin the frame is served from — the one a host must allow under `frame-src`. */
 export function challengeOrigin(moduleUrl: string): string {
   return new URL(CHALLENGE_PATH, moduleUrl).origin
 }
@@ -129,13 +126,12 @@ export function challengeMessage<T extends ChallengeEvent | ChallengeCommand>(me
 export function readChallengeOptions(search: string): ChallengeOptions {
   const params = new URLSearchParams(search)
   const theme = params.get('theme')
+  const language = params.get('language') ?? ''
 
   return {
     theme: theme === 'light' || theme === 'dark' || theme === 'auto' ? theme : 'auto',
     // Turnstile takes `auto` for "follow the browser", which is the right default here too.
-    language: /^[a-z]{2}(-[a-z]{2})?$/i.test(params.get('language') ?? '')
-      ? (params.get('language') as string)
-      : 'auto',
+    language: /^[a-z]{2}(-[a-z]{2})?$/i.test(language) ? language : 'auto',
     probe: params.get('probe') === '1',
   }
 }
diff --git a/src/mocks/errors.ts b/src/mocks/errors.ts
index c0f4e2fc..2d19d523 100644
--- a/src/mocks/errors.ts
+++ b/src/mocks/errors.ts
@@ -28,9 +28,10 @@ export const mockErrors: Record<ErrorKind, unknown> = {
   'not-found': atlasError('not-found', 'Region not found: atlantis'),
   // An embed whose API key SahajCloud rejects.
   config: sdkError(401, 'Unauthorized'),
-  // A host page whose CSP refuses challenges.cloudflare.com, so no form in the widget can
-  // produce a token (issue #182). Tagged rather than script-driven for the same reason
-  // `offline` is: the fixture must classify the same way wherever the story renders.
+  // A host page whose CSP refuses to frame the widget's own origin, so the challenge cannot
+  // render and no form can produce a token (issues #182, #343). Tagged rather than
+  // frame-driven for the same reason `offline` is: the fixture must classify the same way
+  // wherever the story renders.
   'captcha-blocked': atlasError('captcha-blocked', 'Turnstile could not be loaded'),
   // Anything unrecognized — the catch-all that offers both a retry and a report. A zod
   // parse failure lands here too, which is why the fixture IS one: `contract` used to be
diff --git a/src/test-support/turnstile-frame.ts b/src/test-support/turnstile-frame.ts
index 1b793f73..e794a7a3 100644
--- a/src/test-support/turnstile-frame.ts
+++ b/src/test-support/turnstile-frame.ts
@@ -1,6 +1,6 @@
 import { vi } from 'vitest'
 
-import { CHALLENGE_CHANNEL, parseChallengeCommand } from '@/lib/turnstile-frame'
+import { type ChallengeEvent, challengeMessage, parseChallengeCommand } from '@/lib/turnstile-frame'
 
 /**
  * Stands in for the challenge PAGE, never for our own hook (#343).
@@ -19,31 +19,42 @@ export function challengeFrameStub(container: ParentNode) {
 
   if (!frame?.contentWindow) throw new Error('no Turnstile challenge frame')
 
-  const commands: string[] = []
+  let resets = 0
 
   vi.spyOn(frame.contentWindow, 'postMessage').mockImplementation(((data: unknown) => {
-    if (parseChallengeCommand(data)) commands.push('reset')
+    if (parseChallengeCommand(data)) resets += 1
   }) as Window['postMessage'])
 
-  // ⚠ The origin is read off the frame's own `src`. The hook resolves that URL against its
-  // module URL, so hard-coding one here would make the hook's own origin check pass or fail
-  // for a reason unrelated to the form under test.
-  const send = (message: Record<string, unknown>) =>
-    window.dispatchEvent(
-      new MessageEvent('message', {
-        data: { channel: CHALLENGE_CHANNEL, ...message },
-        origin: new URL(frame.src).origin,
-        source: frame.contentWindow,
-      }),
-    )
-
   return {
     /** The challenge renders and is solved, which is what hands the form its token. */
     solve: (token = 'tok-live') => {
-      send({ type: 'ready' })
-      send({ type: 'token', token })
+      sendFromFrame(frame, { type: 'ready' })
+      sendFromFrame(frame, { type: 'token', token })
     },
     /** How many times the form asked the frame for a fresh challenge. */
-    resetCount: () => commands.length,
+    resetCount: () => resets,
   }
 }
+
+/**
+ * Dispatches one message as the challenge page would, for a spec driving the frame directly.
+ *
+ * ⚠ The origin is read off the frame's own `src`. The hook resolves that URL against its
+ * module URL, so hard-coding one here would make the hook's own origin check pass or fail for
+ * a reason unrelated to what the spec is testing. `overrides` is what lets a case send a
+ * deliberately wrong source, origin or shape.
+ */
+export function sendFromFrame(
+  frame: HTMLIFrameElement,
+  message: ChallengeEvent,
+  overrides: MessageEventInit = {},
+) {
+  window.dispatchEvent(
+    new MessageEvent('message', {
+      data: challengeMessage(message),
+      origin: new URL(frame.src).origin,
+      source: frame.contentWindow,
+      ...overrides,
+    }),
+  )
+}
diff --git a/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx b/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx
index fbc36563..f9fc2347 100644
--- a/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx
+++ b/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx
@@ -80,7 +80,7 @@ const Sentinel = () => <p>{INTERFACE}</p>
  * the widget's own origin now. The cost to a host is the same shape: a document and a request
  * for an interface nobody opened.
  */
-const challengeFrames = () => document.querySelectorAll(`iframe[src*="/challenge.html"]`).length
+const challengeFrames = () => document.querySelectorAll('iframe[src*="/challenge.html"]').length
 
 function InterfaceWithTurnstile() {
   useTurnstileGuard()
@@ -111,9 +111,9 @@ describe('CompactEmbedView — what a collapsed card mounts', () => {
   })
 
   // The fifth candidate for the four-bug pattern above, and the one with a cost outside this
-  // project's own page. A collapsed card is one button in somebody's sidebar. Loading
-  // Cloudflare's challenge for it would put a third-party script into their document, and a
-  // request to Cloudflare from every page view, for an interface nobody opened (issue #182).
+  // project's own page. A collapsed card is one button in somebody's sidebar. Checking the
+  // captcha for it would put a document of ours in theirs, and a request to Cloudflare from
+  // inside it, on every page view, for an interface nobody opened (issue #182).
   it('mounts no Turnstile frame while collapsed, and does once opened', () => {
     expect(challengeFrames()).toBe(0)
 
diff --git a/tests/smoke/embed.smoke.test.ts b/tests/smoke/embed.smoke.test.ts
index ecfb2e0c..de2fb738 100644
--- a/tests/smoke/embed.smoke.test.ts
+++ b/tests/smoke/embed.smoke.test.ts
@@ -49,29 +49,63 @@ function fetchEmbed() {
 }
 
 /**
- * Every chunk `auto.js` can reach, crawled once and shared by the specs below.
+ * Runs `crawl` once and shares the result, keeping only a CLEAN one.
  *
- * Only a clean crawl is cached. A broken chunk or a thrown fetch clears it, so each retry
- * crawls again rather than replaying the same transient 5xx (see `fetchEmbed`).
+ * A broken chunk or a thrown fetch clears the memo, so each retry crawls again rather than
+ * replaying the same transient 5xx (see `fetchEmbed`). Shared by both crawls below, because
+ * two copies of this would be two chances to get the clearing wrong.
  */
-let crawl: Promise<{ seen: string[]; broken: string[]; bodies: Map<string, string> }> | undefined
+function cacheCleanCrawl<T extends { broken: string[] }>(crawl: () => Promise<T>) {
+  let cached: Promise<T> | undefined
+
+  return () =>
+    (cached ??= crawl().then(
+      (result) => {
+        if (result.broken.length > 0) cached = undefined
+
+        return result
+      },
+      (err) => {
+        cached = undefined
+        throw err
+      },
+    ))
+}
+
+/**
+ * Fetches one chunk, and decides whether the deploy really served it.
+ *
+ * ⚠ Status alone proves nothing: `assets.not_found_handling` serves the SPA shell with a
+ * **200 `text/html`** for any path that is not a built asset, so a check on `res.status` would
+ * pass for exactly the failure these crawls exist to catch. The content type is what tells a
+ * real chunk from the fallback, and it is the lane's own invariant (`docs/testing.md`) — so it
+ * has one implementation, read by both crawls.
+ *
+ * A chunk that failed is stored with an EMPTY body rather than omitted, so a spec reading the
+ * bodies back cannot mistake a 404 for a chunk that genuinely carries nothing.
+ */
+async function fetchChunk(path: string, bodies: Map<string, string>, broken: string[]) {
+  // Uses GET, not HEAD. The body serves both as the assertion and as the next frontier to
+  // crawl. The whole deploy is roughly 440 KiB gzipped, and this lane runs separately from
+  // the PR gate.
+  const res = await fetchPreview(path)
+  const type = res.headers.get('content-type') ?? ''
 
-function crawlDeploy() {
-  crawl ??= crawlFromLoader().then(
-    (result) => {
-      if (result.broken.length > 0) crawl = undefined
+  if (res.status === 200 && /javascript|ecmascript/i.test(type)) {
+    bodies.set(path, await res.text())
 
-      return result
-    },
-    (err) => {
-      crawl = undefined
-      throw err
-    },
-  )
+    return true
+  }
+
+  bodies.set(path, '')
+  broken.push(`${path} → ${res.status} ${type}`)
 
-  return crawl
+  return false
 }
 
+/** Every chunk `auto.js` can reach, crawled once and shared by the specs below. */
+const crawlDeploy = cacheCleanCrawl(crawlFromLoader)
+
 async function crawlFromLoader() {
   const { body } = await fetchEmbed()
 
@@ -79,39 +113,49 @@ async function crawlFromLoader() {
   // hashed. A host or a proxy holding a stale copy can request names the deploy no
   // longer contains, and the widget then never appears. This spec catches the
   // deploy-side half of that mismatch: a loader published without the graph behind
-  // it.
-  //
-  // This matches every relative `.js` literal, not only the static-import shape. A
-  // missing lazy chunk is the same broken deploy, found one interaction later.
-  //
-  // The crawl is transitive, not one level deep, and that matters more now than
-  // before. The whole widget sits behind one dynamic import from the loader. A
-  // one-level crawl from `auto.js` would reach `embed.js` and stop, missing every
-  // chunk the widget needs. The views behind a lazy seam load from a chunk that
-  // names them, not from the entry file. A one-level crawl stopped covering the
-  // calendar, registration, and share chunks the moment those moved behind
-  // `React.lazy` (issue #96). Following each body in turn makes the found set the
-  // whole deploy the widget can ever request, however deep the seam goes.
-  //
-  // Backticks matter as much as the transitive crawl. rolldown's minifier emits
-  // dynamic specifiers as template literals, for example
-  // `import(\`./CalendarView-<hash>.js\`)`. A pattern that matches only `"` and `'`
-  // catches the static imports and silently skips every lazy chunk in the build.
+  // it. The loader's body is already in hand, so it seeds the walk rather than
+  // being fetched a second time.
+  return crawlFrom([], new Map([['/auto.js', body]]))
+}
+
+/**
+ * Walks a JavaScript graph on the deploy, from `seeds` plus anything already in hand.
+ *
+ * This matches every relative `.js` literal, not only the static-import shape. A missing lazy
+ * chunk is the same broken deploy, found one interaction later.
+ *
+ * ⚠ **The crawl is transitive, not one level deep.** The whole widget sits behind one dynamic
+ * import from the loader, so a one-level crawl from `auto.js` would reach `embed.js` and stop,
+ * missing every chunk the widget needs. The views behind a lazy seam load from a chunk that
+ * names them, not from the entry file: a one-level crawl stopped covering the calendar,
+ * registration and share chunks the moment those moved behind `React.lazy` (issue #96).
+ * Following each body in turn makes the found set the whole graph the widget can ever request,
+ * however deep the seam goes — which is why the challenge page's own entry is walked through
+ * this same function rather than read once.
+ *
+ * ⚠ **Backticks matter as much as the transitive crawl.** rolldown's minifier emits dynamic
+ * specifiers as template literals, for example `import(\`./CalendarView-<hash>.js\`)`. A pattern
+ * matching only `"` and `'` catches the static imports and silently skips every lazy chunk.
+ */
+async function crawlFrom(seeds: string[], prefetched = new Map<string, string>()) {
   const RELATIVE_JS = /["'`](\.\/[^"'`]+\.js)["'`]/g
-  // Chunks reference each other relative to their own directory. `embed.js` sits at
-  // the root and points into `./assets/`. Everything under `assets/` points at its
-  // siblings.
+  // Chunks reference each other relative to their own directory. `embed.js` sits at the root
+  // and points into `./assets/`. Everything under `assets/` points at its siblings.
   const resolveFrom = (path: string, spec: string) =>
     `${path.slice(0, path.lastIndexOf('/'))}/${spec.replace(/^\.\//, '')}`
 
-  // Status alone proves nothing here. The SPA fallback answers `/* /index.html
-  // 200`, so a missing chunk also answers 200 as the shell. A check on
-  // `res.status` would pass for exactly the failure this spec exists to catch. The
-  // content type is what tells a real chunk apart from the fallback HTML.
   const broken: string[] = []
+  const bodies = new Map(prefetched)
   const seen = new Set<string>()
-  const queue = ['/auto.js']
-  const bodies = new Map<string, string>([['/auto.js', body]])
+  const queue = [...prefetched.keys()]
+
+  for (const path of seeds) {
+    if (seen.has(path)) continue
+
+    seen.add(path)
+
+    if (await fetchChunk(path, bodies, broken)) queue.push(path)
+  }
 
   while (queue.length) {
     const path = queue.pop() as string
@@ -126,21 +170,7 @@ async function crawlFromLoader() {
 
       seen.add(next)
 
-      // Uses GET, not HEAD. The body serves both as the assertion and as the next
-      // frontier to crawl. The whole deploy is roughly 440 KiB gzipped, and this
-      // lane runs separately from the PR gate.
-      const res = await fetchPreview(next)
-      const type = res.headers.get('content-type') ?? ''
-
-      if (res.status === 200 && /javascript|ecmascript/i.test(type)) {
-        const text = await res.text()
-
-        bodies.set(next, text)
-        queue.push(next)
-      } else {
-        bodies.set(next, '')
-        broken.push(`${next} → ${res.status} ${type}`)
-      }
+      if (await fetchChunk(next, bodies, broken)) queue.push(next)
     }
   }
 
@@ -155,62 +185,23 @@ async function crawlFromLoader() {
  * (#343). Its chunks are where the site key now lives, which is why the key spec below reads
  * both maps.
  *
- * Only a clean crawl is cached, as `crawlDeploy`.
+ * ⚠ **Transitive from the page's own scripts, not one level deep.** A one-level crawl is the
+ * defect #96 recorded against the loader: it reads the entry and stops, so a chunk named only
+ * by another chunk goes unchecked. `crawlFrom` is the same walk the loader uses, seeded with
+ * the page's own `src` and `modulepreload` paths instead of `auto.js`.
  */
-let challenge:
-  | Promise<{
-      html: string
-      status: number
-      type: string
-      broken: string[]
-      bodies: Map<string, string>
-    }>
-  | undefined
-
-function crawlChallenge() {
-  challenge ??= crawlChallengePage().then(
-    (result) => {
-      if (result.broken.length > 0) challenge = undefined
-
-      return result
-    },
-    (err) => {
-      challenge = undefined
-      throw err
-    },
-  )
-
-  return challenge
-}
+const crawlChallenge = cacheCleanCrawl(crawlChallengePage)
 
 async function crawlChallengePage() {
   const res = await fetchPreview(CHALLENGE_PATH)
   const html = await res.text()
-  const bodies = new Map<string, string>()
-  const broken: string[] = []
-
   // Vite emits the entry as a `<script type="module" src>` plus `modulepreload` links. Both
   // shapes are matched, because which chunks get a preload hint is the bundler's choice and
   // the key could be inlined into any of them.
-  const specs = new Set(
-    [...html.matchAll(/(?:src|href)="(\/assets\/[^"]+\.js)"/g)].map(([, path]) => path),
-  )
-
-  for (const path of specs) {
-    const chunk = await fetchPreview(path)
-    const type = chunk.headers.get('content-type') ?? ''
-
-    // As the loader crawl: the SPA fallback answers 200 `text/html` for a path the deploy
-    // does not have, so the content type is what tells a chunk from the shell.
-    if (chunk.status === 200 && /javascript|ecmascript/i.test(type)) {
-      bodies.set(path, await chunk.text())
-    } else {
-      bodies.set(path, '')
-      broken.push(`${path} → ${chunk.status} ${type}`)
-    }
-  }
+  const seeds = [...html.matchAll(/(?:src|href)="(\/assets\/[^"]+\.js)"/g)].map(([, path]) => path)
+  const crawled = await crawlFrom(seeds)
 
-  return { html, broken, bodies, status: res.status, type: res.headers.get('content-type') ?? '' }
+  return { ...crawled, html, status: res.status, type: res.headers.get('content-type') ?? '' }
 }
 
 describe('turnstile challenge page', () => {

From b1998e1936ae486e3e0fcd5ce670531622343028 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 1 Nov 2026 20:19:23 +0000
Subject: [PATCH 04/14] docs(turnstile): correct what the challenge page's open
 framing costs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The comment justifying `'*'` as the token's target origin said a framer "can
obtain one exactly as they could by loading Turnstile themselves". That reads
as "this changes nothing", and it is the reasoning a future author would
trust, so it is worth getting right.

Half of it holds: minting was never gated, because the production key lists
`localhost` and `127.0.0.1`, so anyone could already solve as many tokens as
they liked on their own machine. What the open frame adds is a token solved in
a third party's visitor's browser — carrying the address SahajCloud passes
siteverify as `remoteip`, and a risk score a residential browser earns — and
`reset` lets a framer take a stream rather than one.

No client-side change fixes it: every framer can replay any handshake a public
page defines. The comment now names the two real answers, both out of #343's
scope, and points at the question thread on the pull request.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mg9rjYffj6R24HDkeuBGpj
---
 src/challenge.ts | 29 ++++++++++++++++++++++++-----
 1 file changed, 24 insertions(+), 5 deletions(-)

diff --git a/src/challenge.ts b/src/challenge.ts
index 0715359e..2622b511 100644
--- a/src/challenge.ts
+++ b/src/challenge.ts
@@ -6,11 +6,30 @@
  * page failed on every partner hostname. Everything here runs in a frame the widget mounts; it
  * is never a page a visitor navigates to.
  *
- * ⚠ **Every framer is untrusted, and that is fine.** A Turnstile token is single-use and only
- * redeemable against SahajCloud's secret for this site key, so anybody who frames this page can
- * obtain one exactly as they could by loading Turnstile themselves. That is why the token goes
- * out with `'*'` as the target origin: the parent's origin is the host site's, unknown here and
- * different per partner, and pinning it would need a list this approach exists to avoid.
+ * ⚠ **This page hands its token to WHOEVER frames it, and nothing here can tell our widget on
+ * a partner's page from a third party's frame.** The target origin is `'*'` and the inbound
+ * `reset` is accepted from the parent without an origin check, because the parent's origin is
+ * the host site's — unknown here, different per partner, and knowing it would need the
+ * allowlist this whole approach exists to avoid. Nothing restricts framing either: no
+ * `frame-ancestors`, no `X-Frame-Options`.
+ *
+ * What that does NOT cost, measured rather than assumed: minting a token for this site key was
+ * never gated. The production key lists `localhost` and `127.0.0.1`, so anyone could already
+ * serve a page there and solve as many as they liked, and SahajCloud redeems each one only
+ * once.
+ *
+ * What it DOES cost is a token solved in somebody else's visitor's browser. That token carries
+ * that visitor's address, which is the address `verifyTurnstileToken` passes siteverify as
+ * `remoteip`, and a residential browser is scored better than an automation farm — so a write
+ * driven from it looks more legitimate than one driven from a minting host. `reset` lets a
+ * framer re-arm the same frame and take a stream rather than one.
+ *
+ * ⚠ **No client-side change fixes this**, since every framer can replay any handshake this
+ * public page defines. The two real answers are a `frame-ancestors` allowlist fetched at
+ * runtime from the client records, or SahajCloud binding a token to something a harvester
+ * cannot replay — `verifyTurnstile.ts` checks `success` alone today, no `action`, no `hostname`.
+ * Both need a decision, and both were out of #343's scope. See the question thread on the pull
+ * request that introduced this file.
  */
 
 import {

From 4833aac4e8256a0d2128021b2de40eefe70ab586 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 1 Nov 2026 20:19:59 +0000
Subject: [PATCH 05/14] docs(deploy): record the challenge document's cache
 rule

`_headers` now carries Cache-Control on three root files, not two.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mg9rjYffj6R24HDkeuBGpj
---
 docs/rules/deployment.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/docs/rules/deployment.md b/docs/rules/deployment.md
index ee90d920..6b21cd05 100644
--- a/docs/rules/deployment.md
+++ b/docs/rules/deployment.md
@@ -50,8 +50,10 @@ move ran one site at a time, and the app's own cutover was split from building i
 Two deploy files live in `public/`, copied into both build outputs, and both govern both sites:
 
 - **`_headers`** — one site-wide `/*` rule carrying CORS (#91: a font always fetches in CORS
-  mode) and `X-Robots-Tag: noindex` (#106), plus `Cache-Control` on `/assets/*` and the two
-  unhashed entry files (#148). The `/locales/*` rule went with the bundles in #198.
+  mode) and `X-Robots-Tag: noindex` (#106), plus `Cache-Control` on `/assets/*`, the two
+  unhashed entry files (#148) and `/challenge.html` (#343, the Turnstile challenge document —
+  unhashed like those two, but cacheable for ten minutes rather than revalidated, since it
+  names only hashed assets and is fetched inside a frame on the registration path). The `/locales/*` rule went with the bundles in #198.
   ⚠ **No two rules may set the same header name on paths that overlap** — the platform applies
   every matching rule and comma-joins a repeated value, so two would serve `<value>, <value>`.
   `scripts/deploy-headers.test.ts` holds this before a deploy, and it is why CORS lives in one

From 7e445ae12adac6255321af10761af63ac4055aec Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 2 Nov 2026 02:57:50 +0000
Subject: [PATCH 06/14] fix(ladle): serve the challenge page in the playground
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both form stories render a live Turnstile widget, which since the move to a
framed challenge (#343) means fetching `/challenge.html` from the bundle's own
origin. The Ladle build carries none of the app's entries, so that page was
absent on `design.sahajatlas.com`: the SPA fallback answered with the Ladle
shell, the handshake timed out, and both stories sat `blocked` with Submit
disabled — their own descriptions promising the opposite.

The page cannot be an input or a `public/` file: Ladle relocates Vite's root to
its own app directory, so the page's `/src/challenge.ts` resolves from neither.
A plugin substitutes it instead — `/@fs` while serving, an emitted chunk when
building — and sets the status explicitly, because Ladle's html fallback has
already parked a 404 on the response by then.

Measured in Chromium 153 against `pnpm ladle`: the report-issue story mounts 4
challenge frames and registration 6, every one solved, no console errors.
`pnpm ladle:build` emits `challenge.html` plus a hashed chunk carrying the test
site key. `turnstile-frame.test.ts` pins the substituted script path against
drift between the two files, since only a browser pass would notice it.

That pin is the nineteenth spec selecting `repo-source.ts`, so the per-edit
width ceiling is ratcheted with a fresh timing pair rather than losing a spec:
6.5s for the widest edit and 7.8s for `i18n.ts`, against the 12s budget.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mg9rjVX8C4HGmmaS1jTp2U
---
 .ladle/vite.config.ts             | 57 +++++++++++++++++++++++++++++++
 docs/testing.md                   | 12 ++++---
 scripts/select-unit-specs.test.ts | 10 +++---
 src/lib/turnstile-frame.test.ts   | 15 ++++++++
 4 files changed, 84 insertions(+), 10 deletions(-)

diff --git a/.ladle/vite.config.ts b/.ladle/vite.config.ts
index 5940d561..a83e37ff 100644
--- a/.ladle/vite.config.ts
+++ b/.ladle/vite.config.ts
@@ -1,4 +1,7 @@
+import type { Plugin } from 'vite'
+
 import { fileURLToPath } from 'url'
+import { readFileSync } from 'node:fs'
 
 import { defineConfig } from 'vite'
 
@@ -15,8 +18,62 @@ import { defineConfig } from 'vite'
 // ships unstyled, so there is nothing of its own for Vite to auto-detect.
 // The decorator imports `globals.css` directly instead.
 const srcDir = fileURLToPath(new URL('../src', import.meta.url))
+const challengeHtml = fileURLToPath(new URL('../challenge.html', import.meta.url))
+
+/**
+ * Serves `/challenge.html` here too, so both form stories render a live challenge (#343).
+ *
+ * The forms frame that page on the bundle's own origin, which on this site is
+ * `design.sahajatlas.com`. Ladle builds none of the app's entries by design — see the note
+ * above — so the page was absent, the SPA fallback answered with the Ladle shell, and both
+ * stories sat `blocked` with Submit disabled once the handshake timed out.
+ *
+ * ⚠ The page cannot simply be an input or a `public/` file. Ladle sets Vite's `root` to its own
+ * app directory, so the page's `/src/challenge.ts` resolves from neither — hence `/@fs` while
+ * serving, and an emitted chunk while building.
+ */
+function challengePage(): Plugin {
+  const page = () => readFileSync(challengeHtml, 'utf8')
+  const script = '/src/challenge.ts'
+  let chunk = ''
+
+  return {
+    name: 'sy-ladle-challenge-page',
+    configureServer(server) {
+      server.middlewares.use((req, res, next) => {
+        if (!req.url || new URL(req.url, 'http://ladle').pathname !== '/challenge.html') {
+          next()
+
+          return
+        }
+
+        server
+          .transformIndexHtml(req.url, page().replace(script, `/@fs${srcDir}/challenge.ts`))
+          .then((html) => {
+            // The status is set explicitly: Vite's own html fallback has already parked a 404
+            // on the response by the time this runs, and the frame would read that as a
+            // refused page rather than a served one.
+            res.statusCode = 200
+            res.setHeader('Content-Type', 'text/html')
+            res.end(html)
+          }, next)
+      })
+    },
+    buildStart() {
+      chunk = this.emitFile({ type: 'chunk', id: `${srcDir}/challenge.ts`, name: 'challenge' })
+    },
+    generateBundle() {
+      this.emitFile({
+        type: 'asset',
+        fileName: 'challenge.html',
+        source: page().replace(script, `/${this.getFileName(chunk)}`),
+      })
+    },
+  }
+}
 
 export default defineConfig({
+  plugins: [challengePage()],
   // Give Ladle its own dependency-optimization cache. Ladle force-includes
   // react, react-dom, and its own dependencies in optimizeDeps. So its
   // `configHash` differs from `pnpm dev`'s. Under rolldown-vite (Vite 8),
diff --git a/docs/testing.md b/docs/testing.md
index 92f0b994..38deb1bd 100644
--- a/docs/testing.md
+++ b/docs/testing.md
@@ -595,15 +595,17 @@ to select from. The full lane still runs in the lean gate (`.claude/skills/pr-pr
 in CI, so this narrows the inner loop, not the gate.
 
 **What holds the budget is the selection's width, and `scripts/select-unit-specs.test.ts` pins
-that**: the widest edit in the tree, exhaustively through the real composition, at 18 against a
-ceiling of 18 — no headroom, so the next spec reading a repo file through `repo-source` trips it,
+that**: the widest edit in the tree, exhaustively through the real composition, at 19 against a
+ceiling of 19 — no headroom, so the next spec reading a repo file through `repo-source` trips it,
 and the answer is to time the hook and ratchet, never to drop a spec. ⚠ **Two PRs can trip it
 without either one doing so alone**: #322's `mobile-zoom.test.ts` and #324's `attribution.test.ts`
 each took a slot, and the pin went red on the merge rather than on either branch; #328's
-`Drawer.scroll.test.tsx` is what ratcheted it from 17 to 18. ⚠ Width is not time, and which of
+`Drawer.scroll.test.tsx` is what ratcheted it from 17 to 18, and #343's `turnstile-frame.test.ts`
+from 18 to 19. ⚠ Width is not time, and which of
 the pair is slower has flipped across machines — `i18n.ts` selects 12, four of them jsdom, and
-measured 4.7s against the widest's 5.0s at eighteen (2026-10-27, 4 cores), having been the slower
-of the two at seventeen — so width
+measured 4.7s against the widest's 5.0s at eighteen (2026-10-27, 4 cores), and **7.8s against the
+widest's 6.5s at nineteen (2026-11-02, 4 cores, medians of three)**, the reverse order on a
+slower machine where both still sit under half the 12s bound — so width
 bounds the slice, never the time, and a jump in either is a re-measure of both. It also pins each
 of the three specifier forms, end to end against this tree; the tree-walking set as a closed list,
 and its absence from the selection, where the fixture carries a walker of each kind, so a re-added
diff --git a/scripts/select-unit-specs.test.ts b/scripts/select-unit-specs.test.ts
index 3b1af9eb..5f6a2503 100644
--- a/scripts/select-unit-specs.test.ts
+++ b/scripts/select-unit-specs.test.ts
@@ -242,10 +242,10 @@ describe('this repository', () => {
     // 17, on `src/test-support/repo-source.ts` (#289) — every spec reading one repo file names
     // it, and a spec may read one no other way, so this grows by one per adopter. ⚠ Width is
     // not time, and which of the pair is slower has flipped across machines: `i18n.ts` selects
-    // 12, four of them jsdom, and measured 4.7s against the widest selection's 5.0s at
-    // eighteen, having been the slower of the two at seventeen. So this bounds width as a
-    // proxy, and the answer when it trips is to time the hook and ratchet, never to drop a
-    // spec from the selection. `docs/testing.md` carries the times and the method.
-    expect(worst.count, `widest selection: ${worst.source}`).toBeLessThanOrEqual(18)
+    // 12, four of them jsdom, and measured 7.8s against the widest selection's 6.5s at
+    // nineteen, against a 12s budget. So this bounds width as a proxy, and the answer when it
+    // trips is to time the hook and ratchet, never to drop a spec from the selection.
+    // `docs/testing.md` carries the times and the method.
+    expect(worst.count, `widest selection: ${worst.source}`).toBeLessThanOrEqual(19)
   })
 })
diff --git a/src/lib/turnstile-frame.test.ts b/src/lib/turnstile-frame.test.ts
index 4b455a36..fc3ceae8 100644
--- a/src/lib/turnstile-frame.test.ts
+++ b/src/lib/turnstile-frame.test.ts
@@ -10,6 +10,8 @@ import {
   readChallengeOptions,
 } from './turnstile-frame'
 
+import { readRepoSource } from '@/test-support/repo-source'
+
 /**
  * The frame protocol, in the node lane. The transport is spec'd in `use-turnstile.test.tsx`,
  * which needs a DOM; everything here is a string.
@@ -139,3 +141,16 @@ describe('challengeMessage', () => {
     })
   })
 })
+
+describe('the challenge page in the Ladle build', () => {
+  // `.ladle/vite.config.ts` serves and emits this page by substituting its script path: Ladle's
+  // Vite root is its own app directory, so the path resolves from neither side without that
+  // rewrite. A path changed in one file and not the other leaves the playground emitting a page
+  // whose script 404s, which only a browser pass would notice (#343).
+  const SCRIPT = '/src/challenge.ts'
+
+  it('substitutes a script path the page actually carries', () => {
+    expect(readRepoSource('challenge.html')).toContain(`src="${SCRIPT}"`)
+    expect(readRepoSource('.ladle/vite.config.ts')).toContain(`const script = '${SCRIPT}'`)
+  })
+})

From c5cf15ca15da6b09892d544c99c6ef9d0f1048a8 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 2 Nov 2026 02:58:17 +0000
Subject: [PATCH 07/14] fix(turnstile): delegate the frame's browser
 capabilities
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`api.js` now runs in a cross-origin child rather than in the host's document,
and every policy-controlled feature is denied to such a frame by default. The
script embed held them all unless a host's own header said otherwise, so the
frame was silently less capable than the arrangement it replaces: Permissions
Policy is hierarchical, and the `allow` Turnstile sets on its own widget frame
one level further in reaches nothing our document was not granted first.

The frame now carries the six features `api.js` asks for, read off it directly:
`cross-origin-isolated; fullscreen; autoplay; keyboard-map; gamepad;
xr-spatial-tracking`.

Private State Tokens are deliberately not among them. `api.js` requests that
capability under the pre-standard name `private-token`, gated on
`document.featurePolicy.features()` listing it, and Chromium 153 lists only
`private-state-token-issuance` and `private-state-token-redemption` — measured.
So Turnstile's widget frame asks for it under no name an engine knows, nothing
a parent delegates can reach the code that would use it, and nothing in our own
document calls the API. Delegating the standard pair would be theatre.

The host-facing half lands in `docs/embedding.md` § Permissions Policy and
`CHANGELOG.md`: the six are listed because a host's header does reach the frame,
with the measurement that the challenge renders and solves with all six denied,
so there is nothing for a host to add.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mg9rjVX8C4HGmmaS1jTp2U
---
 CHANGELOG.md                     |  4 ++++
 docs/embedding.md                | 17 +++++++++++++++++
 src/hooks/use-turnstile.test.tsx | 22 ++++++++++++++++++++++
 src/hooks/use-turnstile.ts       | 28 ++++++++++++++++++++++++++++
 4 files changed, 71 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bb98d789..524b0b6d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -60,6 +60,10 @@ cover everything a host would notice since the widget was first deployed.
   requests to `challenges.cloudflare.com` are made by our frame, so your page's URL is no longer
   the document asking.
 
+  **Your `Permissions-Policy` needs nothing for the captcha.** The frame asks for six features
+  Cloudflare's widget requests, and the challenge renders and solves with all six denied — see
+  the embedding guide's Permissions Policy section.
+
 - **A repeat embed report turns into at most one write in any 6 h window.** ([#160]) The widget
   still reports on every page load, and an unchanged report inside that window is answered
   without a write. This guide and the embedding guide had both published the window as one hour.
diff --git a/docs/embedding.md b/docs/embedding.md
index e25d6e27..b186fb9c 100644
--- a/docs/embedding.md
+++ b/docs/embedding.md
@@ -958,6 +958,23 @@ by a `Permissions-Policy` header on your own page.
 you send a `Permissions-Policy` header, allow these three for your own origin. If you embed in
 an iframe, put them in its `allow` attribute as shown above.
 
+### The captcha frame asks for six more, and needs none of them
+
+The captcha renders in a frame on our own origin (see
+[Content-Security-Policy](#content-security-policy)), and that frame carries
+`allow="cross-origin-isolated; fullscreen; autoplay; keyboard-map; gamepad;
+xr-spatial-tracking"` — the same six Cloudflare's own Turnstile widget asks for one level
+further in. They are listed here because a `Permissions-Policy` header of yours that denies
+them does reach that frame, not because registration depends on them: measured in Chromium
+153, the challenge renders and solves with all six denied. **Nothing to add to your header or
+your `allow` attribute for the captcha.**
+
+⚠ **Private State Tokens are not among them, and adding them achieves nothing.** Turnstile's
+widget frame requests that capability under the pre-standard name `private-token`, which no
+current engine publishes — Chromium 153 publishes `private-state-token-issuance` and
+`private-state-token-redemption` — so no policy either of us writes can delegate it to the
+code that would use it.
+
 ## Where to load it from
 
 One host serves the bundle:
diff --git a/src/hooks/use-turnstile.test.tsx b/src/hooks/use-turnstile.test.tsx
index af4c5dc5..17336ff8 100644
--- a/src/hooks/use-turnstile.test.tsx
+++ b/src/hooks/use-turnstile.test.tsx
@@ -84,6 +84,28 @@ describe('useTurnstile', () => {
     expect(iframe?.title).not.toBe('')
   })
 
+  it('delegates the features Turnstile asks for on its own widget frame', async () => {
+    await mount()
+
+    const allow = frame()?.allow ?? ''
+
+    // Permissions Policy is hierarchical: `api.js` sets these on the frame it renders inside
+    // our page, and that delegation grants nothing our own document was not granted first.
+    for (const feature of [
+      'cross-origin-isolated',
+      'fullscreen',
+      'autoplay',
+      'keyboard-map',
+      'gamepad',
+      'xr-spatial-tracking',
+    ])
+      expect(allow).toContain(feature)
+
+    // Not a Private State Token name, under either spelling: `api.js` asks for none an engine
+    // knows, so nothing a parent delegates can reach the capability.
+    expect(allow).not.toContain('token')
+  })
+
   it('is loading until the frame hands back its handshake', async () => {
     await mount()
 
diff --git a/src/hooks/use-turnstile.ts b/src/hooks/use-turnstile.ts
index 351a7a34..ed8bb8b9 100644
--- a/src/hooks/use-turnstile.ts
+++ b/src/hooks/use-turnstile.ts
@@ -43,6 +43,33 @@ const FRAME_HEIGHT = 65
  */
 const HANDSHAKE_TIMEOUT_MS = 10_000
 
+/**
+ * What the frame delegates, read off Turnstile's own `api.js` on 2026-11-02: these are the
+ * features it sets on the widget frame it renders inside our page.
+ *
+ * ⚠ **Permissions Policy is hierarchical, so that inner delegation reaches nothing our own
+ * document was not granted**, and every policy-controlled feature is denied to a cross-origin
+ * child by default. The script embed ran `api.js` in the HOST's document, which holds them all
+ * unless the host's own header says otherwise — so without this line the challenge frame is
+ * strictly less capable than the arrangement it replaces, silently.
+ *
+ * ⚠ **Private State Tokens cannot be delegated from here, and asking for them would be
+ * theatre.** `api.js` pushes one more feature when `document.featurePolicy.features()` lists
+ * it, under the pre-standard name `private-token` — which Chromium 153 does not: it lists
+ * `private-state-token-issuance` and `private-state-token-redemption`. So Turnstile's own
+ * widget frame is not asking for that capability under any name an engine knows, and nothing
+ * a parent delegates can reach it. Nothing in our own document calls the API either.
+ * `docs/embedding.md` § Permissions Policy carries the host-facing half.
+ */
+const TURNSTILE_FEATURES = [
+  'cross-origin-isolated',
+  'fullscreen',
+  'autoplay',
+  'keyboard-map',
+  'gamepad',
+  'xr-spatial-tracking',
+].join('; ')
+
 /**
  * Builds the frame, the listener that reads it, and the one definition of its liveness — for
  * both the hook and the probe.
@@ -76,6 +103,7 @@ function createChallengeFrame(
   // this keeps out of our own logs is the host page's path and query, which a host opting into
   // an `unsafe-url` referrer policy would otherwise send us.
   frame.referrerPolicy = 'strict-origin'
+  frame.allow = TURNSTILE_FEATURES
 
   const expectedOrigin = new URL(src).origin
   const deliver = (message: ChallengeEvent | null) => {

From 634cc0a72d4620e6943766037a39f1543172fb82 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 2 Nov 2026 02:58:32 +0000
Subject: [PATCH 08/14] fix(turnstile): address the reset command to the
 frame's origin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`createChallengeFrame` pins inbound messages to the origin it built the `src`
from, while `reset` went out to `'*'` — whatever document happens to occupy the
frame. Carrying that origin on the ref costs a line and keeps the two
directions symmetric: a frame navigated elsewhere by a redirect or a captive
portal now receives nothing rather than a command.

`src/challenge.ts` keeps `'*'` on purpose. It genuinely cannot know its parent,
which is the whole reason the hostname list collapsed to one.

The spec asserted `expect.anything()` for the target and so held either
behaviour. It now names the frame's own origin, and goes red with `'*'`
restored.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mg9rjVX8C4HGmmaS1jTp2U
---
 src/hooks/use-turnstile.test.tsx |  4 +++-
 src/hooks/use-turnstile.ts       | 14 ++++++++------
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/src/hooks/use-turnstile.test.tsx b/src/hooks/use-turnstile.test.tsx
index 17336ff8..09f3df63 100644
--- a/src/hooks/use-turnstile.test.tsx
+++ b/src/hooks/use-turnstile.test.tsx
@@ -212,9 +212,11 @@ describe('useTurnstile', () => {
     act(() => hook.reset())
 
     expect(hook.token).toBeNull()
+    // Addressed to the frame's own origin, as narrowly as the inbound filter reads it: a frame
+    // navigated elsewhere gets no command rather than one aimed at whatever occupies it.
     expect(posted).toHaveBeenCalledWith(
       { channel: CHALLENGE_CHANNEL, type: 'reset' },
-      expect.anything(),
+      new URL(frame()?.src as string).origin,
     )
   })
 
diff --git a/src/hooks/use-turnstile.ts b/src/hooks/use-turnstile.ts
index ed8bb8b9..d80bac7a 100644
--- a/src/hooks/use-turnstile.ts
+++ b/src/hooks/use-turnstile.ts
@@ -263,7 +263,9 @@ export function useTurnstile({ disabled = false }: UseTurnstileOptions = {}): Us
   const challengeRef = useRef<HTMLDivElement>(null)
   // This is held in a ref as well as the effect closure.
   // So `reset` can reach the live frame without re-running, and so re-mounting, the challenge.
-  const frameRef = useRef<HTMLIFrameElement | null>(null)
+  // The origin rides along because `reset` must address the frame as narrowly as the inbound
+  // filter reads it — a frame navigated elsewhere receives nothing rather than a command.
+  const frameRef = useRef<{ frame: HTMLIFrameElement; origin: string } | null>(null)
   const [token, setToken] = useState<string | null>(null)
   const [status, setStatus] = useState<TurnstileStatus>(disabled ? 'blocked' : 'loading')
   const { theme } = useTheme()
@@ -278,7 +280,7 @@ export function useTurnstile({ disabled = false }: UseTurnstileOptions = {}): Us
     setToken(null)
     setStatus('loading')
 
-    const { frame, dispose } = createChallengeFrame(
+    const { frame, expectedOrigin, dispose } = createChallengeFrame(
       { theme, language: languageCode },
       (message) => {
         switch (message?.type) {
@@ -305,7 +307,7 @@ export function useTurnstile({ disabled = false }: UseTurnstileOptions = {}): Us
       },
     )
 
-    frameRef.current = frame
+    frameRef.current = { frame, origin: expectedOrigin }
     challengeRef.current.appendChild(frame)
 
     return () => {
@@ -320,12 +322,12 @@ export function useTurnstile({ disabled = false }: UseTurnstileOptions = {}): Us
   // `reset` re-runs the challenge, which sends the same `token` message on success.
   // So the new token arrives through the normal path.
   const reset = useCallback(() => {
-    const frame = frameRef.current
+    const live = frameRef.current
 
-    if (!frame?.contentWindow) return
+    if (!live?.frame.contentWindow) return
 
     setToken(null)
-    frame.contentWindow.postMessage(challengeMessage({ type: 'reset' }), '*')
+    live.frame.contentWindow.postMessage(challengeMessage({ type: 'reset' }), live.origin)
   }, [])
 
   return { challengeRef, token, status, reset }

From f26dccbf3aa65fc5ac3e7c20cffdd2ec48f530b9 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 2 Nov 2026 03:04:27 +0000
Subject: [PATCH 09/14] docs(ladle): record that the playground now serves the
 challenge page
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two surfaces the challenge-page plugin makes stale.

STORYBOOK.md described `.ladle/vite.config.ts` as the alias file alone.

`docs/environment.md` said the real Turnstile site key belongs on the app
Worker's production trigger, which stays true, but the design Worker is now a
place where that key would matter: its build serves its own `/challenge.html`,
and `turnstile-release-guard.mjs` lives in the root Vite config, which Ladle
never loads — so nothing would fail a design build carrying a real key.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mg9rjVX8C4HGmmaS1jTp2U
---
 STORYBOOK.md        | 2 +-
 docs/environment.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/STORYBOOK.md b/STORYBOOK.md
index bd0edc80..f2fb74e9 100644
--- a/STORYBOOK.md
+++ b/STORYBOOK.md
@@ -22,7 +22,7 @@ pnpm ladle:build  # static build (also the CI gate — broken stories fail it)
 | Piece                   | What it does                                                                        |
 | ----------------------- | -------------------------------------------------------------------------------------- |
 | `.ladle/config.mjs`     | Story glob (`src/**/*.stories.{ts,tsx}`), title, port, `viteConfig`.                  |
-| `.ladle/vite.config.ts` | Resolves the `@/` alias to `src/` (Ladle relocates Vite's root).                      |
+| `.ladle/vite.config.ts` | Resolves the `@/` alias to `src/` (Ladle relocates Vite's root), and serves `/challenge.html` so the two form stories render a live captcha (#343). |
 | `.ladle/i18n.ts`        | Self-contained i18next with en/fr bundled (the app loads over HTTP, Ladle has no backend). |
 | `.ladle/components.tsx` | The **global decorator**: React Query + Helmet + a `MemoryRouter` + `<I18nextProvider>`. |
 
diff --git a/docs/environment.md b/docs/environment.md
index 8f7d3f88..d2f8f5b7 100644
--- a/docs/environment.md
+++ b/docs/environment.md
@@ -19,7 +19,7 @@ place it is stated — everywhere else in this repo just points here.
 | --------------------------- | ----------------------------- | ------- |
 | `VITE_SAHAJCLOUD_URL`      | `.env`                        | SahajCloud origin. The client appends `/api`. Default `https://cloud.sydevelopers.com`. Local backend: `http://localhost:3000`. |
 | `ATLAS_API_KEY`            | shell (never committed)       | A **production** `sahaj-atlas-client` API key, read by `pnpm sync:translations` to pull the English copy out of SahajCloud. Build-time only, no `VITE_` prefix — it never reaches the bundle. The script falls back to `VITE_SAHAJCLOUD_API_KEY` **only** when `VITE_SAHAJCLOUD_URL` is the production origin: a key minted against a local CMS, sent to `cloud.sydevelopers.com`, lands in production's log as a rejected credential and gets rotated in a hurry. ⚠ It replaced `VITE_HOST` here, which #198 deleted along with `public/locales/` — the widget fetches its copy from SahajCloud now, so there is no second origin to name. |
-| `VITE_TURNSTILE_SITE_KEY`  | `.env` **+ Cloudflare — Production build variable** | Cloudflare Turnstile **site** key for the registration and report-issue forms. Public by design — the secret half lives in SahajCloud — so this is committed. ⚠ **`src/challenge.ts` is its ONE reader since #343** — the challenge renders in a frame served from `/challenge.html` on the widget's own origin, so Turnstile always sees `sahajatlas.com` whatever page hosts the widget, and the key is inlined into that page's chunk rather than the widget's. `embed.smoke.test.ts` reads both graphs for that reason: the widget's alone would report production as carrying no key at all. `.env` holds Cloudflare's always-passes test key `1x00000000000000000000AA` for dev, Ladle, and CI. Production overrides it with the real `0x4AAAA…` key as a **build variable** on the app Worker's production Workers Builds trigger (Workers & Pages → `sahajatlas-web` → Settings → Build → Variables and secrets). ⚠ **A runtime variable (Settings → Variables and Secrets) does nothing here** — Vite inlines the key at build time, and this Worker runs no code. Previews keep the test key on purpose: a real key validates only on the hostnames it lists, and a preview's `workers.dev` host is not one — the frame makes every HOST page's hostname irrelevant, never the deploy's own. **A release guard holds this (#259)**: `scripts/turnstile-release-guard.mjs`, a Vite plugin, fails a production build whose resolved key is a test key (any `[123]x0000…`), empty, or not a bare `0x…` key (quotes or spaces pasted around it would reach Turnstile too), naming the variable and this setting. Production means Workers Builds (`WORKERS_CI=1`) building `main`, or naming no branch at all — it fails closed; every other branch, every GitHub Actions build and every local build passes on the test key. ⚠ **It guards a build, so production can change without it**: a manual `wrangler deploy` of a locally built `dist/`, or promoting or rolling back to a version no production build made — and every same-repo PR's smoke job uploads a test-key version of this very Worker (`ci.yml`, `versions upload`), so the dashboard's version list is full of them. `embed.smoke.test.ts` reads the live key after every Workers Builds deploy; after any of the others, run `Production Smoke` by hand. ⚠ It also assumes only the production trigger builds `main`: a preview trigger whose branch rule is `*` would build `main` without the key and go red on every merge. Unset, `probeTurnstile` answers `false` and `useTurnstileGuard` fails the whole widget to the captcha-blocked screen — the same state as a CSP-refused script, and no `mailto:` fallback since #182. **Since #103 this key is load-bearing, not decorative.** The form now sends a real email through SahajCloud's captcha-gated endpoint. In production, the test key then makes that captcha a no-op. A site key that does not pair with SahajCloud's `TURNSTILE_SECRET_KEY` makes every report fail with a 403 `captcha_failed`. The viewer sees only one sentence of text for this. |
+| `VITE_TURNSTILE_SITE_KEY`  | `.env` **+ Cloudflare — Production build variable** | Cloudflare Turnstile **site** key for the registration and report-issue forms. Public by design — the secret half lives in SahajCloud — so this is committed. ⚠ **`src/challenge.ts` is its ONE reader since #343** — the challenge renders in a frame served from `/challenge.html` on the widget's own origin, so Turnstile always sees `sahajatlas.com` whatever page hosts the widget, and the key is inlined into that page's chunk rather than the widget's. `embed.smoke.test.ts` reads both graphs for that reason: the widget's alone would report production as carrying no key at all. `.env` holds Cloudflare's always-passes test key `1x00000000000000000000AA` for dev, Ladle, and CI. Production overrides it with the real `0x4AAAA…` key as a **build variable** on the app Worker's production Workers Builds trigger (Workers & Pages → `sahajatlas-web` → Settings → Build → Variables and secrets). ⚠ **A runtime variable (Settings → Variables and Secrets) does nothing here** — Vite inlines the key at build time, and this Worker runs no code. Previews keep the test key on purpose: a real key validates only on the hostnames it lists, and a preview's `workers.dev` host is not one — the frame makes every HOST page's hostname irrelevant, never the deploy's own. **A release guard holds this (#259)**: `scripts/turnstile-release-guard.mjs`, a Vite plugin, fails a production build whose resolved key is a test key (any `[123]x0000…`), empty, or not a bare `0x…` key (quotes or spaces pasted around it would reach Turnstile too), naming the variable and this setting. Production means Workers Builds (`WORKERS_CI=1`) building `main`, or naming no branch at all — it fails closed; every other branch, every GitHub Actions build and every local build passes on the test key. ⚠ **It guards a build, so production can change without it**: a manual `wrangler deploy` of a locally built `dist/`, or promoting or rolling back to a version no production build made — and every same-repo PR's smoke job uploads a test-key version of this very Worker (`ci.yml`, `versions upload`), so the dashboard's version list is full of them. `embed.smoke.test.ts` reads the live key after every Workers Builds deploy; after any of the others, run `Production Smoke` by hand. ⚠ **The `sahajatlas-design` trigger must never carry the real key either, and the guard would not catch it**: since #343 that build serves its own `/challenge.html`, so the key reaches a framable challenge page there too — and `.ladle/vite.config.ts` never loads the root config, where the guard plugin lives. ⚠ It also assumes only the production trigger builds `main`: a preview trigger whose branch rule is `*` would build `main` without the key and go red on every merge. Unset, `probeTurnstile` answers `false` and `useTurnstileGuard` fails the whole widget to the captcha-blocked screen — the same state as a CSP-refused script, and no `mailto:` fallback since #182. **Since #103 this key is load-bearing, not decorative.** The form now sends a real email through SahajCloud's captcha-gated endpoint. In production, the test key then makes that captcha a no-op. A site key that does not pair with SahajCloud's `TURNSTILE_SECRET_KEY` makes every report fail with a 403 `captcha_failed`. The viewer sees only one sentence of text for this. |
 | `VITE_SENTRY_DSN`          | Cloudflare — **Production + Preview** | Sentry ingest DSN for automatic error reporting (issue #108). Use the **modern public-key form** `https://<key>@<host>/<project>`. The legacy `https://<key>:<secret>@…` form puts a real secret in the public bundle. A DSN is write-only, so it is public by design. This repo still does **not** commit it to `.env`: a committed DSN would send every fork, preview, and `pnpm dev` into the production project. Set it per Workers Builds trigger in the Cloudflare dashboard. This org is in Sentry's **DE region**, so the ingest host is `o…​.ingest.de.sentry.io` — not `…us…`, which is what the DSN's own text will tell you. **The integrator CSP needs no edit for it**: `docs/embedding.md`'s `connect-src` row already carries `*.sentry.io`, wide on purpose so a regional host matches (#123). **Unset, `reportInternalError` only logs to the console** — the SDK chunk is never fetched, and that is the only gate there is: the `error-reporting` embed attribute was removed in #149. **Preview carries one too, and that is load-bearing, not a convenience** (#232): `boot-origins.smoke.test.ts` reads the ingest host back off the deploy, and `assert-preview-host.mjs` refuses the Worker's own production host, so a preview is the only deploy the PR gate can observe. ⚠ Since #282 the preview's copy is an **Actions secret in this repo**, read by `ci.yml`'s publish build — not a Cloudflare Preview-environment variable. The production deploy's stays in the dashboard. |
 | `VITE_SENTRY_ENVIRONMENT`  | Cloudflare — **Preview**       | The `environment` tag on every reported event (#232). It replaced `import.meta.env.MODE`, which reads `production` for **every** `vite build`, preview included — so with a DSN on Preview, preview noise would be indistinguishable from the events that matter. Set it to `preview` there and leave Production alone: unset, a build defaults to `production` and `pnpm dev` to `development`, so nothing gets mislabelled. Not a secret, and not in `.env`, where it would be inert anyway — nothing reports without a DSN. |
 | `SENTRY_AUTH_TOKEN`        | Cloudflare                    | **Build-time only, and a real secret** (issue #130). It carries no `VITE_` prefix, so Vite cannot inline it. **`pnpm assert:maps` also greps every emitted file for its value** and fails the build if it appears — a gate, not a habit. Its presence switches source-map upload on. Set: `build.sourcemap: 'hidden'`, and `@sentry/vite-plugin` uploads the maps, then deletes them. Unset: **no maps are emitted at all**, and the build matches one from before #130 byte-for-byte. See runbook step 2 for the token scopes it needs. The plugin never creates, finalizes, or sets commits on a release. Still, the upload call stays release-scoped. |

From 425e2da4fc80b247f478b36e27517c858cf071c6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 2 Nov 2026 21:20:47 +0000
Subject: [PATCH 10/14] refactor(turnstile): streamline the challenge hook
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review asked for less code and fewer comments in `use-turnstile.ts`, with
behaviour preserved. Comments drop 145 lines to 107 and code 189 to 182;
every `⚠` point and `#NNN` breadcrumb the file carried is kept, compressed.

Three substantive edits, all behaviour-neutral:

- `deliver` is inlined into `onMessage`. It had one call site, and the
  timer-clearing rule it held (clear on a real message, never on a stray one)
  is clearer beside the parse it depends on.
- `TURNSTILE_FEATURES` is the joined string rather than an array plus a
  `join('; ')` — the value is a literal either way, and nothing iterates it.
- The `availability` memo's rationale moves to `probeTurnstile`'s docblock,
  so the one eager-check story is in one place rather than split across a
  module-level comment and a body comment.

`use-turnstile` 24, `turnstile-frame` 29 and `use-turnstile-guard` 5 all pass
unchanged, with no spec edited — which is what "preserving behaviour" means
here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mg9rjYk3epghxLxipXmJws
---
 src/hooks/use-turnstile.ts | 227 +++++++++++++++----------------------
 1 file changed, 91 insertions(+), 136 deletions(-)

diff --git a/src/hooks/use-turnstile.ts b/src/hooks/use-turnstile.ts
index d80bac7a..a7263db8 100644
--- a/src/hooks/use-turnstile.ts
+++ b/src/hooks/use-turnstile.ts
@@ -10,80 +10,58 @@ import {
 import { useLocale } from '@/hooks/use-locale'
 import { useTheme } from '@/hooks/use-theme'
 
-// This renders Cloudflare Turnstile explicitly. See issue #79.
-// This code is hand-rolled, instead of adding `@marsidev/react-turnstile`.
-// The embedded bundle ships on host pages we do not control, so every added dependency is weight we would rather avoid.
+// Turnstile rendered explicitly, hand-rolled rather than through `@marsidev/react-turnstile`
+// (#79): this bundle ships on host pages we do not control, so a dependency is weight.
 //
-// ⚠ **The challenge renders in a frame on OUR origin, never in the host's document. See issue #343.**
-// Turnstile validates the hostname of the document that renders it, so the script embed used to present the partner's hostname and fail with `110200`.
-// `src/lib/turnstile-frame.ts` owns that reasoning and the message protocol; `challenge.html` is the page.
-// Nothing here branches on embed mode: the frame is used standalone and framed alike, so one code path is the only one anybody tests.
+// ⚠ **The challenge renders in a frame on OUR origin, never in the host's document (#343).**
+// `src/lib/turnstile-frame.ts` owns that reasoning and the protocol; `challenge.html` is the
+// page. Nothing here branches on embed mode, so one code path is the only one anybody tests.
 //
-// ⚠ **The challenge is no longer lazy. That behavior inverted in issue #182.**
-// Registration is what this widget is for, and registration cannot happen without a token.
-// So a challenge that cannot load is a broken embed, not a form that degrades.
-// `useTurnstileGuard` starts the check as soon as the INTERFACE mounts, never the shell. See `FullInterface`.
-// It fails the widget when the check cannot complete.
-// So a host with an out-of-date CSP finds out from their own page, not from a visitor who could not register.
-//
-// The frame is still removed on unmount.
-// So reopening a form always gets a fresh challenge, not a stale or expired token.
+// ⚠ **The challenge is not lazy — that inverted in #182.** Registration cannot happen without a
+// token, so a challenge that cannot load fails the widget rather than degrading the form, as
+// soon as the INTERFACE mounts (`useTurnstileGuard`). A host with a stale CSP hears it from
+// their own page, not from a visitor who could not register.
 
 /** Cloudflare's own widget is 300×65. The frame is sized to it, since nothing else is on the page. */
 const FRAME_WIDTH = 300
 const FRAME_HEIGHT = 65
 
 /**
- * How long either caller waits for the frame's handshake before calling it dead.
- *
- * It bounds a frame that neither loads nor errors — a host behind a proxy that swallows the
- * request, or one whose policy refuses the frame on an engine that reports no violation — and
- * both callers need the same bound. Nothing blocks on the verdict, so a generous bound costs a
- * late answer, never a slow first paint.
+ * Bounds a frame that neither loads nor errors — a proxy that swallows the request, a refusal on
+ * an engine that reports no violation. Nothing blocks on the verdict, so a generous bound costs
+ * a late answer rather than a slow first paint.
  */
 const HANDSHAKE_TIMEOUT_MS = 10_000
 
 /**
- * What the frame delegates, read off Turnstile's own `api.js` on 2026-11-02: these are the
- * features it sets on the widget frame it renders inside our page.
+ * Read off Turnstile's own `api.js` on 2026-11-02: what it sets on the widget frame it renders
+ * inside our page.
  *
- * ⚠ **Permissions Policy is hierarchical, so that inner delegation reaches nothing our own
- * document was not granted**, and every policy-controlled feature is denied to a cross-origin
- * child by default. The script embed ran `api.js` in the HOST's document, which holds them all
- * unless the host's own header says otherwise — so without this line the challenge frame is
- * strictly less capable than the arrangement it replaces, silently.
+ * ⚠ **Every policy-controlled feature is denied to a cross-origin child by default**, so without
+ * this the frame is silently less capable than the script embed it replaces, which ran `api.js`
+ * in the HOST's document. Permissions Policy is hierarchical, so it grants nothing we lack.
  *
- * ⚠ **Private State Tokens cannot be delegated from here, and asking for them would be
- * theatre.** `api.js` pushes one more feature when `document.featurePolicy.features()` lists
- * it, under the pre-standard name `private-token` — which Chromium 153 does not: it lists
- * `private-state-token-issuance` and `private-state-token-redemption`. So Turnstile's own
- * widget frame is not asking for that capability under any name an engine knows, and nothing
- * a parent delegates can reach it. Nothing in our own document calls the API either.
- * `docs/embedding.md` § Permissions Policy carries the host-facing half.
+ * ⚠ **Private State Tokens cannot be delegated from here.** `api.js` asks for them as
+ * `private-token`, gated on `document.featurePolicy.features()`, which in Chromium 153 lists
+ * `private-state-token-issuance` and `private-state-token-redemption` instead — so the pair a
+ * parent can delegate reaches nothing. `docs/embedding.md` § Permissions Policy has the
+ * host-facing half.
  */
-const TURNSTILE_FEATURES = [
-  'cross-origin-isolated',
-  'fullscreen',
-  'autoplay',
-  'keyboard-map',
-  'gamepad',
-  'xr-spatial-tracking',
-].join('; ')
+const TURNSTILE_FEATURES =
+  'cross-origin-isolated; fullscreen; autoplay; keyboard-map; gamepad; xr-spatial-tracking'
 
 /**
- * Builds the frame, the listener that reads it, and the one definition of its liveness — for
- * both the hook and the probe.
+ * The frame, its listener, and the one definition of its liveness — for both the hook and the
+ * probe.
  *
- * Two checks decide what counts as the frame talking, and both are needed. `event.source`
- * pins the message to this frame's own window, which no other document can forge. `origin`
- * pins it to the origin we built the `src` from, so a frame navigated elsewhere — a redirect,
- * a captive portal — cannot keep answering as the challenge.
+ * `event.source` pins a message to this frame's own window, which no other document can forge;
+ * `origin` pins it to the origin the `src` was built from, so a frame navigated elsewhere cannot
+ * keep answering as the challenge.
  *
- * ⚠ **Silence is delivered as the page's own `error`.** A frame that never handshakes is as
- * dead as one that reported a failure, and both callers already answer `error` correctly — the
- * probe with `false`, the hook with `blocked`. Giving the hook no timeout of its own is what
- * left a form under a refusing `frame-src` on `loading` for ever, with a submit button that
- * could never produce a token.
+ * ⚠ **Silence is delivered as the page's own `error`**, since a frame that never handshakes is as
+ * dead as one that failed, and both callers answer `error` already — the probe `false`, the hook
+ * `blocked`. No timeout here is what left a form under a refusing `frame-src` on `loading` for
+ * ever.
  */
 function createChallengeFrame(
   options: ChallengeOptions,
@@ -96,29 +74,26 @@ function createChallengeFrame(
   frame.width = String(FRAME_WIDTH)
   frame.height = String(FRAME_HEIGHT)
   frame.style.border = '0'
-  // The frame's content is a captcha with its own labelling. A title is still required of
-  // every frame, and "security check" is what a screen-reader user needs to hear here.
+  // A captcha labels itself, but every frame still needs a title, and this is what a
+  // screen-reader user needs to hear.
   frame.title = 'Security check'
-  // This request goes to OUR origin, not Cloudflare's — `src/challenge.ts` owns that hop. What
-  // this keeps out of our own logs is the host page's path and query, which a host opting into
-  // an `unsafe-url` referrer policy would otherwise send us.
+  // This hop goes to OUR origin, not Cloudflare's (`src/challenge.ts` owns that one), so what
+  // this withholds is the host page's path and query from our own logs.
   frame.referrerPolicy = 'strict-origin'
   frame.allow = TURNSTILE_FEATURES
 
   const expectedOrigin = new URL(src).origin
-  const deliver = (message: ChallengeEvent | null) => {
-    if (message) clearTimeout(timer)
-
-    onEvent(message)
-  }
   const onMessage = (event: MessageEvent) => {
-    // `contentWindow` is checked for presence as well as identity: a frame with none yet
-    // leaves both sides `null`, and `null !== null` is false, so a message carrying no source
-    // would pass an identity test alone.
+    // `contentWindow` is checked for presence as well as identity: a frame with none yet leaves
+    // both sides `null`, so a message carrying no source would pass an identity test alone.
     if (!frame.contentWindow || event.source !== frame.contentWindow) return
     if (event.origin !== expectedOrigin) return
 
-    deliver(parseChallengeEvent(event.data))
+    const message = parseChallengeEvent(event.data)
+
+    if (message) clearTimeout(timer)
+
+    onEvent(message)
   }
   const timer = setTimeout(() => onEvent({ type: 'error' }), HANDSHAKE_TIMEOUT_MS)
 
@@ -133,34 +108,26 @@ function createChallengeFrame(
   return { frame, expectedOrigin, dispose }
 }
 
+/** Shared by every mount on the page. Cleared on a negative verdict, so a blip is retried. */
+let availability: Promise<boolean> | null = null
+
 /**
- * This mounts the challenge page hidden, and reports whether Turnstile is live inside it.
+ * Whether Turnstile can run on this page at all — the host's CSP and the network, not any one
+ * form (#182). Resolves `false` rather than rejecting, because every caller wants a verdict.
  *
- * This is the reading half of the eager check. See issue #182.
- * It answers "can this page run Turnstile at all," a question about the host's CSP and the network, not about any one form.
- * This resolves to `false` rather than rejecting, because every caller treats a failure as a verdict, not an exception.
+ * Memoized because the script load this replaced memoized itself: without it a compact embed's
+ * open/close/open pays for a browsing context, three of our chunks and a script eval each time.
  *
- * ⚠ **This check is weaker than a real render, and that gap is deliberate, not overlooked.**
- * The frame is mounted in probe mode, so it hands back the handshake without rendering a
- * challenge — a real render here would spend a solve nobody submits, in a frame nobody can see.
- * What it therefore sees: a `frame-src` that refuses our origin, a `script-src` inside our own
- * frame (ours to get right, not a host's), an absent site key, and a script that loads without
- * defining the API.
- * What it cannot see: a challenge that renders and then errors, which `useTurnstile`'s own
- * `blocked` status remains the backstop for.
- * ⚠ The hostname mismatch this check could never see is **gone** rather than unobserved — the
- * challenge now always renders on the one hostname the widget's Turnstile key lists (#343).
+ * ⚠ **Weaker than a real render, deliberately.** Probe mode hands back the handshake without
+ * rendering, so it sees a `frame-src` that refuses us, a `script-src` inside our own frame, an
+ * absent site key and a script that loads without defining the API — but not a challenge that
+ * renders and then errors, which `useTurnstile`'s `blocked` backstops.
+ * ⚠ The hostname mismatch it could never see is **gone** rather than unobserved: the challenge
+ * now always renders on the one hostname the widget's Turnstile key lists (#343).
  */
-let availability: Promise<boolean> | null = null
-
 export async function probeTurnstile(): Promise<boolean> {
   if (typeof document === 'undefined') return false
 
-  // One check per page, shared by every mount. The script load this replaced memoized itself,
-  // so reopening an interface cost nothing; without this a compact embed's open/close/open
-  // pays for a whole browsing context, three of our chunks and a Cloudflare script eval each
-  // time. Cleared on a negative verdict, so a transient network failure is retried rather
-  // than cached for the life of the page.
   availability ??= runCheck().then((available) => {
     if (!available) availability = null
 
@@ -182,17 +149,14 @@ function runCheck(): Promise<boolean> {
       resolve(available)
     }
 
-    // A host policy that refuses to frame our origin. The frame then fires no load and no
-    // error of its own, so this is the only thing that answers before the handshake timeout —
-    // a latency decision, not a second liveness rule. Ten seconds of a healthy-looking widget
-    // before the error screen is worse than the screen arriving at once.
+    // A host refusing to frame our origin fires no load and no error, so this answers before the
+    // handshake timeout — a latency decision, not a second liveness rule.
     //
-    // Measured in Chromium 153.0.8010.12 against the built page, 2026-11-01: a host sending
-    // `frame-src 'none'` AND one sending only `default-src 'self'` both report
-    // `effectiveDirective: 'frame-src'` with `blockedURI` the BARE ORIGIN — no trailing
-    // slash and no path. Hence `startsWith`, which holds for either shape, rather than an
-    // equality test. `child-src` and `default-src` are matched for the engines this was not
-    // measured on, and for `violatedDirective`, which is the older spelling.
+    // Measured in Chromium 153.0.8010.12 against the built page, 2026-11-01: `frame-src 'none'`
+    // and a bare `default-src 'self'` both report `effectiveDirective: 'frame-src'` with
+    // `blockedURI` the BARE ORIGIN, no trailing slash and no path — hence `startsWith`.
+    // `child-src`, `default-src` and `violatedDirective` cover the engines and spellings this
+    // was not measured on.
     const onViolation = (event: SecurityPolicyViolationEvent) => {
       const directive = event.effectiveDirective || event.violatedDirective
 
@@ -210,13 +174,12 @@ function runCheck(): Promise<boolean> {
       },
     )
 
-    // Hidden, not `display: none`: a frame with no box is still fetched, but keeping it in the
-    // layout tree is what keeps this check as close as possible to the frame a form mounts.
+    // Hidden rather than `display: none`, which would still fetch but leave the layout tree —
+    // this keeps the check as close as possible to the frame a form mounts.
     //
-    // ⚠ `fixed`, not `absolute`. This lands in the HOST page's body, and an out-of-flow
-    // element at its static position still extends the document's scroll area — a stray
-    // pixel of scroll on somebody else's page for the length of the check. A fixed element
-    // contributes none.
+    // ⚠ `fixed`, not `absolute`. This lands in the HOST page's body, where an out-of-flow element
+    // at its static position still extends the document's scroll area. A fixed one contributes
+    // no scroll to somebody else's page.
     frame.style.cssText =
       'position:fixed;top:0;left:0;width:1px;height:1px;opacity:0;pointer-events:none;border:0'
     frame.setAttribute('aria-hidden', 'true')
@@ -228,52 +191,48 @@ function runCheck(): Promise<boolean> {
 }
 
 /**
- * This is `loading` until the challenge renders.
- * This is `blocked` when Turnstile is unavailable: no site key, a CSP-blocked frame, or a widget that errors out.
- * A caller must degrade on `blocked`, rather than leaving a submit button that can never produce a token.
+ * `loading` until the challenge renders, `blocked` when Turnstile is unavailable: no site key, a
+ * CSP-blocked frame, or a widget that errors out. A caller must degrade on `blocked` rather than
+ * leave a submit button that can never produce a token.
  */
 export type TurnstileStatus = 'loading' | 'ready' | 'blocked'
 
 export type UseTurnstileOptions = {
-  /** This skips the frame entirely and reports `blocked`, for the Ladle story's degraded case. */
+  /** Skips the frame entirely and reports `blocked`, for the Ladle story's degraded case. */
   disabled?: boolean
 }
 
 export type UseTurnstile = {
   /** Attach to the element the challenge frame is appended to. */
   challengeRef: RefObject<HTMLDivElement>
-  /** This is the solved token, or null while unsolved or expired. */
+  /** The solved token, or null while unsolved or expired. */
   token: string | null
   status: TurnstileStatus
   /**
-   * This discards the current token and re-runs the challenge in place.
-   *
-   * **A Turnstile token is single-use.** The server redeems it the moment it verifies, before it does the work the token was gating.
-   * So after ANY failed submit, the token in hand may already be spent.
-   * Re-sending it would then be refused for the rest of the widget's life.
-   * A caller whose submit failed must reset, rather than offer a retry that cannot succeed.
+   * Discards the token and re-runs the challenge in place. A no-op while it is not rendered, so
+   * a caller never has to check `status` first.
    *
-   * This is a no-op while the challenge is not rendered, blocked or still loading.
-   * So a caller never has to check `status` first.
+   * **A Turnstile token is single-use**, redeemed the moment the server verifies it and before
+   * the work it gated. So after ANY failed submit the token in hand may be spent, and re-sending
+   * it is refused for the rest of the widget's life: a caller whose submit failed must reset
+   * rather than offer a retry that cannot succeed.
    */
   reset: () => void
 }
 
 export function useTurnstile({ disabled = false }: UseTurnstileOptions = {}): UseTurnstile {
   const challengeRef = useRef<HTMLDivElement>(null)
-  // This is held in a ref as well as the effect closure.
-  // So `reset` can reach the live frame without re-running, and so re-mounting, the challenge.
-  // The origin rides along because `reset` must address the frame as narrowly as the inbound
-  // filter reads it — a frame navigated elsewhere receives nothing rather than a command.
+  // In a ref as well as the effect closure, so `reset` reaches the live frame without re-running
+  // the effect. The origin rides along so `reset` addresses the frame as narrowly as the inbound
+  // filter reads it: a frame navigated elsewhere receives nothing rather than a command.
   const frameRef = useRef<{ frame: HTMLIFrameElement; origin: string } | null>(null)
   const [token, setToken] = useState<string | null>(null)
   const [status, setStatus] = useState<TurnstileStatus>(disabled ? 'blocked' : 'loading')
   const { theme } = useTheme()
   const { languageCode } = useLocale()
 
-  // Re-mounting on a theme or language change is deliberate.
-  // Turnstile bakes both into the widget at render time, so the frame carries them in its URL.
-  // So the challenge tears down and re-mounts, which also drops the token correctly, since the new widget has not been solved.
+  // Re-mounting on a theme or language change is deliberate: Turnstile bakes both in at render
+  // time, so the frame carries them in its URL and the teardown drops the unsolved token with it.
   useEffect(() => {
     if (disabled || !challengeRef.current) return
 
@@ -287,11 +246,9 @@ export function useTurnstile({ disabled = false }: UseTurnstileOptions = {}): Us
           case 'ready':
             setStatus('ready')
             break
-          // Turnstile's `retry` option defaults to `auto`.
-          // So a transient failure is often followed by an automatic retry that solves.
-          // So `blocked` must NOT be a one-way latch.
-          // A solved challenge has to win the form back.
-          // Otherwise the user holds a valid token while the UI still offers only the mailto escape.
+          // Turnstile's `retry` defaults to `auto`, so a transient failure is often followed by a
+          // retry that solves. `blocked` must NOT latch, or the user holds a valid token while
+          // the UI still offers only the mailto escape.
           case 'token':
             setToken(message.token)
             setStatus('ready')
@@ -316,11 +273,9 @@ export function useTurnstile({ disabled = false }: UseTurnstileOptions = {}): Us
     }
   }, [disabled, theme, languageCode])
 
-  // This is stable across renders, with no dependencies.
-  // The caller passes this straight to `useMutation`'s `onError`.
-  // A fresh identity on each render would re-run the observer's `setOptions` for nothing.
-  // `reset` re-runs the challenge, which sends the same `token` message on success.
-  // So the new token arrives through the normal path.
+  // Stable with no dependencies: the caller hands this to `useMutation`'s `onError`, and a fresh
+  // identity each render would re-run the observer's `setOptions` for nothing. The new token
+  // arrives through the normal path, since the re-run challenge sends `token` on success.
   const reset = useCallback(() => {
     const live = frameRef.current
 

From edbe4b3cee54494896159fb2255040953015ba15 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 2 Nov 2026 21:20:57 +0000
Subject: [PATCH 11/14] refactor(turnstile): streamline the frame protocol
 module
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review asked for less code and fewer comments in `turnstile-frame.ts`, and
for reuse in place of recreation. Comments drop 58 lines to 50; every `⚠`
point and `#NNN` breadcrumb is kept, compressed.

The recreation was real and is gone. `challengeSrc` and `challengeOrigin`
each built `new URL(CHALLENGE_PATH, moduleUrl)` of their own; both now go
through one `challengeUrl`, so the path and the base resolve in one place.
`isRecord` was a private generic predicate with a single caller, folded into
`onChannel` by narrowing in place.

Reuse from outside the file was looked for and there is none to take. No
shared record predicate exists in `src/lib/` — `prefetch-intent.ts` has
`isThenable`, a different test. `shape/query.ts` owns this repo's URL-editing
helpers, and they are the wrong tool here by their own docblock: they exist to
edit one pair on a host's query byte-identically, and argue against
`URLSearchParams.set` for that case. This module builds a URL of ours from
scratch, where `set` is correct. Importing them would also pull host-query
machinery into `challenge.html`'s graph, which carries this module.

`turnstile-frame` 29 and both form submit specs pass unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mg9rjYk3epghxLxipXmJws
---
 src/lib/turnstile-frame.ts | 82 +++++++++++++++++---------------------
 1 file changed, 37 insertions(+), 45 deletions(-)

diff --git a/src/lib/turnstile-frame.ts b/src/lib/turnstile-frame.ts
index 9d325145..c2a1bfb0 100644
--- a/src/lib/turnstile-frame.ts
+++ b/src/lib/turnstile-frame.ts
@@ -2,28 +2,23 @@
  * The contract between the widget and the Turnstile challenge page it frames (#343).
  *
  * **Turnstile validates the hostname of the document that RENDERS it, not the top-level page.**
- * The script embed puts our React tree inside the HOST's document, so the challenge used to
- * render on the partner's hostname and every one not on the widget's Turnstile hostname list
- * failed with `110200` — measured directly, and in a nested frame on the same host, where it
- * passed. One hostname list covers every partner once the challenge renders on our origin, so
- * there is no per-partner onboarding step and nothing for a host to configure.
+ * The script embed put our React tree in the HOST's document, so every partner hostname off the
+ * widget's Turnstile list failed with `110200` — measured, including in a nested frame on the
+ * same host, where it passed. On our own origin, one hostname list covers every partner and a
+ * host configures nothing.
  *
- * Pure, and shared by both sides of the frame: `src/challenge.ts` is the page, and
- * `src/hooks/use-turnstile.ts` frames it. One module rather than two copies, because a
- * protocol that drifts fails silently — the parent waits for a handshake the page stopped
- * sending, and the form stays disabled with nothing on the console.
+ * Pure, and shared by both sides: `src/challenge.ts` is the page, `src/hooks/use-turnstile.ts`
+ * frames it. One module rather than two copies, because a protocol that drifts fails silently —
+ * the parent waits for a handshake the page stopped sending, with nothing on the console.
  */
 
 /** The challenge page's own path. A Vite HTML input, so it lands at the output root. */
 export const CHALLENGE_PATH = '/challenge.html'
 
 /**
- * Namespaces every message in both directions.
- *
- * The frame's `postMessage` traffic lands on a window the HOST page also owns, and a host may
- * run its own cross-frame messaging, a chat widget or an analytics bridge. Without a channel
- * marker a message shaped like `{ type: 'token' }` from any of those would read as a solved
- * challenge.
+ * Namespaces every message in both directions. The traffic lands on a window the HOST page also
+ * owns, and a host may run its own cross-frame messaging — without the marker a message shaped
+ * like `{ type: 'token' }` from a chat widget or an analytics bridge would read as a solve.
  */
 export const CHALLENGE_CHANNEL = 'sahaj-atlas-turnstile'
 
@@ -42,28 +37,27 @@ export type ChallengeOptions = {
   /** Turnstile's own `language` option — a two-letter code, as the widget's locale gives it. */
   language: string
   /**
-   * Hand back `ready` and render nothing.
-   *
-   * The eager availability check asks whether Turnstile can run here at all, which the
-   * handshake answers on its own. Rendering for it would solve a challenge nobody submits,
-   * against the account's own quota, in a frame the viewer cannot see.
+   * Hand back `ready` and render nothing. The eager check asks only whether Turnstile can run
+   * here, which the handshake answers; a render would spend a solve nobody submits, against the
+   * account's quota, in a frame the viewer cannot see.
    */
   probe?: boolean
 }
 
 /**
- * The frame's `src`, resolved against the calling module's own URL so the frame is always
- * same-origin with the bundle — production, a Workers preview, `pnpm dev` or Ladle, with
- * nothing to configure. `src/styles/fonts.ts` resolves the font files the same way and for the
- * same reason: the deploy origin is not knowable at build time.
+ * Resolved against the calling module's own URL, so the frame is same-origin with the bundle in
+ * production, a Workers preview, `pnpm dev` and Ladle alike. `src/styles/fonts.ts` resolves font
+ * files the same way: the deploy origin is not knowable at build time.
  *
- * ⚠ `moduleUrl` is a parameter rather than a `import.meta.url` read inside this module, for
- * two reasons. Vite rewrites the literal `new URL(…, import.meta.url)` expression at transform
- * time as its asset-URL idiom, and a variable base is left alone. And it is what lets a spec
- * assert the shape this returns on a real deploy, rather than on the test runner's own origin.
+ * ⚠ `moduleUrl` is a parameter rather than an `import.meta.url` read here. Vite rewrites the
+ * literal `new URL(…, import.meta.url)` expression as its asset-URL idiom and leaves a variable
+ * base alone — and a parameter is what lets a spec assert what a real deploy returns.
  */
+const challengeUrl = (moduleUrl: string): URL => new URL(CHALLENGE_PATH, moduleUrl)
+
+/** The frame's `src`, carrying what Turnstile bakes into the widget at render time. */
 export function challengeSrc(moduleUrl: string, options: ChallengeOptions): string {
-  const url = new URL(CHALLENGE_PATH, moduleUrl)
+  const url = challengeUrl(moduleUrl)
 
   url.searchParams.set('theme', options.theme)
   url.searchParams.set('language', options.language)
@@ -73,15 +67,16 @@ export function challengeSrc(moduleUrl: string, options: ChallengeOptions): stri
 }
 
 /** The origin the frame is served from — the one a host must allow under `frame-src`. */
-export function challengeOrigin(moduleUrl: string): string {
-  return new URL(CHALLENGE_PATH, moduleUrl).origin
-}
-
-const isRecord = (value: unknown): value is Record<string, unknown> =>
-  typeof value === 'object' && value !== null
+export const challengeOrigin = (moduleUrl: string): string => challengeUrl(moduleUrl).origin
 
+/** The envelope both parsers read: an object on our channel, or `null` for anything else. */
 const onChannel = (data: unknown): Record<string, unknown> | null =>
-  isRecord(data) && data.channel === CHALLENGE_CHANNEL ? data : null
+  typeof data === 'object' &&
+  data !== null &&
+  'channel' in data &&
+  data.channel === CHALLENGE_CHANNEL
+    ? (data as Record<string, unknown>)
+    : null
 
 /** The page's message, or `null` for anything else on the window. */
 export function parseChallengeEvent(data: unknown): ChallengeEvent | null {
@@ -95,8 +90,8 @@ export function parseChallengeEvent(data: unknown): ChallengeEvent | null {
     case 'error':
       return { type: message.type }
     case 'token':
-      // An empty token would enable Submit and then fail verification, which reads to a
-      // visitor as the form being broken rather than the challenge.
+      // An empty token would enable Submit and then fail verification, which reads to a visitor
+      // as the form being broken rather than the challenge.
       return typeof message.token === 'string' && message.token !== ''
         ? { type: 'token', token: message.token }
         : null
@@ -107,9 +102,7 @@ export function parseChallengeEvent(data: unknown): ChallengeEvent | null {
 
 /** The parent's command, or `null`. Read by the page, where every framer is untrusted. */
 export function parseChallengeCommand(data: unknown): ChallengeCommand | null {
-  const message = onChannel(data)
-
-  return message?.type === 'reset' ? { type: 'reset' } : null
+  return onChannel(data)?.type === 'reset' ? { type: 'reset' } : null
 }
 
 /** Wraps an outgoing message. Both sides send through this, so the channel cannot be forgotten. */
@@ -118,10 +111,9 @@ export function challengeMessage<T extends ChallengeEvent | ChallengeCommand>(me
 }
 
 /**
- * The page's own query string, read back.
- *
- * Unknown values fall back rather than refusing: these reach us from a URL the parent built,
- * and a captcha that will not render is a worse answer than one rendered in the wrong theme.
+ * The page's own query string, read back. Unknown values fall back rather than refusing: they
+ * reach us from a URL the parent built, and a captcha that will not render is a worse answer
+ * than one rendered in the wrong theme.
  */
 export function readChallengeOptions(search: string): ChallengeOptions {
   const params = new URLSearchParams(search)

From 21e2775e6bc4c103ee208a845d7e073c6ec4c629 Mon Sep 17 00:00:00 2001
From: Devindra <devindra@Devindras-MacBook-Pro.local>
Date: Tue, 3 Nov 2026 10:16:23 -0700
Subject: [PATCH 12/14] refactor(turnstile): frame SahajCloud's challenge page,
 pinned to this document
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The challenge page moves to SahajCloud (sydevs/SahajCloud#1072), which now holds
both halves of the Turnstile key and decides which pages may receive a token.
The frame is `${VITE_SAHAJCLOUD_URL}/api/atlas/challenge?parent=<origin>…`, with
`parent` this document's `location.origin`: the page posts every message to that
origin alone, and renders nothing for a parent whose domain no client record
lists. One page, one key, one allowlist, and the widget carries no Turnstile
configuration at all.

So everything that existed to serve a page from our own origin goes:
`challenge.html`, `src/challenge.ts`, its Vite input, its `_headers` row, the
Ladle plugin, `VITE_TURNSTILE_SITE_KEY`, #259's release guard and the smoke case
reading the key back. The page-side parsers left `turnstile-frame.ts` with it,
so the per-edit width ceiling returns to 18.

The probe now answers why it failed — `csp`, `origin` or `failed` — so the
console names the one fix that applies: SahajCloud's origin under `frame-src`,
or the domain to have added to the client record. A host's CSP needs
`frame-src https://cloud.sydevelopers.com`, the origin already in its
`connect-src`; `docs/embedding.md` and the changelog say so.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .env                                          |   6 -
 .ladle/vite.config.ts                         |  57 ----
 CHANGELOG.md                                  |  37 ++-
 README.md                                     |   7 +-
 STORYBOOK.md                                  |   2 +-
 challenge.html                                |  24 --
 docs/embedding.md                             |  52 ++--
 docs/environment.md                           |  11 +-
 docs/rules/deployment.md                      |  18 +-
 docs/testing.md                               |  18 +-
 public/_headers                               |  10 -
 scripts/select-unit-specs.test.ts             |  10 +-
 scripts/turnstile-release-guard.mjs           | 156 ----------
 scripts/turnstile-release-guard.test.ts       | 275 ------------------
 src/challenge.ts                              | 143 ---------
 .../molecules/Fallbacks/Fallbacks.tsx         |  10 +-
 .../ReportIssueForm.stories.tsx               |   6 +-
 src/hooks/use-turnstile-guard.test.tsx        |  58 ++--
 src/hooks/use-turnstile-guard.ts              |  53 +++-
 src/hooks/use-turnstile.test.tsx              |  77 ++---
 src/hooks/use-turnstile.ts                    |  64 ++--
 src/lib/turnstile-frame.test.ts               | 118 ++------
 src/lib/turnstile-frame.ts                    |  85 +++---
 src/mocks/errors.ts                           |   2 +-
 src/test-support/turnstile-frame.ts           |  17 +-
 .../CompactEmbedView.mount.test.tsx           |   5 +-
 tests/smoke/embed.smoke.test.ts               | 264 ++++-------------
 vite.config.ts                                |   7 -
 28 files changed, 390 insertions(+), 1202 deletions(-)
 delete mode 100644 challenge.html
 delete mode 100644 scripts/turnstile-release-guard.mjs
 delete mode 100644 scripts/turnstile-release-guard.test.ts
 delete mode 100644 src/challenge.ts

diff --git a/.env b/.env
index 34740107..ee0e1f9a 100644
--- a/.env
+++ b/.env
@@ -21,12 +21,6 @@ VITE_SAHAJCLOUD_URL="https://cloud.sydevelopers.com"
 # #130. Set them on every Workers Builds trigger that builds the app; the runbook is in
 # docs/environment.md.
 
-# Cloudflare Turnstile site key for the report-issue form. A SITE key is public by
-# design (the secret half lives in SahajCloud), so it belongs here rather than in
-# .env.local. This is Cloudflare's always-passes TEST key — dev, Ladle and CI use it;
-# production overrides it with the real key as a BUILD variable on its Workers Builds
-# trigger, and a production build fails if it does not (#259, docs/environment.md).
-VITE_TURNSTILE_SITE_KEY="1x00000000000000000000AA"
 
 # Where a FRAMED embed sends a visitor when its frame is too small for the interface (#161).
 # A frame cannot expand — `position: fixed` resolves against the frame — so the compact card's
diff --git a/.ladle/vite.config.ts b/.ladle/vite.config.ts
index a83e37ff..5940d561 100644
--- a/.ladle/vite.config.ts
+++ b/.ladle/vite.config.ts
@@ -1,7 +1,4 @@
-import type { Plugin } from 'vite'
-
 import { fileURLToPath } from 'url'
-import { readFileSync } from 'node:fs'
 
 import { defineConfig } from 'vite'
 
@@ -18,62 +15,8 @@ import { defineConfig } from 'vite'
 // ships unstyled, so there is nothing of its own for Vite to auto-detect.
 // The decorator imports `globals.css` directly instead.
 const srcDir = fileURLToPath(new URL('../src', import.meta.url))
-const challengeHtml = fileURLToPath(new URL('../challenge.html', import.meta.url))
-
-/**
- * Serves `/challenge.html` here too, so both form stories render a live challenge (#343).
- *
- * The forms frame that page on the bundle's own origin, which on this site is
- * `design.sahajatlas.com`. Ladle builds none of the app's entries by design — see the note
- * above — so the page was absent, the SPA fallback answered with the Ladle shell, and both
- * stories sat `blocked` with Submit disabled once the handshake timed out.
- *
- * ⚠ The page cannot simply be an input or a `public/` file. Ladle sets Vite's `root` to its own
- * app directory, so the page's `/src/challenge.ts` resolves from neither — hence `/@fs` while
- * serving, and an emitted chunk while building.
- */
-function challengePage(): Plugin {
-  const page = () => readFileSync(challengeHtml, 'utf8')
-  const script = '/src/challenge.ts'
-  let chunk = ''
-
-  return {
-    name: 'sy-ladle-challenge-page',
-    configureServer(server) {
-      server.middlewares.use((req, res, next) => {
-        if (!req.url || new URL(req.url, 'http://ladle').pathname !== '/challenge.html') {
-          next()
-
-          return
-        }
-
-        server
-          .transformIndexHtml(req.url, page().replace(script, `/@fs${srcDir}/challenge.ts`))
-          .then((html) => {
-            // The status is set explicitly: Vite's own html fallback has already parked a 404
-            // on the response by the time this runs, and the frame would read that as a
-            // refused page rather than a served one.
-            res.statusCode = 200
-            res.setHeader('Content-Type', 'text/html')
-            res.end(html)
-          }, next)
-      })
-    },
-    buildStart() {
-      chunk = this.emitFile({ type: 'chunk', id: `${srcDir}/challenge.ts`, name: 'challenge' })
-    },
-    generateBundle() {
-      this.emitFile({
-        type: 'asset',
-        fileName: 'challenge.html',
-        source: page().replace(script, `/${this.getFileName(chunk)}`),
-      })
-    },
-  }
-}
 
 export default defineConfig({
-  plugins: [challengePage()],
   // Give Ladle its own dependency-optimization cache. Ladle force-includes
   // react, react-dom, and its own dependencies in optimizeDeps. So its
   // `configHash` differs from `pnpm dev`'s. Under rolldown-vite (Vite 8),
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 524b0b6d..a96172dc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -44,21 +44,27 @@ cover everything a host would notice since the widget was first deployed.
 
 ### Changed
 
-- ⚠ **BREAKING: your CSP needs `frame-src https://sahajatlas.com`, and the three
-  `challenges.cloudflare.com` entries can go.** ([#343]) The captcha that gates every form now
-  renders in a small frame served from the widget's own origin, instead of inside your document.
-  So `challenges.cloudflare.com` leaves your `script-src`, `connect-src` and `frame-src`, and
-  the widget's origin joins `frame-src`. **A policy that does not allow our origin to be framed
-  shows the error screen**, exactly as a blocked Turnstile did before — and the console names
-  the directive. Leaving the old three in place breaks nothing; they are simply dead.
-
-  Two things improve for you, and neither needs a change. **Onboarding a site needs no captcha
-  step at all**: Turnstile validates the hostname of the document that renders the challenge, so
-  every partner site used to need its hostname registered with us before a registration could be
-  sent — and the free plan caps that list at ten. It is our one hostname now, whatever page
-  hosts the widget. And **no script of Cloudflare's runs in your document any more**: the
-  requests to `challenges.cloudflare.com` are made by our frame, so your page's URL is no longer
-  the document asking.
+- ⚠ **BREAKING: your CSP needs `frame-src https://cloud.sydevelopers.com`, and the three
+  `challenges.cloudflare.com` entries can go.** ([#343], [SahajCloud#1072]) The captcha that
+  gates every form now renders in a small frame served by `cloud.sydevelopers.com` — the origin
+  already in your `connect-src` — instead of inside your document. So `challenges.cloudflare.com`
+  leaves your `script-src`, `connect-src` and `frame-src`, and that origin joins `frame-src`.
+  **A policy that does not allow the frame shows the error screen**, exactly as a blocked
+  Turnstile did before — and the console names the directive. Leaving the old three in place
+  breaks nothing; they are simply dead.
+
+  ⚠ **The captcha renders only on a domain your client record lists** — the same list that
+  already gates the API. A page on any other domain shows the error screen, and the console names
+  the domain to send us. An iframe embed needs nothing listed: there the challenge's parent is the
+  widget's own page.
+
+  Two things improve for you, and neither needs a change. **Onboarding a site needs no Turnstile
+  step**: Turnstile validates the hostname of the document that renders the challenge, so every
+  partner site used to need its hostname registered with Cloudflare before a registration could
+  be sent — and the free plan caps that list at ten. It is one hostname now, whatever page hosts
+  the widget. And **no script of Cloudflare's runs in your document any more**: the requests to
+  `challenges.cloudflare.com` are made by the frame, so your page's URL is no longer the document
+  asking.
 
   **Your `Permissions-Policy` needs nothing for the captcha.** The frame asks for six features
   Cloudflare's widget requests, and the challenge renders and solves with all six denied — see
@@ -865,6 +871,7 @@ must-revalidate`, pinned rather than left to the CDN default. The production dom
 [#320]: https://github.com/sydevs/SahajAtlasWeb/issues/320
 [#326]: https://github.com/sydevs/SahajAtlasWeb/issues/326
 [#343]: https://github.com/sydevs/SahajAtlasWeb/issues/343
+[SahajCloud#1072]: https://github.com/sydevs/SahajCloud/issues/1072
 [#322]: https://github.com/sydevs/SahajAtlasWeb/issues/322
 [#329]: https://github.com/sydevs/SahajAtlasWeb/pull/329
 [#325]: https://github.com/sydevs/SahajAtlasWeb/issues/325
diff --git a/README.md b/README.md
index e6f425e1..0d3ea03a 100644
--- a/README.md
+++ b/README.md
@@ -103,9 +103,10 @@ SahajCloud's:
   [`docs/embedding.md`](docs/embedding.md#content-security-policy).
   **`challenges.cloudflare.com`** loads Turnstile as soon as the interface
   mounts, not when a visitor opens a form (#182) — but since #343 it is loaded
-  by the challenge document on OUR origin, not by the host's page, so it is in
-  no directive of theirs and their URL is never the referrer. The host allows
-  `frame-src` for our origin instead.
+  by a challenge page SahajCloud serves (sydevs/SahajCloud#1072), not by the
+  host's page, so it is in no directive of theirs and their URL is never the
+  referrer. The host allows `frame-src` for SahajCloud's origin instead, and
+  that page hands its token only to a page on a domain the client record lists.
 
 None of these has a script-URL opt-out (#149) — each is built so it does not
 need one. A compliance requirement we have not anticipated becomes a setting
diff --git a/STORYBOOK.md b/STORYBOOK.md
index f2fb74e9..bd0edc80 100644
--- a/STORYBOOK.md
+++ b/STORYBOOK.md
@@ -22,7 +22,7 @@ pnpm ladle:build  # static build (also the CI gate — broken stories fail it)
 | Piece                   | What it does                                                                        |
 | ----------------------- | -------------------------------------------------------------------------------------- |
 | `.ladle/config.mjs`     | Story glob (`src/**/*.stories.{ts,tsx}`), title, port, `viteConfig`.                  |
-| `.ladle/vite.config.ts` | Resolves the `@/` alias to `src/` (Ladle relocates Vite's root), and serves `/challenge.html` so the two form stories render a live captcha (#343). |
+| `.ladle/vite.config.ts` | Resolves the `@/` alias to `src/` (Ladle relocates Vite's root).                      |
 | `.ladle/i18n.ts`        | Self-contained i18next with en/fr bundled (the app loads over HTTP, Ladle has no backend). |
 | `.ladle/components.tsx` | The **global decorator**: React Query + Helmet + a `MemoryRouter` + `<I18nextProvider>`. |
 
diff --git a/challenge.html b/challenge.html
deleted file mode 100644
index 82e6ee37..00000000
--- a/challenge.html
+++ /dev/null
@@ -1,24 +0,0 @@
-<!doctype html>
-
-<!--
-  The Turnstile challenge, served from the widget's own origin and framed by the widget
-  (#343). src/challenge.ts and src/lib/turnstile-frame.ts carry the reasoning; this file is
-  deliberately thin, because Vite strips no HTML comment and every byte here is fetched inside
-  a frame on the registration path.
-
-  ⚠ The reset below is in `style` ATTRIBUTES and may not move into a `<style>` block:
-  scripts/postcss-scope-widget.mjs rewrites every selector in this build to `:where(.sy-atlas)`,
-  which matches nothing on this page.
--->
-<html lang="en" style="margin: 0; padding: 0; background: transparent; overflow: hidden">
-  <head>
-    <meta charset="UTF-8" />
-    <!-- As index.html: the layer that does not depend on Cloudflare serving public/_headers. -->
-    <meta name="robots" content="noindex" />
-    <title>Security check</title>
-  </head>
-  <body style="margin: 0; padding: 0; background: transparent; overflow: hidden">
-    <div id="challenge"></div>
-    <script type="module" src="/src/challenge.ts"></script>
-  </body>
-</html>
diff --git a/docs/embedding.md b/docs/embedding.md
index b186fb9c..e93a6976 100644
--- a/docs/embedding.md
+++ b/docs/embedding.md
@@ -239,6 +239,7 @@ Some things are **not** parameters, on purpose:
 | ---------------------------------- | ---------------------------------------------------------------------- |
 | Display name, brand colours        | your client record                                                     |
 | The path prefix for `routing=path` | your client record — the same value your canonical URLs are built from |
+| The domains you embed on           | your client record — the API refuses reads from anywhere else, and the captcha renders nowhere else |
 
 Identity is the same on every page you embed on, so making it per-embed only risks two of your
 pages disagreeing about what the product is called. The routing prefix is worse than merely
@@ -793,10 +794,13 @@ and `cloud.sydevelopers.com` is in `connect-src` already, for the widget's own r
 If your page sends a CSP, this is what the widget needs added to it. **It is a list of
 additions to your policy, not a policy** — your own sources still have to be in there.
 
-**There is nothing to configure per site for the captcha.** Every form in the widget is behind a
-Cloudflare Turnstile challenge, and that challenge is served, rendered and validated on the
-widget's own origin. So onboarding a new site needs no key of yours, no account of yours, and no
-hostname of yours registered with us. The `frame-src` line below is the whole of it.
+**The captcha needs nothing of yours but a listed domain.** Every form in the widget is behind a
+Cloudflare Turnstile challenge, and that challenge is served, rendered and validated by
+`cloud.sydevelopers.com` — the origin the widget already reads its data from. So onboarding a
+new site needs no key of yours and no account of yours. It renders only for a page on one of the
+domains on your client record, the same list that already gates the API ([What you configure in
+the CMS instead](#what-you-configure-in-the-cms-instead)), so tell us every domain you embed on.
+The `frame-src` line below is the whole of your policy's part.
 
 ```
 script-src  https://sahajatlas.com https://api.mapbox.com https://cdn.usefathom.com
@@ -806,7 +810,7 @@ style-src   'unsafe-inline'
 font-src    https://sahajatlas.com
 img-src     data: https://api.mapbox.com https://imagedelivery.net https://cloud.sydevelopers.com https://react-circle-flags.pages.dev
 connect-src https://cloud.sydevelopers.com https://api.mapbox.com https://events.mapbox.com https://ipwho.is https://cdn.usefathom.com https://*.sentry.io
-frame-src   https://sahajatlas.com
+frame-src   https://cloud.sydevelopers.com
 ```
 
 **One line per directive, deliberately: CSP ignores every repeat of a directive name after the
@@ -833,12 +837,12 @@ believing you allowed something you hadn't.
 |                            | `ipwho.is`                                    | the once-per-session IP→city lookup behind "classes near you"                                                                                                                                                                                                                                                                                                                                                                                                                         | **degrades**: the nearby suggestion is skipped                                                                                                                                                                |
 |                            | `cdn.usefathom.com`                           | analytics, conditional as above                                                                                                                                                                                                                                                                                                                                                                                                                                                       | analytics only                                                                                                                                                                                                |
 |                            | `*.sentry.io`                                 | crash reporting. Contacted **only after the widget has already failed**, and only on a build with a DSN.                                                                                                                                                                                                                                                                                                                                                                              | **degrades**: the widget notices the refusal and stops trying for the rest of the page's life                                                                                                                 |
-| `frame-src`                | the widget's origin                           | **The captcha — required.** Every write the widget makes is captcha-gated, so registration is impossible without it. The challenge is Cloudflare Turnstile, and it renders in a small frame the widget serves from its own origin rather than in your document, so `challenges.cloudflare.com` belongs in no directive of yours. The frame is mounted as soon as the interface does, so a policy that omits this fails immediately rather than at the moment somebody registers.      | **the widget shows an error screen and does not run.** Not a degradation — see the note below                                                                                                                 |
+| `frame-src`                | `cloud.sydevelopers.com`                      | **The captcha — required.** Every write the widget makes is captcha-gated, so registration is impossible without it. The challenge is Cloudflare Turnstile, and it renders in a small frame `cloud.sydevelopers.com` serves rather than in your document, so `challenges.cloudflare.com` belongs in no directive of yours. The frame is mounted as soon as the interface does, so a policy that omits this fails immediately rather than at the moment somebody registers.      | **the widget shows an error screen and does not run.** Not a degradation — see the note below                                                                                                                 |
 
 Notes on that table:
 
 **Nothing of Cloudflare's runs in your document, and `'unsafe-eval'` is not wanted here.** The
-challenge is a separate document on the widget's own origin, which loads Turnstile's `api.js`
+challenge is a separate document on `cloud.sydevelopers.com`, which loads Turnstile's `api.js`
 under its own policy and nests Cloudflare's own challenge frame inside itself. So your
 `frame-src` above is the only directive of yours that reaches any of it. **Do not add
 `'unsafe-eval'`**, and do not add `challenges.cloudflare.com` — neither buys you anything, and
@@ -849,8 +853,10 @@ is ours rather than yours.
 forced interactive challenge rendered in the host's own document was clicked through in six runs
 of six, Chromium 141.0.7390.37, on the policy of that day: the challenge reached its success
 state, the widget took the token, and Submit went from disabled to enabled. What has been
-measured since is that the challenge reaches its success state in a nested frame on our origin
-and that `frame-src` is what refuses it — not a full solve-and-submit on a partner site. Two
+measured since is that the challenge reaches its success state in a nested frame on the widget's
+origin, the arrangement before this one, and that `frame-src` is what refuses it — not a full
+solve-and-submit on a partner site. The page `cloud.sydevelopers.com` serves now is the same
+protocol on a different origin, and has not yet been watched solving in a browser. Two
 things have therefore never been covered in either arrangement: nothing was posted to the
 backend, so the measurement ends at the token rather than at an accepted submission, and map
 mode was not measured, for want of a Mapbox token. Tell us if a challenge will not solve on
@@ -902,7 +908,7 @@ nothing else, allow these — each breaks the widget as a whole:
 |                                      |                                     |
 | ------------------------------------ | ----------------------------------- |
 | `script-src` the widget's origin     | nothing renders                     |
-| `frame-src` the widget's origin      | the widget shows an error and stops |
+| `frame-src cloud.sydevelopers.com`   | the widget shows an error and stops |
 | `connect-src cloud.sydevelopers.com` | no data at all                      |
 | `worker-src blob:`                   | the map never renders               |
 | `img-src data:`                      | the map renders with no pins        |
@@ -923,12 +929,13 @@ silently fail to sign up for one, with no reason for the page owner to suspect a
 wrong. Failing loudly is worse for five minutes and better thereafter.
 
 ⚠ **Which line that entry is has CHANGED.** It used to be `challenges.cloudflare.com`, under
-`script-src`, `frame-src` and `connect-src`. It is now `https://sahajatlas.com` under
-`frame-src` alone, and the three Cloudflare entries can go. A policy still carrying the old
-three is not broken by this — they are simply dead — but one that never had `frame-src
-https://sahajatlas.com` will show the error screen. The widget writes the specific directive it
-needs to the browser console, so a developer looking at the page gets the answer without opening
-this document.
+`script-src`, `frame-src` and `connect-src`. It is now `https://cloud.sydevelopers.com` under
+`frame-src` alone — the origin already in your `connect-src` — and the three Cloudflare entries
+can go. A policy still carrying the old three is not broken by this — they are simply dead — but
+one that never had `frame-src https://cloud.sydevelopers.com` will show the error screen. The
+widget writes the fix to the browser console — the directive, or that your domain is not yet on
+your client record — so a developer looking at the page gets the answer without opening this
+document.
 
 Everything else degrades to exactly what its "Blocked ⇒" column says — a missing typeface, a
 search field that offers no places, missing photography, missing flags, no analytics, no
@@ -960,7 +967,7 @@ an iframe, put them in its `allow` attribute as shown above.
 
 ### The captcha frame asks for six more, and needs none of them
 
-The captcha renders in a frame on our own origin (see
+The captcha renders in a frame on `cloud.sydevelopers.com` (see
 [Content-Security-Policy](#content-security-policy)), and that frame carries
 `allow="cross-origin-isolated; fullscreen; autoplay; keyboard-map; gamepad;
 xr-spatial-tracking"` — the same six Cloudflare's own Turnstile widget asks for one level
@@ -1081,7 +1088,7 @@ Seven honest exceptions, none of them styling your content:
 
 - **A 1-pixel hidden `<iframe>` sits in your `<body>` for a moment after the widget mounts**,
   and is removed again as soon as it has answered. It is the captcha's availability check: it
-  loads the challenge page from the widget's origin and asks whether your policy lets it, so a
+  loads the challenge page from `cloud.sydevelopers.com` and asks whether it may run here, so a
   page where registration is impossible says so immediately rather than at the moment somebody
   tries to sign up. It is `position: fixed`, fully transparent, not focusable and hidden from
   assistive technology, and it adds nothing to your page's scroll height. Nothing else of yours
@@ -1202,12 +1209,13 @@ maintainers rather than editing the snippet:
   own scripts' exceptions are never captured. No breadcrumbs, no session replay.
 
 **The captcha's own requests no longer come from your page.** Cloudflare Turnstile gates every
-form in the widget, and the challenge is now a small frame served from the widget's origin, so
+form in the widget, and the challenge is now a small frame served from `cloud.sydevelopers.com`, so
 the requests to `challenges.cloudflare.com` are made by that frame's document rather than by
 yours. Cloudflare still sees the visitor's IP, as it did before — what changed is that it no
 longer sees your page as the document asking, and no script of Cloudflare's runs in your
-document. The frame is mounted as soon as the interface is, so this happens whether or not the
-visitor opens a form.
+document. The frame's URL carries your page's **origin** — scheme, host and port, never a path —
+because that is the one window the challenge will hand its token to. The frame is mounted as soon
+as the interface is, so this happens whether or not the visitor opens a form.
 
 **`map=false` removes the Mapbox flows too** — tiles, the geocoder (which sends the visitor's
 typed query and the map centre to Mapbox), and the map-load telemetry — along with the two
@@ -1286,7 +1294,7 @@ Three things to check when you migrate:
 | **The map area is blank or grey**                                            | `worker-src blob:` (Mapbox starts its worker from a `blob:` URL), or `api.mapbox.com` missing from `img-src`/`connect-src`.                                                                                                                                                                                                                                                                                                      |
 | **The map renders but has no pins**                                          | `img-src data:` — the pins are inline SVG rasterised from a `data:` URI.                                                                                                                                                                                                                                                                                                                                                         |
 | **Country flags are missing, everything else fine**                          | `img-src https://react-circle-flags.pages.dev`. Cosmetic.                                                                                                                                                                                                                                                                                                                                                                        |
-| **The widget shows "its security check was blocked" and nothing else**       | The captcha's frame is blocked — add `https://sahajatlas.com` to `frame-src`. The browser console carries the exact directive. `challenges.cloudflare.com` is **not** the answer any more: the challenge renders on our origin, not in your document. This used to degrade the report form instead — since the atlas cannot take a registration without it, it now fails outright.                                               |
+| **The widget shows "its security check was blocked" and nothing else**       | Read the browser console, which names one of two causes. Either your CSP blocks the captcha's frame — add `https://cloud.sydevelopers.com` to `frame-src` — or your page's domain is not on your client record, so the challenge refuses to run here — ask us to add it. `challenges.cloudflare.com` is **not** the answer any more: the challenge renders on `cloud.sydevelopers.com`, not in your document. This used to degrade the report form instead — since the atlas cannot take a registration without it, it now fails outright. |
 | **The widget's route never appears in the address bar**                      | The document refuses `history.replaceState` — most often `file://`. The widget detects that and routes in memory.                                                                                                                                                                                                                                                                                                                |
 | **The compact card's button does nothing, in an iframe**                     | The frame is sandboxed without `allow-popups`, so its `target="_blank"` link cannot open. It fails silently, with nothing in the console. Add `allow-popups`, or drop `sandbox`.                                                                                                                                                                                                                                                 |
 | **`atlas=` on the script URL seems to be ignored**                           | The page's own URL already carries an `?atlas=` route, which always wins. That is intended — see [`atlas`, and how the route is chosen](#atlas-and-how-the-route-is-chosen).                                                                                                                                                                                                                                                     |
diff --git a/docs/environment.md b/docs/environment.md
index d2f8f5b7..7218d203 100644
--- a/docs/environment.md
+++ b/docs/environment.md
@@ -19,7 +19,6 @@ place it is stated — everywhere else in this repo just points here.
 | --------------------------- | ----------------------------- | ------- |
 | `VITE_SAHAJCLOUD_URL`      | `.env`                        | SahajCloud origin. The client appends `/api`. Default `https://cloud.sydevelopers.com`. Local backend: `http://localhost:3000`. |
 | `ATLAS_API_KEY`            | shell (never committed)       | A **production** `sahaj-atlas-client` API key, read by `pnpm sync:translations` to pull the English copy out of SahajCloud. Build-time only, no `VITE_` prefix — it never reaches the bundle. The script falls back to `VITE_SAHAJCLOUD_API_KEY` **only** when `VITE_SAHAJCLOUD_URL` is the production origin: a key minted against a local CMS, sent to `cloud.sydevelopers.com`, lands in production's log as a rejected credential and gets rotated in a hurry. ⚠ It replaced `VITE_HOST` here, which #198 deleted along with `public/locales/` — the widget fetches its copy from SahajCloud now, so there is no second origin to name. |
-| `VITE_TURNSTILE_SITE_KEY`  | `.env` **+ Cloudflare — Production build variable** | Cloudflare Turnstile **site** key for the registration and report-issue forms. Public by design — the secret half lives in SahajCloud — so this is committed. ⚠ **`src/challenge.ts` is its ONE reader since #343** — the challenge renders in a frame served from `/challenge.html` on the widget's own origin, so Turnstile always sees `sahajatlas.com` whatever page hosts the widget, and the key is inlined into that page's chunk rather than the widget's. `embed.smoke.test.ts` reads both graphs for that reason: the widget's alone would report production as carrying no key at all. `.env` holds Cloudflare's always-passes test key `1x00000000000000000000AA` for dev, Ladle, and CI. Production overrides it with the real `0x4AAAA…` key as a **build variable** on the app Worker's production Workers Builds trigger (Workers & Pages → `sahajatlas-web` → Settings → Build → Variables and secrets). ⚠ **A runtime variable (Settings → Variables and Secrets) does nothing here** — Vite inlines the key at build time, and this Worker runs no code. Previews keep the test key on purpose: a real key validates only on the hostnames it lists, and a preview's `workers.dev` host is not one — the frame makes every HOST page's hostname irrelevant, never the deploy's own. **A release guard holds this (#259)**: `scripts/turnstile-release-guard.mjs`, a Vite plugin, fails a production build whose resolved key is a test key (any `[123]x0000…`), empty, or not a bare `0x…` key (quotes or spaces pasted around it would reach Turnstile too), naming the variable and this setting. Production means Workers Builds (`WORKERS_CI=1`) building `main`, or naming no branch at all — it fails closed; every other branch, every GitHub Actions build and every local build passes on the test key. ⚠ **It guards a build, so production can change without it**: a manual `wrangler deploy` of a locally built `dist/`, or promoting or rolling back to a version no production build made — and every same-repo PR's smoke job uploads a test-key version of this very Worker (`ci.yml`, `versions upload`), so the dashboard's version list is full of them. `embed.smoke.test.ts` reads the live key after every Workers Builds deploy; after any of the others, run `Production Smoke` by hand. ⚠ **The `sahajatlas-design` trigger must never carry the real key either, and the guard would not catch it**: since #343 that build serves its own `/challenge.html`, so the key reaches a framable challenge page there too — and `.ladle/vite.config.ts` never loads the root config, where the guard plugin lives. ⚠ It also assumes only the production trigger builds `main`: a preview trigger whose branch rule is `*` would build `main` without the key and go red on every merge. Unset, `probeTurnstile` answers `false` and `useTurnstileGuard` fails the whole widget to the captcha-blocked screen — the same state as a CSP-refused script, and no `mailto:` fallback since #182. **Since #103 this key is load-bearing, not decorative.** The form now sends a real email through SahajCloud's captcha-gated endpoint. In production, the test key then makes that captcha a no-op. A site key that does not pair with SahajCloud's `TURNSTILE_SECRET_KEY` makes every report fail with a 403 `captcha_failed`. The viewer sees only one sentence of text for this. |
 | `VITE_SENTRY_DSN`          | Cloudflare — **Production + Preview** | Sentry ingest DSN for automatic error reporting (issue #108). Use the **modern public-key form** `https://<key>@<host>/<project>`. The legacy `https://<key>:<secret>@…` form puts a real secret in the public bundle. A DSN is write-only, so it is public by design. This repo still does **not** commit it to `.env`: a committed DSN would send every fork, preview, and `pnpm dev` into the production project. Set it per Workers Builds trigger in the Cloudflare dashboard. This org is in Sentry's **DE region**, so the ingest host is `o…​.ingest.de.sentry.io` — not `…us…`, which is what the DSN's own text will tell you. **The integrator CSP needs no edit for it**: `docs/embedding.md`'s `connect-src` row already carries `*.sentry.io`, wide on purpose so a regional host matches (#123). **Unset, `reportInternalError` only logs to the console** — the SDK chunk is never fetched, and that is the only gate there is: the `error-reporting` embed attribute was removed in #149. **Preview carries one too, and that is load-bearing, not a convenience** (#232): `boot-origins.smoke.test.ts` reads the ingest host back off the deploy, and `assert-preview-host.mjs` refuses the Worker's own production host, so a preview is the only deploy the PR gate can observe. ⚠ Since #282 the preview's copy is an **Actions secret in this repo**, read by `ci.yml`'s publish build — not a Cloudflare Preview-environment variable. The production deploy's stays in the dashboard. |
 | `VITE_SENTRY_ENVIRONMENT`  | Cloudflare — **Preview**       | The `environment` tag on every reported event (#232). It replaced `import.meta.env.MODE`, which reads `production` for **every** `vite build`, preview included — so with a DSN on Preview, preview noise would be indistinguishable from the events that matter. Set it to `preview` there and leave Production alone: unset, a build defaults to `production` and `pnpm dev` to `development`, so nothing gets mislabelled. Not a secret, and not in `.env`, where it would be inert anyway — nothing reports without a DSN. |
 | `SENTRY_AUTH_TOKEN`        | Cloudflare                    | **Build-time only, and a real secret** (issue #130). It carries no `VITE_` prefix, so Vite cannot inline it. **`pnpm assert:maps` also greps every emitted file for its value** and fails the build if it appears — a gate, not a habit. Its presence switches source-map upload on. Set: `build.sourcemap: 'hidden'`, and `@sentry/vite-plugin` uploads the maps, then deletes them. Unset: **no maps are emitted at all**, and the build matches one from before #130 byte-for-byte. See runbook step 2 for the token scopes it needs. The plugin never creates, finalizes, or sets commits on a release. Still, the upload call stays release-scoped. |
@@ -31,6 +30,12 @@ place it is stated — everywhere else in this repo just points here.
 | `VITE_FATHOM_ID`           | `.env.local`                  | Fathom analytics site id (optional). Analytics is disabled when unset or on localhost. |
 | `SAHAJCLOUD_DOCS_PASSWORD` | `.env.local`                  | HTTP basic-auth password for the SahajCloud OpenAPI docs. Used **only** by the `pnpm types:openapi` script. Never `VITE_`-prefixed — tooling-only, never in the bundle. |
 
+**The widget carries no Turnstile configuration.** Its captcha renders in a page SahajCloud serves
+(`GET /api/atlas/challenge`, sydevs/SahajCloud#1072), and SahajCloud holds both halves of the key —
+`TURNSTILE_SITE_KEY` beside the secret. `VITE_TURNSTILE_SITE_KEY`, its Workers Builds build
+variable and #259's release guard went with the widget's own challenge page: delete the variable
+from the app Worker's production trigger if it is still set, since nothing reads it.
+
 ## GitHub Actions secrets — the smoke lane's preview (#282)
 
 The `Smoke` job builds the app and publishes its own Workers preview, so five values live in
@@ -56,8 +61,8 @@ deploy. That is deliberate: the alternative is a green check that read nothing,
 which is the hole #99 closed.
 
 `VITE_SENTRY_ENVIRONMENT: preview` is a plain workflow value in `ci.yml`, not a secret — unset, a
-build tags itself `production`. `VITE_SAHAJCLOUD_URL` and `VITE_TURNSTILE_SITE_KEY` keep `.env`'s
-committed defaults, the Turnstile one being the always-passes test key. `SENTRY_AUTH_TOKEN` is
+build tags itself `production`. `VITE_SAHAJCLOUD_URL` keeps `.env`'s committed default.
+`SENTRY_AUTH_TOKEN` is
 deliberately **not** set for a preview: no maps are emitted at all and `pnpm assert:maps` passes,
 which is the simplest correct state.
 
diff --git a/docs/rules/deployment.md b/docs/rules/deployment.md
index 930efd73..9e665e3a 100644
--- a/docs/rules/deployment.md
+++ b/docs/rules/deployment.md
@@ -11,8 +11,6 @@ paths:
   - 'scripts/assert-no-sourcemaps.test.ts'
   - 'scripts/deploy-headers.test.ts'
   - 'scripts/wrangler-config.test.ts'
-  - 'scripts/turnstile-release-guard.mjs'
-  - 'scripts/turnstile-release-guard.test.ts'
   - '.github/workflows/*.yml'
 ---
 
@@ -51,10 +49,8 @@ move ran one site at a time, and the app's own cutover was split from building i
 Two deploy files live in `public/`, copied into both build outputs, and both govern both sites:
 
 - **`_headers`** — one site-wide `/*` rule carrying CORS (#91: a font always fetches in CORS
-  mode) and `X-Robots-Tag: noindex` (#106), plus `Cache-Control` on `/assets/*`, the two
-  unhashed entry files (#148) and `/challenge.html` (#343, the Turnstile challenge document —
-  unhashed like those two, but cacheable for ten minutes rather than revalidated, since it
-  names only hashed assets and is fetched inside a frame on the registration path). The `/locales/*` rule went with the bundles in #198.
+  mode) and `X-Robots-Tag: noindex` (#106), plus `Cache-Control` on `/assets/*` and the two
+  unhashed entry files (#148). The `/locales/*` rule went with the bundles in #198.
   ⚠ **No two rules may set the same header name on paths that overlap** — the platform applies
   every matching rule and comma-joins a repeated value, so two would serve `<value>, <value>`.
   `scripts/deploy-headers.test.ts` holds this before a deploy, and it is why CORS lives in one
@@ -116,13 +112,9 @@ Three facts to remember:
 The Sentry variables are dashboard-only, and owed to **each** target that builds the app. The
 runbook is in `docs/environment.md`.
 
-**A production build refuses Cloudflare's test Turnstile site key (#259).** The real
-`VITE_TURNSTILE_SITE_KEY` is a build variable on the production trigger only; `.env`'s test key
-is correct everywhere else. `scripts/turnstile-release-guard.mjs` fails a Workers Builds build of
-`main` whose resolved key is a test key, empty or malformed, so removing that variable fails the
-release instead of shipping a captcha that accepts everyone. `embed.smoke.test.ts` checks the live
-bundle after each Workers Builds deploy. ⚠ Neither sees a version promoted or rolled back without a
-build. What counts as production, and that gap: `docs/environment.md`.
+**Neither Worker carries a Turnstile key.** The captcha renders in a page SahajCloud serves, which
+holds both halves of the key (sydevs/SahajCloud#1072), so #259's release guard and the production
+trigger's `VITE_TURNSTILE_SITE_KEY` build variable went with the widget's own challenge page.
 
 ## Deploy-side CI gates
 
diff --git a/docs/testing.md b/docs/testing.md
index 38deb1bd..06bde9f0 100644
--- a/docs/testing.md
+++ b/docs/testing.md
@@ -294,7 +294,11 @@ alert. The lane's last step opens an issue instead, and three things about it ar
   production read, and a ticket claiming production is red when nothing read it is worse than no
   ticket. `ci-workflows.test.ts` pins that gate and the token, since both fail silently.
 
-**One spec is scoped by environment, on purpose** (#259): `embed.smoke.test.ts`'s Turnstile case expects the committed test site key on an address `assert-preview-host.mjs` accepts as the app Worker's preview, and a real `0x4…` key with no test key everywhere else — so a bypassed build gate still reddens production. The preview half keeps the production half from passing vacuously: the same patterns must find the test key there. ⚠ **It reads two graphs, and must keep doing so** (#343): the key moved into `challenge.html`'s chunk, which the loader crawl cannot reach because nothing `import()`s the challenge page — the widget frames it by a URL composed at runtime. Measured 2026-11-01 against a locally served build: the loader's graph alone reports "no Turnstile site key at all", the false reading that spec exists to avoid. Measured 2026-10-30: green on `sahajatlas.com` and on `pr-344`'s preview, red against a locally served build carrying the test key and against one carrying no key. Every other spec reads both hosts alike. The lane is **20 cases**, from 16 declarations — count it rather
+**No spec is scoped by environment any more.** #259's Turnstile case read the site key back out
+of the bundle, expecting the committed test key on a preview and a real key everywhere else, so a
+bypassed build gate still reddened production. Since sydevs/SahajCloud#1072 the widget carries no
+Turnstile key at all: SahajCloud serves the challenge page and holds both halves, so the build
+gate, the build variable and this case went together. Every spec reads both hosts alike. The lane is **17 cases**, from 13 declarations — count it rather
 than trusting a figure, since `.each` makes the two differ. Measured 2026-10-06 against the 16 it
 was then: all 16 passed against `sahajatlas.com`. Re-measured 2026-10-13 against the playground
 on its Worker (`PREVIEW_URL=https://design.sahajatlas.com pnpm test:smoke`, #279): **10 of the 17
@@ -595,17 +599,15 @@ to select from. The full lane still runs in the lean gate (`.claude/skills/pr-pr
 in CI, so this narrows the inner loop, not the gate.
 
 **What holds the budget is the selection's width, and `scripts/select-unit-specs.test.ts` pins
-that**: the widest edit in the tree, exhaustively through the real composition, at 19 against a
-ceiling of 19 — no headroom, so the next spec reading a repo file through `repo-source` trips it,
+that**: the widest edit in the tree, exhaustively through the real composition, at 18 against a
+ceiling of 18 — no headroom, so the next spec reading a repo file through `repo-source` trips it,
 and the answer is to time the hook and ratchet, never to drop a spec. ⚠ **Two PRs can trip it
 without either one doing so alone**: #322's `mobile-zoom.test.ts` and #324's `attribution.test.ts`
 each took a slot, and the pin went red on the merge rather than on either branch; #328's
-`Drawer.scroll.test.tsx` is what ratcheted it from 17 to 18, and #343's `turnstile-frame.test.ts`
-from 18 to 19. ⚠ Width is not time, and which of
+`Drawer.scroll.test.tsx` is what ratcheted it from 17 to 18. ⚠ Width is not time, and which of
 the pair is slower has flipped across machines — `i18n.ts` selects 12, four of them jsdom, and
-measured 4.7s against the widest's 5.0s at eighteen (2026-10-27, 4 cores), and **7.8s against the
-widest's 6.5s at nineteen (2026-11-02, 4 cores, medians of three)**, the reverse order on a
-slower machine where both still sit under half the 12s bound — so width
+measured 4.7s against the widest's 5.0s at eighteen (2026-10-27, 4 cores), having been the slower
+of the two at seventeen — so width
 bounds the slice, never the time, and a jump in either is a re-measure of both. It also pins each
 of the three specifier forms, end to end against this tree; the tree-walking set as a closed list,
 and its absence from the selection, where the fixture carries a walker of each kind, so a re-added
diff --git a/public/_headers b/public/_headers
index 2f115674..b70ce7a0 100644
--- a/public/_headers
+++ b/public/_headers
@@ -29,16 +29,6 @@
 /embed.js
   Cache-Control: public, max-age=0, must-revalidate
 
-# The Turnstile challenge document (#343). Unhashed, like the two above, because the widget
-# composes its URL at runtime — but it is fetched inside a frame on the registration path, and
-# it references only content-hashed assets, so it can be cached briefly rather than revalidated
-# on every mount. Without a rule it falls to the platform default, which this file records as
-# host-dependent (`max-age=14400` on the custom domain, `max-age=0` on a vendor host): four
-# hours is too long for a document that names hashed chunks, and zero is a network round trip
-# per frame.
-/challenge.html
-  Cache-Control: public, max-age=600, must-revalidate
-
 
 # CORS. The widget is embedded in OTHER sites, so everything it loads at runtime is a
 # cross-origin request from the host page's point of view. A font is always fetched in CORS
diff --git a/scripts/select-unit-specs.test.ts b/scripts/select-unit-specs.test.ts
index 5f6a2503..3b1af9eb 100644
--- a/scripts/select-unit-specs.test.ts
+++ b/scripts/select-unit-specs.test.ts
@@ -242,10 +242,10 @@ describe('this repository', () => {
     // 17, on `src/test-support/repo-source.ts` (#289) — every spec reading one repo file names
     // it, and a spec may read one no other way, so this grows by one per adopter. ⚠ Width is
     // not time, and which of the pair is slower has flipped across machines: `i18n.ts` selects
-    // 12, four of them jsdom, and measured 7.8s against the widest selection's 6.5s at
-    // nineteen, against a 12s budget. So this bounds width as a proxy, and the answer when it
-    // trips is to time the hook and ratchet, never to drop a spec from the selection.
-    // `docs/testing.md` carries the times and the method.
-    expect(worst.count, `widest selection: ${worst.source}`).toBeLessThanOrEqual(19)
+    // 12, four of them jsdom, and measured 4.7s against the widest selection's 5.0s at
+    // eighteen, having been the slower of the two at seventeen. So this bounds width as a
+    // proxy, and the answer when it trips is to time the hook and ratchet, never to drop a
+    // spec from the selection. `docs/testing.md` carries the times and the method.
+    expect(worst.count, `widest selection: ${worst.source}`).toBeLessThanOrEqual(18)
   })
 })
diff --git a/scripts/turnstile-release-guard.mjs b/scripts/turnstile-release-guard.mjs
deleted file mode 100644
index 01603b75..00000000
--- a/scripts/turnstile-release-guard.mjs
+++ /dev/null
@@ -1,156 +0,0 @@
-/**
- * Fails a production build that would ship Cloudflare's test Turnstile site key, or none (#259).
- *
- * `.env` commits the always-passes test key on purpose: dev, Ladle, CI and every preview need it,
- * because a real key validates only on the hostnames it lists and a preview's host is not one.
- * Production gets the real key from a Workers Builds **build** variable. Remove that variable and
- * production silently falls back to `.env`'s value — a captcha that accepts everything, or one
- * that refuses every visitor, depending on SahajCloud's secret. Nothing else would notice.
- *
- * The check reads Vite's RESOLVED `import.meta.env` (`config.env`), not `process.env` or a file:
- * the shell environment beats every `.env*` file, and `--mode` chooses which files load, so this
- * is exactly the value the bundle inlines.
- *
- * ⚠ It guards a BUILD, so a promotion, a rollback or a manual deploy changes production without
- * passing it. `tests/smoke/embed.smoke.test.ts` reads the live key back after every Workers Builds
- * deploy. Which versions slip through both, and what to run then: docs/environment.md.
- */
-
-import process from 'node:process'
-
-export const SITE_KEY_VARIABLE = 'VITE_TURNSTILE_SITE_KEY'
-
-/** Workers Builds' production branch for the `sahajatlas-web` Worker (its Git branch setting). */
-export const PRODUCTION_BRANCH = 'main'
-
-/**
- * Cloudflare's dummy site keys: `1x…AA` / `1x…BB` pass, `2x…AB` / `2x…BB` block, `3x…FF` forces a
- * challenge. Matched by shape so an unpublished variant is caught too; a real key starts `0x`.
- * The lookbehind keeps a match from starting mid-token.
- */
-const TEST_SITE_KEY_SOURCE = '(?<![0-9A-Za-z])[123]x0{16,}[0-9A-Za-z]*'
-
-/**
- * Every test site key in `text`, for reading a built bundle back.
- *
- * @param {string} text
- * @returns {string[]}
- */
-export function findTestSiteKeys(text) {
-  return [...text.matchAll(new RegExp(TEST_SITE_KEY_SOURCE, 'gi'))].map((m) => m[0])
-}
-
-/**
- * A real site key's shape: `0x` and at least ten more key characters. `embed.smoke.test.ts` reads
- * the live bundle through this same source, because a stricter pattern there blames
- * `VITE_TURNSTILE_SITE_KEY` for being unset over a key this gate has passed.
- */
-const LIVE_SITE_KEY_SOURCE = '0x[0-9A-Za-z_-]{10,}'
-
-/** A real site key, exactly — Vite inlines the value byte for byte, padding and quotes too. */
-const LIVE_SITE_KEY = new RegExp(`^${LIVE_SITE_KEY_SOURCE}$`)
-
-/**
- * Every real site key in `text`, for reading a built bundle back. It must be delimited by the
- * quotes the bundle inlines it between: unanchored, `0x…` matches a hex literal anywhere in the
- * graph, and a false find here reads as production carrying a key it does not serve.
- *
- * @param {string} text
- * @returns {string[]}
- */
-export function findLiveSiteKeys(text) {
-  const delimited = new RegExp(`["'\`](${LIVE_SITE_KEY_SOURCE})["'\`]`, 'g')
-
-  return [...text.matchAll(delimited)].map((m) => m[1])
-}
-
-/**
- * `missing`, `test`, `live`, or `malformed`. Padding and quotes are looked through to find a test
- * key or nothing, but never to pass a value: Turnstile would receive them as part of the key.
- *
- * @param {string | undefined} value
- * @returns {'missing' | 'test' | 'live' | 'malformed'}
- */
-export function classifySiteKey(value) {
-  const key = (value ?? '')
-    .trim()
-    .replace(/^(["'])(.*)\1$/, '$2')
-    .trim()
-
-  if (key === '') return 'missing'
-  if (findTestSiteKeys(key).length > 0) return 'test'
-
-  return LIVE_SITE_KEY.test(value ?? '') ? 'live' : 'malformed'
-}
-
-/**
- * Is this the build Workers Builds deploys to production?
- *
- * Workers Builds sets `WORKERS_CI=1` and `WORKERS_CI_BRANCH` on every build it runs; a preview is
- * any other branch, merge-queue branches included. GitHub Actions sets neither, so `ci.yml`'s
- * builds — the smoke job's preview among them — are never production.
- * ⚠ It fails closed: a Workers build naming no branch is held to the production standard, so a
- * platform change fails a preview loudly rather than waving production through.
- *
- * @param {Record<string, string | undefined>} env
- * @returns {boolean}
- */
-export function isProductionBuild(env) {
-  const ci = env.WORKERS_CI ?? ''
-
-  if (ci === '' || ci === '0' || ci.toLowerCase() === 'false') return false
-
-  const branch = env.WORKERS_CI_BRANCH ?? ''
-
-  return branch === '' || branch === PRODUCTION_BRANCH
-}
-
-/**
- * The message a refused build fails with, or `null` when the build may proceed. It never echoes
- * the key it read.
- *
- * @param {Record<string, string | undefined>} env
- * @param {string | undefined} siteKey
- * @returns {string | null}
- */
-export function releaseGuardError(env, siteKey) {
-  if (!isProductionBuild(env)) return null
-
-  const kind = classifySiteKey(siteKey)
-
-  if (kind === 'live') return null
-
-  const found = {
-    test: `is Cloudflare's always-passes Turnstile test key (\`.env\`'s default)`,
-    missing: 'is empty or unset',
-    malformed: 'is not a site key: expected `0x…` alone, with no quotes or spaces around it',
-  }[kind]
-
-  return (
-    `✗ turnstile: refusing a production build — ${SITE_KEY_VARIABLE} ${found}.\n` +
-    `  This build (Workers Builds, branch \`${env.WORKERS_CI_BRANCH || '(none)'}\`) would ship a captcha\n` +
-    `  that accepts every visitor or refuses every one. Set ${SITE_KEY_VARIABLE} to the real\n` +
-    `  site key (\`0x4AAAA…\`) in the Cloudflare dashboard: Workers & Pages → sahajatlas-web →\n` +
-    `  Settings → Build → Variables and secrets. It must be a BUILD variable: Vite inlines it\n` +
-    `  at build time, so a runtime variable (Settings → Variables and Secrets) never reaches\n` +
-    `  the bundle. See docs/environment.md (#259).`
-  )
-}
-
-/**
- * The Vite plugin. `env` is injectable for the spec; the build reads `process.env`.
- *
- * @param {Record<string, string | undefined>} [env]
- * @returns {import('vite').Plugin}
- */
-export function turnstileReleaseGuard(env = process.env) {
-  return {
-    name: 'sy-turnstile-release-guard',
-    apply: 'build',
-    configResolved(config) {
-      const error = releaseGuardError(env, config.env[SITE_KEY_VARIABLE])
-
-      if (error) throw new Error(error)
-    },
-  }
-}
diff --git a/scripts/turnstile-release-guard.test.ts b/scripts/turnstile-release-guard.test.ts
deleted file mode 100644
index fd1ec453..00000000
--- a/scripts/turnstile-release-guard.test.ts
+++ /dev/null
@@ -1,275 +0,0 @@
-import { resolve } from 'node:path'
-
-import { resolveConfig } from 'vite'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-
-import {
-  PRODUCTION_BRANCH,
-  SITE_KEY_VARIABLE,
-  classifySiteKey,
-  findLiveSiteKeys,
-  findTestSiteKeys,
-  isProductionBuild,
-  releaseGuardError,
-  turnstileReleaseGuard,
-} from './turnstile-release-guard.mjs'
-
-// The release guard asked for on #259: a production build fails when the Turnstile site key it
-// would inline is Cloudflare's always-passes test key, or nothing at all. Every preview and every
-// local build keeps the test key, because no real key validates on a preview's hostname.
-
-// Cloudflare's published dummy site keys: pass, block and force-challenge, visible and invisible.
-const TEST_KEYS = [
-  '1x00000000000000000000AA',
-  '2x00000000000000000000AB',
-  '1x00000000000000000000BB',
-  '2x00000000000000000000BB',
-  '3x00000000000000000000FF',
-]
-
-// The shape of a real key, made up — never the production key itself.
-const LIVE_KEY = '0x4AAAAAAAexampleNotReal1'
-
-describe('classifySiteKey', () => {
-  it.each(TEST_KEYS)('calls %s a test key', (key) => {
-    expect(classifySiteKey(key)).toBe('test')
-  })
-
-  // A dashboard paste carries whatever was copied. Vite inlines the value byte for byte, so
-  // the guard must not be the one thing that reads the padding as "not the test key".
-  it.each([
-    ` ${TEST_KEYS[0]} `,
-    `"${TEST_KEYS[0]}"`,
-    `'${TEST_KEYS[4]}'`,
-    TEST_KEYS[0].toLowerCase(),
-  ])('still calls %j a test key', (key) => {
-    expect(classifySiteKey(key)).toBe('test')
-  })
-
-  // A variant Cloudflare has not published yet still has the `[123]x000…` shape.
-  it('matches the pattern, not a list of literals', () => {
-    expect(classifySiteKey('3x00000000000000000000AA')).toBe('test')
-    expect(classifySiteKey('1x0000000000000000000000CC')).toBe('test')
-  })
-
-  it.each([undefined, '', '   ', '""', "''"])('calls %j missing', (key) => {
-    expect(classifySiteKey(key)).toBe('missing')
-  })
-
-  it('calls a real-shaped key live', () => {
-    expect(classifySiteKey(LIVE_KEY)).toBe('live')
-  })
-
-  // Turnstile would receive the padding or the quotes as part of the key, and refuse it.
-  it.each([`"${LIVE_KEY}"`, ` ${LIVE_KEY}`, 'TODO', 'undefined', '0x4'])(
-    'calls %j malformed',
-    (key) => {
-      expect(classifySiteKey(key)).toBe('malformed')
-    },
-  )
-})
-
-describe('findTestSiteKeys', () => {
-  it('finds a test key inlined into minified source', () => {
-    expect(findTestSiteKeys(`const a={sitekey:"${TEST_KEYS[0]}",theme:t}`)).toEqual([TEST_KEYS[0]])
-  })
-
-  it('finds nothing in a bundle that carries a live key', () => {
-    expect(
-      findTestSiteKeys(`const a={sitekey:"${LIVE_KEY}"},b="0x0000000000000000000000"`),
-    ).toEqual([])
-  })
-
-  // `a1x000…` is not a key; a match must start at a token boundary.
-  it('does not match inside a longer token', () => {
-    expect(findTestSiteKeys('"ab1x00000000000000000000AA"')).toEqual([])
-  })
-})
-
-describe('findLiveSiteKeys', () => {
-  it('finds a live key inlined into minified source', () => {
-    expect(findLiveSiteKeys(`const a={sitekey:"${LIVE_KEY}",theme:t}`)).toEqual([LIVE_KEY])
-  })
-
-  it('finds nothing in a bundle that carries a test key', () => {
-    expect(findLiveSiteKeys(`const a={sitekey:"${TEST_KEYS[0]}"}`)).toEqual([])
-  })
-
-  // Undelimited, `0x…` matches a hex literal anywhere in the graph, and a false find reads as
-  // production carrying a key it does not serve.
-  it('needs the quotes the bundle inlines the key between', () => {
-    expect(findLiveSiteKeys(`const a=${LIVE_KEY},b=t`)).toEqual([])
-  })
-
-  // The gate and `embed.smoke.test.ts` must agree on what a real key is. A key the gate passes
-  // that this reader misses reads on production as an unset build variable.
-  it.each([LIVE_KEY, '0x5AAAAAAAAAA', '0x4AAAA_example-key'])(
-    'finds %j, which the gate calls live',
-    (key) => {
-      expect(classifySiteKey(key)).toBe('live')
-      expect(findLiveSiteKeys(`{sitekey:"${key}"}`)).toEqual([key])
-    },
-  )
-})
-
-describe('isProductionBuild', () => {
-  it('is a Workers Builds build of the production branch', () => {
-    expect(PRODUCTION_BRANCH).toBe('main')
-    expect(isProductionBuild({ WORKERS_CI: '1', WORKERS_CI_BRANCH: 'main' })).toBe(true)
-  })
-
-  // Every preview Workers Builds makes is a branch build, merge-queue branches included.
-  it.each(['feat/venue-clustering', 'gh-readonly-queue/main/pr-259-abc', 'main-old', 'Main'])(
-    'is not a Workers Builds preview of %s',
-    (branch) => {
-      expect(isProductionBuild({ WORKERS_CI: '1', WORKERS_CI_BRANCH: branch })).toBe(false)
-    },
-  )
-
-  // Fail closed: a Workers build that names no branch is held to the production standard, so a
-  // platform change that drops the variable fails a preview loudly instead of waving production
-  // through.
-  it('is a Workers Builds build that names no branch', () => {
-    expect(isProductionBuild({ WORKERS_CI: '1' })).toBe(true)
-    expect(isProductionBuild({ WORKERS_CI: '1', WORKERS_CI_BRANCH: '' })).toBe(true)
-  })
-
-  // Local `pnpm build`, the gate job in `ci.yml`, and the smoke job's own preview build. GitHub
-  // Actions sets `CI=true` and `GITHUB_REF_NAME=main` on a push, and neither one means production.
-  it.each([
-    {},
-    { CI: 'true', GITHUB_ACTIONS: 'true', GITHUB_REF_NAME: 'main' },
-    { WORKERS_CI: '', WORKERS_CI_BRANCH: 'main' },
-    { WORKERS_CI: '0', WORKERS_CI_BRANCH: 'main' },
-    { WORKERS_CI_BRANCH: 'main' },
-  ])('is not a build outside Workers Builds: %j', (env) => {
-    expect(isProductionBuild(env)).toBe(false)
-  })
-})
-
-describe('releaseGuardError', () => {
-  const production = { WORKERS_CI: '1', WORKERS_CI_BRANCH: 'main' }
-  const preview = { WORKERS_CI: '1', WORKERS_CI_BRANCH: 'feat/x' }
-
-  it('refuses a production build that would ship the test key', () => {
-    const error = releaseGuardError(production, TEST_KEYS[0])
-
-    expect(error).toContain(SITE_KEY_VARIABLE)
-    expect(error).toContain('test key')
-    // Where to set it: the build variable, not a runtime variable, which Vite never sees.
-    expect(error).toMatch(/Build.*variables/i)
-  })
-
-  it('refuses a production build with no key at all', () => {
-    expect(releaseGuardError(production, undefined)).toContain(SITE_KEY_VARIABLE)
-    expect(releaseGuardError(production, '')).toContain('empty')
-  })
-
-  it('refuses a production build whose key is malformed', () => {
-    expect(releaseGuardError(production, `"${LIVE_KEY}"`)).toContain('is not a site key')
-  })
-
-  it('passes a production build carrying a live key', () => {
-    expect(releaseGuardError(production, LIVE_KEY)).toBeNull()
-  })
-
-  it('passes every preview and local build, test key and all', () => {
-    expect(releaseGuardError(preview, TEST_KEYS[0])).toBeNull()
-    expect(releaseGuardError({}, TEST_KEYS[0])).toBeNull()
-    expect(releaseGuardError({}, undefined)).toBeNull()
-  })
-
-  // The message lands in a build log; the key is public, but it is named by prefix only.
-  it('never echoes the value it read', () => {
-    expect(releaseGuardError(production, TEST_KEYS[0])).not.toContain(TEST_KEYS[0])
-  })
-})
-
-describe('turnstileReleaseGuard', () => {
-  // The plugin reads `config.env`, Vite's RESOLVED `import.meta.env`: the shell environment
-  // beats every `.env*` file, and `--mode` picks the files. So this is the value that ships.
-  const run = (env: Record<string, string>, siteKey: string | undefined) => {
-    const plugin = turnstileReleaseGuard(env)
-    const hook = plugin.configResolved as (config: unknown) => void
-
-    return () => hook({ command: 'build', env: { [SITE_KEY_VARIABLE]: siteKey } })
-  }
-
-  it('throws on a production build with the test key', () => {
-    expect(run({ WORKERS_CI: '1', WORKERS_CI_BRANCH: 'main' }, TEST_KEYS[0])).toThrow(
-      /VITE_TURNSTILE_SITE_KEY is Cloudflare's always-passes Turnstile test key/,
-    )
-  })
-
-  // Only a resolved value that differs from the ambient one tells the two reads apart.
-  it('reads the resolved env, not the ambient one', () => {
-    vi.stubEnv(SITE_KEY_VARIABLE, undefined)
-
-    try {
-      expect(run({ WORKERS_CI: '1', WORKERS_CI_BRANCH: 'main' }, LIVE_KEY)).not.toThrow()
-    } finally {
-      vi.unstubAllEnvs()
-    }
-  })
-
-  it('lets a preview build with the test key through', () => {
-    expect(run({ WORKERS_CI: '1', WORKERS_CI_BRANCH: 'feat/x' }, TEST_KEYS[0])).not.toThrow()
-  })
-
-  it('applies to builds only, so `pnpm dev` never reads it', () => {
-    expect(turnstileReleaseGuard({}).apply).toBe('build')
-  })
-})
-
-// The pure halves above could be perfect and guard nothing. This resolves the REAL
-// `vite.config.ts` through Vite itself, so it covers the wiring, the committed `.env`, and the
-// precedence of a shell variable over that file — the one a Workers Builds build variable uses.
-describe('the app build, resolved by Vite', () => {
-  const root = resolve(import.meta.dirname, '..')
-  const build = () =>
-    resolveConfig({ root, configFile: resolve(root, 'vite.config.ts') }, 'build', 'production')
-
-  // Hermetic: vitest has already copied `.env` into `process.env`, and a shell may carry a real
-  // key or a Sentry token (whose half-config throws first). Deleting both makes `.env` on disk
-  // the only source a test can be reading.
-  beforeEach(() => {
-    vi.stubEnv(SITE_KEY_VARIABLE, undefined)
-    vi.stubEnv('SENTRY_AUTH_TOKEN', undefined)
-  })
-
-  afterEach(() => {
-    vi.unstubAllEnvs()
-  })
-
-  it('refuses a production build that falls back to the committed test key', async () => {
-    vi.stubEnv('WORKERS_CI', '1')
-    vi.stubEnv('WORKERS_CI_BRANCH', 'main')
-
-    // The reason, not just the name: refusing for "unset" would mean `.env` was never read.
-    await expect(build()).rejects.toThrow(/VITE_TURNSTILE_SITE_KEY is .*test key/)
-  })
-
-  it('passes a production build whose build variable overrides `.env`', async () => {
-    vi.stubEnv('WORKERS_CI', '1')
-    vi.stubEnv('WORKERS_CI_BRANCH', 'main')
-    vi.stubEnv(SITE_KEY_VARIABLE, LIVE_KEY)
-
-    expect((await build()).env[SITE_KEY_VARIABLE]).toBe(LIVE_KEY)
-  })
-
-  // An empty build variable still beats `.env` — Vite copies every prefixed shell value.
-  it('refuses a production build whose build variable is set but empty', async () => {
-    vi.stubEnv('WORKERS_CI', '1')
-    vi.stubEnv('WORKERS_CI_BRANCH', 'main')
-    vi.stubEnv(SITE_KEY_VARIABLE, '')
-
-    await expect(build()).rejects.toThrow('empty')
-  })
-
-  it('passes a preview build on the committed test key', async () => {
-    vi.stubEnv('WORKERS_CI', '1')
-    vi.stubEnv('WORKERS_CI_BRANCH', 'feat/x')
-
-    expect(classifySiteKey((await build()).env[SITE_KEY_VARIABLE])).toBe('test')
-  })
-})
diff --git a/src/challenge.ts b/src/challenge.ts
deleted file mode 100644
index 2622b511..00000000
--- a/src/challenge.ts
+++ /dev/null
@@ -1,143 +0,0 @@
-/**
- * The Turnstile challenge, rendered on the widget's OWN origin and framed by the widget (#343).
- *
- * Why this page exists at all is in `src/lib/turnstile-frame.ts`: Turnstile checks the hostname
- * of the document that renders it, so a script embed rendering the challenge inside the host's
- * page failed on every partner hostname. Everything here runs in a frame the widget mounts; it
- * is never a page a visitor navigates to.
- *
- * ⚠ **This page hands its token to WHOEVER frames it, and nothing here can tell our widget on
- * a partner's page from a third party's frame.** The target origin is `'*'` and the inbound
- * `reset` is accepted from the parent without an origin check, because the parent's origin is
- * the host site's — unknown here, different per partner, and knowing it would need the
- * allowlist this whole approach exists to avoid. Nothing restricts framing either: no
- * `frame-ancestors`, no `X-Frame-Options`.
- *
- * What that does NOT cost, measured rather than assumed: minting a token for this site key was
- * never gated. The production key lists `localhost` and `127.0.0.1`, so anyone could already
- * serve a page there and solve as many as they liked, and SahajCloud redeems each one only
- * once.
- *
- * What it DOES cost is a token solved in somebody else's visitor's browser. That token carries
- * that visitor's address, which is the address `verifyTurnstileToken` passes siteverify as
- * `remoteip`, and a residential browser is scored better than an automation farm — so a write
- * driven from it looks more legitimate than one driven from a minting host. `reset` lets a
- * framer re-arm the same frame and take a stream rather than one.
- *
- * ⚠ **No client-side change fixes this**, since every framer can replay any handshake this
- * public page defines. The two real answers are a `frame-ancestors` allowlist fetched at
- * runtime from the client records, or SahajCloud binding a token to something a harvester
- * cannot replay — `verifyTurnstile.ts` checks `success` alone today, no `action`, no `hostname`.
- * Both need a decision, and both were out of #343's scope. See the question thread on the pull
- * request that introduced this file.
- */
-
-import {
-  type ChallengeEvent,
-  type ChallengeOptions,
-  challengeMessage,
-  parseChallengeCommand,
-  readChallengeOptions,
-} from '@/lib/turnstile-frame'
-
-const SCRIPT_URL = 'https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit'
-
-// The site key is public by design — the secret half lives in SahajCloud. This page is its one
-// reader now, so `scripts/turnstile-release-guard.mjs` gates the build that inlines it here.
-const SITE_KEY: string | undefined = import.meta.env.VITE_TURNSTILE_SITE_KEY
-
-type TurnstileRenderOptions = {
-  sitekey: string
-  theme?: ChallengeOptions['theme']
-  language?: string
-  callback?: (token: string) => void
-  'error-callback'?: () => void
-  'expired-callback'?: () => void
-}
-
-type TurnstileApi = {
-  render: (container: HTMLElement, options: TurnstileRenderOptions) => string | undefined
-  reset: (widgetId: string) => void
-}
-
-declare global {
-  interface Window {
-    turnstile?: TurnstileApi
-  }
-}
-
-function send(message: ChallengeEvent) {
-  window.parent.postMessage(challengeMessage(message), '*')
-}
-
-function mount() {
-  // The div is this document's own, so the fallback is for nothing that can happen rather than
-  // a case to branch on. `challenge.html` carries the id because the smoke lane reads it back
-  // to tell this page from the SPA shell a missing deploy would serve in its place.
-  const container = document.getElementById('challenge') ?? document.body
-  const options = readChallengeOptions(window.location.search)
-
-  // No key means no captcha anywhere in the widget, so the handshake must NOT succeed: the
-  // eager check reads its absence as a blocked embed and fails the widget to the
-  // captcha-blocked screen, which is the behaviour an unset build variable has always had.
-  if (!SITE_KEY) {
-    send({ type: 'error' })
-
-    return
-  }
-
-  const script = document.createElement('script')
-
-  script.src = SCRIPT_URL
-  script.async = true
-  // This is the Cloudflare-facing hop, and the only one. Cloudflare learns this origin
-  // regardless — that is the hostname check. What this keeps off the request is the path and
-  // query, which carry the parent's theme and language.
-  script.referrerPolicy = 'strict-origin'
-  script.addEventListener('error', () => send({ type: 'error' }))
-  script.addEventListener('load', () => {
-    const turnstile = window.turnstile
-
-    // A script that loads without defining the API is a content blocker or a proxy answering
-    // 200 with a stub. Reported as an error rather than left to the parent's timeout, so the
-    // widget fails in a second instead of ten.
-    if (!turnstile) {
-      send({ type: 'error' })
-
-      return
-    }
-
-    send({ type: 'ready' })
-
-    if (options.probe) return
-
-    const widgetId = turnstile.render(container, {
-      sitekey: SITE_KEY,
-      theme: options.theme,
-      language: options.language,
-      callback: (token) => send({ type: 'token', token }),
-      'error-callback': () => send({ type: 'error' }),
-      'expired-callback': () => send({ type: 'expired' }),
-    })
-
-    // `render` returns no id when it refuses. With the challenge on our own origin the
-    // hostname mismatch that used to cause this cannot happen, so what is left is a
-    // malformed key — still no widget, so still no token.
-    if (!widgetId) {
-      send({ type: 'error' })
-
-      return
-    }
-
-    window.addEventListener('message', (event) => {
-      // Only the window that framed this page may drive it. A token is worth nothing to a
-      // third party, but a reset from one would discard a challenge the visitor just solved.
-      if (event.source !== window.parent) return
-      if (parseChallengeCommand(event.data)) turnstile.reset(widgetId)
-    })
-  })
-
-  document.head.appendChild(script)
-}
-
-mount()
diff --git a/src/components/molecules/Fallbacks/Fallbacks.tsx b/src/components/molecules/Fallbacks/Fallbacks.tsx
index 5c3783d7..673fd263 100644
--- a/src/components/molecules/Fallbacks/Fallbacks.tsx
+++ b/src/components/molecules/Fallbacks/Fallbacks.tsx
@@ -229,9 +229,9 @@ export const ERROR_POLICY: Record<FallbackKind, FallbackPolicy> = {
   },
   // Turnstile failed to load, so this widget cannot send anything the viewer
   // writes (issue #182). The usual cause is a `config` failure: a host CSP that
-  // will not let the widget frame its own origin, where the challenge renders
-  // (#343). This row still earns its own row, for one reason `config` cannot
-  // express:
+  // will not let the widget frame SahajCloud, where the challenge renders, or a
+  // host domain no client record lists (#343, sydevs/SahajCloud#1072). This row
+  // still earns its own row, for one reason `config` cannot express:
   //
   // **It offers no report action.** The report form is itself gated by Turnstile.
   // Sending a viewer to it would hand them a second form that also cannot submit.
@@ -239,14 +239,14 @@ export const ERROR_POLICY: Record<FallbackKind, FallbackPolicy> = {
   // `REPORTED_KINDS` mirrors it too.
   //
   // The sentence names the cause, not the fix. A visitor cannot edit a CSP. The
-  // instruction "add our origin to your frame-src" means nothing to most visitors
+  // instruction "add SahajCloud to your frame-src" means nothing to most visitors
   // on a meditation page. Only the site's developer needs it.
   // `reportIntegrationWarning` prints that instruction to the console, where a
   // developer debugging the embed will look. `docs/embedding.md` carries the
   // lasting version.
   //
   // ⚠ **This row DOES retry. That looks wrong next to `config`, but is correct.**
-  // The check reports the same verdict for a CSP that refuses the frame and for a
+  // The check lands on this same kind for a CSP that refuses the frame and for a
   // frame request that simply failed on the network, and it clears its memoized
   // verdict whenever it is negative. So a second attempt mounts a fresh frame and
   // is a real second attempt, and the network-failure half of that pair can
diff --git a/src/components/organisms/ReportIssueForm/ReportIssueForm.stories.tsx b/src/components/organisms/ReportIssueForm/ReportIssueForm.stories.tsx
index e093959f..3d9e1777 100644
--- a/src/components/organisms/ReportIssueForm/ReportIssueForm.stories.tsx
+++ b/src/components/organisms/ReportIssueForm/ReportIssueForm.stories.tsx
@@ -46,9 +46,9 @@ function Panel({ children }: { children: ReactNode }) {
  * auto-attached context the viewer never types, behind a Cloudflare Turnstile
  * challenge.
  *
- * The live sections render a REAL Turnstile widget against Cloudflare's
- * always-passes test site key, so submit becomes enabled once every authored
- * field answers its own rule. Submitting performs a real
+ * The live sections render a REAL Turnstile widget, in the challenge page the
+ * configured SahajCloud serves, so submit becomes enabled once it is solved and
+ * every authored field answers its own rule. Submitting performs a real
  * `POST /api/user-submissions`. Ladle carries no API key, so it comes back
  * refused, and you land on the failure state. That is the honest outcome, and
  * the point of the ticket: the thank-you screen shows only for a stored message.
diff --git a/src/hooks/use-turnstile-guard.test.tsx b/src/hooks/use-turnstile-guard.test.tsx
index f3918e70..523f9b43 100644
--- a/src/hooks/use-turnstile-guard.test.tsx
+++ b/src/hooks/use-turnstile-guard.test.tsx
@@ -6,7 +6,7 @@ import { ErrorBoundary } from 'react-error-boundary'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { createRoot } from 'react-dom/client'
 
-import { cspAdvice, useTurnstileGuard } from './use-turnstile-guard'
+import { turnstileAdvice, useTurnstileGuard } from './use-turnstile-guard'
 
 import { classifyError } from '@/lib/report'
 
@@ -89,7 +89,7 @@ describe('useTurnstileGuard', () => {
   })
 
   it('renders the interface when Turnstile is available', async () => {
-    probeTurnstile.mockResolvedValue(true)
+    probeTurnstile.mockResolvedValue('available')
 
     await mount()
 
@@ -97,20 +97,23 @@ describe('useTurnstileGuard', () => {
     expect(caught).toBeUndefined()
   })
 
-  it('fails the widget as `captcha-blocked` when Turnstile cannot load', async () => {
-    probeTurnstile.mockResolvedValue(false)
+  it.each(['csp', 'origin', 'failed'])(
+    'fails the widget as `captcha-blocked` on %s',
+    async (verdict) => {
+      probeTurnstile.mockResolvedValue(verdict)
 
-    await mount()
+      await mount()
 
-    expect(document.body.textContent).not.toContain(GUARDED)
-    // This checks the KIND, not merely that something threw.
-    // The kind picks the sentence.
-    // More importantly, it withholds the report CTA that would open a second form the same failure has already disabled.
-    expect(classifyError(caught)).toBe('captcha-blocked')
-  })
+      expect(document.body.textContent).not.toContain(GUARDED)
+      // This checks the KIND, not merely that something threw.
+      // The kind picks the sentence.
+      // More importantly, it withholds the report CTA that would open a second form the same failure has already disabled.
+      expect(classifyError(caught)).toBe('captcha-blocked')
+    },
+  )
 
   it('tells the host developer what to change, on the console', async () => {
-    probeTurnstile.mockResolvedValue(false)
+    probeTurnstile.mockResolvedValue('csp')
 
     await mount()
 
@@ -122,16 +125,29 @@ describe('useTurnstileGuard', () => {
     expect(advice).toContain('docs/embedding.md')
   })
 
-  // ⚠ The advice names OUR origin, not Cloudflare's, since #343: the challenge renders in a
-  // frame served from the widget's origin, so `challenges.cloudflare.com` has left the host's
-  // policy altogether and naming it would send a developer to edit a line that fixes nothing.
-  it('names the widget origin under frame-src, and nothing a host no longer needs', () => {
-    const advice = cspAdvice('https://sahajatlas.com')
+  // ⚠ The advice names SahajCloud's origin, not Cloudflare's or the widget's (#343,
+  // sydevs/SahajCloud#1072): the challenge renders in a frame SahajCloud serves, so naming
+  // anything else would send a developer to edit a line that fixes nothing.
+  it.each(['csp', 'failed'] as const)(
+    'names the SahajCloud origin under frame-src on %s, and nothing a host no longer needs',
+    (verdict) => {
+      const advice = turnstileAdvice(verdict, 'https://cloud.sydevelopers.com', 'partner.org')
+
+      expect(advice).toContain('frame-src')
+      expect(advice).toContain('https://cloud.sydevelopers.com')
+      expect(advice).not.toContain('challenges.cloudflare.com')
+      expect(advice).not.toContain('script-src')
+    },
+  )
 
-    expect(advice).toContain('frame-src')
-    expect(advice).toContain('https://sahajatlas.com')
-    expect(advice).not.toContain('challenges.cloudflare.com')
-    expect(advice).not.toContain('script-src')
+  // A host's own policy cannot fix this one, so pointing at `frame-src` would waste the reader's
+  // time: the page's domain is missing from every client record.
+  it('names the domain to have listed when SahajCloud refuses the page', () => {
+    const advice = turnstileAdvice('origin', 'https://cloud.sydevelopers.com', 'partner.org')
+
+    expect(advice).toContain('partner.org')
+    expect(advice).toContain('client record')
+    expect(advice).not.toContain('frame-src')
   })
 
   it('does not block the first paint on the probe', async () => {
diff --git a/src/hooks/use-turnstile-guard.ts b/src/hooks/use-turnstile-guard.ts
index 6c7e83b8..10d78025 100644
--- a/src/hooks/use-turnstile-guard.ts
+++ b/src/hooks/use-turnstile-guard.ts
@@ -1,8 +1,9 @@
 import { useEffect, useState } from 'react'
 
-import { challengeOrigin } from '@/lib/turnstile-frame'
 import { atlasError, reportIntegrationWarning } from '@/lib/report'
-import { probeTurnstile } from '@/hooks/use-turnstile'
+import { type TurnstileVerdict, probeTurnstile } from '@/hooks/use-turnstile'
+
+const GUIDE = 'https://github.com/sydevs/SahajAtlasWeb/blob/main/docs/embedding.md'
 
 /**
  * This is where a host's developer is told what to change.
@@ -10,20 +11,36 @@ import { probeTurnstile } from '@/hooks/use-turnstile'
  *
  * This appears on the console, not on the screen, because the two audiences are different people.
  * The visitor gets `error.captcha_blocked`, which says the embed is broken without asking them to do anything about it.
- * The person who can edit the CSP gets the directive instead.
+ * The person who can edit the CSP, or ask for their domain to be listed, gets the fix instead.
  *
- * ⚠ **It names OUR origin under `frame-src`, not Cloudflare's. See issue #343.** The challenge
- * renders in a frame on the widget's origin, so `challenges.cloudflare.com` is governed by that
- * frame's own policy and has left the host's `script-src`, `connect-src` and `frame-src`
- * entirely. The origin is read off the frame URL rather than written out, so a preview deploy
- * and `pnpm dev` each name the host they actually need allowed.
+ * ⚠ **It names SahajCloud's origin under `frame-src`, not Cloudflare's or ours** (#343,
+ * sydevs/SahajCloud#1072). The challenge renders in a frame SahajCloud serves, so
+ * `challenges.cloudflare.com` is governed by that frame's own policy and belongs in no directive
+ * of the host's. The origin is read off the configured API URL rather than written out, so a
+ * build pointed at a local SahajCloud names the host it actually needs allowed.
  */
-export function cspAdvice(origin: string): string {
+export function turnstileAdvice(
+  verdict: Exclude<TurnstileVerdict, 'available'>,
+  serverOrigin: string,
+  hostname: string,
+): string {
+  const lead =
+    'Turnstile could not load, so registration and issue reports are impossible on this page. '
+
+  if (verdict === 'origin') {
+    return (
+      lead +
+      `${hostname} is not an allowed domain of any Sahaj Atlas client, so the security check refuses to run here. ` +
+      'Ask the Sahaj Atlas team to add it to your client record. ' +
+      `See ${GUIDE}#what-you-configure-in-the-cms-instead`
+    )
+  }
+
   return (
-    'Turnstile could not load, so registration and issue reports are impossible on this page. ' +
-    `Allow ${origin} in this page's Content-Security-Policy, under \`frame-src\` — ` +
+    lead +
+    `If this page sends a Content-Security-Policy, allow ${serverOrigin} under \`frame-src\` — ` +
     'the challenge renders in a frame served from there. ' +
-    'See https://github.com/sydevs/SahajAtlasWeb/blob/main/docs/embedding.md#content-security-policy'
+    `See ${GUIDE}#content-security-policy`
   )
 }
 
@@ -58,12 +75,18 @@ export function useTurnstileGuard(): void {
   useEffect(() => {
     let cancelled = false
 
-    void probeTurnstile().then((available) => {
-      if (cancelled || available) return
+    void probeTurnstile().then((verdict) => {
+      if (cancelled || verdict === 'available') return
 
       // This runs before the throw, not after.
       // The throw unmounts this tree, and the console line is the only part of this addressed to somebody who can fix it.
-      reportIntegrationWarning(cspAdvice(challengeOrigin(import.meta.url)))
+      reportIntegrationWarning(
+        turnstileAdvice(
+          verdict,
+          new URL(import.meta.env.VITE_SAHAJCLOUD_URL).origin,
+          window.location.hostname,
+        ),
+      )
       setBlocked(true)
     })
 
diff --git a/src/hooks/use-turnstile.test.tsx b/src/hooks/use-turnstile.test.tsx
index 09f3df63..eda76386 100644
--- a/src/hooks/use-turnstile.test.tsx
+++ b/src/hooks/use-turnstile.test.tsx
@@ -3,13 +3,13 @@ import { act } from 'react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { createRoot } from 'react-dom/client'
 
-import { type UseTurnstile, useTurnstile } from './use-turnstile'
+import { type TurnstileVerdict, type UseTurnstile, useTurnstile } from './use-turnstile'
 
 import { sendFromFrame } from '@/test-support/turnstile-frame'
-import { CHALLENGE_CHANNEL, type ChallengeEvent } from '@/lib/turnstile-frame'
+import { CHALLENGE_CHANNEL, CHALLENGE_PATH, type ChallengeEvent } from '@/lib/turnstile-frame'
 
 /**
- * The challenge lives in a frame on our own origin since #343, so what this covers is the
+ * The challenge lives in a frame SahajCloud serves (#343, sydevs/SahajCloud#1072), so what this covers is the
  * `postMessage` seam between the widget and that frame — the part no pure test can express,
  * and the part a real browser cannot reach either, since jsdom will not run Cloudflare's
  * script and a browser pass cannot drive an unsolved challenge to each of these states.
@@ -70,13 +70,16 @@ afterEach(() => {
 })
 
 describe('useTurnstile', () => {
-  it('frames the challenge page on its own origin, carrying theme and language', async () => {
+  it('frames the SahajCloud challenge page, naming this document as its parent', async () => {
     await mount()
 
     const iframe = frame()
     const url = new URL(iframe?.src as string)
 
-    expect(url.pathname).toBe('/challenge.html')
+    expect(url.origin).toBe(new URL(import.meta.env.VITE_SAHAJCLOUD_URL).origin)
+    expect(url.pathname).toBe(CHALLENGE_PATH)
+    // The page hands its token to this origin alone, so it must be the document the frame is in.
+    expect(url.searchParams.get('parent')).toBe(window.location.origin)
     expect(url.searchParams.get('theme')).toBe('dark')
     expect(url.searchParams.get('language')).toBe('cs')
     // The form mounts a real challenge, never the probe's handshake-only mode.
@@ -277,9 +280,7 @@ describe('useTurnstile', () => {
 
 describe('probeTurnstile', () => {
   const probeFrame = () =>
-    [...document.body.querySelectorAll('iframe')].find((node) =>
-      node.src.includes('/challenge.html'),
-    )
+    [...document.body.querySelectorAll('iframe')].find((node) => node.src.includes(CHALLENGE_PATH))
 
   /**
    * Starts the check on a FRESH copy of the module, and reports what it has decided so far.
@@ -297,12 +298,12 @@ describe('probeTurnstile', () => {
     vi.resetModules()
 
     const { probeTurnstile } = await import('./use-turnstile')
-    const verdicts: (boolean | 'pending')[] = []
+    const verdicts: (TurnstileVerdict | 'pending')[] = []
     const run = () => {
       const index = verdicts.push('pending') - 1
 
-      return probeTurnstile().then((available) => {
-        verdicts[index] = available
+      return probeTurnstile().then((verdict) => {
+        verdicts[index] = verdict
       })
     }
 
@@ -324,46 +325,56 @@ describe('probeTurnstile', () => {
       }),
     )
 
-  const fromProbe = (type: ChallengeEvent['type']) => {
+  const fromProbe = (message: ChallengeEvent) => {
     const iframe = probeFrame()
 
     if (!iframe) throw new Error('no probe frame')
 
-    sendFromFrame(iframe, { type } as ChallengeEvent)
+    sendFromFrame(iframe, message)
   }
 
   afterEach(() => {
     vi.useRealTimers()
   })
 
-  it('mounts a handshake-only frame and resolves true on ready', async () => {
+  it('mounts a handshake-only frame and resolves available on ready', async () => {
     const probe = await startProbe()
 
     expect(new URL(probeFrame()?.src as string).searchParams.get('probe')).toBe('1')
 
-    fromProbe('ready')
+    fromProbe({ type: 'ready' })
     await probe.done
 
-    expect(probe.settled()).toBe(true)
+    expect(probe.settled()).toBe('available')
     // The frame is torn down with the verdict: it exists only to produce one.
     expect(probeFrame()).toBeUndefined()
   })
 
-  it('resolves false when the frame reports an error', async () => {
+  it('resolves failed when the frame reports an error', async () => {
+    const probe = await startProbe()
+
+    fromProbe({ type: 'error' })
+    await probe.done
+
+    expect(probe.settled()).toBe('failed')
+  })
+
+  it('resolves origin when SahajCloud refuses this page as a parent', async () => {
     const probe = await startProbe()
 
-    fromProbe('error')
+    // The one refusal a host cannot fix in its own policy, so the advice it earns differs.
+    fromProbe({ type: 'error', reason: 'origin' })
     await probe.done
 
-    expect(probe.settled()).toBe(false)
+    expect(probe.settled()).toBe('origin')
   })
 
   // Chromium reports the BARE origin as `blockedURI` — measured, and the reason the handler
   // matches by prefix. The path form is kept for the engines that were not measured.
   it.each([
     ['the bare origin, as Chromium sends it', ''],
-    ['the origin with a path', '/challenge.html'],
-  ])('resolves false at once on a frame-src violation naming %s', async (_label, path) => {
+    ['the origin with a path', CHALLENGE_PATH],
+  ])('resolves csp at once on a frame-src violation naming %s', async (_label, path) => {
     const probe = await startProbe()
 
     violation('frame-src', `${probe.origin()}${path}`)
@@ -371,14 +382,14 @@ describe('probeTurnstile', () => {
 
     // Before the handshake timeout, which is the whole point: a refused frame fires no load
     // and no error of its own, so without this the widget looks healthy for ten seconds.
-    expect(probe.settled()).toBe(false)
+    expect(probe.settled()).toBe('csp')
   })
 
   // Two near misses, because each filter in the violation handler is wrong on its own. A
-  // strict-CSP host can produce either: the widget fetches its own flags and pins from this
-  // same origin, and it frames nothing else from Cloudflare's.
+  // strict-CSP host can produce either: the widget loads event photography from this same
+  // SahajCloud origin, and a host frames plenty of other origins of its own.
   it.each([
-    ['another directive, our origin', 'img-src', true],
+    ['another directive, the SahajCloud origin', 'img-src', true],
     ['frame-src, another origin', 'frame-src', false],
   ])('ignores a violation about %s', async (_label, directive, ours) => {
     const probe = await startProbe()
@@ -391,10 +402,10 @@ describe('probeTurnstile', () => {
     await vi.advanceTimersByTimeAsync(5_000)
     await probe.done
 
-    expect(probe.settled()).toBe(false)
+    expect(probe.settled()).toBe('failed')
   })
 
-  it('resolves false only once the frame has had its full wait', async () => {
+  it('resolves failed only once the frame has had its full wait', async () => {
     const probe = await startProbe()
 
     await vi.advanceTimersByTimeAsync(9_999)
@@ -404,13 +415,13 @@ describe('probeTurnstile', () => {
     await vi.advanceTimersByTimeAsync(1)
     await probe.done
 
-    expect(probe.settled()).toBe(false)
+    expect(probe.settled()).toBe('failed')
   })
 
   it('checks once per page and shares the answer', async () => {
     const probe = await startProbe()
 
-    fromProbe('ready')
+    fromProbe({ type: 'ready' })
     await probe.done
 
     const second = probe.run()
@@ -419,14 +430,14 @@ describe('probeTurnstile', () => {
 
     // A compact embed's dialog unmounts its children, so open/close/open would otherwise pay
     // for a whole browsing context, three of our chunks and a Cloudflare script eval each time.
-    expect(probe.settled(1)).toBe(true)
+    expect(probe.settled(1)).toBe('available')
     expect(probeFrame()).toBeUndefined()
   })
 
   it('checks again after a negative verdict', async () => {
     const probe = await startProbe()
 
-    fromProbe('error')
+    fromProbe({ type: 'error' })
     await probe.done
 
     // Not cached: the same verdict covers a CSP refusal and a request that simply failed, and
@@ -436,9 +447,9 @@ describe('probeTurnstile', () => {
 
     expect(probeFrame()).toBeDefined()
 
-    fromProbe('ready')
+    fromProbe({ type: 'ready' })
     await second
 
-    expect(probe.settled(1)).toBe(true)
+    expect(probe.settled(1)).toBe('available')
   })
 })
diff --git a/src/hooks/use-turnstile.ts b/src/hooks/use-turnstile.ts
index a7263db8..80c84b6c 100644
--- a/src/hooks/use-turnstile.ts
+++ b/src/hooks/use-turnstile.ts
@@ -13,9 +13,10 @@ import { useTheme } from '@/hooks/use-theme'
 // Turnstile rendered explicitly, hand-rolled rather than through `@marsidev/react-turnstile`
 // (#79): this bundle ships on host pages we do not control, so a dependency is weight.
 //
-// ⚠ **The challenge renders in a frame on OUR origin, never in the host's document (#343).**
-// `src/lib/turnstile-frame.ts` owns that reasoning and the protocol; `challenge.html` is the
-// page. Nothing here branches on embed mode, so one code path is the only one anybody tests.
+// ⚠ **The challenge renders in a frame on SahajCloud's origin, never in the host's document
+// (#343, sydevs/SahajCloud#1072).** `src/lib/turnstile-frame.ts` owns that reasoning and the
+// protocol; SahajCloud owns the page and both halves of the key. Nothing here branches on embed
+// mode, so one code path is the only one anybody tests.
 //
 // ⚠ **The challenge is not lazy — that inverted in #182.** Registration cannot happen without a
 // token, so a challenge that cannot load fails the widget rather than degrading the form, as
@@ -64,11 +65,15 @@ const TURNSTILE_FEATURES =
  * ever.
  */
 function createChallengeFrame(
-  options: ChallengeOptions,
+  options: Omit<ChallengeOptions, 'parent'>,
   onEvent: (message: ChallengeEvent | null) => void,
 ) {
   const frame = document.createElement('iframe')
-  const src = challengeSrc(import.meta.url, options)
+  // The frame's parent is this document, in a script embed and an iframe embed alike.
+  const src = challengeSrc(import.meta.env.VITE_SAHAJCLOUD_URL, {
+    ...options,
+    parent: window.location.origin,
+  })
 
   frame.src = src
   frame.width = String(FRAME_WIDTH)
@@ -77,8 +82,8 @@ function createChallengeFrame(
   // A captcha labels itself, but every frame still needs a title, and this is what a
   // screen-reader user needs to hear.
   frame.title = 'Security check'
-  // This hop goes to OUR origin, not Cloudflare's (`src/challenge.ts` owns that one), so what
-  // this withholds is the host page's path and query from our own logs.
+  // SahajCloud reads the parent from the URL, so all this withholds is the host page's path and
+  // query from SahajCloud's logs.
   frame.referrerPolicy = 'strict-origin'
   frame.allow = TURNSTILE_FEATURES
 
@@ -108,48 +113,57 @@ function createChallengeFrame(
   return { frame, expectedOrigin, dispose }
 }
 
+/**
+ * Why the probe answered as it did, so the console advice can name the one fix that applies.
+ * `csp`: the host's policy refused the frame. `origin`: SahajCloud refused this page's origin,
+ * which is in no client record's allowed domains. `failed`: anything else — a page that errored,
+ * an absent site key, or silence until the handshake timeout.
+ */
+export type TurnstileVerdict = 'available' | 'csp' | 'origin' | 'failed'
+
 /** Shared by every mount on the page. Cleared on a negative verdict, so a blip is retried. */
-let availability: Promise<boolean> | null = null
+let availability: Promise<TurnstileVerdict> | null = null
 
 /**
- * Whether Turnstile can run on this page at all — the host's CSP and the network, not any one
- * form (#182). Resolves `false` rather than rejecting, because every caller wants a verdict.
+ * Whether Turnstile can run on this page at all — the host's CSP, SahajCloud's allowlist and the
+ * network, not any one form (#182). Resolves rather than rejecting, because every caller wants a
+ * verdict.
  *
  * Memoized because the script load this replaced memoized itself: without it a compact embed's
  * open/close/open pays for a browsing context, three of our chunks and a script eval each time.
  *
  * ⚠ **Weaker than a real render, deliberately.** Probe mode hands back the handshake without
- * rendering, so it sees a `frame-src` that refuses us, a `script-src` inside our own frame, an
+ * rendering, so it sees a `frame-src` that refuses the frame, a parent SahajCloud refuses, an
  * absent site key and a script that loads without defining the API — but not a challenge that
  * renders and then errors, which `useTurnstile`'s `blocked` backstops.
  * ⚠ The hostname mismatch it could never see is **gone** rather than unobserved: the challenge
- * now always renders on the one hostname the widget's Turnstile key lists (#343).
+ * always renders on the one hostname the Turnstile key lists, SahajCloud's (#343).
  */
-export async function probeTurnstile(): Promise<boolean> {
-  if (typeof document === 'undefined') return false
+export async function probeTurnstile(): Promise<TurnstileVerdict> {
+  if (typeof document === 'undefined') return 'failed'
 
-  availability ??= runCheck().then((available) => {
-    if (!available) availability = null
+  availability ??= runCheck().then((verdict) => {
+    if (verdict !== 'available') availability = null
 
-    return available
+    return verdict
   })
 
   return availability
 }
 
-function runCheck(): Promise<boolean> {
-  return new Promise<boolean>((resolve) => {
+function runCheck(): Promise<TurnstileVerdict> {
+  return new Promise<TurnstileVerdict>((resolve) => {
     let settled = false
-    const settle = (available: boolean) => {
+    const settle = (verdict: TurnstileVerdict) => {
       if (settled) return
 
       settled = true
       document.removeEventListener('securitypolicyviolation', onViolation)
       dispose()
-      resolve(available)
+      resolve(verdict)
     }
 
-    // A host refusing to frame our origin fires no load and no error, so this answers before the
+    // A host refusing to frame SahajCloud fires no load and no error, so this answers before the
     // handshake timeout — a latency decision, not a second liveness rule.
     //
     // Measured in Chromium 153.0.8010.12 against the built page, 2026-11-01: `frame-src 'none'`
@@ -163,14 +177,14 @@ function runCheck(): Promise<boolean> {
       if (!/^(frame|child|default)-src$/.test(directive)) return
       if (!event.blockedURI.startsWith(expectedOrigin)) return
 
-      settle(false)
+      settle('csp')
     }
 
     const { frame, expectedOrigin, dispose } = createChallengeFrame(
       { theme: 'auto', language: 'auto', probe: true },
       (message) => {
-        if (message?.type === 'ready') settle(true)
-        if (message?.type === 'error') settle(false)
+        if (message?.type === 'ready') settle('available')
+        if (message?.type === 'error') settle(message.reason === 'origin' ? 'origin' : 'failed')
       },
     )
 
diff --git a/src/lib/turnstile-frame.test.ts b/src/lib/turnstile-frame.test.ts
index fc3ceae8..a519a656 100644
--- a/src/lib/turnstile-frame.test.ts
+++ b/src/lib/turnstile-frame.test.ts
@@ -2,86 +2,50 @@ import { describe, expect, it } from 'vitest'
 
 import {
   CHALLENGE_CHANNEL,
+  CHALLENGE_PATH,
   challengeMessage,
-  challengeOrigin,
   challengeSrc,
-  parseChallengeCommand,
   parseChallengeEvent,
-  readChallengeOptions,
 } from './turnstile-frame'
 
-import { readRepoSource } from '@/test-support/repo-source'
-
 /**
  * The frame protocol, in the node lane. The transport is spec'd in `use-turnstile.test.tsx`,
- * which needs a DOM; everything here is a string.
+ * which needs a DOM; everything here is a string. The page's half lives in SahajCloud and is
+ * spec'd there (`tests/unit/atlas-challenge.spec.ts`).
  */
 
-// What `import.meta.url` is inside a built chunk: the widget's own graph, under /assets/.
-const CHUNK = 'https://sahajatlas.com/assets/use-turnstile-a1b2c3.js'
+const SERVER = 'https://cloud.sydevelopers.com'
+const OPTIONS = { parent: 'https://partner.org', theme: 'dark', language: 'cs' } as const
 
 describe('challengeSrc', () => {
-  it('resolves to the challenge page at the ROOT of the chunk-s own origin', () => {
-    const url = new URL(challengeSrc(CHUNK, { theme: 'dark', language: 'cs' }))
-
-    // The whole fix turns on this origin being ours rather than the host page's (#343), and
-    // on the path being the output root rather than the chunk's own directory — Vite emits
-    // an HTML input there, so `/assets/challenge.html` would 404 into the SPA fallback.
-    expect(url.origin).toBe('https://sahajatlas.com')
-    expect(url.pathname).toBe('/challenge.html')
+  it('addresses the challenge page on the SahajCloud origin', () => {
+    const url = new URL(challengeSrc(SERVER, OPTIONS))
+
+    expect(url.origin).toBe(SERVER)
+    expect(url.pathname).toBe(CHALLENGE_PATH)
   })
 
-  it('carries the theme and language the widget is rendering in', () => {
-    const url = new URL(challengeSrc(CHUNK, { theme: 'dark', language: 'cs' }))
+  it('carries the parent origin, theme and language the page renders with', () => {
+    const url = new URL(challengeSrc(SERVER, OPTIONS))
 
+    // The page hands its token to this origin and no other, so it is the one parameter whose
+    // loss would silently break every embed: SahajCloud refuses a frame that names no parent.
+    expect(url.searchParams.get('parent')).toBe('https://partner.org')
     expect(url.searchParams.get('theme')).toBe('dark')
     expect(url.searchParams.get('language')).toBe('cs')
     expect(url.searchParams.get('probe')).toBeNull()
   })
 
   it('marks a probe frame, so it hands back the handshake and renders nothing', () => {
-    const url = new URL(challengeSrc(CHUNK, { theme: 'auto', language: 'auto', probe: true }))
+    const url = new URL(challengeSrc(SERVER, { ...OPTIONS, probe: true }))
 
     expect(url.searchParams.get('probe')).toBe('1')
   })
 
-  it.each([
-    ['a dev server', 'http://localhost:5174/src/hooks/use-turnstile.ts'],
-    ['a Workers preview', 'https://pr-9-sahajatlas.sydevs.workers.dev/assets/x.js'],
-  ])('follows the origin the bundle was served from — %s', (_label, moduleUrl) => {
-    const expected = new URL(moduleUrl).origin
-
-    expect(new URL(challengeSrc(moduleUrl, { theme: 'auto', language: 'en' })).origin).toBe(
-      expected,
+  it('follows a local SahajCloud, so `pnpm dev` against one frames it', () => {
+    expect(new URL(challengeSrc('http://localhost:3000', OPTIONS)).origin).toBe(
+      'http://localhost:3000',
     )
-    expect(challengeOrigin(moduleUrl)).toBe(expected)
-  })
-})
-
-describe('readChallengeOptions', () => {
-  it('reads what the widget sent', () => {
-    expect(readChallengeOptions('?theme=dark&language=ru&probe=1')).toEqual({
-      theme: 'dark',
-      language: 'ru',
-      probe: true,
-    })
-  })
-
-  it.each([
-    ['an unknown theme', '?theme=sepia&language=en', 'auto', 'en'],
-    ['no theme at all', '?language=en', 'auto', 'en'],
-    // A language Turnstile would refuse, or one carrying anything but a locale code, must not
-    // stop the challenge rendering: `auto` follows the browser, which is a worse answer than
-    // the widget's own locale and a far better one than no captcha.
-    ['a non-locale language', '?theme=light&language=klingon', 'light', 'auto'],
-    ['an empty query', '', 'auto', 'auto'],
-  ])('falls back rather than refusing, given %s', (_label, search, theme, language) => {
-    expect(readChallengeOptions(search)).toEqual({ theme, language, probe: false })
-  })
-
-  it('treats any probe value but 1 as a real challenge', () => {
-    expect(readChallengeOptions('?probe=0').probe).toBe(false)
-    expect(readChallengeOptions('?probe=true').probe).toBe(false)
   })
 })
 
@@ -92,6 +56,15 @@ describe('parseChallengeEvent', () => {
     expect(parseChallengeEvent(on({ type }))).toEqual({ type })
   })
 
+  it.each(['origin', 'unavailable'] as const)('keeps the refusal reason %s', (reason) => {
+    expect(parseChallengeEvent(on({ type: 'error', reason }))).toEqual({ type: 'error', reason })
+  })
+
+  it('reads an unknown reason as a plain error rather than ignoring it', () => {
+    // A newer page must never make an older widget wait out its handshake timeout.
+    expect(parseChallengeEvent(on({ type: 'error', reason: 'quota' }))).toEqual({ type: 'error' })
+  })
+
   it('reads a token', () => {
     expect(parseChallengeEvent(on({ type: 'token', token: 'tok' }))).toEqual({
       type: 'token',
@@ -117,40 +90,11 @@ describe('parseChallengeEvent', () => {
   })
 })
 
-describe('parseChallengeCommand', () => {
-  it('reads a reset', () => {
-    expect(parseChallengeCommand(challengeMessage({ type: 'reset' }))).toEqual({ type: 'reset' })
-  })
-
-  it.each([
-    ['an unchannelled reset', { type: 'reset' }],
-    // The page accepts commands, not events: a `token` echoed back at it is not one.
-    ['an event', { channel: CHALLENGE_CHANNEL, type: 'token', token: 'tok' }],
-    ['null', null],
-  ])('refuses %s', (_label, data) => {
-    expect(parseChallengeCommand(data)).toBeNull()
-  })
-})
-
 describe('challengeMessage', () => {
-  it('stamps the channel on everything either side sends', () => {
-    expect(challengeMessage({ type: 'token', token: 'tok' })).toEqual({
+  it('stamps the channel on everything the widget sends', () => {
+    expect(challengeMessage({ type: 'reset' })).toEqual({
       channel: CHALLENGE_CHANNEL,
-      type: 'token',
-      token: 'tok',
+      type: 'reset',
     })
   })
 })
-
-describe('the challenge page in the Ladle build', () => {
-  // `.ladle/vite.config.ts` serves and emits this page by substituting its script path: Ladle's
-  // Vite root is its own app directory, so the path resolves from neither side without that
-  // rewrite. A path changed in one file and not the other leaves the playground emitting a page
-  // whose script 404s, which only a browser pass would notice (#343).
-  const SCRIPT = '/src/challenge.ts'
-
-  it('substitutes a script path the page actually carries', () => {
-    expect(readRepoSource('challenge.html')).toContain(`src="${SCRIPT}"`)
-    expect(readRepoSource('.ladle/vite.config.ts')).toContain(`const script = '${SCRIPT}'`)
-  })
-})
diff --git a/src/lib/turnstile-frame.ts b/src/lib/turnstile-frame.ts
index c2a1bfb0..b9e65cdf 100644
--- a/src/lib/turnstile-frame.ts
+++ b/src/lib/turnstile-frame.ts
@@ -3,17 +3,18 @@
  *
  * **Turnstile validates the hostname of the document that RENDERS it, not the top-level page.**
  * The script embed put our React tree in the HOST's document, so every partner hostname off the
- * widget's Turnstile list failed with `110200` — measured, including in a nested frame on the
- * same host, where it passed. On our own origin, one hostname list covers every partner and a
- * host configures nothing.
+ * key's Turnstile list failed with `110200` — measured, including in a nested frame on the same
+ * host, where it passed. In a page on one origin of ours, one hostname covers every partner.
  *
- * Pure, and shared by both sides: `src/challenge.ts` is the page, `src/hooks/use-turnstile.ts`
- * frames it. One module rather than two copies, because a protocol that drifts fails silently —
- * the parent waits for a handshake the page stopped sending, with nothing on the console.
+ * ⚠ **Cross-repo contract.** The page is SahajCloud's `GET /api/atlas/challenge`
+ * (sydevs/SahajCloud#1072, `src/endpoints/atlas/challenge/challengeDocument.ts` there), which holds
+ * both halves of the Turnstile key and decides which parents may receive a token. Change the
+ * channel, a message `type`, a `reason` or a query parameter in both repos in the same release: a
+ * drifted protocol fails silently, the frame waiting out its handshake with nothing on the console.
  */
 
-/** The challenge page's own path. A Vite HTML input, so it lands at the output root. */
-export const CHALLENGE_PATH = '/challenge.html'
+/** The page's path on the SahajCloud origin. */
+export const CHALLENGE_PATH = '/api/atlas/challenge'
 
 /**
  * Namespaces every message in both directions. The traffic lands on a window the HOST page also
@@ -22,17 +23,29 @@ export const CHALLENGE_PATH = '/challenge.html'
  */
 export const CHALLENGE_CHANNEL = 'sahaj-atlas-turnstile'
 
-/** What the page tells its parent. `ready` is the handshake: Turnstile is live on our origin. */
+/**
+ * Why the page rendered no challenge. `origin`: SahajCloud does not allow the parent — the host's
+ * domain is in no client record's allowed domains. `unavailable`: SahajCloud has no site key.
+ */
+export type ChallengeRefusal = 'origin' | 'unavailable'
+
+/** What the page tells its parent. `ready` is the handshake: Turnstile is live in the frame. */
 export type ChallengeEvent =
   | { type: 'ready' }
   | { type: 'token'; token: string }
   | { type: 'expired' }
-  | { type: 'error' }
+  | { type: 'error'; reason?: ChallengeRefusal }
 
 /** What the parent tells the page. */
 export type ChallengeCommand = { type: 'reset' }
 
 export type ChallengeOptions = {
+  /**
+   * The origin of the document the frame is appended to — `location.origin`, the host's in a
+   * script embed and ours in an iframe embed. The page talks to that origin and no other, so the
+   * browser refuses its token to any other parent.
+   */
+  parent: string
   theme: 'light' | 'dark' | 'auto'
   /** Turnstile's own `language` option — a two-letter code, as the widget's locale gives it. */
   language: string
@@ -44,21 +57,11 @@ export type ChallengeOptions = {
   probe?: boolean
 }
 
-/**
- * Resolved against the calling module's own URL, so the frame is same-origin with the bundle in
- * production, a Workers preview, `pnpm dev` and Ladle alike. `src/styles/fonts.ts` resolves font
- * files the same way: the deploy origin is not knowable at build time.
- *
- * ⚠ `moduleUrl` is a parameter rather than an `import.meta.url` read here. Vite rewrites the
- * literal `new URL(…, import.meta.url)` expression as its asset-URL idiom and leaves a variable
- * base alone — and a parameter is what lets a spec assert what a real deploy returns.
- */
-const challengeUrl = (moduleUrl: string): URL => new URL(CHALLENGE_PATH, moduleUrl)
-
-/** The frame's `src`, carrying what Turnstile bakes into the widget at render time. */
-export function challengeSrc(moduleUrl: string, options: ChallengeOptions): string {
-  const url = challengeUrl(moduleUrl)
+/** The frame's `src` on the SahajCloud origin, carrying what the page renders with. */
+export function challengeSrc(serverUrl: string, options: ChallengeOptions): string {
+  const url = new URL(CHALLENGE_PATH, serverUrl)
 
+  url.searchParams.set('parent', options.parent)
   url.searchParams.set('theme', options.theme)
   url.searchParams.set('language', options.language)
   if (options.probe) url.searchParams.set('probe', '1')
@@ -66,9 +69,6 @@ export function challengeSrc(moduleUrl: string, options: ChallengeOptions): stri
   return url.href
 }
 
-/** The origin the frame is served from — the one a host must allow under `frame-src`. */
-export const challengeOrigin = (moduleUrl: string): string => challengeUrl(moduleUrl).origin
-
 /** The envelope both parsers read: an object on our channel, or `null` for anything else. */
 const onChannel = (data: unknown): Record<string, unknown> | null =>
   typeof data === 'object' &&
@@ -87,8 +87,12 @@ export function parseChallengeEvent(data: unknown): ChallengeEvent | null {
   switch (message.type) {
     case 'ready':
     case 'expired':
-    case 'error':
       return { type: message.type }
+    case 'error':
+      // An unknown reason is still an error: a newer page must not make an older widget hang.
+      return message.reason === 'origin' || message.reason === 'unavailable'
+        ? { type: 'error', reason: message.reason }
+        : { type: 'error' }
     case 'token':
       // An empty token would enable Submit and then fail verification, which reads to a visitor
       // as the form being broken rather than the challenge.
@@ -100,30 +104,7 @@ export function parseChallengeEvent(data: unknown): ChallengeEvent | null {
   }
 }
 
-/** The parent's command, or `null`. Read by the page, where every framer is untrusted. */
-export function parseChallengeCommand(data: unknown): ChallengeCommand | null {
-  return onChannel(data)?.type === 'reset' ? { type: 'reset' } : null
-}
-
-/** Wraps an outgoing message. Both sides send through this, so the channel cannot be forgotten. */
+/** Wraps an outgoing message, so the channel cannot be forgotten. */
 export function challengeMessage<T extends ChallengeEvent | ChallengeCommand>(message: T) {
   return { channel: CHALLENGE_CHANNEL, ...message }
 }
-
-/**
- * The page's own query string, read back. Unknown values fall back rather than refusing: they
- * reach us from a URL the parent built, and a captcha that will not render is a worse answer
- * than one rendered in the wrong theme.
- */
-export function readChallengeOptions(search: string): ChallengeOptions {
-  const params = new URLSearchParams(search)
-  const theme = params.get('theme')
-  const language = params.get('language') ?? ''
-
-  return {
-    theme: theme === 'light' || theme === 'dark' || theme === 'auto' ? theme : 'auto',
-    // Turnstile takes `auto` for "follow the browser", which is the right default here too.
-    language: /^[a-z]{2}(-[a-z]{2})?$/i.test(language) ? language : 'auto',
-    probe: params.get('probe') === '1',
-  }
-}
diff --git a/src/mocks/errors.ts b/src/mocks/errors.ts
index 2d19d523..b359b868 100644
--- a/src/mocks/errors.ts
+++ b/src/mocks/errors.ts
@@ -28,7 +28,7 @@ export const mockErrors: Record<ErrorKind, unknown> = {
   'not-found': atlasError('not-found', 'Region not found: atlantis'),
   // An embed whose API key SahajCloud rejects.
   config: sdkError(401, 'Unauthorized'),
-  // A host page whose CSP refuses to frame the widget's own origin, so the challenge cannot
+  // A host page whose CSP refuses to frame SahajCloud's challenge page, so it cannot
   // render and no form can produce a token (issues #182, #343). Tagged rather than
   // frame-driven for the same reason `offline` is: the fixture must classify the same way
   // wherever the story renders.
diff --git a/src/test-support/turnstile-frame.ts b/src/test-support/turnstile-frame.ts
index e794a7a3..e52f8c06 100644
--- a/src/test-support/turnstile-frame.ts
+++ b/src/test-support/turnstile-frame.ts
@@ -1,11 +1,18 @@
 import { vi } from 'vitest'
 
-import { type ChallengeEvent, challengeMessage, parseChallengeCommand } from '@/lib/turnstile-frame'
+import { CHALLENGE_CHANNEL, type ChallengeEvent, challengeMessage } from '@/lib/turnstile-frame'
+
+/** The reset command as SahajCloud's page reads it: on our channel, `type: 'reset'`. */
+const isReset = (data: unknown) =>
+  typeof data === 'object' &&
+  data !== null &&
+  (data as Record<string, unknown>).channel === CHALLENGE_CHANNEL &&
+  (data as Record<string, unknown>).type === 'reset'
 
 /**
  * Stands in for the challenge PAGE, never for our own hook (#343).
  *
- * `useTurnstile` mounts a frame on the widget's origin and waits for its `postMessage`
+ * `useTurnstile` mounts a frame on SahajCloud's origin and waits for its `postMessage`
  * handshake, so this speaks that protocol from the other side. What the specs using it are
  * for is the form's own wiring — the token reaching Submit, and a failed submit asking for a
  * fresh challenge — and mocking the hook would skip exactly that.
@@ -22,7 +29,7 @@ export function challengeFrameStub(container: ParentNode) {
   let resets = 0
 
   vi.spyOn(frame.contentWindow, 'postMessage').mockImplementation(((data: unknown) => {
-    if (parseChallengeCommand(data)) resets += 1
+    if (isReset(data)) resets += 1
   }) as Window['postMessage'])
 
   return {
@@ -39,8 +46,8 @@ export function challengeFrameStub(container: ParentNode) {
 /**
  * Dispatches one message as the challenge page would, for a spec driving the frame directly.
  *
- * ⚠ The origin is read off the frame's own `src`. The hook resolves that URL against its
- * module URL, so hard-coding one here would make the hook's own origin check pass or fail for
+ * ⚠ The origin is read off the frame's own `src`. The hook builds that URL from
+ * `VITE_SAHAJCLOUD_URL`, so hard-coding one here would make the hook's own origin check pass or fail for
  * a reason unrelated to what the spec is testing. `overrides` is what lets a case send a
  * deliberately wrong source, origin or shape.
  */
diff --git a/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx b/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx
index f9fc2347..a2078ef9 100644
--- a/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx
+++ b/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx
@@ -77,10 +77,11 @@ const Sentinel = () => <p>{INTERFACE}</p>
  * only prove the fake stayed unrendered.
  *
  * ⚠ **What the guard mounts is a frame, not a script, since #343** — the challenge renders on
- * the widget's own origin now. The cost to a host is the same shape: a document and a request
+ * SahajCloud now. The cost to a host is the same shape: a document and a request
  * for an interface nobody opened.
  */
-const challengeFrames = () => document.querySelectorAll('iframe[src*="/challenge.html"]').length
+const challengeFrames = () =>
+  document.querySelectorAll('iframe[src*="/api/atlas/challenge"]').length
 
 function InterfaceWithTurnstile() {
   useTurnstileGuard()
diff --git a/tests/smoke/embed.smoke.test.ts b/tests/smoke/embed.smoke.test.ts
index de2fb738..077ec6b3 100644
--- a/tests/smoke/embed.smoke.test.ts
+++ b/tests/smoke/embed.smoke.test.ts
@@ -1,11 +1,6 @@
 import { describe, expect, test } from 'vitest'
 
-import { appPreviewHost } from '../../scripts/assert-preview-host.mjs'
-import { appWorkerName } from '../../scripts/_wrangler-config.mjs'
-import { findLiveSiteKeys, findTestSiteKeys } from '../../scripts/turnstile-release-guard.mjs'
-import { CHALLENGE_PATH } from '../../src/lib/turnstile-frame'
-
-import { PREVIEW_URL, fetchPreview, skipWithoutPreview } from './_helpers/preview'
+import { fetchPreview, skipWithoutPreview } from './_helpers/preview'
 
 // Smoke test: does the deploy serve the file a host installs?
 //
@@ -49,63 +44,29 @@ function fetchEmbed() {
 }
 
 /**
- * Runs `crawl` once and shares the result, keeping only a CLEAN one.
- *
- * A broken chunk or a thrown fetch clears the memo, so each retry crawls again rather than
- * replaying the same transient 5xx (see `fetchEmbed`). Shared by both crawls below, because
- * two copies of this would be two chances to get the clearing wrong.
- */
-function cacheCleanCrawl<T extends { broken: string[] }>(crawl: () => Promise<T>) {
-  let cached: Promise<T> | undefined
-
-  return () =>
-    (cached ??= crawl().then(
-      (result) => {
-        if (result.broken.length > 0) cached = undefined
-
-        return result
-      },
-      (err) => {
-        cached = undefined
-        throw err
-      },
-    ))
-}
-
-/**
- * Fetches one chunk, and decides whether the deploy really served it.
+ * Every chunk `auto.js` can reach, crawled once and shared by the specs below.
  *
- * ⚠ Status alone proves nothing: `assets.not_found_handling` serves the SPA shell with a
- * **200 `text/html`** for any path that is not a built asset, so a check on `res.status` would
- * pass for exactly the failure these crawls exist to catch. The content type is what tells a
- * real chunk from the fallback, and it is the lane's own invariant (`docs/testing.md`) — so it
- * has one implementation, read by both crawls.
- *
- * A chunk that failed is stored with an EMPTY body rather than omitted, so a spec reading the
- * bodies back cannot mistake a 404 for a chunk that genuinely carries nothing.
+ * Only a clean crawl is cached. A broken chunk or a thrown fetch clears it, so each retry
+ * crawls again rather than replaying the same transient 5xx (see `fetchEmbed`).
  */
-async function fetchChunk(path: string, bodies: Map<string, string>, broken: string[]) {
-  // Uses GET, not HEAD. The body serves both as the assertion and as the next frontier to
-  // crawl. The whole deploy is roughly 440 KiB gzipped, and this lane runs separately from
-  // the PR gate.
-  const res = await fetchPreview(path)
-  const type = res.headers.get('content-type') ?? ''
-
-  if (res.status === 200 && /javascript|ecmascript/i.test(type)) {
-    bodies.set(path, await res.text())
+let crawl: Promise<{ seen: string[]; broken: string[] }> | undefined
 
-    return true
-  }
+function crawlDeploy() {
+  crawl ??= crawlFromLoader().then(
+    (result) => {
+      if (result.broken.length > 0) crawl = undefined
 
-  bodies.set(path, '')
-  broken.push(`${path} → ${res.status} ${type}`)
+      return result
+    },
+    (err) => {
+      crawl = undefined
+      throw err
+    },
+  )
 
-  return false
+  return crawl
 }
 
-/** Every chunk `auto.js` can reach, crawled once and shared by the specs below. */
-const crawlDeploy = cacheCleanCrawl(crawlFromLoader)
-
 async function crawlFromLoader() {
   const { body } = await fetchEmbed()
 
@@ -113,49 +74,39 @@ async function crawlFromLoader() {
   // hashed. A host or a proxy holding a stale copy can request names the deploy no
   // longer contains, and the widget then never appears. This spec catches the
   // deploy-side half of that mismatch: a loader published without the graph behind
-  // it. The loader's body is already in hand, so it seeds the walk rather than
-  // being fetched a second time.
-  return crawlFrom([], new Map([['/auto.js', body]]))
-}
-
-/**
- * Walks a JavaScript graph on the deploy, from `seeds` plus anything already in hand.
- *
- * This matches every relative `.js` literal, not only the static-import shape. A missing lazy
- * chunk is the same broken deploy, found one interaction later.
- *
- * ⚠ **The crawl is transitive, not one level deep.** The whole widget sits behind one dynamic
- * import from the loader, so a one-level crawl from `auto.js` would reach `embed.js` and stop,
- * missing every chunk the widget needs. The views behind a lazy seam load from a chunk that
- * names them, not from the entry file: a one-level crawl stopped covering the calendar,
- * registration and share chunks the moment those moved behind `React.lazy` (issue #96).
- * Following each body in turn makes the found set the whole graph the widget can ever request,
- * however deep the seam goes — which is why the challenge page's own entry is walked through
- * this same function rather than read once.
- *
- * ⚠ **Backticks matter as much as the transitive crawl.** rolldown's minifier emits dynamic
- * specifiers as template literals, for example `import(\`./CalendarView-<hash>.js\`)`. A pattern
- * matching only `"` and `'` catches the static imports and silently skips every lazy chunk.
- */
-async function crawlFrom(seeds: string[], prefetched = new Map<string, string>()) {
+  // it.
+  //
+  // This matches every relative `.js` literal, not only the static-import shape. A
+  // missing lazy chunk is the same broken deploy, found one interaction later.
+  //
+  // The crawl is transitive, not one level deep, and that matters more now than
+  // before. The whole widget sits behind one dynamic import from the loader. A
+  // one-level crawl from `auto.js` would reach `embed.js` and stop, missing every
+  // chunk the widget needs. The views behind a lazy seam load from a chunk that
+  // names them, not from the entry file. A one-level crawl stopped covering the
+  // calendar, registration, and share chunks the moment those moved behind
+  // `React.lazy` (issue #96). Following each body in turn makes the found set the
+  // whole deploy the widget can ever request, however deep the seam goes.
+  //
+  // Backticks matter as much as the transitive crawl. rolldown's minifier emits
+  // dynamic specifiers as template literals, for example
+  // `import(\`./CalendarView-<hash>.js\`)`. A pattern that matches only `"` and `'`
+  // catches the static imports and silently skips every lazy chunk in the build.
   const RELATIVE_JS = /["'`](\.\/[^"'`]+\.js)["'`]/g
-  // Chunks reference each other relative to their own directory. `embed.js` sits at the root
-  // and points into `./assets/`. Everything under `assets/` points at its siblings.
+  // Chunks reference each other relative to their own directory. `embed.js` sits at
+  // the root and points into `./assets/`. Everything under `assets/` points at its
+  // siblings.
   const resolveFrom = (path: string, spec: string) =>
     `${path.slice(0, path.lastIndexOf('/'))}/${spec.replace(/^\.\//, '')}`
 
+  // Status alone proves nothing here. The SPA fallback answers `/* /index.html
+  // 200`, so a missing chunk also answers 200 as the shell. A check on
+  // `res.status` would pass for exactly the failure this spec exists to catch. The
+  // content type is what tells a real chunk apart from the fallback HTML.
   const broken: string[] = []
-  const bodies = new Map(prefetched)
   const seen = new Set<string>()
-  const queue = [...prefetched.keys()]
-
-  for (const path of seeds) {
-    if (seen.has(path)) continue
-
-    seen.add(path)
-
-    if (await fetchChunk(path, bodies, broken)) queue.push(path)
-  }
+  const queue = ['/auto.js']
+  const bodies = new Map<string, string>([['/auto.js', body]])
 
   while (queue.length) {
     const path = queue.pop() as string
@@ -170,64 +121,26 @@ async function crawlFrom(seeds: string[], prefetched = new Map<string, string>()
 
       seen.add(next)
 
-      if (await fetchChunk(next, bodies, broken)) queue.push(next)
-    }
-  }
+      // Uses GET, not HEAD. The body serves both as the assertion and as the next
+      // frontier to crawl. The whole deploy is roughly 440 KiB gzipped, and this
+      // lane runs separately from the PR gate.
+      const res = await fetchPreview(next)
+      const type = res.headers.get('content-type') ?? ''
 
-  return { seen: [...seen], broken, bodies }
-}
+      if (res.status === 200 && /javascript|ecmascript/i.test(type)) {
+        const text = await res.text()
 
-/**
- * The Turnstile challenge page's own graph, crawled once and shared.
- *
- * It is a SECOND entry, not reachable from the loader: `challenge.html` is framed at runtime
- * by a URL the widget composes, so no `import()` names it and the crawl above cannot find it
- * (#343). Its chunks are where the site key now lives, which is why the key spec below reads
- * both maps.
- *
- * ⚠ **Transitive from the page's own scripts, not one level deep.** A one-level crawl is the
- * defect #96 recorded against the loader: it reads the entry and stops, so a chunk named only
- * by another chunk goes unchecked. `crawlFrom` is the same walk the loader uses, seeded with
- * the page's own `src` and `modulepreload` paths instead of `auto.js`.
- */
-const crawlChallenge = cacheCleanCrawl(crawlChallengePage)
-
-async function crawlChallengePage() {
-  const res = await fetchPreview(CHALLENGE_PATH)
-  const html = await res.text()
-  // Vite emits the entry as a `<script type="module" src>` plus `modulepreload` links. Both
-  // shapes are matched, because which chunks get a preload hint is the bundler's choice and
-  // the key could be inlined into any of them.
-  const seeds = [...html.matchAll(/(?:src|href)="(\/assets\/[^"]+\.js)"/g)].map(([, path]) => path)
-  const crawled = await crawlFrom(seeds)
+        bodies.set(next, text)
+        queue.push(next)
+      } else {
+        broken.push(`${next} → ${res.status} ${type}`)
+      }
+    }
+  }
 
-  return { ...crawled, html, status: res.status, type: res.headers.get('content-type') ?? '' }
+  return { seen: [...seen], broken }
 }
 
-describe('turnstile challenge page', () => {
-  // Every registration and every issue report frames this page. A deploy that does not serve
-  // it answers the SPA shell with a 200 instead, so the frame loads the whole widget inside
-  // itself, never sends a handshake, and the eager check fails the embed ten seconds later —
-  // on every host at once.
-  test.skipIf(skipWithoutPreview)('serves the challenge page, not the SPA shell', async () => {
-    const { html, status, type } = await crawlChallenge()
-
-    expect(status).toBe(200)
-    expect(type).toMatch(/text\/html/)
-    expect(html).toContain('id="challenge"')
-    // The shell's own mount point. `assets.not_found_handling` serves it for any path the
-    // deploy lacks, which is exactly the failure this case exists to catch.
-    expect(html).not.toContain('id="syatlas"')
-  })
-
-  test.skipIf(skipWithoutPreview)('serves every chunk the challenge page names', async () => {
-    const { broken, bodies } = await crawlChallenge()
-
-    expect(bodies.size).toBeGreaterThan(0)
-    expect(broken).toEqual([])
-  })
-})
-
 describe('embed bundle', () => {
   test.skipIf(skipWithoutPreview)('serves auto.js as a loader, not as the widget', async () => {
     const { status, body } = await fetchEmbed()
@@ -262,62 +175,3 @@ describe('embed bundle', () => {
     expect(broken).toEqual([])
   })
 })
-
-// The live half of #259's release guard: the build refuses a production build on the test key,
-// and this reads what production actually serves, so a bypassed build gate still goes red.
-//
-// ⚠ The one spec in this lane whose expectation depends on the host, because the committed
-// `.env` key IS correct on a preview — no real key validates on a `workers.dev` host. Only an
-// address `assert-preview-host.mjs` accepts as the app Worker's preview may carry it; every
-// other host, `sahajatlas.com` among them, is held to production's standard. The preview half is
-// what keeps the production half honest: the same patterns must FIND the test key there, so a
-// minifier change that hid the literal fails the PR gate instead of greening production.
-//
-// Both patterns come from the guard, so what this reads back is what the gate passes. Defining
-// "a real key" a second time here, stricter, reddens production over a key the gate accepted.
-
-describe('turnstile site key', () => {
-  test.skipIf(skipWithoutPreview)(
-    'ships the test key only on a preview, and a real key everywhere else',
-    async () => {
-      const loader = await crawlDeploy()
-      const page = await crawlChallenge()
-
-      // A chunk that failed to fetch is stored with an empty body, so a 404 on the chunk
-      // carrying the key would read here as an unset build variable. The sibling cases above
-      // own that failure and name it correctly.
-      if (loader.broken.length > 0 || page.broken.length > 0) return
-
-      // ⚠ Both graphs, because the key moved out of the widget's own into the challenge
-      // page's when the challenge moved to a frame (#343) — and a key found in EITHER is a
-      // key production serves. Reading only the loader's graph would report production as
-      // carrying no key at all, and reading only the page's would miss a key re-inlined into
-      // the widget.
-      const bodies = [...loader.bodies, ...page.bodies]
-      const where = (find: (body: string) => string[]) =>
-        bodies.flatMap(([path, body]) => find(body).map((key) => `${path}: ${key}`))
-
-      const testKeys = where(findTestSiteKeys)
-      // A real key is public, but it stays out of CI logs: named by prefix only.
-      const liveKeys = where((body) => findLiveSiteKeys(body).map((key) => `${key.slice(0, 7)}…`))
-
-      if (appPreviewHost(PREVIEW_URL as string, appWorkerName())) {
-        expect(
-          testKeys.length,
-          'no Turnstile test key found on a preview — moved, or renamed?',
-        ).toBeGreaterThan(0)
-
-        return
-      }
-
-      expect(
-        testKeys,
-        'production serves the Turnstile TEST key: set VITE_TURNSTILE_SITE_KEY as a Workers Builds build variable (docs/environment.md)',
-      ).toEqual([])
-      expect(
-        liveKeys.length,
-        'production serves no Turnstile site key at all: VITE_TURNSTILE_SITE_KEY is unset on its build',
-      ).toBeGreaterThan(0)
-    },
-  )
-})
diff --git a/vite.config.ts b/vite.config.ts
index 7842c9f1..0f409c8c 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -11,7 +11,6 @@ import process from 'node:process'
 import { resolve } from 'path'
 
 import flattenEntryImports from './scripts/flatten-entry-imports.mjs'
-import { turnstileReleaseGuard } from './scripts/turnstile-release-guard.mjs'
 
 /**
  * Where the emitted CSS goes instead of `document.head` (#236).
@@ -282,8 +281,6 @@ export default defineConfig(({ command }) => ({
     // `<script>` tag parsed up front.
     flattenEntryImports('loader'),
     stripDsStore(),
-    // Fails a production build that would ship `.env`'s test Turnstile key (#259).
-    turnstileReleaseGuard(),
     // This plugin's position in the array does not set its order.
     // `sentryVitePlugin` returns `enforce: 'pre'`, so Vite hoists it
     // ahead of every plugin above, regardless of array order. What makes
@@ -311,10 +308,6 @@ export default defineConfig(({ command }) => ({
     rolldownOptions: {
       input: {
         main: resolve(import.meta.dirname, 'index.html'),
-        // The Turnstile challenge, served from our origin so Turnstile sees one hostname
-        // whatever page hosts the widget (#343). An HTML input, so it lands at the output
-        // root as `/challenge.html` — the path `src/lib/turnstile-frame.ts` resolves.
-        challenge: resolve(import.meta.dirname, 'challenge.html'),
         // This is the one script a host installs. Nobody loads
         // `embed.js` directly any more — the loader imports it
         // dynamically. It stays an explicit entry so it keeps a stable,

From 3ed0e77e71c596cada782695e1ed5143481e84fd Mon Sep 17 00:00:00 2001
From: Devindra <devindra@Devindras-MacBook-Pro.local>
Date: Tue, 3 Nov 2026 13:15:04 -0700
Subject: [PATCH 13/14] refactor(turnstile): fold the frame protocol into the
 hook

`src/lib/turnstile-frame.ts` existed to share the protocol between the challenge page and the
hook. The page now lives in SahajCloud (sydevs/SahajCloud#1072), so the hook is its only
consumer, and the module, its option and command types, the `challengeMessage` wrapper and the
`unavailable` reason (never acted on) go. The test stub writes SahajCloud's wire format out
literally, so the specs pin the contract rather than the hook's own constants.

The `securitypolicyviolation` fast path and the `csp` verdict go too. Their advice was the
`failed` advice word for word; what they bought was latency, so a host whose CSP refuses the
frame now reaches the error screen at the 10 s handshake timeout instead of at once.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/embedding.md                      |   4 +-
 src/hooks/use-turnstile-guard.test.tsx |  46 ++---
 src/hooks/use-turnstile.test.tsx       |  83 +++------
 src/hooks/use-turnstile.ts             | 242 ++++++++++++-------------
 src/lib/turnstile-frame.test.ts        | 100 ----------
 src/lib/turnstile-frame.ts             | 110 -----------
 src/test-support/turnstile-frame.ts    |  17 +-
 7 files changed, 172 insertions(+), 430 deletions(-)
 delete mode 100644 src/lib/turnstile-frame.test.ts
 delete mode 100644 src/lib/turnstile-frame.ts

diff --git a/docs/embedding.md b/docs/embedding.md
index e93a6976..b3ed31ec 100644
--- a/docs/embedding.md
+++ b/docs/embedding.md
@@ -837,7 +837,7 @@ believing you allowed something you hadn't.
 |                            | `ipwho.is`                                    | the once-per-session IP→city lookup behind "classes near you"                                                                                                                                                                                                                                                                                                                                                                                                                         | **degrades**: the nearby suggestion is skipped                                                                                                                                                                |
 |                            | `cdn.usefathom.com`                           | analytics, conditional as above                                                                                                                                                                                                                                                                                                                                                                                                                                                       | analytics only                                                                                                                                                                                                |
 |                            | `*.sentry.io`                                 | crash reporting. Contacted **only after the widget has already failed**, and only on a build with a DSN.                                                                                                                                                                                                                                                                                                                                                                              | **degrades**: the widget notices the refusal and stops trying for the rest of the page's life                                                                                                                 |
-| `frame-src`                | `cloud.sydevelopers.com`                      | **The captcha — required.** Every write the widget makes is captcha-gated, so registration is impossible without it. The challenge is Cloudflare Turnstile, and it renders in a small frame `cloud.sydevelopers.com` serves rather than in your document, so `challenges.cloudflare.com` belongs in no directive of yours. The frame is mounted as soon as the interface does, so a policy that omits this fails immediately rather than at the moment somebody registers.      | **the widget shows an error screen and does not run.** Not a degradation — see the note below                                                                                                                 |
+| `frame-src`                | `cloud.sydevelopers.com`                      | **The captcha — required.** Every write the widget makes is captcha-gated, so registration is impossible without it. The challenge is Cloudflare Turnstile, and it renders in a small frame `cloud.sydevelopers.com` serves rather than in your document, so `challenges.cloudflare.com` belongs in no directive of yours. The frame is mounted as soon as the interface does, so a policy that omits this fails within seconds of the page loading rather than at the moment somebody registers.      | **the widget shows an error screen and does not run.** Not a degradation — see the note below                                                                                                                 |
 
 Notes on that table:
 
@@ -1089,7 +1089,7 @@ Seven honest exceptions, none of them styling your content:
 - **A 1-pixel hidden `<iframe>` sits in your `<body>` for a moment after the widget mounts**,
   and is removed again as soon as it has answered. It is the captcha's availability check: it
   loads the challenge page from `cloud.sydevelopers.com` and asks whether it may run here, so a
-  page where registration is impossible says so immediately rather than at the moment somebody
+  page where registration is impossible says so within seconds rather than at the moment somebody
   tries to sign up. It is `position: fixed`, fully transparent, not focusable and hidden from
   assistive technology, and it adds nothing to your page's scroll height. Nothing else of yours
   is touched.
diff --git a/src/hooks/use-turnstile-guard.test.tsx b/src/hooks/use-turnstile-guard.test.tsx
index 523f9b43..c8f9ac3f 100644
--- a/src/hooks/use-turnstile-guard.test.tsx
+++ b/src/hooks/use-turnstile-guard.test.tsx
@@ -97,23 +97,20 @@ describe('useTurnstileGuard', () => {
     expect(caught).toBeUndefined()
   })
 
-  it.each(['csp', 'origin', 'failed'])(
-    'fails the widget as `captcha-blocked` on %s',
-    async (verdict) => {
-      probeTurnstile.mockResolvedValue(verdict)
-
-      await mount()
-
-      expect(document.body.textContent).not.toContain(GUARDED)
-      // This checks the KIND, not merely that something threw.
-      // The kind picks the sentence.
-      // More importantly, it withholds the report CTA that would open a second form the same failure has already disabled.
-      expect(classifyError(caught)).toBe('captcha-blocked')
-    },
-  )
+  it.each(['origin', 'failed'])('fails the widget as `captcha-blocked` on %s', async (verdict) => {
+    probeTurnstile.mockResolvedValue(verdict)
+
+    await mount()
+
+    expect(document.body.textContent).not.toContain(GUARDED)
+    // This checks the KIND, not merely that something threw.
+    // The kind picks the sentence.
+    // More importantly, it withholds the report CTA that would open a second form the same failure has already disabled.
+    expect(classifyError(caught)).toBe('captcha-blocked')
+  })
 
   it('tells the host developer what to change, on the console', async () => {
-    probeTurnstile.mockResolvedValue('csp')
+    probeTurnstile.mockResolvedValue('failed')
 
     await mount()
 
@@ -128,17 +125,14 @@ describe('useTurnstileGuard', () => {
   // ⚠ The advice names SahajCloud's origin, not Cloudflare's or the widget's (#343,
   // sydevs/SahajCloud#1072): the challenge renders in a frame SahajCloud serves, so naming
   // anything else would send a developer to edit a line that fixes nothing.
-  it.each(['csp', 'failed'] as const)(
-    'names the SahajCloud origin under frame-src on %s, and nothing a host no longer needs',
-    (verdict) => {
-      const advice = turnstileAdvice(verdict, 'https://cloud.sydevelopers.com', 'partner.org')
-
-      expect(advice).toContain('frame-src')
-      expect(advice).toContain('https://cloud.sydevelopers.com')
-      expect(advice).not.toContain('challenges.cloudflare.com')
-      expect(advice).not.toContain('script-src')
-    },
-  )
+  it('names the SahajCloud origin under frame-src, and nothing a host no longer needs', () => {
+    const advice = turnstileAdvice('failed', 'https://cloud.sydevelopers.com', 'partner.org')
+
+    expect(advice).toContain('frame-src')
+    expect(advice).toContain('https://cloud.sydevelopers.com')
+    expect(advice).not.toContain('challenges.cloudflare.com')
+    expect(advice).not.toContain('script-src')
+  })
 
   // A host's own policy cannot fix this one, so pointing at `frame-src` would waste the reader's
   // time: the page's domain is missing from every client record.
diff --git a/src/hooks/use-turnstile.test.tsx b/src/hooks/use-turnstile.test.tsx
index eda76386..ddf95849 100644
--- a/src/hooks/use-turnstile.test.tsx
+++ b/src/hooks/use-turnstile.test.tsx
@@ -5,8 +5,7 @@ import { createRoot } from 'react-dom/client'
 
 import { type TurnstileVerdict, type UseTurnstile, useTurnstile } from './use-turnstile'
 
-import { sendFromFrame } from '@/test-support/turnstile-frame'
-import { CHALLENGE_CHANNEL, CHALLENGE_PATH, type ChallengeEvent } from '@/lib/turnstile-frame'
+import { type PageMessage, sendFromFrame } from '@/test-support/turnstile-frame'
 
 /**
  * The challenge lives in a frame SahajCloud serves (#343, sydevs/SahajCloud#1072), so what this covers is the
@@ -47,7 +46,7 @@ async function mount(node = <Probe />) {
 const frame = () => container.querySelector('iframe')
 
 /** Speaks as the challenge page does. `sendFromFrame` owns the origin and source. */
-function fromFrame(message: ChallengeEvent, overrides: MessageEventInit = {}) {
+function fromFrame(message: PageMessage, overrides: MessageEventInit = {}) {
   const iframe = frame()
 
   if (!iframe) throw new Error('no challenge frame')
@@ -77,7 +76,8 @@ describe('useTurnstile', () => {
     const url = new URL(iframe?.src as string)
 
     expect(url.origin).toBe(new URL(import.meta.env.VITE_SAHAJCLOUD_URL).origin)
-    expect(url.pathname).toBe(CHALLENGE_PATH)
+    // SahajCloud's route, written out: a constant shared with the hook would follow it anywhere.
+    expect(url.pathname).toBe('/api/atlas/challenge')
     // The page hands its token to this origin alone, so it must be the document the frame is in.
     expect(url.searchParams.get('parent')).toBe(window.location.origin)
     expect(url.searchParams.get('theme')).toBe('dark')
@@ -130,6 +130,14 @@ describe('useTurnstile', () => {
     expect(hook.status).toBe('ready')
   })
 
+  it('refuses an empty token, which would enable Submit and then fail verification', async () => {
+    await mount()
+    fromFrame({ type: 'ready' })
+    fromFrame({ type: 'token', token: '' })
+
+    expect(hook.token).toBeNull()
+  })
+
   it('drops the token on expiry, without blocking the form', async () => {
     await mount()
     fromFrame({ type: 'token', token: 'tok-1' })
@@ -218,7 +226,7 @@ describe('useTurnstile', () => {
     // Addressed to the frame's own origin, as narrowly as the inbound filter reads it: a frame
     // navigated elsewhere gets no command rather than one aimed at whatever occupies it.
     expect(posted).toHaveBeenCalledWith(
-      { channel: CHALLENGE_CHANNEL, type: 'reset' },
+      { channel: 'sahaj-atlas-turnstile', type: 'reset' },
       new URL(frame()?.src as string).origin,
     )
   })
@@ -280,7 +288,9 @@ describe('useTurnstile', () => {
 
 describe('probeTurnstile', () => {
   const probeFrame = () =>
-    [...document.body.querySelectorAll('iframe')].find((node) => node.src.includes(CHALLENGE_PATH))
+    [...document.body.querySelectorAll('iframe')].find((node) =>
+      node.src.includes('/api/atlas/challenge'),
+    )
 
   /**
    * Starts the check on a FRESH copy of the module, and reports what it has decided so far.
@@ -289,9 +299,9 @@ describe('probeTurnstile', () => {
    * otherwise read whichever answer the first one cached.
    *
    * ⚠ **Every case runs on fake timers, and that is the only thing that makes them
-   * non-vacuous.** The handshake timeout answers `false` too, so a case that simply awaits the
-   * verdict passes whether the signal it dispatched was read or ignored — it just takes ten
-   * seconds about it. What each case asserts is therefore WHEN the verdict lands.
+   * non-vacuous.** The handshake timeout answers `failed` too, so on real timers a case that
+   * awaits the verdict passes whether the signal it dispatched was read or ignored — it just
+   * takes ten seconds about it. Frozen, an ignored signal leaves the verdict pending for good.
    */
   async function startProbe() {
     vi.useFakeTimers()
@@ -312,20 +322,10 @@ describe('probeTurnstile', () => {
       done: run(),
       settled: (index = 0) => verdicts[index],
       calls: () => verdicts.length,
-      origin: () => new URL(probeFrame()?.src as string).origin,
     }
   }
 
-  const violation = (directive: string, blockedURI: string) =>
-    document.dispatchEvent(
-      Object.assign(new Event('securitypolicyviolation'), {
-        effectiveDirective: directive,
-        violatedDirective: directive,
-        blockedURI,
-      }),
-    )
-
-  const fromProbe = (message: ChallengeEvent) => {
+  const fromProbe = (message: PageMessage) => {
     const iframe = probeFrame()
 
     if (!iframe) throw new Error('no probe frame')
@@ -350,10 +350,11 @@ describe('probeTurnstile', () => {
     expect(probeFrame()).toBeUndefined()
   })
 
-  it('resolves failed when the frame reports an error', async () => {
+  it('resolves failed when the frame reports any other error', async () => {
     const probe = await startProbe()
 
-    fromProbe({ type: 'error' })
+    // What SahajCloud sends with no site key: the host can fix nothing, so no domain advice.
+    fromProbe({ type: 'error', reason: 'unavailable' })
     await probe.done
 
     expect(probe.settled()).toBe('failed')
@@ -369,43 +370,9 @@ describe('probeTurnstile', () => {
     expect(probe.settled()).toBe('origin')
   })
 
-  // Chromium reports the BARE origin as `blockedURI` — measured, and the reason the handler
-  // matches by prefix. The path form is kept for the engines that were not measured.
-  it.each([
-    ['the bare origin, as Chromium sends it', ''],
-    ['the origin with a path', CHALLENGE_PATH],
-  ])('resolves csp at once on a frame-src violation naming %s', async (_label, path) => {
-    const probe = await startProbe()
-
-    violation('frame-src', `${probe.origin()}${path}`)
-    await vi.advanceTimersByTimeAsync(0)
-
-    // Before the handshake timeout, which is the whole point: a refused frame fires no load
-    // and no error of its own, so without this the widget looks healthy for ten seconds.
-    expect(probe.settled()).toBe('csp')
-  })
-
-  // Two near misses, because each filter in the violation handler is wrong on its own. A
-  // strict-CSP host can produce either: the widget loads event photography from this same
-  // SahajCloud origin, and a host frames plenty of other origins of its own.
-  it.each([
-    ['another directive, the SahajCloud origin', 'img-src', true],
-    ['frame-src, another origin', 'frame-src', false],
-  ])('ignores a violation about %s', async (_label, directive, ours) => {
-    const probe = await startProbe()
-
-    violation(directive, ours ? `${probe.origin()}/logo.svg` : 'https://widgets.example/f.html')
-    await vi.advanceTimersByTimeAsync(5_000)
-
-    expect(probe.settled()).toBe('pending')
-
-    await vi.advanceTimersByTimeAsync(5_000)
-    await probe.done
-
-    expect(probe.settled()).toBe('failed')
-  })
-
   it('resolves failed only once the frame has had its full wait', async () => {
+    // A `frame-src` that refuses the frame is silent to its parent, so this is the path a host's
+    // stale CSP takes.
     const probe = await startProbe()
 
     await vi.advanceTimersByTimeAsync(9_999)
diff --git a/src/hooks/use-turnstile.ts b/src/hooks/use-turnstile.ts
index 80c84b6c..9ce2e916 100644
--- a/src/hooks/use-turnstile.ts
+++ b/src/hooks/use-turnstile.ts
@@ -1,103 +1,129 @@
 import { type RefObject, useCallback, useEffect, useRef, useState } from 'react'
 
-import {
-  type ChallengeEvent,
-  type ChallengeOptions,
-  challengeMessage,
-  challengeSrc,
-  parseChallengeEvent,
-} from '@/lib/turnstile-frame'
 import { useLocale } from '@/hooks/use-locale'
 import { useTheme } from '@/hooks/use-theme'
 
 // Turnstile rendered explicitly, hand-rolled rather than through `@marsidev/react-turnstile`
 // (#79): this bundle ships on host pages we do not control, so a dependency is weight.
 //
-// ⚠ **The challenge renders in a frame on SahajCloud's origin, never in the host's document
-// (#343, sydevs/SahajCloud#1072).** `src/lib/turnstile-frame.ts` owns that reasoning and the
-// protocol; SahajCloud owns the page and both halves of the key. Nothing here branches on embed
-// mode, so one code path is the only one anybody tests.
+// ⚠ **The challenge renders in a frame SahajCloud serves, never in the host's document (#343,
+// sydevs/SahajCloud#1072).** Turnstile validates the hostname of the document that renders it, so
+// one SahajCloud hostname covers every partner. SahajCloud holds both halves of the key and decides
+// which parents may receive a token; this file only frames the page and listens to it.
+//
+// ⚠ **Cross-repo contract** with SahajCloud's `src/endpoints/atlas/challenge/`: the path, the query
+// parameters, the channel, each message `type` and the `origin` reason. Change them in both repos
+// in the same release — a drifted protocol fails silently, the frame waiting out its handshake.
 //
 // ⚠ **The challenge is not lazy — that inverted in #182.** Registration cannot happen without a
-// token, so a challenge that cannot load fails the widget rather than degrading the form, as
-// soon as the INTERFACE mounts (`useTurnstileGuard`). A host with a stale CSP hears it from
-// their own page, not from a visitor who could not register.
+// token, so a challenge that cannot load fails the widget as soon as the INTERFACE mounts
+// (`useTurnstileGuard`), and a host with a stale CSP hears it from their own page.
+
+const CHALLENGE_PATH = '/api/atlas/challenge'
 
-/** Cloudflare's own widget is 300×65. The frame is sized to it, since nothing else is on the page. */
+/**
+ * Stamped on every message, both ways. `source` and `origin` pin a message to SahajCloud's page,
+ * but that page also runs Cloudflare's `api.js`, so they cannot tell this protocol from anything
+ * else its scripts post.
+ */
+const CHALLENGE_CHANNEL = 'sahaj-atlas-turnstile'
+
+/** `ready` is the handshake: Turnstile is live in the frame. */
+type ChallengeEvent =
+  | { type: 'ready' }
+  | { type: 'expired' }
+  | { type: 'token'; token: string }
+  /** `origin`: SahajCloud refused this page's origin — no client record lists its domain. */
+  | { type: 'error'; reason?: 'origin' }
+
+function readChallengeEvent(data: unknown): ChallengeEvent | null {
+  if (typeof data !== 'object' || data === null) return null
+
+  const { channel, type, token, reason } = data as Record<string, unknown>
+
+  if (channel !== CHALLENGE_CHANNEL) return null
+  if (type === 'ready' || type === 'expired') return { type }
+  // Any other reason is still an error: a newer page must not leave this widget waiting.
+  if (type === 'error') return reason === 'origin' ? { type, reason } : { type }
+  // An empty token would enable Submit and then fail verification, which reads to a visitor as
+  // the form being broken rather than the challenge.
+  if (type === 'token' && typeof token === 'string' && token !== '') return { type, token }
+
+  return null
+}
+
+/** Cloudflare's own widget is 300×65, and nothing else is on the page. */
 const FRAME_WIDTH = 300
 const FRAME_HEIGHT = 65
 
 /**
- * Bounds a frame that neither loads nor errors — a proxy that swallows the request, a refusal on
- * an engine that reports no violation. Nothing blocks on the verdict, so a generous bound costs
- * a late answer rather than a slow first paint.
+ * Bounds a frame that never answers. A `frame-src` that refuses it is silent to its parent, so
+ * this is also how a host's stale CSP is found. Nothing blocks on it, so a generous bound costs a
+ * late answer rather than a slow first paint.
  */
 const HANDSHAKE_TIMEOUT_MS = 10_000
 
 /**
- * Read off Turnstile's own `api.js` on 2026-11-02: what it sets on the widget frame it renders
- * inside our page.
+ * Read off Turnstile's own `api.js` on 2026-11-02: what it sets on the widget frame it renders.
  *
  * ⚠ **Every policy-controlled feature is denied to a cross-origin child by default**, so without
- * this the frame is silently less capable than the script embed it replaces, which ran `api.js`
- * in the HOST's document. Permissions Policy is hierarchical, so it grants nothing we lack.
+ * this the challenge is less capable than when `api.js` ran in the host's document. Permissions
+ * Policy is hierarchical, so it grants nothing the host did not.
  *
- * ⚠ **Private State Tokens cannot be delegated from here.** `api.js` asks for them as
- * `private-token`, gated on `document.featurePolicy.features()`, which in Chromium 153 lists
- * `private-state-token-issuance` and `private-state-token-redemption` instead — so the pair a
- * parent can delegate reaches nothing. `docs/embedding.md` § Permissions Policy has the
- * host-facing half.
+ * ⚠ **Private State Tokens cannot be delegated from here.** `api.js` asks for `private-token`,
+ * gated on `document.featurePolicy.features()`, which in Chromium 153 lists only
+ * `private-state-token-issuance` and `-redemption` — so the pair a parent can delegate reaches
+ * nothing. `docs/embedding.md` § Permissions Policy has the host-facing half.
  */
 const TURNSTILE_FEATURES =
   'cross-origin-isolated; fullscreen; autoplay; keyboard-map; gamepad; xr-spatial-tracking'
 
+type FrameOptions = { theme: 'light' | 'dark' | 'auto'; language: string; probe?: boolean }
+
 /**
- * The frame, its listener, and the one definition of its liveness — for both the hook and the
- * probe.
+ * The frame, its listener, and the one definition of its liveness, for both the hook and the
+ * probe. `event.source` pins a message to this frame's window, which no other document can forge;
+ * `origin` pins it to SahajCloud, so a frame navigated elsewhere cannot answer as the challenge.
  *
- * `event.source` pins a message to this frame's own window, which no other document can forge;
- * `origin` pins it to the origin the `src` was built from, so a frame navigated elsewhere cannot
- * keep answering as the challenge.
- *
- * ⚠ **Silence is delivered as the page's own `error`**, since a frame that never handshakes is as
- * dead as one that failed, and both callers answer `error` already — the probe `false`, the hook
- * `blocked`. No timeout here is what left a form under a refusing `frame-src` on `loading` for
- * ever.
+ * ⚠ **Silence is delivered as the page's own `error`**: a frame that never handshakes is as dead
+ * as one that failed, and both callers already answer `error`.
  */
 function createChallengeFrame(
-  options: Omit<ChallengeOptions, 'parent'>,
-  onEvent: (message: ChallengeEvent | null) => void,
+  { theme, language, probe = false }: FrameOptions,
+  onEvent: (message: ChallengeEvent) => void,
 ) {
+  const url = new URL(CHALLENGE_PATH, import.meta.env.VITE_SAHAJCLOUD_URL)
+
+  // The page posts to this origin and no other, so it must be the document the frame is appended
+  // to — the host's in a script embed, ours in an iframe embed.
+  url.searchParams.set('parent', window.location.origin)
+  url.searchParams.set('theme', theme)
+  url.searchParams.set('language', language)
+  // Handshake only: a hidden render would spend a solve nobody submits.
+  if (probe) url.searchParams.set('probe', '1')
+
   const frame = document.createElement('iframe')
-  // The frame's parent is this document, in a script embed and an iframe embed alike.
-  const src = challengeSrc(import.meta.env.VITE_SAHAJCLOUD_URL, {
-    ...options,
-    parent: window.location.origin,
-  })
 
-  frame.src = src
+  frame.src = url.href
   frame.width = String(FRAME_WIDTH)
   frame.height = String(FRAME_HEIGHT)
   frame.style.border = '0'
-  // A captcha labels itself, but every frame still needs a title, and this is what a
-  // screen-reader user needs to hear.
   frame.title = 'Security check'
-  // SahajCloud reads the parent from the URL, so all this withholds is the host page's path and
-  // query from SahajCloud's logs.
+  // SahajCloud reads the parent from the URL, so this withholds only the host page's path and query.
   frame.referrerPolicy = 'strict-origin'
   frame.allow = TURNSTILE_FEATURES
 
-  const expectedOrigin = new URL(src).origin
   const onMessage = (event: MessageEvent) => {
-    // `contentWindow` is checked for presence as well as identity: a frame with none yet leaves
-    // both sides `null`, so a message carrying no source would pass an identity test alone.
+    // Presence as well as identity: before the frame has a window both sides are `null`, and a
+    // message carrying no source would pass an identity test alone.
     if (!frame.contentWindow || event.source !== frame.contentWindow) return
-    if (event.origin !== expectedOrigin) return
+    if (event.origin !== url.origin) return
 
-    const message = parseChallengeEvent(event.data)
+    const message = readChallengeEvent(event.data)
 
-    if (message) clearTimeout(timer)
+    if (!message) return
 
+    clearTimeout(timer)
     onEvent(message)
   }
   const timer = setTimeout(() => onEvent({ type: 'error' }), HANDSHAKE_TIMEOUT_MS)
@@ -110,104 +136,63 @@ function createChallengeFrame(
     frame.remove()
   }
 
-  return { frame, expectedOrigin, dispose }
+  return { frame, origin: url.origin, dispose }
 }
 
 /**
- * Why the probe answered as it did, so the console advice can name the one fix that applies.
- * `csp`: the host's policy refused the frame. `origin`: SahajCloud refused this page's origin,
- * which is in no client record's allowed domains. `failed`: anything else — a page that errored,
- * an absent site key, or silence until the handshake timeout.
+ * `origin`: SahajCloud refused this page's origin. `failed`: anything else — a page that errored,
+ * an absent site key, or a frame refused by the host's CSP, which is silent until the timeout.
  */
-export type TurnstileVerdict = 'available' | 'csp' | 'origin' | 'failed'
+export type TurnstileVerdict = 'available' | 'origin' | 'failed'
 
 /** Shared by every mount on the page. Cleared on a negative verdict, so a blip is retried. */
 let availability: Promise<TurnstileVerdict> | null = null
 
 /**
  * Whether Turnstile can run on this page at all — the host's CSP, SahajCloud's allowlist and the
- * network, not any one form (#182). Resolves rather than rejecting, because every caller wants a
- * verdict.
- *
- * Memoized because the script load this replaced memoized itself: without it a compact embed's
- * open/close/open pays for a browsing context, three of our chunks and a script eval each time.
+ * network, not any one form (#182). Resolves rather than rejecting: every caller wants a verdict.
+ * Memoized, so a compact embed's open/close/open does not pay for a browsing context each time.
  *
- * ⚠ **Weaker than a real render, deliberately.** Probe mode hands back the handshake without
- * rendering, so it sees a `frame-src` that refuses the frame, a parent SahajCloud refuses, an
- * absent site key and a script that loads without defining the API — but not a challenge that
- * renders and then errors, which `useTurnstile`'s `blocked` backstops.
+ * ⚠ **Weaker than a real render, deliberately.** The probe hands back the handshake without
+ * rendering, so it sees whatever stops the page loading Turnstile, but not a challenge that
+ * renders and then errors — `useTurnstile`'s `blocked` backstops that.
  * ⚠ The hostname mismatch it could never see is **gone** rather than unobserved: the challenge
  * always renders on the one hostname the Turnstile key lists, SahajCloud's (#343).
  */
 export async function probeTurnstile(): Promise<TurnstileVerdict> {
   if (typeof document === 'undefined') return 'failed'
 
-  availability ??= runCheck().then((verdict) => {
-    if (verdict !== 'available') availability = null
-
-    return verdict
-  })
-
-  return availability
-}
-
-function runCheck(): Promise<TurnstileVerdict> {
-  return new Promise<TurnstileVerdict>((resolve) => {
-    let settled = false
-    const settle = (verdict: TurnstileVerdict) => {
-      if (settled) return
-
-      settled = true
-      document.removeEventListener('securitypolicyviolation', onViolation)
-      dispose()
-      resolve(verdict)
-    }
-
-    // A host refusing to frame SahajCloud fires no load and no error, so this answers before the
-    // handshake timeout — a latency decision, not a second liveness rule.
-    //
-    // Measured in Chromium 153.0.8010.12 against the built page, 2026-11-01: `frame-src 'none'`
-    // and a bare `default-src 'self'` both report `effectiveDirective: 'frame-src'` with
-    // `blockedURI` the BARE ORIGIN, no trailing slash and no path — hence `startsWith`.
-    // `child-src`, `default-src` and `violatedDirective` cover the engines and spellings this
-    // was not measured on.
-    const onViolation = (event: SecurityPolicyViolationEvent) => {
-      const directive = event.effectiveDirective || event.violatedDirective
-
-      if (!/^(frame|child|default)-src$/.test(directive)) return
-      if (!event.blockedURI.startsWith(expectedOrigin)) return
-
-      settle('csp')
-    }
-
-    const { frame, expectedOrigin, dispose } = createChallengeFrame(
+  availability ??= new Promise<TurnstileVerdict>((resolve) => {
+    const { frame, dispose } = createChallengeFrame(
       { theme: 'auto', language: 'auto', probe: true },
       (message) => {
-        if (message?.type === 'ready') settle('available')
-        if (message?.type === 'error') settle(message.reason === 'origin' ? 'origin' : 'failed')
+        if (message.type !== 'ready' && message.type !== 'error') return
+
+        dispose()
+        resolve(message.type === 'ready' ? 'available' : (message.reason ?? 'failed'))
       },
     )
 
-    // Hidden rather than `display: none`, which would still fetch but leave the layout tree —
-    // this keeps the check as close as possible to the frame a form mounts.
-    //
-    // ⚠ `fixed`, not `absolute`. This lands in the HOST page's body, where an out-of-flow element
-    // at its static position still extends the document's scroll area. A fixed one contributes
-    // no scroll to somebody else's page.
+    // ⚠ `fixed`, not `absolute`: this lands in the HOST page's body, where an out-of-flow element
+    // at its static position still extends the scroll area. Hidden rather than `display: none`,
+    // to keep the check as close as possible to the frame a form mounts.
     frame.style.cssText =
       'position:fixed;top:0;left:0;width:1px;height:1px;opacity:0;pointer-events:none;border:0'
     frame.setAttribute('aria-hidden', 'true')
     frame.tabIndex = -1
-
-    document.addEventListener('securitypolicyviolation', onViolation)
     document.body.appendChild(frame)
+  }).then((verdict) => {
+    if (verdict !== 'available') availability = null
+
+    return verdict
   })
+
+  return availability
 }
 
 /**
- * `loading` until the challenge renders, `blocked` when Turnstile is unavailable: no site key, a
- * CSP-blocked frame, or a widget that errors out. A caller must degrade on `blocked` rather than
- * leave a submit button that can never produce a token.
+ * `loading` until the challenge renders, `blocked` when Turnstile is unavailable. A caller must
+ * degrade on `blocked` rather than leave a submit button that can never produce a token.
  */
 export type TurnstileStatus = 'loading' | 'ready' | 'blocked'
 
@@ -236,9 +221,8 @@ export type UseTurnstile = {
 
 export function useTurnstile({ disabled = false }: UseTurnstileOptions = {}): UseTurnstile {
   const challengeRef = useRef<HTMLDivElement>(null)
-  // In a ref as well as the effect closure, so `reset` reaches the live frame without re-running
-  // the effect. The origin rides along so `reset` addresses the frame as narrowly as the inbound
-  // filter reads it: a frame navigated elsewhere receives nothing rather than a command.
+  // A ref as well as the effect closure, so `reset` reaches the live frame without re-running the
+  // effect. The origin rides along so a frame navigated elsewhere receives no command.
   const frameRef = useRef<{ frame: HTMLIFrameElement; origin: string } | null>(null)
   const [token, setToken] = useState<string | null>(null)
   const [status, setStatus] = useState<TurnstileStatus>(disabled ? 'blocked' : 'loading')
@@ -253,10 +237,10 @@ export function useTurnstile({ disabled = false }: UseTurnstileOptions = {}): Us
     setToken(null)
     setStatus('loading')
 
-    const { frame, expectedOrigin, dispose } = createChallengeFrame(
+    const { frame, origin, dispose } = createChallengeFrame(
       { theme, language: languageCode },
       (message) => {
-        switch (message?.type) {
+        switch (message.type) {
           case 'ready':
             setStatus('ready')
             break
@@ -278,7 +262,7 @@ export function useTurnstile({ disabled = false }: UseTurnstileOptions = {}): Us
       },
     )
 
-    frameRef.current = { frame, origin: expectedOrigin }
+    frameRef.current = { frame, origin }
     challengeRef.current.appendChild(frame)
 
     return () => {
@@ -296,7 +280,7 @@ export function useTurnstile({ disabled = false }: UseTurnstileOptions = {}): Us
     if (!live?.frame.contentWindow) return
 
     setToken(null)
-    live.frame.contentWindow.postMessage(challengeMessage({ type: 'reset' }), live.origin)
+    live.frame.contentWindow.postMessage({ channel: CHALLENGE_CHANNEL, type: 'reset' }, live.origin)
   }, [])
 
   return { challengeRef, token, status, reset }
diff --git a/src/lib/turnstile-frame.test.ts b/src/lib/turnstile-frame.test.ts
deleted file mode 100644
index a519a656..00000000
--- a/src/lib/turnstile-frame.test.ts
+++ /dev/null
@@ -1,100 +0,0 @@
-import { describe, expect, it } from 'vitest'
-
-import {
-  CHALLENGE_CHANNEL,
-  CHALLENGE_PATH,
-  challengeMessage,
-  challengeSrc,
-  parseChallengeEvent,
-} from './turnstile-frame'
-
-/**
- * The frame protocol, in the node lane. The transport is spec'd in `use-turnstile.test.tsx`,
- * which needs a DOM; everything here is a string. The page's half lives in SahajCloud and is
- * spec'd there (`tests/unit/atlas-challenge.spec.ts`).
- */
-
-const SERVER = 'https://cloud.sydevelopers.com'
-const OPTIONS = { parent: 'https://partner.org', theme: 'dark', language: 'cs' } as const
-
-describe('challengeSrc', () => {
-  it('addresses the challenge page on the SahajCloud origin', () => {
-    const url = new URL(challengeSrc(SERVER, OPTIONS))
-
-    expect(url.origin).toBe(SERVER)
-    expect(url.pathname).toBe(CHALLENGE_PATH)
-  })
-
-  it('carries the parent origin, theme and language the page renders with', () => {
-    const url = new URL(challengeSrc(SERVER, OPTIONS))
-
-    // The page hands its token to this origin and no other, so it is the one parameter whose
-    // loss would silently break every embed: SahajCloud refuses a frame that names no parent.
-    expect(url.searchParams.get('parent')).toBe('https://partner.org')
-    expect(url.searchParams.get('theme')).toBe('dark')
-    expect(url.searchParams.get('language')).toBe('cs')
-    expect(url.searchParams.get('probe')).toBeNull()
-  })
-
-  it('marks a probe frame, so it hands back the handshake and renders nothing', () => {
-    const url = new URL(challengeSrc(SERVER, { ...OPTIONS, probe: true }))
-
-    expect(url.searchParams.get('probe')).toBe('1')
-  })
-
-  it('follows a local SahajCloud, so `pnpm dev` against one frames it', () => {
-    expect(new URL(challengeSrc('http://localhost:3000', OPTIONS)).origin).toBe(
-      'http://localhost:3000',
-    )
-  })
-})
-
-describe('parseChallengeEvent', () => {
-  const on = (message: Record<string, unknown>) => ({ channel: CHALLENGE_CHANNEL, ...message })
-
-  it.each(['ready', 'expired', 'error'])('reads %s', (type) => {
-    expect(parseChallengeEvent(on({ type }))).toEqual({ type })
-  })
-
-  it.each(['origin', 'unavailable'] as const)('keeps the refusal reason %s', (reason) => {
-    expect(parseChallengeEvent(on({ type: 'error', reason }))).toEqual({ type: 'error', reason })
-  })
-
-  it('reads an unknown reason as a plain error rather than ignoring it', () => {
-    // A newer page must never make an older widget wait out its handshake timeout.
-    expect(parseChallengeEvent(on({ type: 'error', reason: 'quota' }))).toEqual({ type: 'error' })
-  })
-
-  it('reads a token', () => {
-    expect(parseChallengeEvent(on({ type: 'token', token: 'tok' }))).toEqual({
-      type: 'token',
-      token: 'tok',
-    })
-  })
-
-  it.each([
-    // The host page's own cross-frame traffic, which this shape is indistinguishable from
-    // without the channel marker.
-    ['no channel', { type: 'token', token: 'tok' }],
-    ['another channel', { channel: 'other-widget', type: 'token', token: 'tok' }],
-    ['an unknown type', on({ type: 'solved' })],
-    // An empty token would enable Submit and then fail verification, which reads to a visitor
-    // as the form being broken rather than the challenge.
-    ['an empty token', on({ type: 'token', token: '' })],
-    ['a non-string token', on({ type: 'token', token: 42 })],
-    ['no token', on({ type: 'token' })],
-    ['a string', 'ready'],
-    ['null', null],
-  ])('refuses %s', (_label, data) => {
-    expect(parseChallengeEvent(data)).toBeNull()
-  })
-})
-
-describe('challengeMessage', () => {
-  it('stamps the channel on everything the widget sends', () => {
-    expect(challengeMessage({ type: 'reset' })).toEqual({
-      channel: CHALLENGE_CHANNEL,
-      type: 'reset',
-    })
-  })
-})
diff --git a/src/lib/turnstile-frame.ts b/src/lib/turnstile-frame.ts
deleted file mode 100644
index b9e65cdf..00000000
--- a/src/lib/turnstile-frame.ts
+++ /dev/null
@@ -1,110 +0,0 @@
-/**
- * The contract between the widget and the Turnstile challenge page it frames (#343).
- *
- * **Turnstile validates the hostname of the document that RENDERS it, not the top-level page.**
- * The script embed put our React tree in the HOST's document, so every partner hostname off the
- * key's Turnstile list failed with `110200` — measured, including in a nested frame on the same
- * host, where it passed. In a page on one origin of ours, one hostname covers every partner.
- *
- * ⚠ **Cross-repo contract.** The page is SahajCloud's `GET /api/atlas/challenge`
- * (sydevs/SahajCloud#1072, `src/endpoints/atlas/challenge/challengeDocument.ts` there), which holds
- * both halves of the Turnstile key and decides which parents may receive a token. Change the
- * channel, a message `type`, a `reason` or a query parameter in both repos in the same release: a
- * drifted protocol fails silently, the frame waiting out its handshake with nothing on the console.
- */
-
-/** The page's path on the SahajCloud origin. */
-export const CHALLENGE_PATH = '/api/atlas/challenge'
-
-/**
- * Namespaces every message in both directions. The traffic lands on a window the HOST page also
- * owns, and a host may run its own cross-frame messaging — without the marker a message shaped
- * like `{ type: 'token' }` from a chat widget or an analytics bridge would read as a solve.
- */
-export const CHALLENGE_CHANNEL = 'sahaj-atlas-turnstile'
-
-/**
- * Why the page rendered no challenge. `origin`: SahajCloud does not allow the parent — the host's
- * domain is in no client record's allowed domains. `unavailable`: SahajCloud has no site key.
- */
-export type ChallengeRefusal = 'origin' | 'unavailable'
-
-/** What the page tells its parent. `ready` is the handshake: Turnstile is live in the frame. */
-export type ChallengeEvent =
-  | { type: 'ready' }
-  | { type: 'token'; token: string }
-  | { type: 'expired' }
-  | { type: 'error'; reason?: ChallengeRefusal }
-
-/** What the parent tells the page. */
-export type ChallengeCommand = { type: 'reset' }
-
-export type ChallengeOptions = {
-  /**
-   * The origin of the document the frame is appended to — `location.origin`, the host's in a
-   * script embed and ours in an iframe embed. The page talks to that origin and no other, so the
-   * browser refuses its token to any other parent.
-   */
-  parent: string
-  theme: 'light' | 'dark' | 'auto'
-  /** Turnstile's own `language` option — a two-letter code, as the widget's locale gives it. */
-  language: string
-  /**
-   * Hand back `ready` and render nothing. The eager check asks only whether Turnstile can run
-   * here, which the handshake answers; a render would spend a solve nobody submits, against the
-   * account's quota, in a frame the viewer cannot see.
-   */
-  probe?: boolean
-}
-
-/** The frame's `src` on the SahajCloud origin, carrying what the page renders with. */
-export function challengeSrc(serverUrl: string, options: ChallengeOptions): string {
-  const url = new URL(CHALLENGE_PATH, serverUrl)
-
-  url.searchParams.set('parent', options.parent)
-  url.searchParams.set('theme', options.theme)
-  url.searchParams.set('language', options.language)
-  if (options.probe) url.searchParams.set('probe', '1')
-
-  return url.href
-}
-
-/** The envelope both parsers read: an object on our channel, or `null` for anything else. */
-const onChannel = (data: unknown): Record<string, unknown> | null =>
-  typeof data === 'object' &&
-  data !== null &&
-  'channel' in data &&
-  data.channel === CHALLENGE_CHANNEL
-    ? (data as Record<string, unknown>)
-    : null
-
-/** The page's message, or `null` for anything else on the window. */
-export function parseChallengeEvent(data: unknown): ChallengeEvent | null {
-  const message = onChannel(data)
-
-  if (!message) return null
-
-  switch (message.type) {
-    case 'ready':
-    case 'expired':
-      return { type: message.type }
-    case 'error':
-      // An unknown reason is still an error: a newer page must not make an older widget hang.
-      return message.reason === 'origin' || message.reason === 'unavailable'
-        ? { type: 'error', reason: message.reason }
-        : { type: 'error' }
-    case 'token':
-      // An empty token would enable Submit and then fail verification, which reads to a visitor
-      // as the form being broken rather than the challenge.
-      return typeof message.token === 'string' && message.token !== ''
-        ? { type: 'token', token: message.token }
-        : null
-    default:
-      return null
-  }
-}
-
-/** Wraps an outgoing message, so the channel cannot be forgotten. */
-export function challengeMessage<T extends ChallengeEvent | ChallengeCommand>(message: T) {
-  return { channel: CHALLENGE_CHANNEL, ...message }
-}
diff --git a/src/test-support/turnstile-frame.ts b/src/test-support/turnstile-frame.ts
index e52f8c06..4f4729c8 100644
--- a/src/test-support/turnstile-frame.ts
+++ b/src/test-support/turnstile-frame.ts
@@ -1,12 +1,19 @@
 import { vi } from 'vitest'
 
-import { CHALLENGE_CHANNEL, type ChallengeEvent, challengeMessage } from '@/lib/turnstile-frame'
+/**
+ * SahajCloud's wire format (`src/endpoints/atlas/challenge/` there), written out rather than
+ * imported: the hook keeps its protocol private, and a stub speaking it through the hook's own
+ * constant would pass with both sides wrong together.
+ */
+const CHANNEL = 'sahaj-atlas-turnstile'
+
+/** A message as SahajCloud's page posts it, before the channel is stamped on. */
+export type PageMessage = { type: string } & Record<string, unknown>
 
-/** The reset command as SahajCloud's page reads it: on our channel, `type: 'reset'`. */
 const isReset = (data: unknown) =>
   typeof data === 'object' &&
   data !== null &&
-  (data as Record<string, unknown>).channel === CHALLENGE_CHANNEL &&
+  (data as Record<string, unknown>).channel === CHANNEL &&
   (data as Record<string, unknown>).type === 'reset'
 
 /**
@@ -53,12 +60,12 @@ export function challengeFrameStub(container: ParentNode) {
  */
 export function sendFromFrame(
   frame: HTMLIFrameElement,
-  message: ChallengeEvent,
+  message: PageMessage,
   overrides: MessageEventInit = {},
 ) {
   window.dispatchEvent(
     new MessageEvent('message', {
-      data: challengeMessage(message),
+      data: { channel: CHANNEL, ...message },
       origin: new URL(frame.src).origin,
       source: frame.contentWindow,
       ...overrides,

From 1451d06ee2c90afe9ae96febf1b76d30ad1c0919 Mon Sep 17 00:00:00 2001
From: Devindra <devindra@Devindras-MacBook-Pro.local>
Date: Tue, 3 Nov 2026 14:06:47 -0700
Subject: [PATCH 14/14] refactor(turnstile): slim the probe verdict and the
 host-facing docs

The probe resolves a boolean again, as before #343. Its two negative causes, a CSP that refuses
SahajCloud's frame and a domain no client record lists, now share one console line naming both
fixes; the browser logs a CSP refusal itself beside it, which tells them apart. That removes
`TurnstileVerdict`, the guard's two-branch advice and SahajCloud's `reason` field with it
(sydevs/SahajCloud#1072).

The three "ignores a message from" cases become one table, and the probe spec loses an unused
helper.

The docs describe the arrangement as it is, leaving its history to the changelog entry: the
embedding guide drops its migration notes ("used to", "has CHANGED", "is not the answer any
more") and the troubleshooting table regains its base widths, and the environment, deployment
and testing notes lose their accounts of what #259's key and guard used to be.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                                  |  30 +---
 README.md                                     |  12 +-
 docs/embedding.md                             | 163 +++++++-----------
 docs/environment.md                           |   5 +-
 docs/rules/deployment.md                      |   4 -
 docs/testing.md                               |   6 +-
 src/hooks/use-turnstile-guard.test.tsx        |  40 ++---
 src/hooks/use-turnstile-guard.ts              |  47 ++---
 src/hooks/use-turnstile.test.tsx              |  62 +++----
 src/hooks/use-turnstile.ts                    |  40 ++---
 .../CompactEmbedView.mount.test.tsx           |   4 -
 11 files changed, 144 insertions(+), 269 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a96172dc..0e7268e3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -46,29 +46,17 @@ cover everything a host would notice since the widget was first deployed.
 
 - ⚠ **BREAKING: your CSP needs `frame-src https://cloud.sydevelopers.com`, and the three
   `challenges.cloudflare.com` entries can go.** ([#343], [SahajCloud#1072]) The captcha that
-  gates every form now renders in a small frame served by `cloud.sydevelopers.com` — the origin
-  already in your `connect-src` — instead of inside your document. So `challenges.cloudflare.com`
-  leaves your `script-src`, `connect-src` and `frame-src`, and that origin joins `frame-src`.
-  **A policy that does not allow the frame shows the error screen**, exactly as a blocked
-  Turnstile did before — and the console names the directive. Leaving the old three in place
-  breaks nothing; they are simply dead.
+  gates every form now renders in a small frame `cloud.sydevelopers.com` serves — the origin
+  already in your `connect-src` — instead of in your document. A policy that does not allow the
+  frame shows the error screen, and the console names the fix.
 
   ⚠ **The captcha renders only on a domain your client record lists** — the same list that
-  already gates the API. A page on any other domain shows the error screen, and the console names
-  the domain to send us. An iframe embed needs nothing listed: there the challenge's parent is the
-  widget's own page.
-
-  Two things improve for you, and neither needs a change. **Onboarding a site needs no Turnstile
-  step**: Turnstile validates the hostname of the document that renders the challenge, so every
-  partner site used to need its hostname registered with Cloudflare before a registration could
-  be sent — and the free plan caps that list at ten. It is one hostname now, whatever page hosts
-  the widget. And **no script of Cloudflare's runs in your document any more**: the requests to
-  `challenges.cloudflare.com` are made by the frame, so your page's URL is no longer the document
-  asking.
-
-  **Your `Permissions-Policy` needs nothing for the captcha.** The frame asks for six features
-  Cloudflare's widget requests, and the challenge renders and solves with all six denied — see
-  the embedding guide's Permissions Policy section.
+  already gates the API. Any other domain shows the error screen. An iframe embed needs nothing
+  listed: there the challenge's parent is the widget's own page.
+
+  **Onboarding a site needs no Turnstile step**: Turnstile checks the hostname of the document
+  that renders the challenge, which is now always `cloud.sydevelopers.com`. No script of
+  Cloudflare's runs in your document, and your `Permissions-Policy` needs nothing for the captcha.
 
 - **A repeat embed report turns into at most one write in any 6 h window.** ([#160]) The widget
   still reports on every page load, and an unchanged report inside that window is answered
diff --git a/README.md b/README.md
index 0d3ea03a..a56f5b5b 100644
--- a/README.md
+++ b/README.md
@@ -99,14 +99,12 @@ SahajCloud's:
   posts load telemetry to `events.mapbox.com`. `map=false` drops the whole
   subtree.
 - **`react-circle-flags.pages.dev`** serves the country flag SVGs
-  (`referrer-policy: no-referrer`); it is in the CSP table in
+  (`referrer-policy: no-referrer`). **`challenges.cloudflare.com`** loads
+  Turnstile as soon as the interface mounts, not when a visitor opens a form
+  (#182) — from a challenge page SahajCloud serves, not from the host's page
+  (#343), so the host allows that page under `frame-src` instead. Both are in
+  the CSP table in
   [`docs/embedding.md`](docs/embedding.md#content-security-policy).
-  **`challenges.cloudflare.com`** loads Turnstile as soon as the interface
-  mounts, not when a visitor opens a form (#182) — but since #343 it is loaded
-  by a challenge page SahajCloud serves (sydevs/SahajCloud#1072), not by the
-  host's page, so it is in no directive of theirs and their URL is never the
-  referrer. The host allows `frame-src` for SahajCloud's origin instead, and
-  that page hands its token only to a page on a domain the client record lists.
 
 None of these has a script-URL opt-out (#149) — each is built so it does not
 need one. A compliance requirement we have not anticipated becomes a setting
diff --git a/docs/embedding.md b/docs/embedding.md
index b3ed31ec..877b5292 100644
--- a/docs/embedding.md
+++ b/docs/embedding.md
@@ -795,12 +795,10 @@ If your page sends a CSP, this is what the widget needs added to it. **It is a l
 additions to your policy, not a policy** — your own sources still have to be in there.
 
 **The captcha needs nothing of yours but a listed domain.** Every form in the widget is behind a
-Cloudflare Turnstile challenge, and that challenge is served, rendered and validated by
-`cloud.sydevelopers.com` — the origin the widget already reads its data from. So onboarding a
-new site needs no key of yours and no account of yours. It renders only for a page on one of the
-domains on your client record, the same list that already gates the API ([What you configure in
-the CMS instead](#what-you-configure-in-the-cms-instead)), so tell us every domain you embed on.
-The `frame-src` line below is the whole of your policy's part.
+Cloudflare Turnstile challenge that `cloud.sydevelopers.com` serves, renders and validates, so it
+needs no key or account of yours. It renders only on a domain your client record lists ([What you
+configure in the CMS instead](#what-you-configure-in-the-cms-instead)) — tell us every domain you
+embed on — and the `frame-src` line below is your policy's whole part.
 
 ```
 script-src  https://sahajatlas.com https://api.mapbox.com https://cdn.usefathom.com
@@ -837,30 +835,18 @@ believing you allowed something you hadn't.
 |                            | `ipwho.is`                                    | the once-per-session IP→city lookup behind "classes near you"                                                                                                                                                                                                                                                                                                                                                                                                                         | **degrades**: the nearby suggestion is skipped                                                                                                                                                                |
 |                            | `cdn.usefathom.com`                           | analytics, conditional as above                                                                                                                                                                                                                                                                                                                                                                                                                                                       | analytics only                                                                                                                                                                                                |
 |                            | `*.sentry.io`                                 | crash reporting. Contacted **only after the widget has already failed**, and only on a build with a DSN.                                                                                                                                                                                                                                                                                                                                                                              | **degrades**: the widget notices the refusal and stops trying for the rest of the page's life                                                                                                                 |
-| `frame-src`                | `cloud.sydevelopers.com`                      | **The captcha — required.** Every write the widget makes is captcha-gated, so registration is impossible without it. The challenge is Cloudflare Turnstile, and it renders in a small frame `cloud.sydevelopers.com` serves rather than in your document, so `challenges.cloudflare.com` belongs in no directive of yours. The frame is mounted as soon as the interface does, so a policy that omits this fails within seconds of the page loading rather than at the moment somebody registers.      | **the widget shows an error screen and does not run.** Not a degradation — see the note below                                                                                                                 |
+| `frame-src`                | `cloud.sydevelopers.com`                      | **The captcha — required.** Every write the widget makes is captcha-gated. The challenge renders in a frame `cloud.sydevelopers.com` serves, so `challenges.cloudflare.com` belongs in no directive of yours. The frame mounts with the interface, so a policy that omits this fails within seconds rather than when somebody registers.                                                                                                                                              | **the widget shows an error screen and does not run.** Not a degradation — see the note below                                                                                                                 |
 
 Notes on that table:
 
-**Nothing of Cloudflare's runs in your document, and `'unsafe-eval'` is not wanted here.** The
-challenge is a separate document on `cloud.sydevelopers.com`, which loads Turnstile's `api.js`
-under its own policy and nests Cloudflare's own challenge frame inside itself. So your
-`frame-src` above is the only directive of yours that reaches any of it. **Do not add
-`'unsafe-eval'`**, and do not add `challenges.cloudflare.com` — neither buys you anything, and
-Cloudflare's own CSP guidance for Turnstile is about the page that renders the challenge, which
-is ours rather than yours.
-
-⚠ **A challenge was watched SOLVE on the earlier arrangement, not on this one.** On 2026-10-11 a
-forced interactive challenge rendered in the host's own document was clicked through in six runs
-of six, Chromium 141.0.7390.37, on the policy of that day: the challenge reached its success
-state, the widget took the token, and Submit went from disabled to enabled. What has been
-measured since is that the challenge reaches its success state in a nested frame on the widget's
-origin, the arrangement before this one, and that `frame-src` is what refuses it — not a full
-solve-and-submit on a partner site. The page `cloud.sydevelopers.com` serves now is the same
-protocol on a different origin, and has not yet been watched solving in a browser. Two
-things have therefore never been covered in either arrangement: nothing was posted to the
-backend, so the measurement ends at the token rather than at an accepted submission, and map
-mode was not measured, for want of a Mapbox token. Tell us if a challenge will not solve on
-this policy.
+**Do not add `'unsafe-eval'` or `challenges.cloudflare.com`.** The challenge page on
+`cloud.sydevelopers.com` loads Turnstile's `api.js` under its own policy, so your `frame-src`
+above is the only directive of yours that reaches any of it.
+
+⚠ **The challenge page has not yet been watched solving in a browser.** The same protocol solved
+on this policy in Chromium 141 on 2026-10-11, when the challenge rendered in the host's document,
+but no measurement has gone past the token to an accepted submission, or covered map mode. Tell us
+if a challenge will not solve on this policy.
 
 **The `style-src` row was measured, not deduced** — Chromium 141, 2026-10-10, against a
 `map=false` embed served with the policy above and `'unsafe-inline'` removed from `style-src`
@@ -920,22 +906,13 @@ what of — on Chromium, which is the only engine that degradation was measured
 it: a visitor who gets your typeface and no place search is still worse off. But do not trade a
 load-bearing entry away to afford it.
 
-⚠ **The captcha entry is on that list, and it is the one that can break a page which used to
-work.** It was once a degradation: a host that blocked the challenge got a working atlas whose
-report form offered an email address instead of a submit button. It is now fatal, deliberately —
-**every write the widget makes is captcha-gated, registration included, and registration is the
-thing the atlas exists for.** A blocked challenge meant a visitor could browse classes and then
-silently fail to sign up for one, with no reason for the page owner to suspect anything was
-wrong. Failing loudly is worse for five minutes and better thereafter.
-
-⚠ **Which line that entry is has CHANGED.** It used to be `challenges.cloudflare.com`, under
-`script-src`, `frame-src` and `connect-src`. It is now `https://cloud.sydevelopers.com` under
-`frame-src` alone — the origin already in your `connect-src` — and the three Cloudflare entries
-can go. A policy still carrying the old three is not broken by this — they are simply dead — but
-one that never had `frame-src https://cloud.sydevelopers.com` will show the error screen. The
-widget writes the fix to the browser console — the directive, or that your domain is not yet on
-your client record — so a developer looking at the page gets the answer without opening this
-document.
+⚠ **The captcha entry is fatal on purpose.** **Every write the widget makes is captcha-gated,
+registration included, and registration is the thing the atlas exists for.** A degraded challenge
+would let a visitor browse classes and then silently fail to sign up for one, with no reason for
+the page owner to suspect anything was wrong. Failing loudly is worse for five minutes and better
+thereafter. The widget writes both possible fixes to the browser console — this directive, or the
+domain to have listed on your client record — so a developer looking at the page gets the answer
+without opening this document.
 
 Everything else degrades to exactly what its "Blocked ⇒" column says — a missing typeface, a
 search field that offers no places, missing photography, missing flags, no analytics, no
@@ -965,22 +942,14 @@ by a `Permissions-Policy` header on your own page.
 you send a `Permissions-Policy` header, allow these three for your own origin. If you embed in
 an iframe, put them in its `allow` attribute as shown above.
 
-### The captcha frame asks for six more, and needs none of them
-
-The captcha renders in a frame on `cloud.sydevelopers.com` (see
-[Content-Security-Policy](#content-security-policy)), and that frame carries
-`allow="cross-origin-isolated; fullscreen; autoplay; keyboard-map; gamepad;
-xr-spatial-tracking"` — the same six Cloudflare's own Turnstile widget asks for one level
-further in. They are listed here because a `Permissions-Policy` header of yours that denies
-them does reach that frame, not because registration depends on them: measured in Chromium
-153, the challenge renders and solves with all six denied. **Nothing to add to your header or
-your `allow` attribute for the captcha.**
+### The captcha frame needs nothing from your policy
 
-⚠ **Private State Tokens are not among them, and adding them achieves nothing.** Turnstile's
-widget frame requests that capability under the pre-standard name `private-token`, which no
-current engine publishes — Chromium 153 publishes `private-state-token-issuance` and
-`private-state-token-redemption` — so no policy either of us writes can delegate it to the
-code that would use it.
+The captcha's frame carries `allow="cross-origin-isolated; fullscreen; autoplay; keyboard-map;
+gamepad; xr-spatial-tracking"`, the six features Turnstile's own widget asks for. A
+`Permissions-Policy` of yours that denies them does reach the frame, but the challenge renders and
+solves with all six denied (Chromium 153), so add nothing for the captcha. ⚠ **Private State
+Tokens are not among them**: Turnstile asks for them as `private-token`, a name no current engine
+publishes, so no policy either of us writes can delegate them.
 
 ## Where to load it from
 
@@ -1086,13 +1055,11 @@ Seven honest exceptions, none of them styling your content:
   and without them the widget draws no borders and no shadows. Like the widget's own sheet, it is
   constructed, so it asks nothing new of your [CSP](#content-security-policy).
 
-- **A 1-pixel hidden `<iframe>` sits in your `<body>` for a moment after the widget mounts**,
-  and is removed again as soon as it has answered. It is the captcha's availability check: it
-  loads the challenge page from `cloud.sydevelopers.com` and asks whether it may run here, so a
-  page where registration is impossible says so within seconds rather than at the moment somebody
-  tries to sign up. It is `position: fixed`, fully transparent, not focusable and hidden from
-  assistive technology, and it adds nothing to your page's scroll height. Nothing else of yours
-  is touched.
+- **A 1-pixel hidden `<iframe>` sits in your `<body>` for a moment after the widget mounts.** It
+  is the captcha's availability check, loading the challenge page from `cloud.sydevelopers.com`
+  so that a page where registration is impossible says so within seconds. It is
+  `position: fixed`, transparent, unfocusable, hidden from assistive technology, and adds no
+  scroll height.
 
 **The reverse direction is a boundary, not a defence.** The widget renders inside a **shadow
 root**, so a selector in your stylesheet cannot match an element inside it — at any specificity,
@@ -1208,14 +1175,12 @@ maintainers rather than editing the snippet:
   carries the visitor's **`navigator.userAgent`**. No global error handler is installed, so your
   own scripts' exceptions are never captured. No breadcrumbs, no session replay.
 
-**The captcha's own requests no longer come from your page.** Cloudflare Turnstile gates every
-form in the widget, and the challenge is now a small frame served from `cloud.sydevelopers.com`, so
-the requests to `challenges.cloudflare.com` are made by that frame's document rather than by
-yours. Cloudflare still sees the visitor's IP, as it did before — what changed is that it no
-longer sees your page as the document asking, and no script of Cloudflare's runs in your
-document. The frame's URL carries your page's **origin** — scheme, host and port, never a path —
-because that is the one window the challenge will hand its token to. The frame is mounted as soon
-as the interface is, so this happens whether or not the visitor opens a form.
+**The captcha talks to Cloudflare from a frame, not from your page.** The Turnstile challenge
+gating every form is a small frame served from `cloud.sydevelopers.com`, and that frame's document
+makes the requests to `challenges.cloudflare.com` — so Cloudflare sees the visitor's IP but not
+your page, and no script of Cloudflare's runs in your document. The frame's URL carries your
+page's **origin** — scheme, host and port, never a path — because that is the one window it hands
+its token to. It mounts with the interface, whether or not the visitor opens a form.
 
 **`map=false` removes the Mapbox flows too** — tiles, the geocoder (which sends the visitor's
 typed query and the map centre to Mapbox), and the map-load telemetry — along with the two
@@ -1282,32 +1247,32 @@ Three things to check when you migrate:
 
 ## Troubleshooting
 
-| Symptom                                                                      | Likely cause                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| ---------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Nothing renders, a 404 for the script**                                    | The filename is `auto.js`. `embed.js` exists but is the widget the loader fetches, not the file you install.                                                                                                                                                                                                                                                                                                                     |
-| **"Not set up correctly" / configuration error**                             | The parameter is `key`, not `api-key` (renamed when configuration moved onto the script URL). The loader logs an error naming it. Otherwise the key is wrong, revoked, or not yet issued.                                                                                                                                                                                                                                        |
-| **Nothing renders, no console error, script loaded fine**                    | `map=false` with no height on the element — it collapsed to zero. Give it `display:block;height:…`.                                                                                                                                                                                                                                                                                                                              |
-| **Console: "the embed script is on this page more than once"**               | Exactly that. Only one widget runs per page, so the second copy renders nothing and its settings are ignored. Remove the extra script tag.                                                                                                                                                                                                                                                                                       |
-| **Text is in your own font, and the search field offers no places**          | `style-src 'unsafe-inline'` is missing from your CSP. The console says `Refused to apply inline style`, and the violation reports name **`style-src-elem`**. The field keeps its box — it falls back to a plain text input — and the rest of the interface keeps its styling, since the widget's own sheet is not governed by `style-src`.                                                                                       |
-| **Labels are English on a non-English page**                                 | Either `connect-src https://cloud.sydevelopers.com` is missing, or that language is not switched on in the CMS. The widget carries English compiled in, so this is what a blocked or unavailable language looks like — ask us to enable the language you need.                                                                                                                                                                   |
-| **Widget loads and styles, but shows an error instead of any events**        | `connect-src https://cloud.sydevelopers.com` is missing.                                                                                                                                                                                                                                                                                                                                                                         |
-| **The map area is blank or grey**                                            | `worker-src blob:` (Mapbox starts its worker from a `blob:` URL), or `api.mapbox.com` missing from `img-src`/`connect-src`.                                                                                                                                                                                                                                                                                                      |
-| **The map renders but has no pins**                                          | `img-src data:` — the pins are inline SVG rasterised from a `data:` URI.                                                                                                                                                                                                                                                                                                                                                         |
-| **Country flags are missing, everything else fine**                          | `img-src https://react-circle-flags.pages.dev`. Cosmetic.                                                                                                                                                                                                                                                                                                                                                                        |
-| **The widget shows "its security check was blocked" and nothing else**       | Read the browser console, which names one of two causes. Either your CSP blocks the captcha's frame — add `https://cloud.sydevelopers.com` to `frame-src` — or your page's domain is not on your client record, so the challenge refuses to run here — ask us to add it. `challenges.cloudflare.com` is **not** the answer any more: the challenge renders on `cloud.sydevelopers.com`, not in your document. This used to degrade the report form instead — since the atlas cannot take a registration without it, it now fails outright. |
-| **The widget's route never appears in the address bar**                      | The document refuses `history.replaceState` — most often `file://`. The widget detects that and routes in memory.                                                                                                                                                                                                                                                                                                                |
-| **The compact card's button does nothing, in an iframe**                     | The frame is sandboxed without `allow-popups`, so its `target="_blank"` link cannot open. It fails silently, with nothing in the console. Add `allow-popups`, or drop `sandbox`.                                                                                                                                                                                                                                                 |
-| **`atlas=` on the script URL seems to be ignored**                           | The page's own URL already carries an `?atlas=` route, which always wins. That is intended — see [`atlas`, and how the route is chosen](#atlas-and-how-the-route-is-chosen).                                                                                                                                                                                                                                                     |
-| **Sharing offers no link**                                                   | The same memory-routing mode, on a page with no canonical atlas URL to offer instead.                                                                                                                                                                                                                                                                                                                                            |
-| **The widget covers the rest of the page**                                   | A map embed with no height of its own renders `position: fixed; inset: 0`. Give the element a `display: block` and a height to keep the map inside it, or use `map=false` for an embed with no map.                                                                                                                                                                                                                              |
-| **The widget looks wrong on your site only**                                 | Not a selector of yours — the shadow root stops those. Look instead at an inherited property the widget does not restate on its own root, your root `font-size` (the calendar only), or the `sahaj-atlas-fonts` `<style>` missing from your `<head>` — or sitting there inert, which is what a `style-src` without `'unsafe-inline'` leaves behind. See [what the widget does to your page](#what-the-widget-does-to-your-page). |
-| **It broke after working yesterday**                                         | The embed updates in place. Check [`CHANGELOG.md`](../CHANGELOG.md). Then look for a cached `auto.js` or `embed.js` at your edge requesting chunk names that no longer exist.                                                                                                                                                                                                                                                    |
-| **Console: "could not find a place to render"**                              | The snippet is in `<head>`, or carries `async`/`defer`. Move it into the body without those attributes, or add an empty `<sahaj-atlas></sahaj-atlas>` where the widget should appear.                                                                                                                                                                                                                                            |
-| **Nothing renders; console: "Cannot use import statement outside a module"** | The script tag lost its `type="module"`. An optimizer or an HTML5-cleanup filter rewrote the tag, or combined `auto.js` into a classic bundle. Exclude `auto.js` from minifying, combining and delaying, and from any filter that rewrites script tags. None of the widget runs in this state, so this browser error is the only report you get.                                                                                 |
-| **Console: "could not load the widget"**                                     | The loader ran, but `embed.js` or one of its `assets/` chunks did not load — the error printed with it names the URL. Look for that request in the network panel: a blocker, a CSP rule, or a stale copy cached at your edge (see [Updates and caching](#updates-and-caching)).                                                                                                                                                  |
-| **The widget shows an error after the page is translated**                   | A translation plugin rewrote the widget's text in the browser and ignored its `translate="no"`. Add `sahaj-atlas` to the plugin's excluded elements — see [the widget follows your page's language](#the-widget-follows-your-pages-language).                                                                                                                                                                                    |
-| **Console: "no `key` parameter on the embed script URL"**                    | The query string is missing or was stripped. Some page builders drop everything after `?` from a script URL — if so, that platform cannot host the widget this way. Talk to the maintainers.                                                                                                                                                                                                                                     |
-| **The widget only appears when you scroll to it**                            | Intended. The loader defers fetching the widget until it nears the viewport. A below-the-fold widget therefore costs visitors nothing until they reach it.                                                                                                                                                                                                                                                                       |
+| Symptom                                                                      | Likely cause                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Nothing renders, a 404 for the script**                                    | The filename is `auto.js`. `embed.js` exists but is the widget the loader fetches, not the file you install.                                                                                                                                                                                                                                                                                                                                                                                                  |
+| **"Not set up correctly" / configuration error**                             | The parameter is `key`, not `api-key` (renamed when configuration moved onto the script URL). The loader logs an error naming it. Otherwise the key is wrong, revoked, or not yet issued.                                                                                                                                                                                                                                                                                                                     |
+| **Nothing renders, no console error, script loaded fine**                    | `map=false` with no height on the element — it collapsed to zero. Give it `display:block;height:…`.                                                                                                                                                                                                                                                                                                                                                                                                           |
+| **Console: "the embed script is on this page more than once"**               | Exactly that. Only one widget runs per page, so the second copy renders nothing and its settings are ignored. Remove the extra script tag.                                                                                                                                                                                                                                                                                                                                                                    |
+| **Text is in your own font, and the search field offers no places**          | `style-src 'unsafe-inline'` is missing from your CSP. The console says `Refused to apply inline style`, and the violation reports name **`style-src-elem`**. The field keeps its box — it falls back to a plain text input — and the rest of the interface keeps its styling, since the widget's own sheet is not governed by `style-src`.                                                                                                                                                                    |
+| **Labels are English on a non-English page**                                 | Either `connect-src https://cloud.sydevelopers.com` is missing, or that language is not switched on in the CMS. The widget carries English compiled in, so this is what a blocked or unavailable language looks like — ask us to enable the language you need.                                                                                                                                                                                                                                                |
+| **Widget loads and styles, but shows an error instead of any events**        | `connect-src https://cloud.sydevelopers.com` is missing.                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| **The map area is blank or grey**                                            | `worker-src blob:` (Mapbox starts its worker from a `blob:` URL), or `api.mapbox.com` missing from `img-src`/`connect-src`.                                                                                                                                                                                                                                                                                                                                                                                   |
+| **The map renders but has no pins**                                          | `img-src data:` — the pins are inline SVG rasterised from a `data:` URI.                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| **Country flags are missing, everything else fine**                          | `img-src https://react-circle-flags.pages.dev`. Cosmetic.                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| **The widget shows "its security check was blocked" and nothing else**       | Read the browser console, which names both fixes. If the browser also logged a refused frame, your CSP is missing `frame-src https://cloud.sydevelopers.com`; otherwise your page's domain is not on your client record — ask us to add it. Since the atlas cannot take a registration without the captcha, this fails outright rather than degrading the form.                                                                                                                                               |
+| **The widget's route never appears in the address bar**                      | The document refuses `history.replaceState` — most often `file://`. The widget detects that and routes in memory.                                                                                                                                                                                                                                                                                                                                                                                             |
+| **The compact card's button does nothing, in an iframe**                     | The frame is sandboxed without `allow-popups`, so its `target="_blank"` link cannot open. It fails silently, with nothing in the console. Add `allow-popups`, or drop `sandbox`.                                                                                                                                                                                                                                                                                                                              |
+| **`atlas=` on the script URL seems to be ignored**                           | The page's own URL already carries an `?atlas=` route, which always wins. That is intended — see [`atlas`, and how the route is chosen](#atlas-and-how-the-route-is-chosen).                                                                                                                                                                                                                                                                                                                                  |
+| **Sharing offers no link**                                                   | The same memory-routing mode, on a page with no canonical atlas URL to offer instead.                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| **The widget covers the rest of the page**                                   | A map embed with no height of its own renders `position: fixed; inset: 0`. Give the element a `display: block` and a height to keep the map inside it, or use `map=false` for an embed with no map.                                                                                                                                                                                                                                                                                                           |
+| **The widget looks wrong on your site only**                                 | Not a selector of yours — the shadow root stops those. Look instead at an inherited property the widget does not restate on its own root, your root `font-size` (the calendar only), or the `sahaj-atlas-fonts` `<style>` missing from your `<head>` — or sitting there inert, which is what a `style-src` without `'unsafe-inline'` leaves behind. See [what the widget does to your page](#what-the-widget-does-to-your-page).                                                                              |
+| **It broke after working yesterday**                                         | The embed updates in place. Check [`CHANGELOG.md`](../CHANGELOG.md). Then look for a cached `auto.js` or `embed.js` at your edge requesting chunk names that no longer exist.                                                                                                                                                                                                                                                                                                                                 |
+| **Console: "could not find a place to render"**                              | The snippet is in `<head>`, or carries `async`/`defer`. Move it into the body without those attributes, or add an empty `<sahaj-atlas></sahaj-atlas>` where the widget should appear.                                                                                                                                                                                                                                                                                                                         |
+| **Nothing renders; console: "Cannot use import statement outside a module"** | The script tag lost its `type="module"`. An optimizer or an HTML5-cleanup filter rewrote the tag, or combined `auto.js` into a classic bundle. Exclude `auto.js` from minifying, combining and delaying, and from any filter that rewrites script tags. None of the widget runs in this state, so this browser error is the only report you get.                                                                                                                                                              |
+| **Console: "could not load the widget"**                                     | The loader ran, but `embed.js` or one of its `assets/` chunks did not load — the error printed with it names the URL. Look for that request in the network panel: a blocker, a CSP rule, or a stale copy cached at your edge (see [Updates and caching](#updates-and-caching)).                                                                                                                                                                                                                               |
+| **The widget shows an error after the page is translated**                   | A translation plugin rewrote the widget's text in the browser and ignored its `translate="no"`. Add `sahaj-atlas` to the plugin's excluded elements — see [the widget follows your page's language](#the-widget-follows-your-pages-language).                                                                                                                                                                                                                                                                 |
+| **Console: "no `key` parameter on the embed script URL"**                    | The query string is missing or was stripped. Some page builders drop everything after `?` from a script URL — if so, that platform cannot host the widget this way. Talk to the maintainers.                                                                                                                                                                                                                                                                                                                  |
+| **The widget only appears when you scroll to it**                            | Intended. The loader defers fetching the widget until it nears the viewport. A below-the-fold widget therefore costs visitors nothing until they reach it.                                                                                                                                                                                                                                                                                                                                                    |
 
 If none of these fit, the widget's own **Report an issue** form (behind the settings
 control, and offered on most error screens) reaches the maintainers with the failure
diff --git a/docs/environment.md b/docs/environment.md
index 7218d203..29b95455 100644
--- a/docs/environment.md
+++ b/docs/environment.md
@@ -31,10 +31,7 @@ place it is stated — everywhere else in this repo just points here.
 | `SAHAJCLOUD_DOCS_PASSWORD` | `.env.local`                  | HTTP basic-auth password for the SahajCloud OpenAPI docs. Used **only** by the `pnpm types:openapi` script. Never `VITE_`-prefixed — tooling-only, never in the bundle. |
 
 **The widget carries no Turnstile configuration.** Its captcha renders in a page SahajCloud serves
-(`GET /api/atlas/challenge`, sydevs/SahajCloud#1072), and SahajCloud holds both halves of the key —
-`TURNSTILE_SITE_KEY` beside the secret. `VITE_TURNSTILE_SITE_KEY`, its Workers Builds build
-variable and #259's release guard went with the widget's own challenge page: delete the variable
-from the app Worker's production trigger if it is still set, since nothing reads it.
+(`GET /api/atlas/challenge`, sydevs/SahajCloud#1072), which holds both halves of the key.
 
 ## GitHub Actions secrets — the smoke lane's preview (#282)
 
diff --git a/docs/rules/deployment.md b/docs/rules/deployment.md
index 9e665e3a..7ce74d78 100644
--- a/docs/rules/deployment.md
+++ b/docs/rules/deployment.md
@@ -112,10 +112,6 @@ Three facts to remember:
 The Sentry variables are dashboard-only, and owed to **each** target that builds the app. The
 runbook is in `docs/environment.md`.
 
-**Neither Worker carries a Turnstile key.** The captcha renders in a page SahajCloud serves, which
-holds both halves of the key (sydevs/SahajCloud#1072), so #259's release guard and the production
-trigger's `VITE_TURNSTILE_SITE_KEY` build variable went with the widget's own challenge page.
-
 ## Deploy-side CI gates
 
 Two of the four CI gates that exist because each one once missed something, unnoticed (#99).
diff --git a/docs/testing.md b/docs/testing.md
index 06bde9f0..9618f983 100644
--- a/docs/testing.md
+++ b/docs/testing.md
@@ -294,11 +294,7 @@ alert. The lane's last step opens an issue instead, and three things about it ar
   production read, and a ticket claiming production is red when nothing read it is worse than no
   ticket. `ci-workflows.test.ts` pins that gate and the token, since both fail silently.
 
-**No spec is scoped by environment any more.** #259's Turnstile case read the site key back out
-of the bundle, expecting the committed test key on a preview and a real key everywhere else, so a
-bypassed build gate still reddened production. Since sydevs/SahajCloud#1072 the widget carries no
-Turnstile key at all: SahajCloud serves the challenge page and holds both halves, so the build
-gate, the build variable and this case went together. Every spec reads both hosts alike. The lane is **17 cases**, from 13 declarations — count it rather
+Every spec reads both hosts alike. The lane is **17 cases**, from 13 declarations — count it rather
 than trusting a figure, since `.each` makes the two differ. Measured 2026-10-06 against the 16 it
 was then: all 16 passed against `sahajatlas.com`. Re-measured 2026-10-13 against the playground
 on its Worker (`PREVIEW_URL=https://design.sahajatlas.com pnpm test:smoke`, #279): **10 of the 17
diff --git a/src/hooks/use-turnstile-guard.test.tsx b/src/hooks/use-turnstile-guard.test.tsx
index c8f9ac3f..ec0accc3 100644
--- a/src/hooks/use-turnstile-guard.test.tsx
+++ b/src/hooks/use-turnstile-guard.test.tsx
@@ -6,7 +6,7 @@ import { ErrorBoundary } from 'react-error-boundary'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { createRoot } from 'react-dom/client'
 
-import { turnstileAdvice, useTurnstileGuard } from './use-turnstile-guard'
+import { useTurnstileGuard } from './use-turnstile-guard'
 
 import { classifyError } from '@/lib/report'
 
@@ -89,7 +89,7 @@ describe('useTurnstileGuard', () => {
   })
 
   it('renders the interface when Turnstile is available', async () => {
-    probeTurnstile.mockResolvedValue('available')
+    probeTurnstile.mockResolvedValue(true)
 
     await mount()
 
@@ -97,8 +97,8 @@ describe('useTurnstileGuard', () => {
     expect(caught).toBeUndefined()
   })
 
-  it.each(['origin', 'failed'])('fails the widget as `captcha-blocked` on %s', async (verdict) => {
-    probeTurnstile.mockResolvedValue(verdict)
+  it('fails the widget as `captcha-blocked` when Turnstile cannot load', async () => {
+    probeTurnstile.mockResolvedValue(false)
 
     await mount()
 
@@ -110,7 +110,7 @@ describe('useTurnstileGuard', () => {
   })
 
   it('tells the host developer what to change, on the console', async () => {
-    probeTurnstile.mockResolvedValue('failed')
+    probeTurnstile.mockResolvedValue(false)
 
     await mount()
 
@@ -118,30 +118,16 @@ describe('useTurnstileGuard', () => {
 
     // The directive is the only part of this addressed to somebody who can act on it.
     // It must survive the throw that unmounts the tree. That is why the hook orders its steps this way.
-    expect(advice).toContain('frame-src')
     expect(advice).toContain('docs/embedding.md')
-  })
-
-  // ⚠ The advice names SahajCloud's origin, not Cloudflare's or the widget's (#343,
-  // sydevs/SahajCloud#1072): the challenge renders in a frame SahajCloud serves, so naming
-  // anything else would send a developer to edit a line that fixes nothing.
-  it('names the SahajCloud origin under frame-src, and nothing a host no longer needs', () => {
-    const advice = turnstileAdvice('failed', 'https://cloud.sydevelopers.com', 'partner.org')
-
-    expect(advice).toContain('frame-src')
-    expect(advice).toContain('https://cloud.sydevelopers.com')
+    // ⚠ SahajCloud's origin under `frame-src`, not Cloudflare's (#343, sydevs/SahajCloud#1072):
+    // the challenge renders in a frame SahajCloud serves, so naming anything else would send a
+    // developer to edit a line that fixes nothing.
+    expect(advice).toContain(
+      `${new URL(import.meta.env.VITE_SAHAJCLOUD_URL).origin} under \`frame-src\``,
+    )
     expect(advice).not.toContain('challenges.cloudflare.com')
-    expect(advice).not.toContain('script-src')
-  })
-
-  // A host's own policy cannot fix this one, so pointing at `frame-src` would waste the reader's
-  // time: the page's domain is missing from every client record.
-  it('names the domain to have listed when SahajCloud refuses the page', () => {
-    const advice = turnstileAdvice('origin', 'https://cloud.sydevelopers.com', 'partner.org')
-
-    expect(advice).toContain('partner.org')
-    expect(advice).toContain('client record')
-    expect(advice).not.toContain('frame-src')
+    // The other cause, which no policy of theirs can fix: the page's domain is on no client record.
+    expect(advice).toContain(`${window.location.hostname} is not an allowed domain`)
   })
 
   it('does not block the first paint on the probe', async () => {
diff --git a/src/hooks/use-turnstile-guard.ts b/src/hooks/use-turnstile-guard.ts
index 10d78025..85a7360b 100644
--- a/src/hooks/use-turnstile-guard.ts
+++ b/src/hooks/use-turnstile-guard.ts
@@ -1,7 +1,7 @@
 import { useEffect, useState } from 'react'
 
 import { atlasError, reportIntegrationWarning } from '@/lib/report'
-import { type TurnstileVerdict, probeTurnstile } from '@/hooks/use-turnstile'
+import { probeTurnstile } from '@/hooks/use-turnstile'
 
 const GUIDE = 'https://github.com/sydevs/SahajAtlasWeb/blob/main/docs/embedding.md'
 
@@ -14,35 +14,17 @@ const GUIDE = 'https://github.com/sydevs/SahajAtlasWeb/blob/main/docs/embedding.
  * The person who can edit the CSP, or ask for their domain to be listed, gets the fix instead.
  *
  * ⚠ **It names SahajCloud's origin under `frame-src`, not Cloudflare's or ours** (#343,
- * sydevs/SahajCloud#1072). The challenge renders in a frame SahajCloud serves, so
- * `challenges.cloudflare.com` is governed by that frame's own policy and belongs in no directive
- * of the host's. The origin is read off the configured API URL rather than written out, so a
- * build pointed at a local SahajCloud names the host it actually needs allowed.
+ * sydevs/SahajCloud#1072): the challenge renders in a frame SahajCloud serves. The origin is read
+ * off the configured API URL, so a build pointed at a local SahajCloud names the host it needs.
+ * It names both causes rather than carrying SahajCloud's reason for a refusal: the browser logs a
+ * CSP refusal itself, beside this line, which tells the two apart.
  */
-export function turnstileAdvice(
-  verdict: Exclude<TurnstileVerdict, 'available'>,
-  serverOrigin: string,
-  hostname: string,
-): string {
-  const lead =
-    'Turnstile could not load, so registration and issue reports are impossible on this page. '
-
-  if (verdict === 'origin') {
-    return (
-      lead +
-      `${hostname} is not an allowed domain of any Sahaj Atlas client, so the security check refuses to run here. ` +
-      'Ask the Sahaj Atlas team to add it to your client record. ' +
-      `See ${GUIDE}#what-you-configure-in-the-cms-instead`
-    )
-  }
-
-  return (
-    lead +
-    `If this page sends a Content-Security-Policy, allow ${serverOrigin} under \`frame-src\` — ` +
-    'the challenge renders in a frame served from there. ' +
-    `See ${GUIDE}#content-security-policy`
-  )
-}
+const captchaAdvice = (serverOrigin: string, hostname: string) =>
+  'Turnstile could not load, so registration and issue reports are impossible on this page. ' +
+  `Either this page's Content-Security-Policy does not allow ${serverOrigin} under \`frame-src\` ` +
+  '(the browser logs that refusal itself), ' +
+  `or ${hostname} is not an allowed domain on your Sahaj Atlas client record. ` +
+  `See ${GUIDE}#troubleshooting`
 
 /**
  * This fails the widget when Turnstile cannot load. See issue #182.
@@ -75,14 +57,13 @@ export function useTurnstileGuard(): void {
   useEffect(() => {
     let cancelled = false
 
-    void probeTurnstile().then((verdict) => {
-      if (cancelled || verdict === 'available') return
+    void probeTurnstile().then((available) => {
+      if (cancelled || available) return
 
       // This runs before the throw, not after.
       // The throw unmounts this tree, and the console line is the only part of this addressed to somebody who can fix it.
       reportIntegrationWarning(
-        turnstileAdvice(
-          verdict,
+        captchaAdvice(
           new URL(import.meta.env.VITE_SAHAJCLOUD_URL).origin,
           window.location.hostname,
         ),
diff --git a/src/hooks/use-turnstile.test.tsx b/src/hooks/use-turnstile.test.tsx
index ddf95849..2c162336 100644
--- a/src/hooks/use-turnstile.test.tsx
+++ b/src/hooks/use-turnstile.test.tsx
@@ -3,7 +3,7 @@ import { act } from 'react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { createRoot } from 'react-dom/client'
 
-import { type TurnstileVerdict, type UseTurnstile, useTurnstile } from './use-turnstile'
+import { type UseTurnstile, useTurnstile } from './use-turnstile'
 
 import { type PageMessage, sendFromFrame } from '@/test-support/turnstile-frame'
 
@@ -161,25 +161,14 @@ describe('useTurnstile', () => {
     expect(hook.token).toBe('tok-2')
   })
 
-  it('ignores a message from another window', async () => {
+  it.each([
+    ['another window', { source: window }],
+    ['another origin', { origin: 'https://evil.example' }],
+    // Anything else the page's own scripts post, `api.js` among them: same source, same origin.
+    ['no channel', { data: { type: 'token', token: 'tok-other' } }],
+  ])('ignores a token from %s', async (_label, overrides: MessageEventInit) => {
     await mount()
-    fromFrame({ type: 'token', token: 'tok-evil' }, { source: window })
-
-    expect(hook.token).toBeNull()
-  })
-
-  it('ignores a message from another origin', async () => {
-    await mount()
-    fromFrame({ type: 'token', token: 'tok-evil' }, { origin: 'https://evil.example' })
-
-    expect(hook.token).toBeNull()
-  })
-
-  it('ignores a message on another channel', async () => {
-    await mount()
-    // A host page's own cross-frame traffic. Without the channel marker this shape would read
-    // as a solved challenge.
-    fromFrame({ type: 'token', token: 'tok-1' }, { data: { type: 'token', token: 'tok-host' } })
+    fromFrame({ type: 'token', token: 'tok-1' }, overrides)
 
     expect(hook.token).toBeNull()
   })
@@ -299,7 +288,7 @@ describe('probeTurnstile', () => {
    * otherwise read whichever answer the first one cached.
    *
    * ⚠ **Every case runs on fake timers, and that is the only thing that makes them
-   * non-vacuous.** The handshake timeout answers `failed` too, so on real timers a case that
+   * non-vacuous.** The handshake timeout answers `false` too, so on real timers a case that
    * awaits the verdict passes whether the signal it dispatched was read or ignored — it just
    * takes ten seconds about it. Frozen, an ignored signal leaves the verdict pending for good.
    */
@@ -308,7 +297,7 @@ describe('probeTurnstile', () => {
     vi.resetModules()
 
     const { probeTurnstile } = await import('./use-turnstile')
-    const verdicts: (TurnstileVerdict | 'pending')[] = []
+    const verdicts: (boolean | 'pending')[] = []
     const run = () => {
       const index = verdicts.push('pending') - 1
 
@@ -321,7 +310,6 @@ describe('probeTurnstile', () => {
       run,
       done: run(),
       settled: (index = 0) => verdicts[index],
-      calls: () => verdicts.length,
     }
   }
 
@@ -337,7 +325,7 @@ describe('probeTurnstile', () => {
     vi.useRealTimers()
   })
 
-  it('mounts a handshake-only frame and resolves available on ready', async () => {
+  it('mounts a handshake-only frame and resolves true on ready', async () => {
     const probe = await startProbe()
 
     expect(new URL(probeFrame()?.src as string).searchParams.get('probe')).toBe('1')
@@ -345,32 +333,22 @@ describe('probeTurnstile', () => {
     fromProbe({ type: 'ready' })
     await probe.done
 
-    expect(probe.settled()).toBe('available')
+    expect(probe.settled()).toBe(true)
     // The frame is torn down with the verdict: it exists only to produce one.
     expect(probeFrame()).toBeUndefined()
   })
 
-  it('resolves failed when the frame reports any other error', async () => {
-    const probe = await startProbe()
-
-    // What SahajCloud sends with no site key: the host can fix nothing, so no domain advice.
-    fromProbe({ type: 'error', reason: 'unavailable' })
-    await probe.done
-
-    expect(probe.settled()).toBe('failed')
-  })
-
-  it('resolves origin when SahajCloud refuses this page as a parent', async () => {
+  it('resolves false at once when the frame reports an error', async () => {
     const probe = await startProbe()
 
-    // The one refusal a host cannot fix in its own policy, so the advice it earns differs.
-    fromProbe({ type: 'error', reason: 'origin' })
+    // SahajCloud refusing this page's origin, among others: posted the moment the page loads.
+    fromProbe({ type: 'error' })
     await probe.done
 
-    expect(probe.settled()).toBe('origin')
+    expect(probe.settled()).toBe(false)
   })
 
-  it('resolves failed only once the frame has had its full wait', async () => {
+  it('resolves false only once the frame has had its full wait', async () => {
     // A `frame-src` that refuses the frame is silent to its parent, so this is the path a host's
     // stale CSP takes.
     const probe = await startProbe()
@@ -382,7 +360,7 @@ describe('probeTurnstile', () => {
     await vi.advanceTimersByTimeAsync(1)
     await probe.done
 
-    expect(probe.settled()).toBe('failed')
+    expect(probe.settled()).toBe(false)
   })
 
   it('checks once per page and shares the answer', async () => {
@@ -397,7 +375,7 @@ describe('probeTurnstile', () => {
 
     // A compact embed's dialog unmounts its children, so open/close/open would otherwise pay
     // for a whole browsing context, three of our chunks and a Cloudflare script eval each time.
-    expect(probe.settled(1)).toBe('available')
+    expect(probe.settled(1)).toBe(true)
     expect(probeFrame()).toBeUndefined()
   })
 
@@ -417,6 +395,6 @@ describe('probeTurnstile', () => {
     fromProbe({ type: 'ready' })
     await second
 
-    expect(probe.settled(1)).toBe('available')
+    expect(probe.settled(1)).toBe(true)
   })
 })
diff --git a/src/hooks/use-turnstile.ts b/src/hooks/use-turnstile.ts
index 9ce2e916..0cdee3ba 100644
--- a/src/hooks/use-turnstile.ts
+++ b/src/hooks/use-turnstile.ts
@@ -12,8 +12,8 @@ import { useTheme } from '@/hooks/use-theme'
 // which parents may receive a token; this file only frames the page and listens to it.
 //
 // ⚠ **Cross-repo contract** with SahajCloud's `src/endpoints/atlas/challenge/`: the path, the query
-// parameters, the channel, each message `type` and the `origin` reason. Change them in both repos
-// in the same release — a drifted protocol fails silently, the frame waiting out its handshake.
+// parameters, the channel and each message `type`. Change them in both repos in the same release —
+// a drifted protocol fails silently, the frame waiting out its handshake.
 //
 // ⚠ **The challenge is not lazy — that inverted in #182.** Registration cannot happen without a
 // token, so a challenge that cannot load fails the widget as soon as the INTERFACE mounts
@@ -28,23 +28,23 @@ const CHALLENGE_PATH = '/api/atlas/challenge'
  */
 const CHALLENGE_CHANNEL = 'sahaj-atlas-turnstile'
 
-/** `ready` is the handshake: Turnstile is live in the frame. */
+/**
+ * `ready` is the handshake: Turnstile is live in the frame. `error` includes SahajCloud refusing
+ * this page's origin, which no client record lists.
+ */
 type ChallengeEvent =
   | { type: 'ready' }
   | { type: 'expired' }
+  | { type: 'error' }
   | { type: 'token'; token: string }
-  /** `origin`: SahajCloud refused this page's origin — no client record lists its domain. */
-  | { type: 'error'; reason?: 'origin' }
 
 function readChallengeEvent(data: unknown): ChallengeEvent | null {
   if (typeof data !== 'object' || data === null) return null
 
-  const { channel, type, token, reason } = data as Record<string, unknown>
+  const { channel, type, token } = data as Record<string, unknown>
 
   if (channel !== CHALLENGE_CHANNEL) return null
-  if (type === 'ready' || type === 'expired') return { type }
-  // Any other reason is still an error: a newer page must not leave this widget waiting.
-  if (type === 'error') return reason === 'origin' ? { type, reason } : { type }
+  if (type === 'ready' || type === 'expired' || type === 'error') return { type }
   // An empty token would enable Submit and then fail verification, which reads to a visitor as
   // the form being broken rather than the challenge.
   if (type === 'token' && typeof token === 'string' && token !== '') return { type, token }
@@ -139,14 +139,8 @@ function createChallengeFrame(
   return { frame, origin: url.origin, dispose }
 }
 
-/**
- * `origin`: SahajCloud refused this page's origin. `failed`: anything else — a page that errored,
- * an absent site key, or a frame refused by the host's CSP, which is silent until the timeout.
- */
-export type TurnstileVerdict = 'available' | 'origin' | 'failed'
-
 /** Shared by every mount on the page. Cleared on a negative verdict, so a blip is retried. */
-let availability: Promise<TurnstileVerdict> | null = null
+let availability: Promise<boolean> | null = null
 
 /**
  * Whether Turnstile can run on this page at all — the host's CSP, SahajCloud's allowlist and the
@@ -159,17 +153,17 @@ let availability: Promise<TurnstileVerdict> | null = null
  * ⚠ The hostname mismatch it could never see is **gone** rather than unobserved: the challenge
  * always renders on the one hostname the Turnstile key lists, SahajCloud's (#343).
  */
-export async function probeTurnstile(): Promise<TurnstileVerdict> {
-  if (typeof document === 'undefined') return 'failed'
+export async function probeTurnstile(): Promise<boolean> {
+  if (typeof document === 'undefined') return false
 
-  availability ??= new Promise<TurnstileVerdict>((resolve) => {
+  availability ??= new Promise<boolean>((resolve) => {
     const { frame, dispose } = createChallengeFrame(
       { theme: 'auto', language: 'auto', probe: true },
       (message) => {
         if (message.type !== 'ready' && message.type !== 'error') return
 
         dispose()
-        resolve(message.type === 'ready' ? 'available' : (message.reason ?? 'failed'))
+        resolve(message.type === 'ready')
       },
     )
 
@@ -181,10 +175,10 @@ export async function probeTurnstile(): Promise<TurnstileVerdict> {
     frame.setAttribute('aria-hidden', 'true')
     frame.tabIndex = -1
     document.body.appendChild(frame)
-  }).then((verdict) => {
-    if (verdict !== 'available') availability = null
+  }).then((available) => {
+    if (!available) availability = null
 
-    return verdict
+    return available
   })
 
   return availability
diff --git a/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx b/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx
index a2078ef9..2db53034 100644
--- a/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx
+++ b/src/views/CompactEmbedView/CompactEmbedView.mount.test.tsx
@@ -75,10 +75,6 @@ const Sentinel = () => <p>{INTERFACE}</p>
  * This calls the real hook, rather than a stand-in. What is being asserted is that React never
  * renders this subtree, so anything the subtree would do is equally prevented. A fake would
  * only prove the fake stayed unrendered.
- *
- * ⚠ **What the guard mounts is a frame, not a script, since #343** — the challenge renders on
- * SahajCloud now. The cost to a host is the same shape: a document and a request
- * for an interface nobody opened.
  */
 const challengeFrames = () =>
   document.querySelectorAll('iframe[src*="/api/atlas/challenge"]').length