Free early-access launch: LAUNCH_MODE policy, CRO, pipeline hardening, AI-SEO, ops

- launch.ts policy: LAUNCH_MODE=free_early_access default; effective access =
  published && (free || early); intended tier (access) never rewritten
- Billing off server-side: /api/subscribe 503 honest copy; subscribe CTAs
  render disabled 'قريباً' from first paint; /subscription early-access panel
  + /api/notify (LaunchNotifications) with honest 503 when mail transport off
- Signup trust: verification email at signup (Users afterChange), no
  confirm-password, 429 message fidelity, typo suggestion, live password hint
- Agent pipeline: pickFields strips access/readingMinutes, sourceId dedup,
  secret-scan 422 (pattern names only), string-content rejected (was silently
  replaced), publish stays explicit opt-in
- lexical.ts: root unwrap fix — lexicalToText/countLexicalWords returned 0
  for real serialized trees (secret scan + readingMinutes were inert)
- llms-full.txt: fetchIndexDocs(true) — bodies were never selected
- Content honesty: contentType/authorName/sourceId fields + migration,
  readingMinutes computed at write (160 wpm) + backfill script, byline,
  'حُدّث' freshness
- SEO/AI-SEO: metadata rewrite (published-only, og:image 1200x630), Article +
  BreadcrumbList + FAQPage + Organization JSON-LD, isAccessibleForFree honest,
  table renderer, robots AI-crawler policy (10 named bots), llms.txt +
  llms-full.txt, /topics/* hubs + sitemap, noindex auth pages, www 301
- Ops: backup-db.sh (restore rehearsed on VPS), docs copies (launch
  readiness + marketing audit + owner-inputs for L-03), GLOSSARY.md entries

Verified: tsc --noEmit 0, npm run build 0, local smoke (ghost VIP read,
subscribe/notify/agent APIs, signup token, 429 on 6th, llms/topics/sitemap,
og:image/JSON-LD)

web/src/app/api/agent/posts/route.ts

@@ -5,6 +5,8 @@ import type { Media } from '@payload-types'
 import configPromise from '@payload-config'
 import { resolveCoverImage } from '@/lib/agent-media'
 import { resolveAttachments, deleteFileDocs } from '@/lib/agent-files'
+import { scanAgentPayload } from '@/lib/secret-scan'
+import { lexicalToText } from '@/lib/lexical'
 
 export const dynamic = 'force-dynamic'
 
@@ -20,9 +22,11 @@ function validKey(req: NextRequest) {
   return req.headers.get('x-agent-key') === key
 }
 
-/** Fields the agent is allowed to write; status is NEVER included. */
+/** Fields the agent is allowed to write; status is NEVER included.
+ *  `access`/`readingMinutes` are admin-only (tier changes and reading time
+ *  are admin/agent-policy decisions — the hook computes honest minutes). */
 function pickFields(body: Body): Body {
-  const allowed = ['title', 'slug', 'dek', 'teaser', 'content', 'category', 'access', 'readingMinutes', 'cover'] as const
+  const allowed = ['title', 'slug', 'dek', 'teaser', 'content', 'category', 'cover'] as const
   const out: Body = {}
   for (const field of allowed) {
     if (field in body) out[field] = body[field]
@@ -58,6 +62,21 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ error: 'slug is required' }, { status: 400 })
   }
 
+  // L-10 dedup first: a retried ingest with the same sourceId surfaces the
+  // existing post (200) instead of a misleading slug 409.
+  if (typeof body.sourceId === 'string' && body.sourceId.trim() !== '') {
+    const dupe = await payload.find({
+      collection: 'posts',
+      where: { sourceId: { equals: body.sourceId } },
+      limit: 1,
+      overrideAccess: true,
+    })
+    const dup = dupe.docs[0] as { id: number; slug: string; status: string } | undefined
+    if (dup) {
+      return NextResponse.json({ id: dup.id, slug: dup.slug, status: dup.status, deduplicated: true }, { status: 200 })
+    }
+  }
+
   // Slug conflict → 409
   const existing = await payload.find({
     collection: 'posts',
@@ -69,6 +88,20 @@ export async function POST(req: NextRequest) {
   }
 
   const data = pickFields(body)
+  if (typeof body.sourceId === 'string' && body.sourceId.trim() !== '') data.sourceId = body.sourceId
+
+  // L-05: pattern names only — matched values are never stored or echoed.
+  // A string content (wrong shape) is scanned raw too — lexicalToText of a
+  // string returns '' and would silently skip the scan.
+  const secretPatterns = scanAgentPayload([
+    data.title as string,
+    data.dek as string,
+    data.teaser as string,
+    typeof data.content === 'string' ? data.content : lexicalToText(data.content),
+  ])
+  if (secretPatterns.length > 0) {
+    return NextResponse.json({ error: 'content rejected: potential secrets', patterns: secretPatterns }, { status: 422 })
+  }
 
   // Per-post work files (inline base64) → stored as gated `files` documents.
   // Like coverImage, `attachments` is an input transform, not a raw field.
@@ -99,7 +132,14 @@ export async function POST(req: NextRequest) {
   // directly (unpublished content requires a deliberate admin action otherwise).
   const publish = body.publish === true
   if (publish && !data.publishedAt) data.publishedAt = new Date().toISOString()
-  if (!data.content || typeof data.content !== 'object') {
+  if (typeof data.content === 'string') {
+    // Wrong shape — never store it and never silently drop the agent's text.
+    return NextResponse.json(
+      { error: 'content must be Lexical JSON ({ root: { children: [...] } }), not a markdown/plain string' },
+      { status: 400 },
+    )
+  }
+  if (!data.content) {
     // minimal valid Lexical doc (empty root is rejected by validation); agent PUTs full content later
     data.content = {
       root: {
@@ -159,6 +199,16 @@ export async function PUT(req: NextRequest) {
   const data = pickFields(body)
   delete (data as Body).status // agent can never publish/unpublish
 
+  const secretPatterns = scanAgentPayload([
+    data.title as string,
+    data.dek as string,
+    data.teaser as string,
+    typeof data.content === 'string' ? data.content : lexicalToText(data.content),
+  ])
+  if (secretPatterns.length > 0) {
+    return NextResponse.json({ error: 'content rejected: potential secrets', patterns: secretPatterns }, { status: 422 })
+  }
+
   const doc = await payload.update({
     collection: 'posts',
     id: post.id,