diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 39f8b31c..a2f56959 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -25,6 +25,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Check landing page contracts
+        run: node --test scripts/landing-site.test.mjs
       - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6
       - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
diff --git a/apps/landing/assets/favicon.svg b/apps/landing/assets/favicon.svg
new file mode 100644
index 00000000..6d5b027c
--- /dev/null
+++ b/apps/landing/assets/favicon.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <rect width="64" height="64" rx="14" fill="#050c1e"/>
+  <path d="M18 21c0-2.2 1.8-4 4-4h5c2.2 0 4 1.8 4 4v5c0 2.2-1.8 4-4 4h-5c-2.2 0-4-1.8-4-4v-5Zm15 17c0-2.2 1.8-4 4-4h5c2.2 0 4 1.8 4 4v5c0 2.2-1.8 4-4 4h-5c-2.2 0-4-1.8-4-4v-5Z" fill="#fff"/>
+  <path d="M28 27c7.2 0 9.1 6.2 9.1 10" fill="none" stroke="#76b7ff" stroke-width="5" stroke-linecap="round"/>
+</svg>
diff --git a/apps/landing/index.html b/apps/landing/index.html
index bae33e51..4da02be0 100644
--- a/apps/landing/index.html
+++ b/apps/landing/index.html
@@ -3,8 +3,22 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="theme-color" content="#050C1E">
+<meta name="description" content="AgentCall is a permissioned phone line between coworkers' coding agents.">
 <title>AgentCall — a permissioned phone line between coworkers' coding agents</title>
+<link rel="icon" type="image/svg+xml" href="assets/favicon.svg">
 <script>document.documentElement.classList.add('js')</script>
+<script>
+!function(t,e){var o,n,p,r;e.__SV||(window.posthog=e,e._i=[],e.init=function(i,s,a){function g(t,e){var o=e.split('.');2==o.length&&(t=t[o[0]],e=o[1]),t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}}(p=t.createElement('script')).type='text/javascript',p.crossOrigin='anonymous',p.async=!0,p.src=s.api_host.replace('.i.posthog.com','-assets.i.posthog.com')+'/static/array.js',(r=t.getElementsByTagName('script')[0]).parentNode.insertBefore(p,r);var u=e;for(void 0!==a?u=e[a]=[]:a='posthog',u.people=u.people||[],u.toString=function(t){var e='posthog';return'posthog'!==a&&(e+='.'+a),t||(e+=' (stub)'),e},u.people.toString=function(){return u.toString(1)+'.people (stub)'},o='capture identify alias people.set people.set_once set_config register register_once unregister opt_out_capturing has_opted_out_capturing opt_in_capturing reset'.split(' '),n=0;n<o.length;n++)g(u,o[n]);e._i.push([i,s,a])},e.__SV=1)}(document,window.posthog||[]);
+posthog.init('phc_yR9jbkhmKC39j3rSw2qvkLLLmPPmfvfNxHA7Rz5qNbfk',{
+  api_host:'https://us.i.posthog.com',
+  cookieless_mode:'always',
+  autocapture:false,
+  capture_pageview:true,
+  disable_session_recording:true,
+  person_profiles:'identified_only'
+});
+</script>
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link href="https://fonts.googleapis.com/css2?family=Playfair+Display:ital,wght@0,500;0,600;0,700;1,500;1,600&family=Inter:wght@300;400;500;600&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet">
@@ -424,6 +438,28 @@
 .close h2{max-width:16ch;margin:0 auto}
 .close p{margin-top:1.2rem;color:rgba(255,255,255,.72);font-weight:300}
 .close .hero-cta{margin-top:2.2rem}
+.waitlist-form{
+  display:flex;gap:.65rem;max-width:650px;margin:2.2rem auto 0;padding:.45rem;
+  background:rgba(255,255,255,.1);border:1px solid rgba(255,255,255,.24);
+  border-radius:999px;backdrop-filter:blur(10px);
+}
+.waitlist-form input[type="email"]{
+  flex:1;min-width:0;border:0;background:transparent;color:#fff;padding:.7rem 1rem;
+  font:400 .92rem var(--sans);outline:none;
+}
+.waitlist-form input[type="email"]::placeholder{color:rgba(255,255,255,.5)}
+.waitlist-form button{border:0;cursor:pointer;white-space:nowrap}
+.waitlist-form button:disabled{cursor:wait;opacity:.65;transform:none}
+.waitlist-status{min-height:1.5rem;margin:.75rem auto 0;color:rgba(255,255,255,.82);font-size:.84rem}
+.waitlist-status.success{color:#A9E8C5}
+.waitlist-status.error{color:#FFB4A8}
+.waitlist-note{margin:.2rem auto 0!important;font-size:.72rem;color:rgba(255,255,255,.5)!important}
+.hp{position:absolute!important;width:1px!important;height:1px!important;overflow:hidden!important;clip:rect(0,0,0,0)!important;white-space:nowrap!important}
+@media(max-width:620px){
+  .waitlist-form{border-radius:16px;display:grid;padding:.6rem}
+  .waitlist-form input[type="email"]{text-align:center}
+  .waitlist-form button{justify-content:center}
+}
 
 /* ---------- footer ---------- */
 footer{background:var(--paper);padding:clamp(3rem,6vw,4.5rem) 0 2rem;border-top:1px solid var(--line)}
@@ -466,7 +502,7 @@
     </div>
     <div class="nav-right">
       <a class="nav-gh" href="https://agentcall.mintlify.app/reference/cli">CLI reference ↗</a>
-      <a class="btn-sm" href="https://agentcall.mintlify.app/get-started/install">Get started</a>
+      <a class="btn-sm" href="#waitlist" data-track="nav_waitlist">Join waitlist</a>
     </div>
   </div>
 </nav>
@@ -480,9 +516,9 @@
     <h1>Your agents should know who to <em>call</em>.</h1>
     <p class="hero-sub">AgentCall turns coworkers' coding agents into a connected team. Ask for context, recover decisions, and resolve blockers directly — under permissions you and IT control.</p>
     <div class="hero-cta">
-      <a class="btn btn-primary" href="https://agentcall.mintlify.app/get-started/install">Get started</a>
-      <a class="btn btn-ghost" href="https://agentcall.mintlify.app">Read the docs</a>
-      <a class="btn btn-ghost" href="#callpath">Read the architecture</a>
+      <a class="btn btn-primary" href="#waitlist" data-track="hero_waitlist">Join the waitlist</a>
+      <a class="btn btn-ghost" href="https://agentcall.mintlify.app/get-started/install" data-track="hero_install">Install now</a>
+      <a class="btn btn-ghost" href="#callpath" data-track="hero_architecture">Read the architecture</a>
     </div>
     <div class="hero-ticks">
       <span>Works with Claude Code</span><span>Codex</span><span>Invite-only enrollment</span>
@@ -855,18 +891,23 @@ <h3>Not there yet</h3>
 </section>
 
 <!-- CLOSE -->
-<section class="close" id="close">
+<section class="close" id="waitlist">
   <div class="close-sky"></div>
   <div class="close-veil"></div>
   <div class="ghost">agentcall</div>
   <div class="wrap">
-    <span class="eyebrow">Start a call</span>
+    <span class="eyebrow">Early access</span>
     <h2>Give your agents each other's number.</h2>
-    <p>Install the CLI, enroll your handle, and make the first call.</p>
-    <div class="hero-cta">
-      <a class="btn btn-primary" href="https://agentcall.mintlify.app/get-started/install">Install AgentCall ↗</a>
-      <a class="btn btn-ghost" href="#callpath">Read the architecture brief</a>
-    </div>
+    <p>Join the waitlist for launch updates and early team access.</p>
+    <form class="waitlist-form" id="waitlist-form" action="https://submit-form.com/36DfpcI7U" method="POST">
+      <label class="hp" for="waitlist-honeypot">Leave this field empty</label>
+      <input class="hp" id="waitlist-honeypot" name="_honeypot" type="text" tabindex="-1" autocomplete="off">
+      <label class="hp" for="waitlist-email">Work email</label>
+      <input id="waitlist-email" name="email" type="email" autocomplete="email" placeholder="you@company.com" required>
+      <button class="btn btn-primary" type="submit">Join waitlist →</button>
+    </form>
+    <p class="waitlist-status" id="waitlist-status" role="status" aria-live="polite"></p>
+    <p class="waitlist-note">Launch updates only. Your email is never sent to analytics.</p>
   </div>
 </section>
 
@@ -892,7 +933,7 @@ <h4>Developers</h4>
           <li><a href="#callpath">Architecture</a></li>
           <li><a href="https://agentcall.mintlify.app/reference/cli">CLI reference</a></li>
           <li><a href="https://agentcall.mintlify.app/reference/protocol">Protocol</a></li>
-          <li><a href="https://agentcall.mintlify.app/get-started/install">Get started</a></li>
+          <li><a href="#waitlist" data-track="footer_waitlist">Join waitlist</a></li>
         </ul>
       </div>
       <div>
@@ -914,6 +955,56 @@ <h4>Project</h4>
 
 <script>
 (function(){
+  function track(event, properties){
+    if(window.posthog && typeof window.posthog.capture==='function'){
+      window.posthog.capture(event, properties);
+    }
+  }
+
+  document.querySelectorAll('[data-track]').forEach(function(link){
+    link.addEventListener('click', function(){
+      track('cta_clicked', {
+        location:link.dataset.track,
+        destination:link.getAttribute('href')
+      });
+    });
+  });
+
+  var waitlistForm=document.getElementById('waitlist-form');
+  var waitlistStatus=document.getElementById('waitlist-status');
+  if(waitlistForm){
+    waitlistForm.addEventListener('submit', async function(event){
+      event.preventDefault();
+      var button=waitlistForm.querySelector('button[type="submit"]');
+      var originalLabel=button.textContent;
+      button.disabled=true;
+      button.textContent='Joining…';
+      waitlistStatus.className='waitlist-status';
+      waitlistStatus.textContent='';
+
+      try{
+        var formData=new FormData(waitlistForm);
+        var response=await fetch(waitlistForm.action, {
+          method:'POST',
+          headers:{Accept:'application/json'},
+          body:formData
+        });
+        if(!response.ok) throw new Error('Submission failed');
+
+        track('waitlist_joined');
+        waitlistForm.reset();
+        waitlistForm.hidden=true;
+        waitlistStatus.className='waitlist-status success';
+        waitlistStatus.textContent="You're on the list. We'll be in touch.";
+      }catch(error){
+        waitlistStatus.className='waitlist-status error';
+        waitlistStatus.textContent='Something went wrong. Please try again.';
+        button.disabled=false;
+        button.textContent=originalLabel;
+      }
+    });
+  }
+
   var nav=document.getElementById('nav');
   var hero=document.getElementById('top');
 
diff --git a/docs/research/2026-08-03-free-landing-analytics-waitlist.md b/docs/research/2026-08-03-free-landing-analytics-waitlist.md
new file mode 100644
index 00000000..4e036cd2
--- /dev/null
+++ b/docs/research/2026-08-03-free-landing-analytics-waitlist.md
@@ -0,0 +1,114 @@
+# Free analytics and waitlist stack for the landing page
+
+**Date:** 2026-08-03
+**Status:** Research note, not a product decision.
+**Method:** Exa was used to discover candidate pricing and documentation pages. All
+claims below were checked against first-party vendor documentation on 2026-08-03.
+**Target:** A dependency-free static HTML site on GitHub Pages, with useful traffic
+analytics and an email waitlist at no recurring cost for the initial launch.
+
+**Implementation decision:** The initial recommendation was Umami Cloud, but its
+dashboard and API returned TLS protocol errors across independent networks during
+setup. The shipped implementation therefore uses the documented runner-up,
+PostHog Cloud, with cookieless mode, autocapture, and session recording disabled.
+
+---
+
+## Recommendation
+
+Use **Umami Cloud Hobby + Formspark Free**.
+
+- **Umami** adds one script tag, supports a `waitlist_joined` custom event, uses no
+  cookies or cross-site tracking, exports cloud data, and has an MIT-licensed
+  self-hosted escape hatch. Its Hobby plan is completely free and intended for
+  low-traffic sites. Umami's accessible official documentation does **not** publish
+  the current Hobby event allowance, so do not promise a numeric limit
+  ([Cloud FAQ](https://docs.umami.is/docs/cloud/faq),
+  [collection](https://docs.umami.is/docs/collect-data),
+  [events](https://docs.umami.is/docs/track-events),
+  [export](https://docs.umami.is/docs/cloud/export-data),
+  [license](https://github.com/umami-software/umami)).
+- **Formspark** keeps the site's existing native `<form>` and styling. It needs only
+  an `action` URL, explicitly requires no credit card, automatically filters spam,
+  supports Turnstile/hCaptcha/reCAPTCHA, and exports CSV or JSON on the free plan.
+  The exact constraint is **250 submissions total per workspace**, not per month;
+  after that, the current upgrade is a one-time purchase rather than a subscription
+  ([pricing](https://formspark.io/pricing/),
+  [static HTML setup](https://formspark.io/),
+  [spam protection](https://documentation.formspark.io/setup/spam-protection.html),
+  [exports](https://formspark.io/features/exports/)).
+
+Track `waitlist_joined` **only after Formspark returns success**, not on button click.
+Never send the email address or other form values to Umami. This measures completed
+signups while keeping contact data solely in the form backend.
+
+If 250 total signups is too small, use **Tally Free** instead. It offers unlimited
+forms and submissions under its fair-use policy, free reCAPTCHA, CSV export, and a
+submission event that can trigger Umami. The tradeoff is a Tally iframe/script and
+visible Tally branding; removing branding or applying custom CSS requires Pro
+([pricing](https://tally.so/pricing),
+[embedding](https://tally.so/help/embed-your-form),
+[events](https://developers.tally.so/widgets/events),
+[reCAPTCHA](https://tally.so/help/recaptcha),
+[CSV export](https://tally.so/changelog)).
+
+---
+
+## Analytics comparison
+
+| Option | Free fit | Conversion tracking | Privacy and consent burden | Exportability / lock-in | Verdict |
+|---|---|---|---|---|---|
+| **Umami Cloud** | Hobby is free; official docs do not expose its current numeric event cap | Native custom events from an HTML attribute or `umami.track()` | No cookies, no PII, no cross-site tracking; vendor says GDPR compliant out of the box | CSV export of pageviews, events, sessions and event data; MIT self-hosting on PostgreSQL | **Best fit:** small snippet, enough conversion tracking, lowest practical lock-in ([FAQ](https://docs.umami.is/docs/faq), [events](https://docs.umami.is/docs/track-events), [export](https://docs.umami.is/docs/cloud/export-data)) |
+| **PostHog Cloud** | 1 million analytics events/month, no card, one-year retention; usage can be capped at the free allowance | Richest option: explicit events, autocapture and funnels | More configuration: it can create persistent anonymous profiles and collect browser/location data; the customer controls consent and collection | API/SQL access and MIT self-hosting, but no equivalently simple full cloud-history export | Excellent runner-up if the landing page soon becomes a product funnel ([pricing](https://posthog.com/pricing), [HTML install](https://posthog.com/docs/web-analytics/installation), [events](https://posthog.com/docs/product-analytics/capture-events), [privacy](https://posthog.com/docs/privacy)) |
+| **Cloudflare Web Analytics** | Free; one script and no Cloudflare proxying required | No custom events or UTM parameters; only a success-page view can approximate a signup | No visitor PII and no cross-site tracking | Six months in the dashboard; no documented raw Web Analytics export | Privacy-friendly but fails the conversion-tracking requirement ([overview](https://developers.cloudflare.com/web-analytics/about/), [FAQ](https://developers.cloudflare.com/web-analytics/faq/), [collection](https://developers.cloudflare.com/web-analytics/data-metrics/data-origin-and-collection/)) |
+| **Google Analytics 4** | Standard GA is free | Strong custom events and key events; BigQuery export available | Uses first-party `_ga` cookies by default; Consent Mode/CMP work creates the highest burden, especially for EEA traffic or Ads linkage | Strong raw BigQuery export, but more setup and Google ecosystem coupling | Capable, but unnecessarily heavy for this launch ([events](https://support.google.com/analytics/answer/9322688), [signup events](https://support.google.com/analytics/answer/14144294), [cookies](https://support.google.com/analytics/answer/11397207), [BigQuery](https://support.google.com/analytics/answer/9823238)) |
+| **Plausible Cloud** | Only a 30-day no-card trial; ongoing cloud use is paid | Strong custom events and goals | Cookieless and no personal data; vendor says no cookie banner is needed | Aggregate CSV export; raw event export is Enterprise-only; self-hosting is available but adds operational cost | Not free-for-now unless self-hosted ([plans](https://plausible.io/docs/subscription-plans), [features](https://plausible.io/docs/your-plausible-experience), [data access](https://plausible.io/docs/data-access), [privacy](https://plausible.io/docs)) |
+
+### Analytics constraint to watch
+
+Umami counts every page hit, custom event, and stored event-data property toward
+usage. Emit one success event with no properties unless a non-personal property is
+actually useful. The free plan's unpublished cap is the only material uncertainty;
+PostHog is the fallback if traffic reaches it
+([Umami usage definition](https://docs.umami.is/docs/cloud/faq)).
+
+---
+
+## Waitlist and form comparison
+
+| Option | Free allowance and card | Static-site / spam fit | Portability and privacy | Verdict |
+|---|---|---|---|---|
+| **Formspark** | **250 total** free submissions in the first workspace; no card; 10 forms | Native custom HTML; no JS required. Automatic filtering plus free Turnstile, hCaptcha, reCAPTCHA and honeypot options | CSV/JSON export on every plan; vendor advertises no lock-in. A form endpoint remains vendor-specific but is trivial to replace | **Recommended:** best match for the existing dependency-free design; 250-total ceiling is explicit ([pricing](https://formspark.io/pricing/), [spam](https://documentation.formspark.io/setup/spam-protection.html), [export](https://documentation.formspark.io/dashboard/exporting-submissions.html)) |
+| **Tally** | Unlimited forms/submissions under fair-use; no time limit | Free iframe/script embed and reCAPTCHA; `Tally.FormSubmitted` supports success-only analytics | CSV export and EU storage; Tally branding and iframe remain on Free, custom CSS/removal require Pro | Best high-volume free fallback; weaker visual and dependency fit ([pricing](https://tally.so/help/plans-and-pricing), [embed](https://tally.so/help/embed-your-form), [GDPR](https://tally.so/help/gdpr)) |
+| **Buttondown** | First 100 subscribers free; official pricing does not state a card requirement | Native stylable HTML endpoint for static/JAMstack sites; optional double opt-in and firewall/CAPTCHA protections | Subscriber exports are CSV/JSON; it stores a real mailing list and can send launch email | Best if "waitlist" must immediately be a newsletter, but 100 contacts is a small ceiling ([pricing](https://buttondown.com/pricing), [HTML embed](https://docs.buttondown.com/building-your-subscriber-base), [exports](https://docs.buttondown.com/api-exports-list), [firewall](https://docs.buttondown.com/firewall)) |
+| **Google Forms** | Free for personal Google accounts; practically high response capacity | Hosted/iframe form, not the site's native styled input; no documented configurable public-form CAPTCHA | Direct Google Sheets destination and CSV/Takeout export; substantial Google UI/ecosystem lock-in | Reliable storage, poor landing-page experience and awkward success-event instrumentation ([product](https://www.google.com/intx/en/forms/about/), [responses](https://support.google.com/docs/answer/139706?hl=en-GB), [sharing/embed](https://support.google.com/a/users/answer/9299716?hl=en)) |
+| **Web3Forms** | 250 submissions/month and unlimited forms on Free; official pages do not state a card requirement | Native HTML/AJAX; server-side filtering and free hCaptcha. Turnstile/reCAPTCHA/domain restriction are paid | Primarily forwards to email; its FAQ says submissions are not retained, while another official page says Free stores them for 30 days. This contradiction makes export/recovery unclear | Easy but not a good system of record for a waitlist; US-East processing and two-month PII log deletion add privacy considerations ([limits](https://web3forms.com/alternatives/formspree-alternative), [HTML](https://docs.web3forms.com/how-to-guides/html-and-javascript), [spam/privacy FAQ](https://docs.web3forms.com/getting-started/faq), [storage claim](https://web3forms.com/platforms/html-contact-form)) |
+| **Formspree** | 50 submissions/month; 30-day history on Free | Native HTML endpoint; reCAPTCHA and honeypot on all plans | CSV/JSON export is **paid only**, so Free has poor portability | Familiar but strictly worse than Formspark for this launch ([limits](https://help.formspree.io/articles/account-management/account-limits/), [HTML](https://formspree.io/html/), [spam](https://help.formspree.io/articles/building-your-form/honeypot-spam-filtering/), [export](https://help.formspree.io/articles/form-and-project-settings/exporting-submissions/)) |
+| **Basin** | 50 submissions/month, one endpoint, 30-day retention on Free | Native HTML/AJAX; basic filtering and free CAPTCHA integrations; spam does not count | Data export begins on Starter, not Free; Free may stop accepting after its monthly cap | Good defenses, but Free is too constrained and non-portable ([pricing](https://usebasin.com/pricing), [plan comparison](https://docs.usebasin.com/plan-comparison/), [FAQ](https://docs.usebasin.com/faq/)) |
+
+### Why not combine analytics and the form provider?
+
+Formspark's built-in form analytics counts submissions and country without a tracking
+pixel or cookie, but it cannot replace site-level acquisition, pageview, referrer and
+conversion-rate measurement. Umami answers those questions; Formspark remains the
+source of truth for the actual email list
+([Formspark analytics](https://formspark.io/features/analytics/)).
+
+---
+
+## Implementation boundary
+
+The initial implementation should contain only:
+
+1. Umami's generated tracker `<script>` in `<head>`.
+2. The existing email form pointed at the generated Formspark endpoint.
+3. AJAX submission so the page can show an inline success state and call
+   `umami.track('waitlist_joined')` only after a successful response.
+4. Formspark's automatic filtering plus Cloudflare Turnstile if spam appears; avoid a
+   visible CAPTCHA until evidence justifies its conversion cost.
+5. A short privacy line explaining that the email is used for launch updates, with a
+   link to the site's privacy notice. Analytics receives no email or user identifier.
+
+The endpoint and Umami website ID are public client-side identifiers, not secrets.
+Store them in the static page or build configuration; do not introduce GitHub Actions
+secrets merely to hide values that every browser must receive.
diff --git a/package.json b/package.json
index 6f026beb..61e9778f 100644
--- a/package.json
+++ b/package.json
@@ -8,7 +8,8 @@
     "build": "pnpm -r build",
     "typecheck": "pnpm -r typecheck",
     "docs:generate": "node scripts/generate-docs-site-cli.mjs && node scripts/generate-docs-site-protocol.mjs && node scripts/generate-docs-site-audit-events.mjs",
-    "docs:check": "node --test scripts/docs-site.test.mjs && node scripts/check-docs-site.mjs"
+    "docs:check": "node --test scripts/docs-site.test.mjs && node scripts/check-docs-site.mjs",
+    "landing:check": "node --test scripts/landing-site.test.mjs"
   },
   "packageManager": "pnpm@11.5.2"
 }
diff --git a/scripts/landing-site.test.mjs b/scripts/landing-site.test.mjs
new file mode 100644
index 00000000..c2476bc0
--- /dev/null
+++ b/scripts/landing-site.test.mjs
@@ -0,0 +1,45 @@
+import assert from "node:assert/strict";
+import { existsSync, readFileSync } from "node:fs";
+import { test } from "node:test";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { Script } from "node:vm";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const html = readFileSync(join(root, "apps/landing/index.html"), "utf8");
+
+test("every inline landing-page script parses", () => {
+  for (const [, source] of html.matchAll(/<script(?:\s[^>]*)?>([\s\S]*?)<\/script>/g)) {
+    assert.doesNotThrow(() => new Script(source));
+  }
+});
+
+test("the landing page publishes favicon metadata and assets", () => {
+  assert.match(
+    html,
+    /<link rel="icon" type="image\/svg\+xml" href="assets\/favicon\.svg">/,
+  );
+  assert.equal(existsSync(join(root, "apps/landing/assets/favicon.svg")), true);
+});
+
+test("the waitlist posts to Formspark with accessible feedback", () => {
+  assert.match(html, /<form[^>]+id="waitlist-form"/);
+  assert.match(html, /action="https:\/\/submit-form\.com\/36DfpcI7U"/);
+  assert.match(html, /<input[^>]+type="email"[^>]+required/);
+  assert.match(html, /id="waitlist-status"[^>]+role="status"[^>]+aria-live="polite"/);
+  assert.match(html, /name="_honeypot"/);
+});
+
+test("analytics records useful actions without form PII", () => {
+  assert.match(html, /phc_yR9jbkhmKC39j3rSw2qvkLLLmPPmfvfNxHA7Rz5qNbfk/);
+  assert.match(html, /cookieless_mode:\s*'always'/);
+  assert.match(html, /autocapture:\s*false/);
+  assert.match(html, /disable_session_recording:\s*true/);
+  assert.match(html, /track\('cta_clicked'/);
+  assert.match(html, /track\('waitlist_joined'\)/);
+  assert.doesNotMatch(html, /track\([^\n]*(?:email|formData)/i);
+
+  const success = html.indexOf("track('waitlist_joined')");
+  const responseCheck = html.indexOf("if(!response.ok)");
+  assert.ok(responseCheck !== -1 && success > responseCheck);
+});
