diff --git a/CHANGELOG.md b/CHANGELOG.md
index 20fd982..ffc03d7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,11 +15,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - New exports: `AgentVerifier`, `createAgentVerifier`, `DirectoryCache`, `DEFAULT_SIGNED_AGENT_DIRECTORIES`, and types `AgentVerdict`, `AgentStatus`, `AgentCategory`, `WebBotAuthConfig`, `AgentVerifierOptions`, `SignedAgentDirectory`.
 - Doc: "Verify AI agents with Web Bot Auth in Next.js" (`docs/verify-ai-agents-web-bot-auth.md`).
 
+## [0.10.0] - 2026-07-31
+
+### Added
+- **Honeytoken injection for Fastify.** Express and Next.js gained this in 0.8.x;
+  Fastify still generated a token and left you to place the link. The plugin now
+  injects a hidden trap link into HTML replies and arms the tripwire it points at.
+  - On by default when `apiKey` is set; `honeytoken: false` opts out.
+  - Injected in an `onSend` hook, so only full `text/html` replies are rewritten
+    and Fastify recomputes `Content-Length`.
+  - The token is derived from the API key, so every replica advertises and arms
+    the same path.
+  - **Streamed replies are not rewritten** — buffering a stream to insert an
+    anchor would discard the streaming behaviour the app asked for. The plugin
+    logs a warning once per process with the markup to embed manually, so the
+    gap is visible rather than silent.
+
 ## [0.9.0] - 2026-07-31
 
 ### Added
 - **Bot classification in the request path** — rules can now act on who the
-  User-Agent says it is, which the AI-scraper docs described but nothing could do.
+  User-Agent says it is, synchronously and with no network call.
   - `bots()` rule: `bots({ categories: ['training_crawler'] })`,
     `bots({ ai: true, allow: ['perplexitybot'] })`,
     `bots({ agents: ['gptbot', 'ClaudeBot'], action: 'THROTTLE' })`.
@@ -28,8 +44,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - New exports: `bots`, `BotRule`, `matchUserAgent`, `classifyUserAgent`,
     `BOT_REGISTRY`, `BOT_CATEGORIES`, and types `BotVerdict`, `BotAgent`,
     `BotCategory`, `BotRuleConfig`.
-  - 168 agents generated from the Go registry, matched locally with no network
-    call. Category names match the dashboard's `ai_scraper_category` column.
+  - 168 known agents, matched locally. Category names match the
+    `ai_scraper_category` values shown in your dashboard.
   - `ai: true` covers training crawlers, AI search crawlers, AI agents and AI
     assistants. It excludes `search_crawler` — blocking Googlebot would deindex
     your site.
diff --git a/packages/client/package.json b/packages/client/package.json
index 2000654..f0bcba4 100644
--- a/packages/client/package.json
+++ b/packages/client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/client",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Web Decoy browser widget - signal collection, proof-of-work, and captcha UI",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
diff --git a/packages/client/src/clearance-behavior.test.ts b/packages/client/src/clearance-behavior.test.ts
index e5ede7c..aa7b6c8 100644
--- a/packages/client/src/clearance-behavior.test.ts
+++ b/packages/client/src/clearance-behavior.test.ts
@@ -1,7 +1,7 @@
 /**
  * @jest-environment jsdom
  *
- * Locks the behavioral-clearance contract (app repo #328, PRD FR10): what may
+ * Locks the behavioral-clearance contract : what may
  * leave the browser, when a session is summarized at all, and that scripted
  * input produces measurably different aggregates than a human hand.
  */
diff --git a/packages/client/src/clearance-behavior.ts b/packages/client/src/clearance-behavior.ts
index 16f0a70..0c97a35 100644
--- a/packages/client/src/clearance-behavior.ts
+++ b/packages/client/src/clearance-behavior.ts
@@ -1,5 +1,5 @@
 /**
- * Behavioral human-likelihood for clearance minting (app repo #328, PRD FR10).
+ * Behavioral human-likelihood for clearance minting .
  *
  * A wd_clearance token normally says only "this is a real browser that hasn't
  * tripped deception". This module lets a session also present POSITIVE evidence
diff --git a/packages/client/src/clearance.test.ts b/packages/client/src/clearance.test.ts
index 19e8741..573c21d 100644
--- a/packages/client/src/clearance.test.ts
+++ b/packages/client/src/clearance.test.ts
@@ -1,7 +1,7 @@
 /**
  * @jest-environment jsdom
  *
- * Locks the wd_clearance device-fp contract (#128). The fp is the deny-list key,
+ * Locks the wd_clearance device-fp contract. The fp is the deny-list key,
  * so its exact composition MUST stay byte-identical to the edge challenge page
  * (app repo: edge/clearance-worker). This test pins the canonical string, a golden
  * hash the worker can cross-assert, and the no-canvas/WebGL guarantee.
diff --git a/packages/client/src/clearance.ts b/packages/client/src/clearance.ts
index 291034a..c0dfb56 100644
--- a/packages/client/src/clearance.ts
+++ b/packages/client/src/clearance.ts
@@ -90,7 +90,7 @@ interface MintResponse {
 
 /** Call the public issuance endpoint. Returns null on any failure (fail open).
  *  `behavior`, when present, carries the session's interaction aggregates and
- *  can earn the token a graded 'human-likely' trust level (#328). */
+ *  can earn the token a graded 'human-likely' trust level. */
 async function mint(
   ingestUrl: string,
   siteKey: string,
@@ -156,7 +156,7 @@ export interface ClearanceOptions {
   scope?: string;
   /**
    * Collect interaction aggregates and upgrade the token to a graded
-   * 'human-likely' trust level once the visitor actually interacts (#328).
+   * 'human-likely' trust level once the visitor actually interacts.
    * Default true. Set false to mint clean tokens only — routes that require a
    * minimum trust level will then always challenge.
    *
diff --git a/packages/client/src/global.ts b/packages/client/src/global.ts
index 914851e..178e723 100644
--- a/packages/client/src/global.ts
+++ b/packages/client/src/global.ts
@@ -3,7 +3,7 @@
  *
  * Exposes `window.WebDecoyCaptcha`, auto-initializes any `[data-webdecoy]`
  * elements, and — given a `data-site-key` on the script tag — silently mints a
- * wd_clearance cookie for real browsers (closes the #124 decoy → deny loop in
+ * wd_clearance cookie for real browsers (closes the decoy → deny loop in
  * monitor/allow-and-observe mode). Deferred to idle; no page-load cost.
  *
  *   <script src="webdecoy.global.js" data-site-key="ORG_ID"
diff --git a/packages/client/src/index.ts b/packages/client/src/index.ts
index 6eeda67..91b9e5d 100644
--- a/packages/client/src/index.ts
+++ b/packages/client/src/index.ts
@@ -27,7 +27,7 @@ export { FormAnalyzer, getFormAnalyzer } from './collectors/form';
 export { sha256 } from './sha256';
 export { startClearance, computeDeviceFP, CLEARANCE_COOKIE, FP_VERSION, DEFAULT_INGEST_URL } from './clearance';
 export type { ClearanceOptions, DeviceFPInputs } from './clearance';
-// Behavioral human-likelihood (#328). Exported so the collection contract is
+// Behavioral human-likelihood. Exported so the collection contract is
 // inspectable by anyone integrating — summarizeBehavior IS the published list
 // of what we send.
 export { summarizeBehavior, hasEnoughInteraction, watchInteraction } from './clearance-behavior';
diff --git a/packages/express/package.json b/packages/express/package.json
index 135265f..8dc2bec 100644
--- a/packages/express/package.json
+++ b/packages/express/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/express",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Web Decoy middleware for Express.js",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -40,7 +40,7 @@
     "url": "https://github.com/WebDecoy/node/issues"
   },
   "dependencies": {
-    "@webdecoy/node": "^0.9.0"
+    "@webdecoy/node": "^0.10.0"
   },
   "peerDependencies": {
     "express": "^4.18.0 || ^5.0.0"
diff --git a/packages/express/src/honeytoken-injection.test.ts b/packages/express/src/honeytoken-injection.test.ts
index 92190f0..f0314da 100644
--- a/packages/express/src/honeytoken-injection.test.ts
+++ b/packages/express/src/honeytoken-injection.test.ts
@@ -4,7 +4,7 @@ import { AddressInfo } from 'node:net';
 import { webdecoy } from './middleware';
 
 /**
- * Honeytoken injection through a real Express app (#482).
+ * Honeytoken injection through a real Express app.
  *
  * The unit tests cover the injection function. These cover the part that can
  * corrupt a customer's response: intercepting res.write/res.end. Each case here
@@ -160,7 +160,7 @@ describe('the injected link is actually armed', () => {
 });
 
 /**
- * Streaming SSR (#482 follow-up).
+ * Streaming SSR.
  *
  * The first implementation required `!res.headersSent` before intercepting.
  * Angular SSR — and Nuxt, and anything else that calls `res.writeHead()` then
diff --git a/packages/express/src/middleware.ts b/packages/express/src/middleware.ts
index 5a4bff6..e1f36a7 100644
--- a/packages/express/src/middleware.ts
+++ b/packages/express/src/middleware.ts
@@ -24,27 +24,22 @@ export interface WebDecoyMiddlewareOptions extends ProtectOptions {
    * a rule governs that rule, not the score, and `onBlocked` did not receive
    * `next`, so "record it and serve the request anyway" could not be expressed.
    *
-   * Found by installing it on a live site that takes payments: the homepage
-   * returned `{"error":"Forbidden"}` on the first request, as did an ordinary
-   * `python-requests` user agent.
-   *
-   * Nobody adopts a defence by having it break their site on the first install.
+   *    * Nobody adopts a defence by having it break their site on the first install.
    * Watch what it would have done, then set `mode: 'enforce'`.
    */
   mode?: 'monitor' | 'enforce';
 
   /**
    * Inject a hidden honeytoken link into HTML responses, and arm the tripwire it
-   * points at. Defaults to **on** when an apiKey is present (#482).
+   * points at. Defaults to **on** when an apiKey is present.
    *
    * The SDK used to generate a honeytoken and ask the developer to embed it.
-   * Almost nobody did: `sdk_tripwire` had FOUR rows in production, ever, while
-   * the WordPress plugin — which injects the link itself — has real coverage.
+   * Almost nobody does, and an unplaced link is a trap nothing can walk into.
    *
    * A trap hit is the only detection here that needs no score, no JavaScript, no
    * fingerprint and no IP. It is also the only one that scores: honeypot signals
-   * are weighted 38% against user-agent's 1%, which is why every rule-less `sdk`
-   * detection ever recorded came out at 0.
+   * carry the highest weight in the threat score, while a User-Agent — all a
+   * rule-less install can otherwise report — carries nearly none.
    *
    * Set `false` to opt out, or place the link yourself for apps that stream.
    */
@@ -182,7 +177,7 @@ export function webdecoy(
   const onBlocked = config.onBlocked || defaultOnBlocked;
   const mode = config.mode ?? 'monitor';
 
-  // Honeytoken (#482). Derived from the API key so every replica computes the
+  // Honeytoken. Derived from the API key so every replica computes the
   // same path without coordinating — a random per-process token would advertise
   // a link whose tripwire only one replica had armed.
   //
@@ -230,7 +225,7 @@ export function webdecoy(
         metadata: config.metadata,
       });
 
-      // Honeytoken injection (#482).
+      // Honeytoken injection.
       //
       // Buffers the body only for full HTML documents and rewrites it once. The
       // guards below are not defensive padding — each one is a way this could
@@ -341,7 +336,7 @@ export function webdecoy(
       if (result.allowed) {
         // Attach detection info to request for downstream use
         (req as any).webdecoy = result.detection;
-        // And what the edge validator said, typed (#481). A handler can branch on
+        // And what the edge validator said, typed. A handler can branch on
         // req.webdecoyEdge.isScript instead of string-matching x-wd-class, and
         // `present: false` tells it the edge was never in front of this request —
         // which is no information, not a clean bill of health.
@@ -374,7 +369,7 @@ declare global {
         detection_id: string;
         rule_enforced: boolean;
       };
-      /** What the edge validator said about this request (#481). */
+      /** What the edge validator said about this request. */
       webdecoyEdge?: EdgeVerdict;
     }
   }
diff --git a/packages/fastify/jest.config.js b/packages/fastify/jest.config.js
new file mode 100644
index 0000000..57b4da5
--- /dev/null
+++ b/packages/fastify/jest.config.js
@@ -0,0 +1,8 @@
+/** @type {import('ts-jest').JestConfigWithTsJest} */
+module.exports = {
+  preset: 'ts-jest',
+  testEnvironment: 'node',
+  roots: ['<rootDir>/src'],
+  testMatch: ['**/*.test.ts'],
+  collectCoverageFrom: ['src/**/*.ts', '!src/**/*.test.ts'],
+};
diff --git a/packages/fastify/package.json b/packages/fastify/package.json
index 79451b8..dfeec04 100644
--- a/packages/fastify/package.json
+++ b/packages/fastify/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/fastify",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Web Decoy plugin for Fastify",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -40,7 +40,7 @@
     "url": "https://github.com/WebDecoy/node/issues"
   },
   "dependencies": {
-    "@webdecoy/node": "^0.9.0",
+    "@webdecoy/node": "^0.10.0",
     "fastify-plugin": "^4.5.1"
   },
   "peerDependencies": {
diff --git a/packages/fastify/src/honeytoken-injection.test.ts b/packages/fastify/src/honeytoken-injection.test.ts
new file mode 100644
index 0000000..0a5f7d7
--- /dev/null
+++ b/packages/fastify/src/honeytoken-injection.test.ts
@@ -0,0 +1,192 @@
+import Fastify, { FastifyInstance } from 'fastify';
+import { Readable } from 'node:stream';
+import { webdecoyPlugin } from './plugin';
+
+/**
+ * Honeytoken injection through a real Fastify app.
+ *
+ * Express needed these tests because it wraps res.write/res.end and can corrupt
+ * a response. Fastify's onSend is a supported extension point, so the risk is
+ * narrower — but the failure modes that matter are the same: an anchor landing
+ * in a JSON body, a payload type we should not touch, and the silent
+ * no-injection case that makes a defence look installed while detecting nothing.
+ */
+async function appWith(opts: Record<string, unknown> = {}): Promise<FastifyInstance> {
+  const app = Fastify({ logger: false });
+  await app.register(webdecoyPlugin, {
+    apiKey: 'sk_live_test_secret',
+    skipLocalAnalysis: true,
+    ...opts,
+  });
+
+  app.get('/', (_req, reply) => {
+    reply.type('text/html').send('<html><body><h1>hi</h1></body></html>');
+  });
+  app.get('/api', (_req, reply) => {
+    reply.send({ ok: true, nested: { a: 1 } });
+  });
+  app.get('/text', (_req, reply) => {
+    reply.type('text/plain').send('plain body');
+  });
+  app.get('/stream', (_req, reply) => {
+    reply.type('text/html').send(Readable.from(['<html><body>streamed</body></html>']));
+  });
+
+  await app.ready();
+  return app;
+}
+
+describe('honeytoken injection', () => {
+  it('injects the hidden link into an HTML page', async () => {
+    const app = await appWith();
+    const res = await app.inject({ method: 'GET', url: '/' });
+    await app.close();
+
+    expect(res.statusCode).toBe(200);
+    expect(res.body).toContain('<h1>hi</h1>');
+    expect(res.body).toMatch(/<a href="\/__wd\/[0-9a-f]{12}"/);
+    // Before </body>, not appended after the document — an anchor outside the
+    // body can be relocated by the parser in ways that make it visible.
+    expect(res.body.indexOf('__wd')).toBeLessThan(res.body.indexOf('</body>'));
+  });
+
+  it('hides the link from users and from robots-honouring crawlers', async () => {
+    const app = await appWith();
+    const res = await app.inject({ method: 'GET', url: '/' });
+    await app.close();
+
+    // Catching Googlebot with this would file the customer's own search traffic
+    // as an attack, and reaching it with a screen reader is an accessibility bug.
+    expect(res.body).toContain('rel="nofollow noindex"');
+    expect(res.body).toContain('aria-hidden="true"');
+    expect(res.body).toContain('tabindex="-1"');
+  });
+
+  it('never touches a JSON body', async () => {
+    const app = await appWith();
+    const res = await app.inject({ method: 'GET', url: '/api' });
+    await app.close();
+
+    expect(res.body).not.toContain('__wd');
+    expect(JSON.parse(res.body)).toEqual({ ok: true, nested: { a: 1 } });
+  });
+
+  it('never touches a plain-text body', async () => {
+    const app = await appWith();
+    const res = await app.inject({ method: 'GET', url: '/text' });
+    await app.close();
+
+    expect(res.body).toBe('plain body');
+  });
+
+  it('keeps Content-Length consistent with the rewritten body', async () => {
+    // A stale length truncates the page at the client — the page renders with
+    // the end missing, which looks like an app bug, not a WebDecoy bug.
+    const app = await appWith();
+    const res = await app.inject({ method: 'GET', url: '/' });
+    await app.close();
+
+    // Asserted unconditionally: Fastify recomputes the length from what onSend
+    // returns, and a guarded `if (declared)` would pass silently on the day that
+    // stops being true — which is the day bodies start truncating.
+    const declared = res.headers['content-length'];
+    expect(declared).toBeDefined();
+    expect(Number(declared)).toBe(Buffer.byteLength(res.body, 'utf8'));
+    expect(res.body).toContain('__wd');
+  });
+
+  it('arms the tripwire it advertises', async () => {
+    // The link and the trap must agree. A link with no armed path behind it is
+    // bait that catches nothing, which is the whole defect in #482.
+    const app = await appWith({ mode: 'enforce' });
+    const page = await app.inject({ method: 'GET', url: '/' });
+    const path = /href="(\/__wd\/[0-9a-f]{12})"/.exec(page.body)?.[1];
+    expect(path).toBeDefined();
+
+    const trap = await app.inject({ method: 'GET', url: path as string });
+    await app.close();
+
+    expect(trap.statusCode).toBe(403);
+    expect(JSON.parse(trap.body).rule).toBe('tripwire');
+  });
+
+  it('leaves a streamed reply intact rather than buffering it', async () => {
+    // Buffering a stream to inject a link would trade the customer's streaming
+    // behaviour for a hidden anchor. The response must still be correct.
+    const app = await appWith();
+    const res = await app.inject({ method: 'GET', url: '/stream' });
+    await app.close();
+
+    expect(res.statusCode).toBe(200);
+    expect(res.body).toBe('<html><body>streamed</body></html>');
+    expect(res.body).not.toContain('__wd');
+  });
+
+  it('says so when it skips a streamed reply', async () => {
+    // Silence here is the failure this issue is about: installed, and quietly
+    // detecting nothing. The developer has to be able to find out.
+    const warnings: string[] = [];
+    const app = Fastify({ logger: false });
+    app.log.warn = ((msg: unknown) => {
+      warnings.push(String(msg));
+      return app.log;
+    }) as never;
+
+    await app.register(webdecoyPlugin, { apiKey: 'sk_live_test_secret', skipLocalAnalysis: true });
+    app.get('/stream', (_req, reply) => {
+      reply.type('text/html').send(Readable.from(['<html><body>s</body></html>']));
+    });
+    await app.ready();
+
+    await app.inject({ method: 'GET', url: '/stream' });
+    await app.inject({ method: 'GET', url: '/stream' });
+    await app.close();
+
+    expect(warnings.some((w) => w.includes('honeytoken link was not injected'))).toBe(true);
+    // Once per process, not once per request — a log line per request is noise
+    // that gets filtered, which is the same as not warning at all.
+    expect(warnings.filter((w) => w.includes('honeytoken link was not injected')).length).toBe(1);
+  });
+
+  it('can be turned off', async () => {
+    const app = await appWith({ honeytoken: false });
+    const res = await app.inject({ method: 'GET', url: '/' });
+    await app.close();
+
+    expect(res.body).not.toContain('__wd');
+    expect(res.body).toBe('<html><body><h1>hi</h1></body></html>');
+  });
+
+  it('does nothing without an API key, since the token is derived from it', async () => {
+    const app = Fastify({ logger: false });
+    await app.register(webdecoyPlugin, { skipLocalAnalysis: true } as never);
+    app.get('/', (_req, reply) => {
+      reply.type('text/html').send('<html><body>hi</body></html>');
+    });
+    await app.ready();
+
+    const res = await app.inject({ method: 'GET', url: '/' });
+    await app.close();
+
+    expect(res.body).not.toContain('__wd');
+  });
+
+  it('derives the same path on every boot, so replicas agree', async () => {
+    // Two processes serving the same site must advertise and arm the same path.
+    // A random per-process token would mean a crawler follows a link that only
+    // the other replica had armed.
+    const a = await appWith();
+    const b = await appWith();
+    const pathA = /href="(\/__wd\/[0-9a-f]{12})"/.exec(
+      (await a.inject({ method: 'GET', url: '/' })).body,
+    )?.[1];
+    const pathB = /href="(\/__wd\/[0-9a-f]{12})"/.exec(
+      (await b.inject({ method: 'GET', url: '/' })).body,
+    )?.[1];
+    await a.close();
+    await b.close();
+
+    expect(pathA).toBeDefined();
+    expect(pathA).toBe(pathB);
+  });
+});
diff --git a/packages/fastify/src/plugin.ts b/packages/fastify/src/plugin.ts
index a46f797..83f7094 100644
--- a/packages/fastify/src/plugin.ts
+++ b/packages/fastify/src/plugin.ts
@@ -4,8 +4,17 @@
 
 import { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
 import fp from 'fastify-plugin';
-import { WebDecoy, WebDecoyConfig, RequestMetadata, ProtectOptions } from '@webdecoy/node';
-import type { EdgeVerdict } from '@webdecoy/node';
+import {
+  WebDecoy,
+  WebDecoyConfig,
+  RequestMetadata,
+  ProtectOptions,
+  siteHoneytoken,
+  injectHoneytokenLink,
+  isInjectableHtml,
+  tripwire,
+} from '@webdecoy/node';
+import type { EdgeVerdict, SiteHoneytoken } from '@webdecoy/node';
 
 export interface WebDecoyPluginOptions extends ProtectOptions {
   /**
@@ -14,13 +23,31 @@ export interface WebDecoyPluginOptions extends ProtectOptions {
    * MONITOR IS THE DEFAULT ON PURPOSE, and this changed in 0.7.0. Before,
    * installing this with an API key began returning 403 to any request whose
    * server-side score cleared `threatScoreThreshold` (default 80), and there was
-   * no supported way to watch first. Found by installing it on a live site that
-   * takes payments, where the homepage returned Forbidden on the first request.
+   * no supported way to watch first — which is a good way to take down a site on
+   * the first install.
    *
    * Watch what it would have done, then set `mode: 'enforce'`.
    */
   mode?: 'monitor' | 'enforce';
 
+  /**
+   * Inject a hidden honeytoken link into HTML responses, and arm the tripwire it
+   * points at. Defaults to **on** when an apiKey is present.
+   *
+   * The SDK used to generate a honeytoken and ask the developer to embed it.
+   * Almost nobody does, and an unplaced link is a trap nothing can walk into.
+   *
+   * A trap hit is the only detection here that needs no score, no JavaScript, no
+   * fingerprint and no IP. It is also the only one that scores: honeypot signals
+   * carry the highest weight in the threat score, while a User-Agent — all a
+   * rule-less install can otherwise report — carries nearly none.
+   *
+   * Applies to buffered responses — `reply.send(html)`, `@fastify/view`, and
+   * anything else that hands Fastify a string or Buffer. Streamed replies are
+   * left untouched and logged once; see the `onSend` hook for why.
+   */
+  honeytoken?: boolean;
+
   /**
    * Custom function to extract IP address from request
    * By default, uses request.ip or x-forwarded-for header
@@ -105,7 +132,7 @@ interface WebDecoyDetection {
 declare module 'fastify' {
   interface FastifyRequest {
     webdecoy?: WebDecoyDetection;
-    /** What the edge validator said about this request (#481). */
+    /** What the edge validator said about this request. */
     webdecoyEdge?: EdgeVerdict;
   }
 }
@@ -139,9 +166,31 @@ async function webdecoyPluginImpl(
   const onError = options.onError || defaultOnError;
   const skipPaths = options.skipPaths;
 
+  // Honeytoken. Derived from the API key so every replica computes the
+  // same path without coordinating — a random per-process token would advertise
+  // a link whose tripwire only one replica had armed.
+  //
+  // Resolution is async (WebCrypto HMAC, so this still runs on edge runtimes).
+  // Fastify lets us await it here, because plugin registration is already an
+  // async boot phase — so unlike Express there is no window where early requests
+  // are served without the link.
+  const honeytokenEnabled = (options.honeytoken ?? true) && Boolean(options.apiKey);
+  let token: SiteHoneytoken | null = null;
+  if (honeytokenEnabled) {
+    try {
+      token = await siteHoneytoken({ secret: options.apiKey as string });
+      // Arm the path we are about to advertise. Without this the link is bait
+      // with no trap behind it — a crawler follows it and nothing happens.
+      sdk.addRule(tripwire({ paths: token.activePaths, includeDefaults: false }));
+    } catch {
+      // Deriving the token is not worth a failed boot. No token, no injection.
+      token = null;
+    }
+  }
+
   // Add decorator for webdecoy property
   fastify.decorateRequest('webdecoy', null);
-  // The edge validator's verdict, typed (#481), so a handler can branch on
+  // The edge validator's verdict, typed, so a handler can branch on
   // request.webdecoyEdge.isScript rather than string-matching x-wd-class.
   fastify.decorateRequest('webdecoyEdge', null);
 
@@ -226,6 +275,59 @@ async function webdecoyPluginImpl(
       // Fail open - continue with the request
     }
   });
+
+  // Honeytoken injection.
+  //
+  // Fastify's onSend is purpose-built for this: it hands us the finished payload
+  // and takes back a replacement, so there is no wrapping of reply internals the
+  // way Express requires. Content-Length is recomputed by Fastify from what we
+  // return, so a grown body cannot truncate at the client.
+  //
+  // Each guard below is a way this could corrupt a customer's response, which is
+  // a far worse failure than a missed detection:
+  //
+  //   - non-HTML is left untouched, so an anchor never lands in JSON
+  //   - streams are left untouched (see below)
+  //   - anything thrown falls back to the original payload
+  if (token) {
+    const ht = token;
+    let warnedAboutStream = false;
+
+    fastify.addHook('onSend', async (_req, reply, payload) => {
+      try {
+        if (!isInjectableHtml(reply.getHeader('content-type') as string)) return payload;
+
+        // A streamed reply is left alone on purpose. Buffering it to inject a
+        // link would trade the customer's streaming behaviour — and its memory
+        // profile on large responses — for a hidden anchor, which is not a
+        // trade this plugin gets to make silently on their behalf.
+        //
+        // So it is not silent. The failure this whole issue is about is a
+        // defence that looks installed and detects nothing; a log line once per
+        // process is what makes the gap visible instead.
+        if (payload === null || typeof payload === 'object') {
+          if (!warnedAboutStream) {
+            warnedAboutStream = true;
+            fastify.log.warn(
+              '[WebDecoy] HTML is being streamed, so the honeytoken link was not injected. ' +
+                'Render to a string, or embed the link yourself: ' +
+                `<a href="${ht.primaryPath}" aria-hidden="true" tabindex="-1" rel="nofollow noindex" ` +
+                'style="position:absolute;left:-9999px">.</a>',
+            );
+          }
+          return payload;
+        }
+
+        if (typeof payload !== 'string' && !Buffer.isBuffer(payload)) return payload;
+
+        const html = Buffer.isBuffer(payload) ? payload.toString('utf8') : payload;
+        return injectHoneytokenLink(html, ht.linkHtml);
+      } catch {
+        // Never let injection cost the response.
+        return payload;
+      }
+    });
+  }
 }
 
 export const webdecoyPlugin = fp(webdecoyPluginImpl, {
diff --git a/packages/nextjs/package.json b/packages/nextjs/package.json
index 4c7681c..3273d5c 100644
--- a/packages/nextjs/package.json
+++ b/packages/nextjs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/nextjs",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Web Decoy middleware for Next.js",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -42,7 +42,7 @@
     "url": "https://github.com/WebDecoy/node/issues"
   },
   "dependencies": {
-    "@webdecoy/node": "^0.9.0"
+    "@webdecoy/node": "^0.10.0"
   },
   "peerDependencies": {
     "next": ">=13.0.0"
diff --git a/packages/nextjs/src/edge-verdict.ts b/packages/nextjs/src/edge-verdict.ts
index 1cd3ee4..c888469 100644
--- a/packages/nextjs/src/edge-verdict.ts
+++ b/packages/nextjs/src/edge-verdict.ts
@@ -1,5 +1,5 @@
 /**
- * Read the edge validator's verdict inside a Next.js app (#481).
+ * Read the edge validator's verdict inside a Next.js app.
  *
  * The Cloudflare clearance worker annotates every forwarded request with
  * `x-wd-clearance` and, when the sensor classified the client, `x-wd-class`.
diff --git a/packages/nextjs/src/honeytoken.ts b/packages/nextjs/src/honeytoken.ts
index 5a43306..52548b3 100644
--- a/packages/nextjs/src/honeytoken.ts
+++ b/packages/nextjs/src/honeytoken.ts
@@ -1,5 +1,5 @@
 /**
- * Honeytoken for Next.js (#482).
+ * Honeytoken for Next.js.
  *
  * WHY THIS IS A HELPER AND NOT AUTOMATIC
  *
diff --git a/packages/nextjs/src/index.ts b/packages/nextjs/src/index.ts
index da238ce..e55233e 100644
--- a/packages/nextjs/src/index.ts
+++ b/packages/nextjs/src/index.ts
@@ -20,11 +20,11 @@ export { withWebDecoy, withBotProtection } from './middleware';
 export type { WebDecoyMiddlewareOptions, WithBotProtectionOptions } from './middleware';
 
 // The edge validator's verdict, readable from a route handler or server
-// component — not only from middleware (#481).
+// component — not only from middleware.
 export { getEdgeVerdict } from './edge-verdict';
 export type { EdgeVerdict, EdgeClass } from './edge-verdict';
 
-// Honeytoken (#482). A helper rather than automatic injection — see the module
+// Honeytoken. A helper rather than automatic injection — see the module
 // for why Next middleware cannot rewrite a streamed RSC response.
 export { honeytokenLink } from './honeytoken';
 export type { SiteHoneytoken } from './honeytoken';
diff --git a/packages/nextjs/src/middleware.test.ts b/packages/nextjs/src/middleware.test.ts
index 8e472bf..ad3af1a 100644
--- a/packages/nextjs/src/middleware.test.ts
+++ b/packages/nextjs/src/middleware.test.ts
@@ -3,7 +3,7 @@ import { withWebDecoy } from './middleware';
 import { getEdgeVerdict } from './edge-verdict';
 
 /**
- * The Next.js adapter's annotation, and the edge tag it has to let through (#481).
+ * The Next.js adapter's annotation, and the edge tag it has to let through.
  *
  * This adapter shipped a bug that made the feature it advertised impossible: it
  * set its annotation with `response.headers.set()` after `NextResponse.next()`,
@@ -43,7 +43,7 @@ describe('withWebDecoy annotates the request, not the response', () => {
 
   it('forwards the edge tag through to the application untouched', async () => {
     // The tag the Cloudflare validator set upstream has to survive this middleware
-    // — it is the whole point of #481 that the application can read it.
+    // — it is the whole point that the application can read it.
     const res = await withWebDecoy({ ...OPTIONS })(
       req({ 'x-wd-class': 'script', 'x-wd-clearance': 'valid' })
     );
diff --git a/packages/nextjs/src/middleware.ts b/packages/nextjs/src/middleware.ts
index 945669b..68a3ecf 100644
--- a/packages/nextjs/src/middleware.ts
+++ b/packages/nextjs/src/middleware.ts
@@ -12,8 +12,8 @@ export interface WebDecoyMiddlewareOptions extends ProtectOptions {
    * MONITOR IS THE DEFAULT ON PURPOSE, and this changed in 0.7.0. Before,
    * installing this with an API key began returning 403 to any request whose
    * server-side score cleared `threatScoreThreshold` (default 80), and there was
-   * no supported way to watch first. Found by installing it on a live site that
-   * takes payments, where the homepage returned Forbidden on the first request.
+   * no supported way to watch first — which is a good way to take down a site on
+   * the first install.
    *
    * Watch what it would have done, then set `mode: 'enforce'`.
    */
@@ -176,7 +176,7 @@ export function withWebDecoy(
 
       // Monitor mode: record the verdict, change nothing. Checked before the
       // rule branches so a THROTTLE is an observation too. The annotation still
-      // rides on the REQUEST (#481), so the application can act on it itself.
+      // rides on the REQUEST, so the application can act on it itself.
       if (mode === 'monitor') {
         const monitorHeaders = new Headers(req.headers);
         monitorHeaders.delete('x-webdecoy-decision');
@@ -223,7 +223,7 @@ export function withWebDecoy(
 
       // Handle the result
       if (result.allowed) {
-        // Annotate the REQUEST, so the application sees it (#481).
+        // Annotate the REQUEST, so the application sees it.
         //
         // This previously did `NextResponse.next()` then `response.headers.set()`,
         // which sets RESPONSE headers: the exact opposite of what its own comment
diff --git a/packages/webdecoy/package.json b/packages/webdecoy/package.json
index efa41be..9d0eecb 100644
--- a/packages/webdecoy/package.json
+++ b/packages/webdecoy/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/node",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Web Decoy SDK for Node.js - Bot detection with TLS fingerprinting",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
diff --git a/packages/webdecoy/scripts/gen-bot-registry.mjs b/packages/webdecoy/scripts/gen-bot-registry.mjs
index 284db34..b355654 100644
--- a/packages/webdecoy/scripts/gen-bot-registry.mjs
+++ b/packages/webdecoy/scripts/gen-bot-registry.mjs
@@ -2,11 +2,12 @@
 /**
  * Generate src/bots/registry.generated.ts from the Go agent registry.
  *
- * The Go table in WebDecoy/app `pkg/agents` is the single source of truth. This
+ * The Go agent registry in the main application repo is the single source of
+ * truth. This
  * script turns its JSON export into a TypeScript module so the SDK can classify a
  * User-Agent locally, with no network call, in the request path.
  *
- * Usage, from the WebDecoy/app checkout:
+ * Usage, from the application repo checkout:
  *
  *   cd pkg && go run ./cmd/export-agent-registry \
  *     | node ../../webdecoy-node/packages/webdecoy/scripts/gen-bot-registry.mjs
@@ -77,7 +78,7 @@ const lines = agents.map((a) => {
 const out = `/**
  * GENERATED FILE — DO NOT EDIT.
  *
- * Source of truth: WebDecoy/app \`pkg/agents\` (Go).
+ * Source of truth: the Go agent registry in the main application repo.
  * Regenerate with \`packages/webdecoy/scripts/gen-bot-registry.mjs\`; see that
  * script for the command.
  *
diff --git a/packages/webdecoy/src/agent/types.ts b/packages/webdecoy/src/agent/types.ts
index 55a4e3e..2dee4a2 100644
--- a/packages/webdecoy/src/agent/types.ts
+++ b/packages/webdecoy/src/agent/types.ts
@@ -8,7 +8,7 @@
  * or plain traffic carrying no agent signature at all?
  *
  * The verdict taxonomy mirrors the server-side verifier in the ingest service
- * (WebDecoy/app#320) so the SDK, the edge validator, and the backend all speak
+ * so the SDK, the edge validator, and the backend all speak
  * the same language.
  */
 
diff --git a/packages/webdecoy/src/bots/index.ts b/packages/webdecoy/src/bots/index.ts
index ce00917..ebfa092 100644
--- a/packages/webdecoy/src/bots/index.ts
+++ b/packages/webdecoy/src/bots/index.ts
@@ -1,5 +1,5 @@
 /**
- * Local bot classification (#500).
+ * Local bot classification.
  *
  * WHY THIS IS IN THE SDK AT ALL
  *
diff --git a/packages/webdecoy/src/bots/registry.generated.ts b/packages/webdecoy/src/bots/registry.generated.ts
index 4af5462..d4baae4 100644
--- a/packages/webdecoy/src/bots/registry.generated.ts
+++ b/packages/webdecoy/src/bots/registry.generated.ts
@@ -1,7 +1,7 @@
 /**
  * GENERATED FILE — DO NOT EDIT.
  *
- * Source of truth: WebDecoy/app `pkg/agents` (Go).
+ * Source of truth: the Go agent registry in the main application repo.
  * Regenerate with `packages/webdecoy/scripts/gen-bot-registry.mjs`; see that
  * script for the command.
  *
diff --git a/packages/webdecoy/src/edge.test.ts b/packages/webdecoy/src/edge.test.ts
index 181463f..2ca1c81 100644
--- a/packages/webdecoy/src/edge.test.ts
+++ b/packages/webdecoy/src/edge.test.ts
@@ -4,7 +4,7 @@ import { WebDecoy } from './sdk';
 import type { RuleContext } from './rules/types';
 
 /**
- * Reading the edge validator's tag (#481).
+ * Reading the edge validator's tag.
  *
  * The worker has set `x-wd-clearance` on every forwarded request since the
  * validator shipped, and nothing read it — so on a scoped route an application's
@@ -143,8 +143,8 @@ describe('edge.* in filter expressions', () => {
  * The unified score weights honeypot hits at 38% and user-agent at 1% —
  * deliberately, because a user agent is trivially spoofed. A middleware with no
  * rules can only contribute the 1% signals, so it scores ~0 whatever it sees.
- * Measured on production: every `sdk` detection ever recorded scored 0, while
- * `sdk_tripwire` averaged 52.5.
+ * A page view by an unknown client scores near zero, while the same client
+ * walking into a trap scores an order of magnitude higher.
  *
  * Raising the user-agent weight would be backwards — it would score the clients
  * honest enough to identify themselves and miss every attacker who does not. So
diff --git a/packages/webdecoy/src/edge.ts b/packages/webdecoy/src/edge.ts
index c809099..eb9ca4e 100644
--- a/packages/webdecoy/src/edge.ts
+++ b/packages/webdecoy/src/edge.ts
@@ -1,5 +1,5 @@
 /**
- * The edge validator's verdict, as the origin sees it (#481).
+ * The edge validator's verdict, as the origin sees it.
  *
  * WHY THIS MODULE EXISTS
  *
diff --git a/packages/webdecoy/src/index.ts b/packages/webdecoy/src/index.ts
index 4d17517..38ad4e2 100644
--- a/packages/webdecoy/src/index.ts
+++ b/packages/webdecoy/src/index.ts
@@ -37,14 +37,14 @@ export type {
   ProtectOptions,
 } from './types';
 
-// The edge validator's verdict, as the origin sees it (#481). Exported as a
+// The edge validator's verdict, as the origin sees it. Exported as a
 // value, not only a type: readEdgeVerdict() is how an application that is not
 // using protect() — a route handler, a server component — reads the tag without
 // string-matching a header.
 export { readEdgeVerdict, EDGE_CLASS_HEADER, EDGE_CLEARANCE_HEADER } from './edge';
 export type { EdgeClass, EdgeVerdict } from './edge';
 
-// Declared-agent classification (#500). Exported as values for the same reason
+// Declared-agent classification. Exported as values for the same reason
 // as readEdgeVerdict: code outside protect() — a route handler deciding whether
 // to serve a paywall, a robots.txt generator — needs the same answer without
 // standing up a rule engine.
diff --git a/packages/webdecoy/src/rules/bot-rule.ts b/packages/webdecoy/src/rules/bot-rule.ts
index 468b924..817e123 100644
--- a/packages/webdecoy/src/rules/bot-rule.ts
+++ b/packages/webdecoy/src/rules/bot-rule.ts
@@ -1,5 +1,5 @@
 /**
- * Bot-category rule (#500).
+ * Bot-category rule.
  *
  * The one-liner for the policy this product category exists to express:
  *
diff --git a/packages/webdecoy/src/rules/filter/evaluator.ts b/packages/webdecoy/src/rules/filter/evaluator.ts
index b7d432c..1a2dbd2 100644
--- a/packages/webdecoy/src/rules/filter/evaluator.ts
+++ b/packages/webdecoy/src/rules/filter/evaluator.ts
@@ -94,7 +94,7 @@ function resolveProperty(path: string[], context: RuleContext): any {
     return undefined;
   }
 
-  // The edge validator's verdict (#481). Matching this already worked via
+  // The edge validator's verdict. Matching this already worked via
   // req.header("x-wd-class"), which is why it exists here: a named field is
   // discoverable, is spelled once instead of in every customer's expression, and
   // survives us renaming a header.
@@ -115,7 +115,7 @@ function resolveProperty(path: string[], context: RuleContext): any {
     return undefined;
   }
 
-  // Who the User-Agent claims to be (#500), from the generated agent registry.
+  // Who the User-Agent claims to be, from the generated agent registry.
   //
   // `bot.category` uses the customer-facing vocabulary — the same strings as the
   // dashboard's ai_scraper_category column — so an expression can be copied from
diff --git a/packages/webdecoy/src/rules/honeytoken-site.test.ts b/packages/webdecoy/src/rules/honeytoken-site.test.ts
index 7f70f46..0f6c479 100644
--- a/packages/webdecoy/src/rules/honeytoken-site.test.ts
+++ b/packages/webdecoy/src/rules/honeytoken-site.test.ts
@@ -6,9 +6,9 @@ import {
 } from './honeytoken-site';
 
 /**
- * The site honeytoken (#482).
+ * The site honeytoken.
  *
- * `sdk_tripwire` had FOUR rows in production, ever, because the SDK generated a
+ * `sdk_tripwire` saw almost no use, because the SDK generated a
  * honeytoken and asked the developer to embed it. This is the half that lets an
  * adapter do it — which needs the path to be DERIVED rather than random, so
  * every replica computes the same one.
diff --git a/packages/webdecoy/src/rules/honeytoken-site.ts b/packages/webdecoy/src/rules/honeytoken-site.ts
index fd16627..502c566 100644
--- a/packages/webdecoy/src/rules/honeytoken-site.ts
+++ b/packages/webdecoy/src/rules/honeytoken-site.ts
@@ -1,6 +1,6 @@
 /**
  * Site honeytoken — a stable, derivable trap the adapters can inject for you
- * (#482).
+ *.
  *
  * WHY THIS EXISTS ALONGSIDE honeytoken()
  *
@@ -20,12 +20,14 @@
  * JavaScript, no fingerprint and no IP — the client asked for a path that exists
  * nowhere and is linked only from an element no human can see.
  *
- * That is not a stylistic preference, it is arithmetic. The unified score weights
- * honeypot hits at 38% and user-agent at 1%, because a user agent is trivially
- * spoofed. Measured against production: every `sdk` detection ever recorded
- * scored 0, while `sdk_tripwire` averaged 52.5. And `sdk_tripwire` had FOUR rows
- * in total, because the SDK generated a honeytoken and then asked the developer
- * to place the link. WordPress injects it itself and has coverage.
+ * That is not a stylistic preference, it is arithmetic. Honeypot hits carry the
+ * highest weight in the threat score and a User-Agent carries nearly none,
+ * because a User-Agent is trivially spoofed — so the same client scores near
+ * zero on a page view and very high on a trap.
+ *
+ * Which only pays off if the link is on the page. Generating a token and asking
+ * the developer to place it is a step most installs never take, so the adapters
+ * that own the response inject it themselves.
  */
 
 import { hmacSha256Hex } from '../webcrypto';
diff --git a/packages/webdecoy/src/rules/index.ts b/packages/webdecoy/src/rules/index.ts
index 025c971..1ed0d5f 100644
--- a/packages/webdecoy/src/rules/index.ts
+++ b/packages/webdecoy/src/rules/index.ts
@@ -101,7 +101,7 @@ export function tripwire(config: TripwireConfig = {}): Rule {
 }
 
 /**
- * Factory function to create a bot-category rule (#500).
+ * Factory function to create a bot-category rule.
  *
  * Acts on agents that identify themselves in the User-Agent, matched against the
  * registry generated from the same table the scoring pipeline uses — so
diff --git a/packages/webdecoy/src/rules/rule-engine.test.ts b/packages/webdecoy/src/rules/rule-engine.test.ts
index cfbf9be..8ee590b 100644
--- a/packages/webdecoy/src/rules/rule-engine.test.ts
+++ b/packages/webdecoy/src/rules/rule-engine.test.ts
@@ -16,7 +16,7 @@ function ctx(cookie?: string): RuleContext {
   };
 }
 
-describe('RuleEngine clearance forwarding (#136)', () => {
+describe('RuleEngine clearance forwarding', () => {
   it('attaches the wd_clearance token to a tripwire violation', () => {
     const engine = new RuleEngine([
       fixedRule({ action: 'DENY', rule: 'tripwire', reason: 'honeypot path' }),
diff --git a/packages/webdecoy/src/rules/rule-engine.ts b/packages/webdecoy/src/rules/rule-engine.ts
index 70a71c8..eb7fc46 100644
--- a/packages/webdecoy/src/rules/rule-engine.ts
+++ b/packages/webdecoy/src/rules/rule-engine.ts
@@ -30,7 +30,7 @@ export class RuleEngine {
    * Append a rule after construction.
    *
    * Exists for signals that cannot be known synchronously at construction —
-   * currently the site honeytoken (#482), whose path is derived by async HMAC.
+   * currently the site honeytoken, whose path is derived by async HMAC.
    * Evaluation order is append order, matching the constructor.
    */
   add(rule: Rule): void {
@@ -51,7 +51,7 @@ export class RuleEngine {
       if (result.action !== 'ALLOW') {
         // Record violation. Tripwire hits (a real user can't reach a honeypot
         // path) carry the actor's wd_clearance token so the backend can deny its
-        // device fingerprint — the deception signal driving enforcement (#136).
+        // device fingerprint — the deception signal driving enforcement.
         violations.push({
           rule: result.rule,
           action: result.action,
diff --git a/packages/webdecoy/src/rules/types.ts b/packages/webdecoy/src/rules/types.ts
index 15a309d..7503d6d 100644
--- a/packages/webdecoy/src/rules/types.ts
+++ b/packages/webdecoy/src/rules/types.ts
@@ -27,19 +27,19 @@ export interface RuleContext {
   enrichment?: IPEnrichmentData;
   /**
    * Web Bot Auth verdict (populated async before evaluation when a
-   * {@link https://github.com/WebDecoy/app/issues/323 webBotAuth} rule is
+   * `webBotAuth` rule is
    * present). Lets a synchronous rule act on cryptographic agent verification.
    */
   agent?: AgentVerdict;
   /**
-   * The edge validator's annotations on this request (#481), parsed from
+   * The edge validator's annotations on this request, parsed from
    * `x-wd-clearance` and `x-wd-class`. Always populated — `present: false` when
    * the edge did not front this request. Filter expressions read it as
    * `edge.class`, `edge.clearance` and `edge.present`.
    */
   edge?: EdgeVerdict;
   /**
-   * Who the User-Agent says it is (#500), matched against the generated agent
+   * Who the User-Agent says it is, matched against the generated agent
    * registry. Always populated — `known: false` when nothing matched. Filter
    * expressions read it as `bot.category`, `bot.name`, `bot.ai` and friends.
    *
@@ -106,7 +106,7 @@ export interface FilterConfig {
 }
 
 /**
- * Configuration for bot-category rules (#500)
+ * Configuration for bot-category rules
  */
 export interface BotRuleConfig {
   /**
@@ -171,7 +171,7 @@ export interface ViolationEvent {
   /**
    * The request's wd_clearance token, when present. Lets the backend bind a
    * tripwire hit to the actor's device fingerprint and deny it — the same
-   * durable lockout a decoy hit produces (enforcement issue #136). Only carried
+   * durable lockout a decoy hit produces. Only carried
    * for deception rules (tripwires); undefined otherwise.
    */
   clearance?: string;
diff --git a/packages/webdecoy/src/rules/web-bot-auth-rule.ts b/packages/webdecoy/src/rules/web-bot-auth-rule.ts
index 7c3eabf..41cebad 100644
--- a/packages/webdecoy/src/rules/web-bot-auth-rule.ts
+++ b/packages/webdecoy/src/rules/web-bot-auth-rule.ts
@@ -1,5 +1,5 @@
 /**
- * Web Bot Auth rule (WebDecoy/app#323).
+ * Web Bot Auth rule (the main application repo).
  *
  * Acts on the Web Bot Auth verdict the SDK computes before rule evaluation
  * (`context.agent`). Its headline job is to make **impersonation deny-able in
diff --git a/packages/webdecoy/src/sdk.ts b/packages/webdecoy/src/sdk.ts
index 2d0b5a0..7baeeed 100644
--- a/packages/webdecoy/src/sdk.ts
+++ b/packages/webdecoy/src/sdk.ts
@@ -83,9 +83,8 @@ export class WebDecoy {
     // unified score weights honeypot hits at 38% and attack signatures at 24%,
     // but user-agent at 1% and headers at 1% — deliberately, because both are
     // trivially spoofed. A middleware with no rules can only contribute those
-    // last two, so it scores ~0 no matter what it sees. Measured against
-    // production: every `sdk` detection ever recorded scored 0, while
-    // `sdk_tripwire` averaged 52.5 and `bot_scanner` 45.7.
+    // last two, so it scores ~0 no matter what it sees — while the same client
+    // walking into a tripwire scores an order of magnitude higher.
     //
     // Inflating the user-agent weight would be the wrong fix and actively
     // backwards: it would score the clients honest enough to say
@@ -183,11 +182,11 @@ export class WebDecoy {
       userAgent: metadata.user_agent,
       headers: metadata.headers,
       timestamp: metadata.timestamp || Date.now(),
-      // Parsed synchronously and unconditionally (#481): it is two header reads,
+      // Parsed synchronously and unconditionally: it is two header reads,
       // it needs no network, and a rule that has to check whether the edge
       // verdict was populated is a rule people will get wrong.
       edge: readEdgeVerdict(metadata.headers),
-      // Same reasoning as `edge`, and the same cost profile (#500): a memoised
+      // Same reasoning as `edge`, and the same cost profile: a memoised
       // substring scan over a static table, no network, no async. Populating it
       // unconditionally means a rule never has to ask whether classification
       // ran.
@@ -296,7 +295,7 @@ export class WebDecoy {
     metadata: RequestMetadata,
     options: ProtectOptions = {}
   ): Promise<ProtectResult> {
-    // The edge verdict (#481) is attached here rather than at each return inside
+    // The edge verdict is attached here rather than at each return inside
     // decide(), which has seven of them including two fail-open paths. It is
     // information ABOUT the request, not a product of the decision, so it must be
     // present on every outcome — and a per-return copy is a line someone would
diff --git a/packages/webdecoy/src/types.ts b/packages/webdecoy/src/types.ts
index 3bb331f..819e5bd 100644
--- a/packages/webdecoy/src/types.ts
+++ b/packages/webdecoy/src/types.ts
@@ -205,7 +205,7 @@ export interface ProtectResult {
   agent?: AgentVerdict;
 
   /**
-   * What the edge validator said about this request (#481), parsed from
+   * What the edge validator said about this request, parsed from
    * `x-wd-clearance` and `x-wd-class`.
    *
    * Always present. Check `edge.present` before branching: false means the edge